1. Who we are
ChoreQuest is an independent app developed by Chris Skaaning. If you have any questions about this policy, contact us at c@rpediem.com.
2. What data we collect and why
ChoreQuest collects the minimum data needed to operate. The table below lists everything stored, where it lives, and why.
| Data | Where stored | Why |
|---|---|---|
| Parent email address | Firebase Authentication | Used to log in. No marketing emails are sent. |
| Family name | Firebase Firestore | Displayed in the app to identify the family. |
| Family join code | Firebase Firestore | A 6-character code that lets a second parent join the same family. |
| Children's first names and chosen avatar | Firebase Firestore | Displayed in the app. Avatars are emoji-based presets — no photos are collected. |
| Quest (chore) names, icons, and settings | Firebase Firestore | The quests you create for your children. |
| Completion records | Firebase Firestore | Records of when a child marked a quest complete and whether a parent approved or rejected it. Includes the date (YYYY-MM-DD) and star count. |
| Star totals and reward goals | Firebase Firestore | Tracks each child's accumulated stars and any reward goal the parent sets. |
| Device push token | Firebase Firestore | Stored when a parent grants notification permission. Used to send a push notification when a child completes a quest. Never used for marketing. |
| Child device PIN (hashed) | The device (expo-secure-store) and Firebase Firestore | A PIN that locks the child-mode device so the child cannot exit. Stored as a SHA-256 hash on the device and in your family's data, so it can be checked from a parent's device. The PIN itself is never stored. |
| Purchase receipt / entitlement | RevenueCat servers | Records whether you have purchased the unlimited plan. Managed by RevenueCat — see their privacy policy at revenuecat.com/privacy. |
3. Data we do NOT collect
- Photos or camera access
- Location data
- Contacts
- Advertising identifiers
- Behavioural analytics or usage tracking
- Children's ages or dates of birth
4. Children's privacy (COPPA / UK GDPR)
ChoreQuest is designed for use by parents with young children. Children do not create accounts and do not provide any personal information to the app themselves. The only child data stored — first name and chosen avatar — is entered by the parent.
We do not knowingly collect any personal information directly from children under 13. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.
5. Cloud services we use
ChoreQuest is built on the following third-party services, each of which processes data as a data processor on our behalf:
- Google Firebase (Authentication + Firestore) — stores account credentials and all family data. Hosted in the EU/US depending on your region. See Firebase Privacy.
- RevenueCat — manages in-app purchases and entitlements. See RevenueCat Privacy.
- Expo (push notifications) — push tokens are forwarded to Expo's push API when a quest completion notification is sent. See Expo Privacy.
We do not share your data with any other third parties, and none of these services are authorised to use your data for their own purposes.
6. Data retention and deletion
Your data remains in Firestore for as long as you use the app. You can delete your account and all your family's data at any time inside the app: Parent dashboard → Delete account. Deletion is immediate and permanent. If another parent shares the family, only your account is removed and the family stays with them. You can also email c@rpediem.com and we will delete it for you within 30 days.
Your Firebase Authentication account (email address) will be deleted at the same time. Push tokens are deleted when a parent device logs out.
7. Security
All data in transit is encrypted via HTTPS/TLS. Data at rest is protected by Firebase's built-in encryption. Access to your family's data in Firestore is enforced by security rules that require authentication — no other user can read or modify your family's data.
Child device PINs are hashed with SHA-256 before being stored; the PIN itself is never stored or transmitted. Child devices sign in anonymously: no email address or personal details are needed for a child.
8. Your rights
Depending on where you live, you may have the right to access, correct, or delete the personal data we hold about you. To exercise any of these rights, email c@rpediem.com. We will respond within 30 days.
9. Changes to this policy
If we make material changes to this policy, we will update the "last updated" date at the top of this page. Continued use of the app after changes are posted constitutes acceptance of the updated policy.
10. Contact
Questions or requests: c@rpediem.com