ChoreSight Privacy Policy

ChoreSight helps a household assign chores and confirm they are done, often with a live photo. Adults and teens 13 and older sign in with their own accounts. Children under 13 do not create accounts: after a parent gives consent, the parent adds them as kid profiles. The household's data syncs between devices through a server. This policy explains what is collected, who can see it, how long it is kept, and how a parent can review or delete it.

Who we are

JC Mobile App Studio LLC, a one-person studio based in Pennsylvania, USA, is the operator of ChoreSight and is responsible for the personal information described here. "We" and "us" in this policy mean JC Mobile App Studio LLC. You can reach us at contact@jcmobileappstudio.com.

Short version

• Before anyone signs in on a device, the app asks for a birth month and year. The answer stays on that device and is never sent to us.
• Adults and teens 13 and older sign in with an email and password or with Sign in with Apple. Each account has a display name and a role.
• Children under 13 do not sign up. A parent first gives consent through a link we email to them, then adds each child by first name or nickname only, and signs the child's device in with a one-time setup code. Kid profiles have no email address, password, or birthdate.
• Your household's chores, completions, notes, points, rewards, and reminders, plus chore photos, are stored in a Google Firebase project we operate, located in the United States.
• Proof photos are taken live with the camera and may show your child, other people, or the inside of your home. They are shown to members of your household.
• We delete each proof photo file from our storage about 30 days after it is submitted. The text record of the completion stays with the household until it is deleted.
• Deleting a kid profile, or revoking parental consent, deletes that child's photos, completion notes, points history, and reward requests.
• No ads, no analytics or crash reporting SDKs, no tracking, and we never sell personal data.
• You can delete your account in the app. If the household owner deletes their account, the whole household, its kid profiles, and all of its photos are deleted.

What we collect

• Age screen answer, the birth month and year entered before sign-in. The app only uses it to decide whether to show sign-up or the kid setup code screen. It is not sent to us. The app keeps only the result on the device, and an under 13 result is remembered on that device for 24 hours.
• Account information (adults and teens), the email address you sign up with (or the email, possibly an Apple private relay address, and name that Sign in with Apple shares if you allow it), a display name, and a Firebase user ID. Firebase Authentication handles passwords; we cannot see them.
• Kid profile information, the first name or nickname the parent types (up to 30 characters), a Firebase user ID, markers showing the profile is a minor's and is managed by a parent, which Admin created it, the household, and the creation date. We do not collect a child's email address, phone number, password, birthdate, or location.
• Profile, for every member: role (Admin or member), household, whether the profile is marked as a minor, points balance and streak, and the date the profile was created.
• Push token and app language, a notification token for each device where notifications are allowed, and the language the app is running in, so our server can send notifications about due chores, reviews, and reminders in your language.
• Household data, the household name, join code, list of Admins, parental consent status, the plan (free or Premium) and which member's subscription covers it, the monthly photo proof count, and the chores, routines, reminders, rewards, reward requests, and points history you create.
• Parental consent records, when an Admin asks to add children: the name the parent types as a signature, the account email address the consent email is sent to, the parent's user ID, the consent method and notice version, the status (pending, given, refused, expired, or revoked), and when it was requested and decided. The one-time link in the email is stored only in scrambled (hashed) form.
• Setup codes, a one-time 8-character code linked to a kid profile, which expires after 15 minutes and is deleted as soon as it is used.
• Completions, who completed a chore and when, the review status, an optional completion note, the Admin's feedback, any dispute text, and emoji reactions.
• Proof photos, the photos captured with the in-app camera to show a chore is done. On a real device the app only allows the live camera for proof, not the photo library. Photos are compressed in the app to under 1 MB before upload. ChoreSight does not request location access.
• Baseline photos, optional reference photos an Admin picks from the photo library when creating a chore, to show what "done" looks like.

Some things stay on your device and are not sent to us: the age screen result, chore dates you add to your calendar with Add to Calendar (ChoreSight can only add events, it cannot read your calendar), the home screen widget and Live Activity data (household name, open chore titles, assignee names, and your points and streak), and weekly summary images, which leave the device only if you choose to share them. The widget's sign-in credentials are kept in the device Keychain; when you tap Done in the widget, the widget uses them to send that completion directly to our Firebase project, the same as the app would.

How we use it

We use this information only to run ChoreSight: signing you in, syncing your household's chores between devices, showing completions and photos to your household for review, tracking points, streaks, and rewards, sending the notifications you allow, asking for and recording parental consent, setting up kids' devices, enforcing plan limits (for example, the free plan's monthly photo proof limit), and deleting data on schedule. We do not use your data for advertising, and we do not build profiles of you or track you across other apps or websites.

Who can see your data

• Your household. Our server's security rules only let signed-in members of your household read your household's chores, completions, photos, points history, rewards, and reminders. Household members, including kid profiles, can also read each other's profiles, which include display name, role, the minor flag, points, push token, and app language. Profiles do not include email addresses, so household members never see each other's email.
• The household record. Only members and Admins of your household can read your main household record: household name, join code, Admin list, plan, and parental consent details, including the consenting parent's name. The parent's email address is kept only in the consent record, which no app user can read. Our server rules do not let anyone list or search household records.
• Us. As the operator of the Firebase project, we can technically access the data stored there. We only do so when needed to operate, secure, or fix the service, or to handle a request you send us.
• Our service providers, listed below.

What we receive vs. what third parties receive

Data that reaches servers we operate.

• Our Google Firebase project (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, and Cloud Messaging), hosted by Google in the United States. It holds everything listed under "What we collect" except the on-device items. Our Cloud Functions send notifications, run parental consent and kid device setup, host the consent page the emailed link opens, enforce plan limits, delete expired proof photos and expired consent requests, and clean up data when chores, kid profiles, or accounts are deleted. Google processes this data on our behalf under Firebase's privacy and security terms. Firebase Authentication also sends email verification and password reset emails when you ask for one.

Data handled by third parties under their own policies.

• Apple, for Sign in with Apple, delivering push notifications (through Apple Push Notification service), and App Store purchases. See Apple's privacy policy.
• Google, as the provider behind Firebase above. See Google's privacy policy.
• Cloudflare, which sends the parental consent email and the confirmation email for us, from consent@jcmobileappstudio.com. It receives the parent's email address, the name the parent typed, and the email's contents (the notice and the one-time consent link). It receives no information about children. See Cloudflare's privacy policy.

ChoreSight does not include Firebase Analytics, Crashlytics, advertising SDKs, or any other analytics or tracking tools.

Children's privacy (COPPA)

ChoreSight is made for families, and children use it. Parents or guardians set up the household as Admins. Teens 13 and older can create their own accounts like adults. Children under 13 use kid profiles that a parent creates. Here is how we handle children's information.

• Age screen. Before sign-in, the app asks for a birth month and year, with no answer filled in. If the answer is under 13, the device shows only the kid setup code screen, not sign-up or sign-in, and remembers that answer on the device for 24 hours. The answer is never sent to us.
• How a parent gives consent. Before any kid profile can be created, a household Admin opens Household, then Kids, reads our notice in the app, types their name as a signature, and confirms they are the child's parent or legal guardian. The Admin's account email must be verified first (Sign in with Apple addresses already are). We then email the notice and a one-time link to that address. The link works for 48 hours. On the page it opens, the parent reviews the notice again and chooses to give or refuse consent. After consent is given, we send a second, confirmation email, so that if someone else used the parent's account, the parent finds out and can revoke it. Only our server can record consent; the app cannot mark a household as consented on its own. If the parent refuses, we remove their name and email from the request right away, and nothing is collected from their children.
• What is collected from or about a child. The first name or nickname the parent chooses, a user ID, the minor and parent-managed markers, the chores assigned to them, their completions, completion notes, dispute text, emoji reactions, points, streaks, and reward requests, and the live proof photos they take, which may show the child's face, other people, or the inside of your home. If notifications are allowed on the child's device, we also store that device's push token and app language. We do not collect a child's email address, phone number, password, birthdate, or location, and we show no ads.
• How a child's device is set up. The parent taps Set up device next to the kid profile and gets an 8-character code that works once, for 15 minutes. Entering it on the child's device signs that device in as the kid profile.
• Who can see it. Members of the child's household see chores, points, and the Proof Feed in the app, and the household's Admins review proof photos and notes. We can access it as the operator (only as described above), and Google hosts it for us. We never sell children's information or use it for advertising.
• Third parties that receive it. Google (Firebase hosting, on our behalf) and Apple (delivering push notifications to the child's device, using its push token). No one else. Cloudflare, which sends consent emails, receives only the parent's details.
• Parental review. Admins can see the chores, completions, notes, and photos for every member of the household in the app. You can also email us to ask what we hold about your child.
• Parental deletion. In Household, then Kids, an Admin can delete a kid profile. That deletes the child's proof photos and completion records (including notes and dispute text), points history, reward requests, any setup codes, the profile, and its sign-in account; chores assigned to the child go back to the House Pool. Revoking parental consent in the same place deletes every kid profile in the household the same way. Emoji reactions the child left on other members' completions, and reminders that were assigned to the child, are not removed by this; email us and we will remove them.
• Children who joined before version 1.5.1. Earlier versions let a child sign up with their own email address. Those accounts keep working, and Household, then Kids, lists them. If the child is under 13, please remove them from the household and add them again as a kid profile. Removing only unlinks the account from the household; to delete the old account and its data, sign in on the child's device and use Settings, then Delete Account, or email us from the Admin's account email and we will delete it along with the child's completions and photos.
• How long we keep it. Proof photos are deleted about 30 days after they are taken. Everything else collected from a child is kept until the parent deletes the kid profile, revokes consent, or the household is deleted, whichever comes first.

Data retention

We keep personal information, including children's information, only as long as it is needed to run the household's chores in ChoreSight, and then delete it as follows:

• Proof photos: a job runs every day and deletes each proof photo file 30 days after submission, so a photo is gone within about 31 days. Deleting a chore or a kid profile deletes its proof photos sooner.
• Completion records (who, when, status, note, feedback, dispute text): kept with the household until the chore is deleted, the household is deleted, the kid profile that submitted them is deleted, or you ask us to delete them.
• Baseline photos: kept until the chore that uses them is deleted, or the household is deleted.
• Chores, routines, reminders, rewards, and points history: kept until an Admin deletes them or the household is deleted. A kid profile's points history and reward requests are deleted with the kid profile.
• Kid profiles: kept until the parent deletes the kid profile, revokes consent, or the household is deleted.
• Your account and profile: kept until you delete your account. Delete Account removes your sign-in account and profile. If you are the household owner, it also deletes the entire household, its kid profiles, all of its chores and history, and all of its photos. If you are an adult or teen member, your past completions stay with the household.
• Parental consent records: a consent request that is not answered expires after 48 hours, and a daily job then removes the parent's name and email from it. A refused request has them removed right away. Unanswered, refused, and replaced requests are deleted within 30 days. A given consent record (the parent's name, email, and when consent was given or revoked) is kept as proof of consent while consent is in effect and for 5 years after it ends (when consent is revoked or the household is deleted), and is then deleted automatically.
• Setup codes: deleted when used, or within about a day after they expire.
• Push tokens and app language: the token is removed from your profile when you sign out, and removed when it is no longer valid.
• On-device data: stays on your device until you delete it or uninstall the app. Signing out clears the widget's sign-in credentials.

Google may keep deleted data in its systems for a limited period as part of normal operations, under its own terms.

Subscriptions

ChoreSight Premium is an auto-renewable subscription billed through Apple's App Store. Apple handles payment, so we never see your card or Apple Account details. The app checks your subscription with Apple's StoreKit on the device and records the household's plan, and which member's subscription covers it, in the household data. You can manage or cancel anytime in your Apple Account settings.

Sale, sharing, and targeted advertising

We do not sell personal data. We do not share it for targeted advertising, and ChoreSight contains no ads or ad SDKs.

Your privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon, Indiana, Kentucky, Rhode Island and other US states, or the EU/UK), you may have the right to access, correct, delete, or get a copy of personal data, and to opt out of targeted advertising, sale, or profiling. Many of these laws may not apply to a studio our size, but we honor these requests from everyone.

Many requests can be handled directly in the app (edit or delete chores, remove members, Delete Account). For anything else, email contact@jcmobileappstudio.com. We respond within 45 days, and we will not treat you differently for asking. If we decline your request, you can appeal by replying to our answer with "Appeal," and we will respond within 45 days (60 days at most, as some laws allow). If your appeal is denied, you may contact your state attorney general.

International users

The data we hold for ChoreSight is stored and processed in the United States. If you use the app from outside the US, your data will be transferred to the US.

Security

Data travels between the app and Firebase over encrypted connections. Server security rules limit each household's data and photos to its own signed-in members, and photo uploads are limited to images under 1 MB. No system is perfectly secure, so please use a strong password or Sign in with Apple and keep your devices locked.

We maintain a written information security program to protect the information we collect, including children's information. It names the person responsible for it and covers yearly risk assessments, access controls (only the people and services that need data can reach it), encryption in transit and at rest, automatic deletion on the schedules above, testing of our security rules before each release, oversight of our service providers, and how we respond to and notify people about a security incident.

Changes

If this policy changes, we will update the "Last updated" line above and post the new version at this URL. Material changes will also be noted in the app's release notes.

Contact

Questions or requests: contact@jcmobileappstudio.com