Privacy & safety

KindTally is built for families. Your children's profiles belong to you, not the internet.

• Child profiles are private to your family. Nobody outside it can see them.
• There are no public child pages or public leaderboards.
• We never show ads to children, and we do not build advertising profiles of children.
• We do not sell your family's data or share it for advertising. We only use trusted service providers where needed to run KindTally safely.
• Children cannot create independent public accounts — parents set everything up.
• Children cannot message other children outside your family.
• We do not track your child's location.
• High privacy by default — we collect only what we need to run the service.
• You can export everything we hold, any time.
• You can delete your family, and we delete the data.

Only people in your family can see your name, your stars and your goals. No strangers, no ads, no scoreboards. We never share where you are.

1. Who we are (data controller)

KindTally is a family chores, rewards and routines app for parents and carers in the United Kingdom. The data controller for personal data processed through KindTally is Karl Newton, trading as KindTally, a sole trader based in the United Kingdom.KindTally is not currently a registered limited company. You can reach us at kindtally.app@gmail.com.

Data Protection Officer. Because of the size and scope of our processing, we are not required under UK GDPR to appoint a Data Protection Officer, and we have not appointed one. Any privacy question, request or complaint can be sent to kindtally.app@gmail.com and will be handled by Karl Newton directly.

2. What we collect

• Parent or guardian name and email address.
• Family name and family code.
• Child first names and ages where you choose to enter them.
• Optional child PIN (stored as a one-way hash, never as the original number).
• Chores, routines, behaviour goals, rewards, savings goals and pocket-money ledger entries you create.
• Subscription and billing status (plan, renewal date, payment status). We do not store full card numbers — those go directly to our payment provider.
• Basic technical data needed to keep you signed in, keep the service secure, fix bugs and monitor performance (for example IP address, browser type and error logs).
• Any messages or screenshots you choose to send when submitting in-app feedback.

Data minimisation and high privacy by default. We deliberately ask for as little information as possible. We do not request precise location, contacts, phone numbers, school details or social handles. Privacy-protective defaults (no public profiles, no ads to children, no leaderboards, no child-to-child messaging outside the family) are switched on out of the box — they are not optional extras you have to turn on.

3. Why we use your data

• To provide the app and the features you sign up for.
• To manage your family account, including parent and child profiles.
• To process your subscription and renewals where you have a paid plan.
• To keep your account secure and prevent abuse.
• To provide customer support when you contact us.
• To improve reliability, fix bugs and understand how features perform.

4. Children's privacy (UK Children's Code)

• Parent-led setup. A parent or guardian creates the family account and adds each child profile. Children do not sign themselves up.
• Children cannot create independent public accounts on KindTally.
• Child profiles are private to the family — there are no public child profiles and no public leaderboards.
• There is no child-to-child messaging with anyone outside the family.
• We do not show advertising to children and we do not build advertising or behavioural profiles of children.
• We do not track a child's location.
• We do not sell children's data, and we never use it to train external advertising systems.
• High-privacy settings are on by default and parents can tighten them further at any time from Settings → Privacy.

5. Legal basis (UK GDPR), in plain English

• Contract — we need to process your account, family and subscription data to give you the service you signed up for.
• Legitimate interests — we use basic technical data to keep the service secure, fix bugs and improve reliability, in a way you would reasonably expect.
• Consent — for anything optional, for example opting in to product emails. If we ever introduce non-essential analytics or advertising cookies we will ask for your consent first. You can withdraw consent at any time.
• Legal obligation — for limited records we have to keep, for example billing records for tax purposes.

6. Who helps us run the service (sub-processors)

We use a small number of trusted providers to run KindTally. They only process data on our instructions and under written terms. We do not sell your data and we do not share it with advertising networks or data brokers.

• Lovable Cloud — hosting, database, authentication, file storage and serverless functions. Data is stored in the underlying managed database with row-level security so families can only see their own data.
• Lovable platform analytics — aggregate visitor and usage statistics for the website and app (page views, visits, session and bounce measurements, device type, referral source and country-level location). See section 11.
• Paddle — payments and subscription billing (Merchant of Record) for paid plans. Card details are entered directly with Paddle — we never see or store full card numbers.
• Lovable AI Gateway — used only if you choose to use AI-assisted features such as the parent or child Kind Buddy support tool. Prompts contain the minimum information needed to answer and are not used to train public AI models. If you don't use these features, no data is sent to the AI Gateway.
• Lovable Cloud email service — all outbound app and account email (sign-up confirmation, password reset, admin and co-parent invitations, notifications) is sent through the email service built into Lovable Cloud, from our own verified sending domain. We do not currently use a separate third-party email marketing provider.
• Google and Apple sign-in — used only if you choose to sign in with a Google or Apple account. In that case Google or Apple confirms your identity to us and we receive your email address and basic profile information. If you sign in with an email address and password instead, no data is shared with them.
• AI agent connections (MCP) — used only if you, as a parent, explicitly connect an external AI assistant to your account from the Connect page. You choose the assistant, you approve the connection, and you can disconnect it at any time. Once connected, the assistant provider receives the family data it requests within the permissions you approved, and their own privacy policy applies to that data.

7. How long we keep your data

• We keep your account and family data for as long as your account is active.
• Deletion timeframe. When you delete your family or account (from Settings → Privacy or by emailing us), we delete the associated personal data from our live systems within 30 days, unless we are legally required to keep specific records for longer.
• Backups. Routine encrypted system backups may still contain a copy of your data for a short additional period before they are overwritten on their normal rotation (typically up to 30 days). Backup copies are not used for any other purpose and are deleted in the normal backup cycle.
• Billing records. Where you have made a payment, we (and our payment provider Paddle) keep the minimum billing and tax records required by UK law — currently up to 6 years after the end of the relevant tax year — even after you delete your account.
• We may also keep a limited set of records for longer where the law requires it or where they are needed to deal with a complaint or fraud investigation.

8. Your rights as a parent

Under UK GDPR you have the right to:

• Access the personal data we hold about you and your family.
• Correct anything that is wrong.
• Receive an export of your data in a common, machine-readable format.
• Delete your account and family data, subject to the limited retention noted above.
• Restrict or object to certain processing, where the law allows.
• Withdraw any consent you have previously given.

9. How to request export or deletion

Most controls are available inside the app under Settings → Privacy once you sign in. From there a parent or carer can:

• Export everything we hold about your family as a JSON file with one tap.
• Delete an individual child profile and all of that child's chores, money history and rewards.
• Delete the whole family (owner only), which permanently removes every record we hold for your family from our live systems.

If you'd rather we handle it for you, email kindtally.app@gmail.com from the address on your account and tell us whether you want an export, a correction or a full deletion. We aim to respond within 30 days.

10. Security

• All connections to KindTally use HTTPS encryption.
• Passwords are stored using one-way hashing by our authentication provider. Child PINs are stored as one-way hashes too.
• The database uses row-level security so each family can only see its own children, chores, rewards and ledger entries.
• Admin tools are protected behind a separate admin role and audit log.
• Access to production systems is limited to people who genuinely need it to run the service.

11. Cookies, storage and analytics

KindTally itself uses only essential cookies and storage — the items needed to keep you signed in, remember your preferences and complete a checkout where you have a paid plan. In practice this means a small amount of information held in your browser's local storage and session storage (for example your sign-in session, your chosen display settings and short-lived state such as a plan you selected before signing up). You can clear it at any time in your browser settings, though doing so signs you out. If we ever introduce non-essential cookies or analytics that need your permission, we will tell you first and give you a clear way to accept or decline before anything non-essential loads. We do not run Google Analytics, advertising pixels or any third-party behavioural advertising tracker, and we do not build advertising profiles of parents or children.

We do, however, use the built-in analytics provided by our hosting platform, and this is live today. It records aggregate visitor and usage information about the website and app, which may include: page views and which pages were visited, the number of visitors and visits, the page paths requested, visit and session measurements such as session length, engagement and bounce rate where available, device and browser type (for example desktop or mobile), the referring website or source that brought someone to us, and broad country-level location. It is used to operate, secure and improve KindTally — to understand which parts of the service people use and to keep it working well. It is not used to build third-party advertising profiles, and your data and conversations are never sold to advertisers.

This information is aggregate service-performance data rather than a profile of you: it is not used for advertising, it is not sold, and it is not combined with your child's chore, reward or money records. Our hosting platform, Lovable, acts as our hosting provider and processor for these measurements.

Lawful basis. We rely on legitimate interests (running, securing and improving the service) for these aggregate hosting measurements. We have not switched on any advertising or behavioural analytics product. If we ever add analytics that requires your consent under the UK PECR/cookie rules, we will ask you first with a consent banner and a "Cookie settings" link in the footer, and nothing non-essential will load unless you choose Accept.

Retention. We do not set our own retention period for these platform measurements — how long they are kept is governed by our hosting provider and the current service configuration. If you would like to know the position that applies at the time you ask, email kindtally.app@gmail.com and we will tell you.

Our own site analytics. We also keep a small, cookie-free count of page views so we can see how many people use KindTally and where they arrive from. For each page view we record the page path (with any identifiers removed), the date and time, a country code, the referring website, any campaign tag in the link, a broad device type (mobile, tablet or desktop), whether the visit was signed in, and an anonymous fingerprint that is re-hashed with a new secret every day so it cannot be linked to you or followed from one day to the next, plus a random per-tab marker (held only in your browser’s session storage and cleared when the tab closes) so we can count unique sessions. We do not store IP addresses, browser strings, names, emails or account identifiers, and child-mode screens are never recorded at all. No cookies are set and the browser’s “Do Not Track” setting is respected. These records are deleted after 400 days. Lawful basis: legitimate interests (running and improving the service). No Google Analytics or other third-party analytics product is switched on today; if we ever enable one we will update this policy and ask for your consent first.

12. Where your data is stored

Your family account, child profiles, chores, rewards and ledger entries are stored by our hosting and database provider (Lovable Cloud) on managed cloud infrastructure, protected by row-level security so each family can only reach its own records. We do not claim a single named data centre or region for every service we use: our hosting, payment, email and platform providers may process limited data in the United Kingdom, the European Economic Area or other countries.

Where personal data is transferred outside the UK, we rely on approved safeguards such as UK adequacy regulations, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, together with written processor terms. If you need to know the region that applies to a specific provider, email kindtally.app@gmail.com and we will confirm the current position.

13. Changes to this policy

If we make material changes to this policy we'll update the "Last updated" date at the top and, where appropriate, let you know inside the app or by email.

14. Complaints

If you're unhappy with how we've handled your data, please contact us first at kindtally.app@gmail.com (or support@kindtally.co.uk) so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.