Privacy & safety

KindTally is built for families. Your children's profiles belong to you, not the internet.

• Child profiles are private to your family. Nobody outside it can see them.
• There are no public child pages or public leaderboards.
• We never show ads to children, and we do not build advertising profiles of children.
• We do not sell your family's data or share it for advertising. We only use trusted service providers where needed to run KindTally safely.
• Children cannot create independent public accounts — parents set everything up.
• Children cannot message other children outside your family.
• We do not track your child's location.
• High privacy by default — we collect only what we need to run the service.
• You can export everything we hold, any time.
• You can delete your family, and we delete the data.

Only people in your family can see your name, your stars and your goals. No strangers, no ads, no scoreboards. We never share where you are.

1. Who we are (data controller)

KindTally is a family chores, rewards and routines app for parents and carers in the United Kingdom. The data controller for personal data processed through KindTally is Karl Newton, trading as KindTally, a sole trader based in the United Kingdom.KindTally is not currently a registered limited company. You can reach us at support@kindtally.co.uk.

Data Protection Officer. Because of the size and scope of our processing, we are not required under UK GDPR to appoint a Data Protection Officer, and we have not appointed one. Any privacy question, request or complaint can be sent to support@kindtally.co.uk and will be handled by Karl Newton directly.

2. What we collect

• Parent or guardian name and email address.
• Family name and family code.
• Child first names and ages where you choose to enter them.
• Optional child PIN (stored as a one-way hash, never as the original number).
• Chores, routines, behaviour goals, rewards, savings goals and pocket-money ledger entries you create.
• Subscription and billing status (plan, renewal date, payment status). We do not store full card numbers — those go directly to our payment provider.
• Basic technical data needed to keep you signed in, keep the service secure, fix bugs and monitor performance (for example IP address, browser type and error logs).
• Any messages or screenshots you choose to send when submitting in-app feedback.

Data minimisation and high privacy by default. We deliberately ask for as little information as possible. We do not request precise location, contacts, phone numbers, school details or social handles. Privacy-protective defaults (no public profiles, no ads to children, no leaderboards, no child-to-child messaging outside the family) are switched on out of the box — they are not optional extras you have to turn on.

3. Why we use your data

• To provide the app and the features you sign up for.
• To manage your family account, including parent and child profiles.
• To process your subscription and renewals where you have a paid plan.
• To keep your account secure and prevent abuse.
• To provide customer support when you contact us.
• To improve reliability, fix bugs and understand how features perform.

4. Children's privacy (UK Children's Code)

• Parent-led setup. A parent or guardian creates the family account and adds each child profile. Children do not sign themselves up.
• Children cannot create independent public accounts on KindTally.
• Child profiles are private to the family — there are no public child profiles and no public leaderboards.
• There is no child-to-child messaging with anyone outside the family.
• We do not show advertising to children and we do not build advertising or behavioural profiles of children.
• We do not track a child's location.
• We do not sell children's data, and we never use it to train external advertising systems.
• High-privacy settings are on by default and parents can tighten them further at any time from Settings → Privacy.

5. Legal basis (UK GDPR), in plain English

• Contract — we need to process your account, family and subscription data to give you the service you signed up for.
• Legitimate interests — we use basic technical data to keep the service secure, fix bugs and improve reliability, in a way you would reasonably expect.
• Consent — for anything optional (for example, opting in to product emails or, in future, non-essential analytics cookies). You can withdraw consent at any time.
• Legal obligation — for limited records we have to keep, for example billing records for tax purposes.

6. Who helps us run the service (sub-processors)

We use a small number of trusted providers to run KindTally. They only process data on our instructions and under written terms. We do not sell your data and we do not share it with advertising networks or data brokers.

• Lovable Cloud — hosting, database, authentication, file storage and serverless functions. Data is stored in the underlying managed database with row-level security so families can only see their own data.
• Paddle — payments and subscription billing (Merchant of Record) for paid plans. Card details are entered directly with Paddle — we never see or store full card numbers.
• Lovable AI Gateway — used only if you choose to use AI-assisted features such as the parent or child Kind Buddy support tool. Prompts contain the minimum information needed to answer and are not used to train public AI models. If you don't use these features, no data is sent to the AI Gateway.
• Resend — used to send transactional emails such as admin invitations. Sign-up confirmation and password-reset emails are sent through the email provider built into Lovable Cloud. Before our public live launch we will confirm the named sending provider here if it changes (for example, if we move to a custom sending domain).

7. How long we keep your data

• We keep your account and family data for as long as your account is active.
• Deletion timeframe. When you delete your family or account (from Settings → Privacy or by emailing us), we delete the associated personal data from our live systems within 30 days, unless we are legally required to keep specific records for longer.
• Backups. Routine encrypted system backups may still contain a copy of your data for a short additional period before they are overwritten on their normal rotation (typically up to 30 days). Backup copies are not used for any other purpose and are deleted in the normal backup cycle.
• Billing records. Where you have made a payment, we (and our payment provider Paddle) keep the minimum billing and tax records required by UK law — currently up to 6 years after the end of the relevant tax year — even after you delete your account.
• We may also keep a limited set of records for longer where the law requires it or where they are needed to deal with a complaint or fraud investigation.

8. Your rights as a parent

Under UK GDPR you have the right to:

• Access the personal data we hold about you and your family.
• Correct anything that is wrong.
• Receive an export of your data in a common, machine-readable format.
• Delete your account and family data, subject to the limited retention noted above.
• Restrict or object to certain processing, where the law allows.
• Withdraw any consent you have previously given.

9. How to request export or deletion

Most controls are available inside the app under Settings → Privacy once you sign in. From there a parent or carer can:

• Export everything we hold about your family as a JSON file with one tap.
• Delete an individual child profile and all of that child's chores, money history and rewards.
• Delete the whole family (owner only), which permanently removes every record we hold for your family from our live systems.

If you'd rather we handle it for you, email support@kindtally.co.uk from the address on your account and tell us whether you want an export, a correction or a full deletion. We aim to respond within 30 days.

10. Security

• All connections to KindTally use HTTPS encryption.
• Passwords are stored using one-way hashing by our authentication provider. Child PINs are stored as one-way hashes too.
• The database uses row-level security so each family can only see its own children, chores, rewards and ledger entries.
• Admin tools are protected behind a separate admin role and audit log.
• Access to production systems is limited to people who genuinely need it to run the service.

11. Cookies and analytics

KindTally currently uses only essential cookies and storage — the items needed to keep you signed in, remember your preferences and complete a checkout where you have a paid plan. We do not currently run Google Analytics or any other third-party advertising or behavioural analytics cookies.

We are planning to add a privacy-respecting analytics tool (most likely Google Analytics 4) to help us understand which features parents find useful and where the app needs improving. It is not live yet. Before we switch it on we will show a cookie consent banner, and any non-essential analytics will only load if you choose Accept. A "Cookie settings" link will then appear in the footer so you can change your mind at any time. If you choose Reject, no analytics cookies are set and no analytics data is sent.

12. Where your data is stored

Your family account, child profiles, chores, rewards and ledger entries are stored in a United Kingdom data centre operated by our hosting and database provider. A small number of sub-processors (for example our payments provider and any analytics tool you consent to) may process limited data outside the UK; where they do, we rely on approved safeguards such as UK or EU Standard Contractual Clauses and the UK Addendum.

13. Changes to this policy

If we make material changes to this policy we'll update the "Last updated" date at the top and, where appropriate, let you know inside the app or by email.

14. Complaints

If you're unhappy with how we've handled your data, please contact us first at support@kindtally.co.uk so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.