Privacy Policy

📋 1. Overview & Scope

This Privacy Policy describes how YourChores ("YourChores," "we," "us," or "our") collects, uses, stores, and discloses information when you use our website at yourchores.app, our Progressive Web Application (PWA), and any related services (collectively, the "Service").

This Policy applies to:

• Primary Guardians — adults who create and manage family accounts
• Co-Guardians — additional adults added to a household
• Child Users — minors using the Service under parental supervision
• Visitors — anyone who browses yourchores.app without an account

By accessing or using the Service, you agree to this Privacy Policy. If you are creating an account on behalf of children, you represent that you are the parent or legal guardian of those children and that you consent to their use of the Service under the terms described herein.

🏢 2. Who We Are (Data Controller)

YourChores is a registered trade name (DBA) of BehavioralLink, LLC, a limited liability company organized under the laws of Wyoming, United States. All data collected through YourChores is owned and controlled exclusively by BehavioralLink, LLC. This structure ensures full COPPA compliance — data never leaves the controlling legal entity.

📂 3. What We Collect

3.1 — Information You Provide Directly

3.2 — Information Generated by Use of the Service

3.3 — What We Do NOT Collect

👶 4. Children's Privacy (COPPA Compliance)

4.1 — Verifiable Parental Consent (VPC)

Before any child profile is created or any child data is collected, the Primary Guardian must complete account registration, explicitly consent to this Privacy Policy and our Terms of Service, and acknowledge that they are creating child profiles under their direct supervision.

Our consent mechanism records:

• Parent's email address (verified at signup)
• Timestamp of consent
• IP address and browser user agent at time of consent
• The version of this Privacy Policy accepted

These consent records are stored in an immutable log in our parental_consent_records database table and cannot be altered after the fact.

4.2 — Data Minimization for Children

In strict compliance with COPPA's data minimization principle, we collect only the minimum information necessary to provide the Service to child users:

• A display name (nickname, not legal name — parents choose this)
• An age range bucket (e.g., "9–12") — not an exact birthdate
• A 4-digit PIN for device authentication (stored as a salted hash)
• Chore completion and reward interaction records linked to an anonymous internal ID

4.3 — No Behavioral Advertising for Children

YourChores does not serve advertisements to child users. We do not use child data for behavioral targeting, profiling for commercial purposes, or share child data with advertising networks of any kind. Child interaction data is used solely to provide the core chore tracking and reward features of the Service.

4.4 — Parental Rights Under COPPA

As the parent or legal guardian of a child user, you have the following rights at any time:

4.5 — Third Parties and Children's Data

We do not disclose children's personal information to any third party except as strictly necessary to operate the Service (e.g., our hosting provider). Any service provider who may incidentally process child data is bound by contractual obligations prohibiting further use, and is required to maintain security standards consistent with COPPA requirements.

⚙️ 5. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery — Creating and managing family accounts, child profiles, chore assignments, allowance tracking, and reward systems.
• Authentication & Security — Verifying identity at login, protecting accounts from unauthorized access, detecting and preventing fraud and abuse.
• Communications — Sending transactional emails (account confirmation, password reset, service updates). We do not send marketing emails without your explicit opt-in.
• Legal Compliance — Maintaining COPPA consent records, responding to lawful legal requests, and complying with applicable laws and regulations.
• Service Improvement — Aggregated, anonymized usage analytics to understand how families use the Service and improve features. This data cannot be linked back to individual users or children.
• Billing & Subscription Management — Processing coupon codes and managing subscription tier access.

🤝 6. How We Share Information

We do not sell, rent, or trade your personal information or your children's personal information to any third party. We share data only in the following limited circumstances:

6.1 — Service Providers (Processors)

We use the following categories of service providers who may process your data solely on our behalf and under our instructions:

6.2 — Legal Requirements

We may disclose information if required to do so by law or in the good-faith belief that such action is necessary to: (a) comply with a legal obligation or court order; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Service; (d) protect the personal safety of users or the public.

We will notify affected users of any such disclosure to the extent permitted by law.

6.3 — Business Transfers

If YourChores is involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy. In any such transaction, the acquiring party will be required to honor the commitments made in this Privacy Policy, and obtain fresh parental consent before any changes to child data processing.

🗄️ 7. Data Retention

We retain personal information only for as long as necessary to provide the Service and fulfill the purposes described in this Policy:

• Active accounts: Data retained for the duration of the account relationship.
• Inactive accounts: Accounts with no login activity for 24 consecutive months are flagged for deletion and purged after a 30-day notification window.
• Deleted accounts: All personal data is permanently deleted within 30 days of an account deletion request. Anonymized aggregate statistics (no personal identifiers) may be retained indefinitely.
• Child data: Child profiles and associated data are deleted within 72 hours of a parental deletion request. COPPA consent records are retained for 3 years as required for legal compliance.
• Server logs: IP addresses and error logs are rotated and deleted after 30 days.
• Billing records: Transaction records are retained for 7 years as required by applicable tax and financial regulations.

🛡️ 8. Security

We implement industry-standard technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit: All data is transmitted over HTTPS/TLS 1.2+. HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Database and file storage are encrypted at rest on our server infrastructure.
• Password security: All passwords are hashed using bcrypt with a per-user salt. We never store plaintext passwords.
• PIN security: Child PINs are stored as salted hashes. They are never logged or transmitted in plaintext.
• Session security: Sessions use HttpOnly, Secure, SameSite=Lax cookies. Sessions expire after 14 days of inactivity.
• Rate limiting: Login endpoints are protected against brute-force attacks with automated rate limiting and temporary lockouts.
• Access controls: Production database access is restricted to the application server. Administrative access requires multi-factor authentication.
• Intrusion detection: Server-level DDoS mitigation and automated threat monitoring are active at the hosting layer.

⚖️ 9. Your Rights (All Users)

Regardless of where you live, you have the following rights with respect to your personal information:

To exercise any of these rights, email privacy@yourchores.app with the subject "Privacy Rights Request." We will respond within 30 days (or sooner as required by applicable law). We may need to verify your identity before processing your request.

🌴 10. California Residents — CCPA / CPRA

10.1 — Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

• A — Identifiers Name, email address, IP address, account ID
• B — Personal Records Account credentials, family household information
• G — Geolocation (limited) IP-derived country/region for security logging only — not precise location
• F — Internet Activity Session data, error logs (30-day retention)
• K — Inferences None. We do not build consumer profiles or inferences.

10.2 — California Privacy Rights

• Right to Know: You may request disclosure of the categories and specific pieces of personal information collected about you in the past 12 months.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information as those terms are defined under CCPA/CPRA. No opt-out mechanism is required because we do not engage in these practices.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide the Service.
• Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To submit a CCPA request, email privacy@yourchores.app. We will respond within 45 days, with a possible 45-day extension with notice.

🇪🇺 11. International Users — GDPR

11.1 — Lawful Basis for Processing

11.2 — International Data Transfers

YourChores is operated from servers located in the United States. If you are located outside the United States, your personal data will be transferred to and processed in the U.S., which may have different data protection laws than your country of residence.

For transfers from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) where applicable, or will implement other appropriate transfer mechanisms as required.

11.3 — GDPR Rights

In addition to the rights listed in Section 9, EEA and UK residents also have the right to lodge a complaint with your national data protection authority (DPA). For the UK, this is the Information Commissioner's Office (ICO). For other EU member states, find your DPA at edpb.europa.eu.

🍪 12. Cookies & Local Storage

YourChores uses a minimal, functional-only cookie approach. We do not use advertising cookies, third-party analytics cookies, or tracking pixels.

No third-party cookies are set on any YourChores page. No advertising or analytics cookies are used. Because we only use strictly necessary and functional cookies, a cookie consent banner is not required under applicable law — however we disclose all cookies here in full.

🔄 13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will:

• Update the "Effective Date" at the top of this page
• Send an email notification to all registered Primary Guardian accounts
• For material changes affecting children's data, obtain fresh parental consent before continuing to process child data under the new terms
• Post a notice on the YourChores dashboard for 30 days following the change

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Policy (for adult account data). For child data, continued use after fresh parental consent has been obtained constitutes acceptance.

📩 14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through any of the following channels: