ChoreQuest Privacy Policy

Last updated: May 2026

ChoreQuest ("we," "us," or "our") operates the website mychorequest.com and the ChoreQuest family chore management service ("the Service"), developed and maintained by a sole proprietor based in California, United States. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have regarding your information.

By creating a ChoreQuest account, you acknowledge that you have read and agree to this Privacy Policy. If you do not agree, do not use the Service.

Questions or requests regarding this policy may be directed to: [email protected]

1. Who Can Use ChoreQuest

ChoreQuest accounts may only be created by adults who are 18 years of age or older. The Service is designed for parents and legal guardians to manage household chores for their children.

Children under 18 do not create accounts and do not submit personal information directly to ChoreQuest. Child profiles are created, configured, and managed entirely by a parent or legal guardian who has agreed to this Privacy Policy on the child's behalf at the time of account creation. The parent or legal guardian is the sole account holder and is responsible for all activity that occurs under their account.

If you are under 18, do not attempt to create an account, submit personal information, or use the Service in any way not directly supervised by your parent or legal guardian.

We do not knowingly allow anyone under the age of 18 to create an independent account. If we become aware that someone under 18 has created an account without parental consent, we will promptly delete that account and all associated data.

2. Information We Collect

A. Information from Parent Account Holders

When you create a ChoreQuest account, we collect:

• Email address — required to create your account, verify your identity, send you account-related communications (such as email verification, password resets, and billing receipts), and contact you about service changes.
• Password — stored as a one-way cryptographic hash (bcrypt). We never store or transmit your plaintext password, and we cannot retrieve it.
• Family name — the name you give your family within the app (for example, "The Johnson Family"). This is display-only and used solely to personalize your experience.
• Subscription and billing information — when you upgrade to ChoreQuest Premium, your payment is processed by Stripe. We store only a Stripe Customer ID and a Stripe Subscription ID — reference numbers that allow us to manage your subscription status. We do not store your credit card number, card expiration date, CVV, or any other payment card details on our servers.
• Subscription tier — whether your account is on the Free or Premium plan. This determines which features are available to your family.
• Parent PIN hash — if you choose to set a parent PIN to protect the parent dashboard from being accessed from the child view, your PIN is stored as a one-way cryptographic hash. We cannot retrieve your PIN in plaintext.
• Account timestamps — the date and time your account was created and when parental consent was recorded.

We do not collect your physical mailing address, phone number, date of birth, Social Security Number, government-issued ID, or any information not described above unless specifically required to comply with a legal obligation.

B. Information About Child Profiles

Child profiles are created by parents — not by children themselves. Children do not submit any information directly to ChoreQuest. We collect only the minimum information necessary to operate the chore management features:

• Display name — the child's first name or nickname, as entered by the parent. We recommend using only a first name or a nickname rather than a full legal name.
• Avatar color — a color selected by the parent or child from a preset palette of eight colors. No photograph, uploaded image, or biometric data of any kind is collected.
• Chore history — a record of chores assigned to the child, including the chore title, coin value, completion timestamp, and approval status. This information is created and managed by the parent.
• Coin balance — an in-app point total that reflects completed and approved chores. Coins have no monetary value, cannot be transferred, and cannot be exchanged for real-world currency or goods through ChoreQuest.
• Reward redemption history — if your family is on the Premium plan and uses the rewards feature, a record of rewards the child has requested and whether the parent approved or declined each request.

We explicitly do not collect from child profiles:

• Email addresses
• Phone numbers
• Photographs, selfies, or uploaded images of any kind
• Physical location data or GPS coordinates
• Date of birth or age (unless a parent voluntarily provides it in a display name or chore description, which we do not solicit)
• Browsing history or behavioral data beyond in-app activity
• Device identifiers associated specifically with a child
• Any information submitted directly by a child

Children do not have their own login credentials, username, or password. All access to child profiles occurs through the parent's authenticated account session. A child interacting with the app does so through a filtered view of their parent's session — no separate child account exists in our systems.

C. Information Collected Automatically

When you use the Service, we automatically collect limited technical information to operate and improve the Service:

• Log data — IP addresses, browser type, operating system, pages visited, and timestamps. This information is collected by our hosting provider (Vercel) and error monitoring service (Sentry) and is used solely for security and debugging purposes.
• Session cookies — small files stored in your browser to maintain your login session. See Section 10 (Cookies) for details.
• Error data — if the application encounters an error, our error monitoring service (Sentry) may capture technical context including the page you were on and the nature of the error. We configure Sentry to minimize personal data in error reports.
• Aggregate usage analytics — Vercel Analytics collects anonymized, aggregated data about page views and performance metrics. This data cannot be used to identify individual users.

3. Children's Online Privacy Protection Act (COPPA)

ChoreQuest is a family service that involves children. We take our obligations under the Children's Online Privacy Protection Act (COPPA) seriously. The following describes our COPPA compliance practices in full.

A. Verifiable Parental Consent

Before a child profile is created in ChoreQuest, the parent or legal guardian must:

1. Create a ChoreQuest account using their own email address, confirming they are 18 years of age or older.
2. Verify their email address through a confirmation link we send to their provided email.
3. Explicitly acknowledge, during the onboarding process, that they are the child's parent or legal guardian and that they consent to our collection and use of their child's display name and in-app activity as described in this Privacy Policy.

We record the date, time, and method of this consent. This consent covers all child profiles subsequently added to the family account by that parent or legal guardian.

B. Parental Rights

Parents and legal guardians have the following rights with respect to their child's information, which may be exercised at any time by contacting us at [email protected]:

• Right to Review — You may request a copy of all personal information we hold about your child's profile.
• Right to Correct — You may request correction of any inaccurate information in your child's profile. Alternatively, you may edit your child's display name and avatar directly within the parent dashboard at any time.
• Right to Delete — You may delete any child profile at any time directly from the parent dashboard. Deletion permanently removes the child's profile, display name, avatar color, chore history, coin balance, and reward redemption history. This action is immediate and irreversible.
• Right to Revoke Consent — You may revoke consent for the collection of your child's information by deleting the child profile as described above, or by closing your entire family account. To close your account and delete all family data, email [email protected].
• Right to Restrict Operators — You may consent to our collection and use of your child's information while refusing to allow us to disclose that information to third parties, except as necessary to operate the Service.

We will respond to verifiable parental requests within 30 days. We will not require you to create an account to submit a parental rights request if you do not already have one.

C. No Conditioning on Disclosure

We will not condition a child's participation in any activity on the disclosure of more personal information than is reasonably necessary to participate in that activity. The only information required to create a child profile is a display name.

D. No Child-Directed Advertising

We do not serve advertisements within ChoreQuest. We do not use children's information for behavioral advertising, targeted advertising, or any advertising purpose whatsoever. ChoreQuest earns revenue solely through parent subscription fees.

E. Data Minimization

We collect the minimum information necessary to operate the features of the Service. We do not collect information about children "just in case" it might be useful in the future.

4. How We Use Information

We use the information we collect for the following purposes only:

• To create and maintain your family account
• To provide the chore tracking, assignment, approval, and rewards features of the Service
• To process and manage your subscription payments through Stripe
• To send you transactional emails: account verification, password reset links, billing receipts, and service announcements
• To display your family's data to you within the application
• To maintain the security and integrity of the Service, including detecting and preventing fraud and abuse
• To debug errors and improve application performance
• To respond to your support requests and communications
• To comply with applicable laws and legal obligations

We do not:

• Sell your personal information or your child's information to any third party under any circumstances
• Share your information with third parties for their own marketing purposes
• Use your information or your child's information for behavioral advertising or targeted advertising
• Use children's information for any purpose other than providing the chore management features described in this policy
• Make automated decisions about you or your children that produce legal or similarly significant effects
• Combine children's information with information from third-party sources

5. How We Share Information

We do not sell, rent, or trade personal information. We share information only in the following limited circumstances:

A. Service Providers

We share information with the third-party service providers described in Section 6 solely to the extent necessary for them to provide services to us. These providers are contractually prohibited from using your information for their own purposes and are required to protect your information.

B. Legal Obligations

We may disclose personal information if required to do so by law, regulation, legal process, or governmental request, including to comply with a court order, subpoena, or law enforcement request. We will attempt to notify you of such a disclosure if permitted by law.

C. Protection of Rights

We may disclose information when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of ChoreQuest, our users, or the public.

D. Business Transfers

If ChoreQuest is acquired by or merged with another company, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice in the Service before your information becomes subject to a different privacy policy.

We will never disclose children's personal information in connection with a business transfer or sale without providing you prior notice and an opportunity to delete the information.

6. Third-Party Services We Use

The following third-party services process personal information in connection with the operation of ChoreQuest. We have reviewed each provider's privacy practices and have configured our use of each service to minimize data sharing where possible.

No third-party service listed below receives children's personal information as a matter of deliberate design. None of these services are permitted to use information shared with them for their own advertising or marketing purposes in connection with our agreement with them.

Supabase (supabase.com)

• Role: Database, authentication, and real-time data
• Data shared: All account data, family data, child profile data, chore records, and reward records are stored in Supabase's managed PostgreSQL database hosted in the United States (us-east-1).
• Notes: Supabase processes data under a Data Processing Agreement. Row Level Security is enabled to ensure each family can only access their own data.
• Privacy policy: supabase.com/privacy

Stripe (stripe.com)

• Role: Payment processing and subscription management
• Data shared: Parent email address, subscription status. Stripe processes all payment card information directly and we do not receive or store payment card numbers. Child profile information is never shared with Stripe.
• Notes: Stripe is PCI DSS Level 1 certified.
• Privacy policy: stripe.com/privacy

Vercel (vercel.com)

• Role: Application hosting and content delivery
• Data shared: Vercel processes all web requests to mychorequest.com and may log IP addresses and request metadata for security and performance purposes. Vercel Analytics collects anonymized, aggregated page view data.
• Privacy policy: vercel.com/legal/privacy-policy

Cloudflare (cloudflare.com)

• Role: DNS, network security, and DDoS protection
• Data shared: All web traffic to mychorequest.com passes through Cloudflare's network, which processes IP addresses and request metadata to provide security services.
• Privacy policy: cloudflare.com/privacypolicy

Sentry (sentry.io)

• Role: Application error monitoring
• Data shared: When application errors occur, Sentry captures technical context to help us diagnose and fix issues. We configure Sentry to minimize personal data capture. Error reports may incidentally include a database record ID or anonymized context but are not intentionally associated with personal information.
• Privacy policy: sentry.io/privacy

Resend / Email Delivery

• Role: Transactional email delivery (account verification, password resets, billing receipts)
• Data shared: Parent email address and the content of transactional emails. Child email addresses are never used because children do not have email addresses in ChoreQuest.
• Privacy policy: resend.com/legal/privacy-policy

7. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Service.

Active accounts: All data is retained for as long as your family account remains open. You can review, edit, or delete specific information (such as child profiles and chores) directly within the application at any time.

Account deletion: When you request account deletion by emailing [email protected], we will permanently delete all family data, child profiles, chore history, coin balances, and reward redemption records within 30 days of your verified request. Following deletion, we retain only:

• Anonymized, aggregate usage statistics that cannot be linked to any individual or family
• Billing records retained by Stripe as required by financial regulations and applicable law
• Minimal records required to demonstrate COPPA compliance (consent timestamps without associated personal data)

Child profile deletion: When a parent deletes an individual child profile from within the parent dashboard, all information associated with that profile (display name, avatar color, chore history, coin balance, reward history) is permanently deleted immediately. This cannot be undone.

Inactive accounts: We may delete accounts and associated data after an extended period of inactivity (currently defined as 24 months of no login activity). We will send a notice to the parent's email address before deleting an inactive account.

8. Data Security

We implement the following security measures to protect your information:

• Encrypted transmission — All data transmitted between your browser and mychorequest.com is encrypted using TLS (HTTPS). We enforce HTTPS for all connections and reject unencrypted requests.
• Password hashing — Passwords are stored as bcrypt hashes with an appropriate work factor. We cannot retrieve your password in plaintext and do not store it in any recoverable form.
• PIN hashing — Parent PINs are stored as bcrypt hashes. We cannot retrieve your PIN in plaintext.
• Row Level Security — Our database enforces Row Level Security policies that ensure each family's data is completely isolated. Queries from one family's account cannot access data belonging to another family, regardless of application-level code.
• Access controls — Database service role credentials and other sensitive keys are stored as encrypted environment variables and are never embedded in client-side code or version control repositories.
• Least privilege — Application components are granted only the minimum database permissions required to perform their function. The child dashboard cannot perform parent-only actions (such as approving chores) even if accessed directly.
• Cloudflare protection — All traffic passes through Cloudflare's network, which provides DDoS protection and blocks malicious requests before they reach our servers.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay at the email address associated with your account.

If you discover a security vulnerability in ChoreQuest, please report it responsibly to [email protected] before making it public. We appreciate responsible disclosure.

9. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following rights:

Right to Know: You have the right to request that we disclose what personal information we collect, use, disclose, and sell. This Privacy Policy describes these practices. You may also submit a specific request to [email protected].

Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions permitted by law. To request deletion, email [email protected].

Right to Correct: You have the right to request correction of inaccurate personal information. Much of your account information can be corrected directly within the application. For other corrections, email [email protected].

Right to Opt Out of Sale or Sharing: We do not sell personal information and we do not share personal information with third parties for cross-context behavioral advertising. There is nothing to opt out of in this regard.

Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide the Service.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you service, charge you different prices, or provide a different quality of service because you exercised a privacy right.

Shine the Light: California Civil Code Section 1798.83 permits users who are California residents to request information regarding disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

To submit a California privacy request: Email us at [email protected] with "California Privacy Request" in the subject line. We will respond within 45 days and may ask you to verify your identity before fulfilling the request.

10. Cookies and Tracking Technologies

ChoreQuest uses the following cookies and local storage technologies:

Essential Cookies (required for the Service to function):

• Authentication session cookies — set by Supabase Auth when you log in. These cookies maintain your logged-in session and are required for the application to work. They expire when your session ends or after a configured inactivity period.
• family_id cookie — set after you complete onboarding. Stores a reference to your family so the application can load your family's data efficiently. This cookie does not contain personal information — only a database identifier.
• active_child_id cookie — set when you switch to a child's view within the application. Identifies which child's chores to display. Automatically cleared when you return to the parent view or when your session ends.

Analytics:

• Vercel Analytics — we use Vercel's built-in analytics to understand aggregate usage patterns such as how many people visit specific pages. Vercel Analytics does not use cookies, does not track individual users across sessions, and does not collect personal information. It uses a privacy-respecting approach based on aggregated data.

We do not use:

• Advertising or marketing cookies
• Third-party tracking cookies
• Cross-site tracking technologies
• Social media tracking pixels
• Fingerprinting technologies

Managing cookies: You can configure your browser to refuse cookies or to alert you when cookies are being set. If you disable essential cookies, the Service will not function correctly — you will not be able to log in or maintain a session. Analytics are not affected by cookie preferences as Vercel Analytics does not use cookies.

11. Children's Devices and Supervised Use

ChoreQuest is designed to be used on shared or supervised devices. The child view is accessible through the parent's authenticated session — it is not a separate account.

We recommend the following practices for families:

• Set a parent PIN within the application to prevent children from accessing the parent dashboard without your permission.
• Log out of ChoreQuest on any device that children use independently and that is not supervised.
• Review your child's chore and coin history periodically through the parent dashboard.

The parent is responsible for supervising how children interact with the application on devices in their household. ChoreQuest's technical design supports parental control, but cannot substitute for parental oversight.

12. International Users

ChoreQuest is operated from the United States and is primarily intended for users within the United States. Our servers and third-party service providers are based in the United States.

If you are accessing ChoreQuest from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

If you are located in the European Economic Area, United Kingdom, or Switzerland, please note that we do not currently have a legal basis established under GDPR to offer the Service to residents of those jurisdictions at scale. If you choose to use the Service anyway, you do so on the basis of your explicit consent to the data practices described in this policy.

13. Links to Other Websites

ChoreQuest may contain links to third-party websites or services that are not operated by us. This Privacy Policy does not apply to those websites. We encourage you to review the privacy policy of any third-party site you visit. We have no control over and assume no responsibility for the content or privacy practices of any third-party sites or services.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

For material changes — particularly any changes that affect how we collect, use, or share children's personal information — we will:

• Email notice to the primary account email address at least 14 days before the changes take effect
• Post a prominent notice within the application
• Update the "Last updated" date at the top of this policy

Your continued use of ChoreQuest after changes take effect constitutes your acceptance of the revised Privacy Policy.

For changes that materially affect children's information, we will seek renewed parental consent where required by COPPA.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Website: mychorequest.com

For COPPA-related requests (parental review, correction, or deletion of children's information), email us with "COPPA Request" in the subject line. We will respond within 30 days. We may ask you to verify your identity and your relationship to the child before fulfilling the request.

For California privacy rights requests, include "California Privacy Request" in the subject line.

We are committed to working with you to resolve any privacy concerns in a fair and timely manner.