Privacy Policy

Who we are, and our privacy officer

Chore Scape is run by Chris Smith, trading as Chore Scape ("we", "us"), who is the data controller for the personal data described in this policy, for Chore Scape and this website.

Chore Scape is run by one person, so Chris is our privacy officer. UK law doesn't require us to appoint a data protection officer, and we haven't. The privacy officer is responsible for how we handle personal data, and deals with privacy questions, requests and complaints. This one role is our privacy officer under New Zealand's Privacy Act 2020, our Data Protection Officer under Singapore's Personal Data Protection Act, the person in charge of the protection of personal information under Quebec law, and the person accountable for our privacy practices under Canada's PIPEDA. In Australia, these are our contact details for privacy questions and complaints.

What we collect

• Account details: a nickname (the name other people in the app see), email address, and a password (stored as a secure one-way hash, never in plain text).
• Sign-in records. Our sign-in provider, Supabase, records when you last signed in, and each session you're signed in with, with its IP address and the kind of device or browser. We use them to keep accounts secure, and to tell whether an account whose email address was never verified is still in use.
• Which accounts yours is linked to: a Warrior and their Strategists.
• When your email address was first verified, and when it last changed. We use this to tell a new, unchecked account from an older one whose address has changed.
• Codes we email you, to check your email address or to reset your password. We keep only a scrambled copy of each code (a hash), the address it was sent to, when it was sent, and how many codes and wrong tries there have been, so codes are hard to guess and can't be used over and over. To stop one network asking for too many codes, we also keep a scrambled key made from your IP address. It can't be turned back into the address without a secret key that we keep on our server.
• Task ("quest") data that you or someone you're linked to create: titles, descriptions, due dates, rewards, whether photos are asked for, completion status, who approved it, and any reason a Strategist gives for sending it back.
• Requests to change a quest, if a Warrior makes one: the changes asked for and what the quest said before, the Warrior's note (up to 280 characters), the Strategist's answer and any reason they give (up to 280 characters), who answered and when.
• Your year of birth (never your full date of birth). We ask everyone for it when they sign up, and older accounts are asked once in the app. We use it only to apply the rules and settings for your age: the privacy settings, whether a parent's OK is needed, which kinds of account you can have, which actions need an adult, and whether Chore Scape on your own is free for you (see "Age rules" and "A parent's OK" below). We also record each change to a Warrior's or Solo user's year of birth after sign-up: the old and new year, whether it changed the need for a parent's OK, when, and who made it (if we make the change through support, the record shows it was made by Chore Scape).
• Photos submitted as proof a quest was done, where that feature is used. The app (version 1.6.5 and later) removes location data and other hidden details (EXIF metadata) from a photo before it leaves your phone, and we check stored photos and remove any location data that older versions left in. If a photo can't be cleaned, we delete it. We keep a note of each check: the photo's file name, the result and when.
• In-app progress data: coins, XP, levels, bonuses and penalties, and your collectible cards, including the card packs you earn.
• Payouts: how often, and on which day, a Strategist plans to pay out. If a Strategist uses Mark as Paid: the amount, the coins it settled, when it was marked as paid and when the Warrior confirmed it, and any payment reference note the Strategist adds. The note is stored encrypted, but we hold the key, so we can still read it.
• Payout requests, if a Warrior asks to be paid: whether they asked for all of it or a set amount, the amount, their balance when they asked, and when. Then what happened: paid (and how much), "not now" (with the Strategist's reason, if they give one, up to 200 characters), cancelled by the Warrior, or closed because no Strategist is linked any more, and who answered and when. We use the history of a Warrior's requests to apply the limits in "Automatic decisions" below.
• Friends and Duels, if you use them: your friend code and who you are friends with or have asked to be friends with; and in Duels (the card game, played against the computer), your decks, the cards you own, your Duels choices saved on your account (where your packs come from and, for Strategists, Play Duels) and the result of each match.
• A parent's OK for a child under 15, and what happens around it: the consent record described in "A parent's OK" below; a child's reminders to their Strategists (how many, and when); a Strategist's answer if they say "No", or that they're not the child's parent or guardian; and the records of the 7-day wait described in "The 7-day wait" below.
• The missed-quest penalty setting for each Warrior: whether it's on, who last switched it on or off, and when. If it's on, the fines it takes.
• Your time zone (for example "Europe/London"), so days, reminders and quiet hours match your local time. Strategists and Solo users give it when they sign up. For a Warrior, the app sends it only once they're linked to a Strategist.
• Your quiet hours: the times when notifications wait until morning. If an adult Strategist sets a Warrior's quiet hours, we also store who set them, when, and whether they're locked. If a Warrior asks for different hours, the request goes to their Strategists as a notification, with the hours asked for.
• Your phone, for notifications: a push notification token from Google Firebase, and with it the phone's install ID (see below), whether it's an Android phone or an iPhone, on Android whether the app came from Google Play or a direct download, the app's build number, whether notifications are allowed, the notification sound you've picked, when the app was last used on it and when a notification last reached it. For a Warrior, the app registers the phone only once they're linked to a Strategist. We use where the app came from to send "new version" notifications only to phones that installed Chore Scape by direct download. A linked Strategist can see whether a Warrior's phone can get notifications, how many phones the Warrior is signed in on, and whether they haven't opened Chore Scape for 14 days. Our server also tells the Strategist's app when one of the Warrior's phones last checked in with us, though the app doesn't show it. The Strategist never gets the token or the other details.
• The notifications we send you (such as "Quest approved!"), so the app can list them: which Warrior each one is about, who did the thing it's about, and when you read it, dismissed it, or it was dealt with. We also keep a record of each notification we send to your phones (its title and text, and whether it reached each phone), and your Notify me about choices for each Warrior.
• A random install ID the app creates the first time it runs. It isn't taken from your phone's hardware. On Android, it changes if the app is uninstalled. On iPhone, it's kept in the phone's secure storage (the Keychain), which iOS keeps when an app is deleted, so it can stay the same if Chore Scape is reinstalled. The app sends it when a Strategist or Solo account signs up, and with the phone's details each time it registers for notifications (for a Warrior, only once they're linked to a Strategist). We use it to stop the same phone starting a new free trial again and again, and to tell your phones apart, for example in the app's notification check. A Warrior's sign-up doesn't use it, so a child who signs up first doesn't use up their parent's free trial. A phone only counts as having had its free trial once the account's email address is verified, so a mistyped sign-up doesn't use it up. Until then, we keep the install ID with that account.
• Which tips and walkthroughs you've seen in the app (only which ones, not when or for how long), so they aren't shown again on another phone.
• If you switch on the fingerprint or face lock, your phone does the check. Your fingerprint or face never reaches us.
• Blocks and reports: who you've blocked, and any report you send (who it's about, the reason, any detail you add, and the name you saw). Reports are emailed to our support inbox so we can look into them.
• Purchase history: which plan or free access your account has, whether a household plan covers you (see "Plans and households" below), and, once plans go on sale in the app, a record of each plan bought: the plan, when it started, when it renews or ends, whether it's active or cancelled, and the app store's reference for the purchase. The app store handles the payment itself, so we never see or store your card details.
• Emails you send us and our replies, such as support questions and requests about your data.
• Technical logs. Like most online services, Supabase keeps logs of the requests our servers get from the app and this website, with the IP address and the kind of device or browser, and a log of sign-ins and account changes. We use these logs only to keep the service working and secure.

Older versions of the app may send the time zone, notification token or install ID sooner than described above. For a child under 15 with no linked Strategist, our server doesn't accept a time zone or notification token, and removes any notification token it already has. Copies of the install ID, year of birth and time zone that any version of the app sends with a sign-up are removed from our sign-in records within two hours. The year of birth stays on your profile, and a Strategist's or Solo user's install ID stays in the free-trial record.

Children and young people

Chore Scape is used by adults on their own, by adults with a support person, and by children and teenagers with a parent or carer as their "Strategist". Children under 15 use Chore Scape as a Warrior, with a parent or carer linked as their Strategist, and need a parent's OK before they can use photo proof or Friends (see "A parent's OK" below). Chore Scape on your own (Solo) isn't available to anyone under 15: neither the app nor our server will set one up, and one set up by an older version works like a child's account with no Strategist (see "Time limits" below).

We follow the UK Information Commissioner's Age Appropriate Design Code (the Children's Code) for every child who uses Chore Scape, wherever they live. We'll also follow Australia's Children's Online Privacy Code once it's registered (it's due by 10 December 2026).

• Year of birth. Everyone is asked for the year they were born. We only ask for the year, and we don't check it. In the app, only you and the Strategists or Warriors you're linked to can see it. We can see it too (see "Who at Chore Scape can see your data"). We use it only for the rules and default settings for your age (see "Age rules" below). Once it's set, you can't change it yourself. A linked Strategist can correct it, or you can email support. If a linked Warrior hasn't given their year yet, they can only give a year that still needs a parent's OK. For an older year, a linked Strategist adds it. We record every change to a Warrior's or Solo user's year. If a change would mean a parent's OK is no longer needed, only an adult Strategist with a verified email can make it, and they must confirm it first.
• Friends are off for under-18s. For anyone under 18, or anyone who hasn't told us their year of birth yet, adding friends is switched off. Only a linked adult Strategist can switch Friends on for their Warrior, and they can switch them off again at any time. For a child under 15, a parent's OK is needed first. The Warrior is told when this changes. Duels are played against the computer only: there are no matches against friends or other people.
• What friends see. Friends are added only with a friend code that you choose to share; nobody can search for you. A friend sees your nickname and nothing else: not your email, your quests, your photos or your age. There is no chat. You can remove a friend at any time. Before an under-18 adds or accepts their first friend, the app shows a short reminder about staying safe online.
• Strategists can see a Warrior's quests and photos. Every Strategist linked to a Warrior can see their quests and quest photos, and the app tells Warriors this. They can also see the Warrior's coins, payouts and payout requests, quiet hours and requests to change a quest, and whether the Warrior's phone can get notifications and has been used in the last 14 days (see "Your phone, for notifications" in "What we collect"). A Warrior can see who's linked to them in Settings → Account → Who can see my quests, and tell us if one of them isn't their parent or carer. We look into it, and we don't tell the other linked Strategists.
• New Strategists need approval. When a Warrior already has a Strategist, a new Strategist can only link after the Warrior approves it and one of their existing Strategists aged 18 or over approves it too.
• Nothing to buy. Warriors can't buy anything in Chore Scape. Card packs are only ever earned.
• What we don't do. Chore Scape has no ads, no advertising ID, no analytics or tracking tools and no location tracking, and we don't use anyone's data for marketing or profiling.
• Automatic decisions. A few things happen automatically, without a person deciding each time:
  • the rules and default settings for your age come from your year of birth (see "Age rules" below);
  • the missed-quest penalty takes coins, but only if an adult Strategist has switched it on for that Warrior (at most one 10% fine a day, and the Warrior is told each time);
  • a Warrior can have one payout request open at a time, can't make a new one for 10 minutes after a "not now" or after cancelling one, and can make at most 5 in any 24 hours;
  • an adult who links with a child soon after a Strategist was removed or said No waits 7 days before they can give a parent's OK (see "The 7-day wait" below);
  • a phone that has already had a free trial doesn't get another one;
  • once we've switched on the parent's OK check, an account for a child under 15 with no Strategist is scheduled for deletion (see "Time limits" below);
  • once we switch this clean-up on, an account whose email address was never verified is deleted after 7 days (see "How long we keep it").
  If you think one of these got something wrong, email our privacy officer and a person will look at it.
• Accounts children set up themselves. A Warrior can create their own account with an email address, and linking to a Strategist happens afterwards. If you're a parent or carer and your child has done this, you can link to their account as their Strategist, or email us and we'll help, including deleting the account if you ask (see "Making a request").

Age rules

We go by year of birth. Because we only know the year, we assume the youngest age you could be: for example, someone who turns 15 this year is treated as 14 until 1 January.

• Strategists must be 15 or over. Neither the app nor our server will set up a Strategist account for someone younger. A Strategist who hasn't given their year of birth can't link with a Warrior, or approve a new Strategist, until they do. If we find that a Strategist linked to a Warrior is under 15, we may remove that link through support, after contacting the family. Both of them are told.
• Chore Scape on your own (Solo) is for people aged 15 or over. It's free while you're under 18: until 1 January of the year you turn 19.
• Some things need a Strategist aged 18 or over: giving a parent's OK (see "A parent's OK" below), approving a new Strategist for a Warrior, switching Friends on, switching on the missed-quest penalty, and setting a Warrior's quiet hours. Once plans go on sale, Warriors and anyone we know to be under 18 won't be able to buy one.
• Quiet hours. An adult Strategist can set the quiet hours of a Warrior under 18. For a Warrior under 13 they're locked to start with, so the Warrior can't change them. For a Warrior aged 13 to 17, they can be changed unless the Strategist locks them. An adult Warrior's quiet hours are their own. The Warrior can see who set them, and can ask for different ones. A lock stops counting if the Strategist who set it is no longer linked.

A parent's OK for children under 15

This section is part of Version 3 of our privacy policy (5 October 2026). It was first published in Version 2 (1 October 2026). Version 3 doesn't change what a parent's OK covers, so an OK given under Version 2 still counts.

Children under 15 need a parent's or guardian's OK before they can use photo proof or Friends. Quests, coins, XP and cards work either way. We're bringing this in two steps: see "Switching it on" below.

Who needs it

• We go by year of birth. Because we only know the year, we assume the youngest age you could be: someone who turns 15 this year is treated as under 15 until 1 January. If we don't know someone's year of birth, we treat them as under 15.
• We use the same age, 15, in every country. It's the strictest of the rules in the countries this policy covers, so it meets all of them.
• Strategists never need a parent's OK.

What waits for the OK

• Photo proof. Until a parent says OK, the child's quests don't ask for photos and can be completed without them, and nothing is uploaded. The Strategist's choice of photos is kept, so the quests ask for photos again once the OK is given.
• Friends. They stay off until a parent says OK and a Strategist switches them on.
• No Warrior can buy anything in Chore Scape, with or without the OK.

Who can give it, and how

A Strategist linked to the child gives the OK in their own Chore Scape app, by confirming "I'm [the child]'s parent or guardian — I agree". To give it, they must be 18 or over (by year of birth) and have a verified email address that isn't the child's own. An adult who has only just linked with the child may have to wait 7 days first (see "The 7-day wait" below). Before they agree, the app shows them what Chore Scape keeps about the child, and links to this policy.

Our method is in-app confirmation by a linked adult Strategist with a verified email. We can't check that someone really is a child's parent or guardian, so we rely on that confirmation. To help catch mistakes, the Strategist sees the child's year of birth, any other linked Strategists are told when an OK is given, and the child can tell us if a Strategist isn't their parent or carer.

What we record

Each time an OK is given, we record:

• which child it's for, and their year of birth at the time;
• which Strategist gave it, with their nickname at the time and a scrambled copy (a SHA-256 hash) of their email address, so the record still makes sense if their account changes (we can still check an address against it, so it doesn't hide the address from us);
• what it covers (photo proof and Friends);
• the version of this policy they were shown (for example, Version 3), the version of the screen they agreed on, and the consent age at the time;
• how it was given (in-app confirmation), that they confirmed they're the child's parent or guardian, and when;
• when it ended, why (withdrawn, unlinked, the Strategist's account deleted, or replaced by a new OK), and who ended it.

We keep these records for as long as the child's account exists, and delete them with it.

Saying no

• A Strategist can choose No, keep them off instead. Photo proof and Friends then stay off for that child, unless another linked parent or guardian has given their OK. This counts even before we switch the check on for everyone. Quests keep working, and the Strategist can change their mind later.
• A Strategist who isn't the child's parent or guardian can say so. We stop asking them, and the child is told to ask a parent or guardian to link.
• A child can remind their Strategists to decide, at most once a day and 3 times for each Strategist. Once a Strategist has answered, we stop asking them.

Withdrawing the OK

• Any linked Strategist can withdraw the OK at any time, in Settings → Account → Privacy & Friends. This works even before we switch the check on for everyone.
• Withdrawing ends every OK for that child, whoever gave it. Photo proof and Friends switch off, and the child's quest photos are deleted straight away (the stored files within about an hour). A link the app has already made to show a photo can keep working for up to an hour, and a phone that has already shown a photo may keep a copy in the app's cache for a while.
• After a withdrawal, Friends stay off even if an OK is given again, until a Strategist switches them back on.
• Any linked parent or guardian can give their OK again later.
• Unlinking also ends that Strategist's OK. Once we've switched the check on, if no other linked Strategist has given an OK, photo proof and Friends switch off for the child. Their photos are then kept for up to 30 days, so proof of recent chores isn't lost by accident, and deleted after that unless a parent gives their OK again. To have them deleted straight away, withdraw the OK before unlinking, or ask us.

The 7-day wait

This stops a child, or someone else, swapping a parent for another adult to get round the parent's No. It works even before we switch the check on for everyone.

• If a child under 15 removes one of their Strategists, or a Strategist says No to the parent's OK or withdraws it, an adult who links with the child in the 30 days after that must wait 7 days from when they link. Until then, they can't give the parent's OK, and they can't change the child's year of birth to one that no longer needs it. They aren't asked for the OK while they wait.
• Strategists who were already linked when it happened aren't affected. Nor is a parent the child removed and then added back.
• We can also start or extend a wait through support, for example when a parent the child removed gets in touch with us.
• A Strategist the child removes is told once, when it happens. They aren't told if someone else links later.
• For each wait, we record which child it's for, why it started, who was removed or said No (or, for an adult who linked during the 30 days, which adult is waiting), which Strategists were linked at the time, and when it starts and ends. We keep these records for as long as the child's account exists, and delete them with it. A record that ended more than 30 days earlier is removed when a new one starts for that child.

Photos

• A child's quest photos are seen by the child, by every Strategist linked to them, and by the providers that store them for us (see "Who we share it with"). The app tells children: "Your Strategist can see your quests and photos."
• We can access the photos too, but we only look when we need to (see "Who at Chore Scape can see your data").
• Quest photos, for everyone, are deleted 7 days after the quest is completed. Photos still waiting for a Strategist to check them are kept until a Strategist does. See "How long we keep it" for the other times photos are deleted.

Children already using Chore Scape

On the day we switch the check on, photo proof and Friends switch off for children under 15 whose parent hasn't given their OK yet. Their quests keep working, and quests that asked for photos can be completed without them. Photos they took before are kept for up to 30 days, then deleted unless a parent gives their OK. Their Strategists get a notification asking them to decide.

Switching it on

We're bringing this in two steps: first an app update, then we switch the check on for everyone. Until then, photo proof and Friends work as before for children under 15, except that a parent's "No" or a withdrawn OK counts straight away. Strategists can give their OK once they've updated the app; older versions don't have it. When we switch the check on, Strategists who haven't decided yet get a notification asking them to.

What we process before a parent's OK, and why

• United Kingdom: we rely on legitimate interests: providing the service a Strategist has set up for the child, and running it safely. We follow the Children's Code standards on default settings and data minimisation.
• Australia and New Zealand: we collect only what's reasonably necessary to provide the service (APP 3 and IPP 1), and this policy is our notice at collection (APP 5 and IPP 3).
• Canada and Singapore: we rely on consent, which for a child under 15 comes from a parent or guardian. Before a parent's OK, we process only what's needed to create the account, link it with a parent, run the quests a linked Strategist sets, and ask for the OK.
• Quebec: a child under 14 needs the consent of a person with parental authority. Our under-15 rule covers this.

Time limits

• Once we've switched the check on, an account for a child under 15 (with a known year of birth) that has had no linked Strategist for 30 days is scheduled for deletion, and the child is told in the app. It's deleted 30 days after that, unless a Strategist links first. Accounts with no year of birth aren't removed this way.
• A linked child whose parent hasn't given their OK, or has said no, keeps using quests with photo proof and Friends off. We don't delete their account for that.

If a change to this policy affects a child's OK, we'll ask the parent again in the app.

Why we use your data

Under UK law, we rely on the following lawful bases:

• Contract — most processing (account creation, quests and requests to change them, linking, payouts and payout requests, notifications, and giving you or your household the plan that's been bought) is necessary to provide the service you've asked us for. For a Warrior under 15, or an adult Warrior who can't agree to our terms themselves, we rely on legitimate interests instead: providing the service their Strategist has set up for them, in a way that's in their best interests.
• Consent — a parent's OK for photo proof and Friends for a child under 15 (see "A parent's OK" above); your own choice to add or accept friends if you're 15 or over; and optional features such as the fingerprint or face lock. You can withdraw consent at any time; that doesn't affect what we did before.
• Legitimate interests — to apply the rules and settings for your age (your year of birth); to handle photo proof for anyone 15 or over when a quest asks for it (only you and your linked Strategists see the photos, the app removes location data, and they're deleted 7 days after the quest is completed, or sooner: see "How long we keep it"); to keep accounts and children safe (such as the 7-day wait, and the record of when an email address was verified); to keep accounts and the service secure (sign-in records and technical logs); to look into reports; to stop free trials and code emails being misused (the install ID and the scrambled network key); to show a Strategist whether a Warrior's phone can get notifications; to build, fix and update the service, including with an AI coding assistant; and to keep backups, so we can put things right if something goes wrong.
• Legal obligation — to keep records the law requires, such as proof of a parent's OK and records of any data breach, and to answer requests about your data.

Your right to object: where we rely on legitimate interests, you can object at any time. Email our privacy officer and tell us what you object to. We'll stop, unless we have strong reasons to carry on that outweigh yours, or we need it for a legal claim.

In Australia and New Zealand, we collect only what's reasonably necessary to provide the service. In Canada (including Quebec) and Singapore, we rely on your consent, or for a child under 15 their parent's. If you withdraw consent to something the service needs, we may not be able to keep providing it, and we'll tell you what it means first. "What we process before a parent's OK" above explains how this applies to children.

Who at Chore Scape can see your data

Chore Scape is run by one person, Chris Smith, trading as Chore Scape. In the app, your quests and photos are shown only to you and the people you're linked to. Other users can't see them.

Because we run the service, we can technically access the personal data in our systems, including quest photos. Your data is encrypted while it travels and on our hosting provider's disks, but it isn't end-to-end encrypted. That protects it from outsiders, not from us or our hosting provider. Anyone who got hold of our administrator login or our servers' secret keys could access it too, so we keep those to ourselves and never build them into the app.

We only look at or change your personal data when we need to:

• to answer something you've asked us, such as a support question or a request to see, correct or delete your data;
• to look into a safety report or misuse;
• to fix a fault or check that an update works, using as little personal data as we can;
• to keep the service secure;
• or when the law requires it.

We never browse accounts or photos for any other reason, and only Chris looks at an individual person's details.

We use an AI coding assistant, Anthropic's Claude, to help us build and run the service. When we ask it to, it can query and change our database, so it can help us fix faults and release updates. That means it could see any data held there. Our rule is that it works only with totals, test results and account IDs (random codes, not names or email addresses), and we don't use it to read your details, quests or photos. What it works with is sent to Anthropic, in the USA. We use Claude on Anthropic's consumer plan, so Anthropic handles that information under its own privacy policy, not as our processor. We've switched off the setting that lets Anthropic use it to train its models.

We keep copies of our database (not quest photos), so we can put things right if something goes wrong:

• Before an update. Before we update our systems, we take a copy of our database. Since 1 October 2026, each copy is encrypted with a key only we hold before it's stored with Proton, which can't read it. Older copies, taken before then, weren't encrypted this way. We've deleted them.
• Every night. Since 3 October 2026, an automatic job copies our whole database every night, including sign-in accounts (with passwords only as secure hashes) and sign-in records. It runs on a temporary computer provided by GitHub, which may be in the USA and is wiped when the job ends. The copy is encrypted there, with a key only we hold, before it's stored with Backblaze in the EU, which can't read it. These copies don't include quest photos.
• Our hosting provider's backups. Supabase also keeps daily backups of our database for 7 days.

So something that's deleted can take a while to disappear from these copies: see "Backups" in "How long we keep it".

Staff at the providers we use (see "Who we share it with") can access data only as needed to provide their service, under contracts that limit them to that.

Who we share it with

We use a small number of specialist providers ("processors") to run Chore Scape. Their terms with us allow them to use your data only to provide their service to us. A few others decide for themselves how they use what they receive, under their own terms and privacy policies: the app stores and Apple's TestFlight (see below), Apple's push notification service, Google Fonts and Cloudflare's bot check (see "This website"), GitHub for our nightly backup job (see below), and Anthropic for our AI coding assistant (see "Who at Chore Scape can see your data").

• Supabase — hosts our database, file storage (including quest photos), and user authentication. Our project's data is hosted in Supabase's EU region, in Frankfurt, Germany, and our contract is with Supabase Pte. Ltd. Supabase also keeps daily backups of our database (not photos) for 7 days, and the sign-in records and technical logs described in "What we collect".
• Resend — sends emails on our behalf: sign-in verification codes and password resets, and reports about other users to our own support inbox.
• Google Firebase — delivers push notifications (e.g. "your quest was approved") to the app. This uses a device-level token, not your name or email, but the text of a notification passes through Firebase on its way to your device. That text can include a quest title, the nickname of someone you're linked to, or an amount of money (for example "Sam asked for a payout" and "£5.00. Tap to pay it or say not now"). A notification also carries a few codes that tell the app which screen to open, such as a random account ID. A reason someone gives for sending a quest back, saying "not now" to a payout, or saying no to a change to a quest, is never sent to your phone as part of a notification, so it doesn't show on the lock screen: it's shown only inside the app. On iPhone, Firebase hands notifications to Apple's push notification service, which delivers them to your phone.
• Zoho — hosts our email (support@chorescape.co.uk and privacy@chorescape.co.uk). It holds the emails you send us and our replies, including requests about your data, and the reports about other users that reach our support inbox. Our mailboxes are in Zoho's UK data centre.
• Proton — stores the copies of our database that we take before an update (see "Who at Chore Scape can see your data"). Since 1 October 2026, each copy is encrypted on our own computer, with a key only we hold, before it's uploaded. Proton's storage is end-to-end encrypted as well, so Proton can't read the copies. Proton is a Swiss company.
• Backblaze — stores our nightly backups, in its EU Central region (Amsterdam, the Netherlands). Each copy is encrypted with a key only we hold before it reaches Backblaze, so Backblaze can't read it. Backblaze is a US company.
• Cloudflare — hosts this website. It also uses some of what it learns from its bot check for its own purposes (see "This website" below).

GitHub runs our nightly backup job (see "Who at Chore Scape can see your data"). While the job runs, a readable copy of our database exists on a temporary computer that GitHub provides. The job encrypts it there before anything is uploaded, then deletes it, and GitHub wipes the computer when the job ends. The computer may be in the USA. GitHub is a US company, part of Microsoft. We use GitHub's free plan, so GitHub handles this data under its own privacy statement, not as our processor.

App stores

Plans can't be bought in the app at the moment. When they go on sale, you'll buy them in the app from your phone's app store. On Android phones, that's Google Play. On iPhone, it's Apple's App Store. The store takes the payment as an independent controller, under its own terms and privacy policy, not as our processor. It tells us what we need to give access and to keep your purchase history: which plan was bought, its status, when it renews or ends, and the store's reference for the purchase. We give the store a random reference for your account, so a purchase can be matched to it. We never see or store your card details, and we don't take payments on this website or anywhere else.

Testing new versions

We try out new versions of Chore Scape with a small group of testers before everyone gets them. A test version uses the same accounts and servers as everyone else, so the rest of this policy applies to it too.

• iPhone: testers get test versions through Apple's TestFlight. Apple runs TestFlight as an independent controller, under its own terms and privacy policy, not as our processor. There's no public link to join. We add each tester ourselves in App Store Connect, Apple's site for developers, so we give Apple your name and email address, and we see the name and email address you were invited with. Apple also shows us whether you've installed each test version, how many times you've opened it and how many times it has crashed, and what kind of device you use it on. Apple may also pass on crash reports, and any feedback (with screenshots, if you add them) that you choose to send through TestFlight. These include your device model and its software version.
• Android: testers get test versions through Google Play's testing programme, which Google runs under its own terms and privacy policy. Testers join through a Google Group. Some join through a tester-recruitment service's Google Group, under that service's own terms. In a group, we can see at most your email address, your name if your Google Account shows one, and the date you joined. If we invite you by email, we give Google that address.

Plans and households

One plan covers a household: the adult who buys it, up to 6 Warriors linked to them, and the other adult Strategists linked to those Warriors (such as a second parent or a carer), up to 4 adults in all, including the buyer. To work out who a plan covers, we use the links between accounts that we already hold. We don't collect anything extra for this.

We do not sell your data, and we do not share it with anyone else for marketing purposes.

Where your data goes

Our database and file storage are in Germany (Supabase's Frankfurt region, in the EU). Supabase Pte. Ltd., the company we contract with, is based in Singapore, and Supabase's staff may access data from outside the EU when they need to, for example to give support. Our nightly encrypted backups are stored in the Netherlands, by Backblaze, a US company. They're made on a temporary computer run by GitHub, also a US company, which may be in the USA. Our email is held in the UK, by Zoho. Proton, which stores our encrypted database copies, is a Swiss company. Resend, Google Firebase and Anthropic (for our AI coding assistant) are in the USA, and so is Apple's push notification service for iPhones. Cloudflare, which hosts this website, runs a worldwide network.

Before we send personal data to another country, we make sure it stays protected to the standard the law where you live expects:

• United Kingdom: the EU (including Germany and the Netherlands) and Switzerland are covered by the UK's adequacy regulations. For the USA (including the GitHub computer that makes our nightly backups), Singapore and other countries, we rely on the safeguards each provider commits to in its own terms: the UK Extension to the EU-U.S. Data Privacy Framework, or standard contractual clauses with the UK Addendum. Email our privacy officer if you'd like a copy of these safeguards, or to know which one a provider uses.
• Australia (APP 8), Canada (PIPEDA), New Zealand (IPP 12) and Singapore (the PDPA's transfer rules): we use providers whose contracts require them to protect personal data to a comparable standard, and we stay responsible for how they handle it.
• Quebec: before personal information leaves Quebec, we assess whether it will be adequately protected, taking into account how sensitive it is, why it's used, the safeguards in place and the law where it's going, and we keep that assessment in writing. Ask our privacy officer if you'd like a summary.

Data held in another country may be available to that country's courts, law enforcement and national security authorities under its laws.

This website

This website, chorescape.co.uk, handles a little personal data too:

• My Account. When you sign in, reset your password or ask to delete your account on My Account, what you type (your email address, password or reset code) goes straight to Supabase, the same as in the app. While you're signed in, your session is kept in your browser's session storage, which is cleared when you sign out or close the tab.
• Fonts. Every page loads the Inter font from Google Fonts, so Google receives your device's IP address when you visit.
• Hosting. The website is hosted by Cloudflare, which handles every visit, including your IP address, and adds a small script that checks for automated traffic (bots). Cloudflare runs that check for us, but also uses some of what it learns from it to improve its own bot detection, under its own privacy policy.

How long we keep it

• Account and quest data: kept for as long as your account exists. This includes requests to change a quest (deleted sooner if the quest is deleted), payouts and payout requests, your quiet hours and other settings, and the record of when your email address was verified and last changed.
• Quest photos: deleted 7 days after the quest is completed. Photos sent in for a quest that's still waiting for a Strategist to check it are kept until a Strategist approves it or sends it back, or the quest or account is deleted. Photos are deleted sooner:
  • when the proof is denied: they're kept for a moment so the Strategist can undo, then deleted by the app, or by our nightly clean-up once they're an hour old;
  • when the quest or the account is deleted;
  • straight away if a parent withdraws their OK (the stored files within about an hour).
  If a parent says no, or, once we've switched the check on, a child's OK ends another way (such as by unlinking), the child's photos are kept for up to 30 days. Then they're deleted, unless a parent gives their OK. A link the app makes to show a photo stops working within an hour. A phone that has shown a photo can keep a copy in the app's cache for a while after we've deleted it. That includes the phone of a Strategist who has since unlinked.
• Records of a parent's OK, a child's reminders, a Strategist's answers, the 7-day wait, and year-of-birth changes: kept for as long as the account they're about exists, and deleted with it.
• Year of birth, friends, Duel records and the missed-quest penalty setting: kept for as long as your account exists.
• Notifications: deleted after 30 days. An item that still needs someone, such as a request nobody has answered yet, is kept until it's dealt with, for up to 180 days. Our record of each notification we send to your phones (its title, text, and which phones it reached) is deleted 30 days after it was made.
• Your phone's details for Chore Scape notifications (see "What we collect"): deleted when you sign out on that phone, when Firebase tells us the token no longer works, or once neither the app nor a notification has reached that phone for 120 days.
• Codes we email you to check your email address: removed by our daily clean-up once they're more than a day past their expiry. Password reset codes (with the address each was sent to) and the scrambled network keys: removed once they're more than a day old, the next time anyone asks for a code, so they can stay longer if nobody does. Your codes also go when your account is deleted.
• Sign-in records: kept while your account exists. A session is deleted when you sign out of it. All of them are deleted with your account.
• Technical logs: deleted by Supabase after 7 days.
• Reports: kept, so we have a record of what was reported. If an account involved is deleted, the report is kept without the link to that account. A copy of each report is also emailed to our support inbox (see the next line).
• Emails you send us, our replies, and the copies of reports in our support inbox: kept in our mailbox, so we have a record of what was asked and what we did. They aren't deleted automatically when an account is deleted. Ask us if you'd like yours deleted.
• Purchase history: kept for as long as your account exists. The app store keeps its own record of a purchase, under its own privacy policy.
• The install ID record (for Strategist and Solo phones only; see "What we collect"): kept after your account is deleted, but no longer connected to your account, so the same phone can't start another free trial. Until the account's email address is verified, the install ID is kept with the account instead, and goes if the account is deleted.
• Accounts for children under 15 with no Strategist: scheduled for deletion once they've had no linked Strategist for 30 days, then deleted 30 days later unless a Strategist links first. This starts once we've switched on the parent's OK check.
• Accounts whose email address was never verified: once we switch this clean-up on, an account is deleted if its email address has never been verified, nobody has signed up, signed in or changed its email address for 7 days, and it has nothing in it: no links to anyone (or requests to link), quests, stored files, friends, Duels, reports or plan.
• Backups: Supabase keeps daily backups of our database for 7 days. Our own nightly copies are kept for 14 days, one copy a week for 8 weeks, and one copy a month for 90 days. One monthly copy, made on 3 October 2026, is kept until 3 October 2027. So something deleted from the database stays in our backups until they expire: usually up to about 90 days, or until 3 October 2027 if it was in that copy. The encrypted copies we take before an update (see "Who at Chore Scape can see your data") are kept only while we might need them to undo that update, then deleted.

Chore Scape has Delete My Account in Settings. When you ask, we mark your account for deletion straight away and show you the date it will happen. You can cancel any time before then. 30 days after you ask, we permanently delete your account, everything tied to it, and any files you've uploaded (such as proof photos). The exceptions are the install ID record, reports and emails, described above, and the things listed below. Copies in backups go when those backups are deleted (see "Backups" above). A few things stay in other people's accounts:

• If you're a Warrior, a linked Strategist keeps the card packs they got when you levelled up. Each pack keeps your account ID (a random code, not your name or email), so the same level can't give them a second pack.
• If you're a Strategist, things you did in a Warrior's account, such as answering a payout request, stay in that account, without the link to yours. A parent's OK you gave stays in the child's records, with the nickname you had then and the scrambled copy of your email address (see "What we record" in "A parent's OK"). A record of a 7-day wait keeps your account ID if you were linked to that Warrior when it started. These go when the Warrior's account is deleted.

You can also ask us to delete your account by email. A parent or guardian can ask us to delete their child's account (see "Making a request"). Deleting your account doesn't cancel a subscription bought through an app store: cancel it in the store.

How we protect it

• All traffic between the app and our servers is encrypted in transit.
• Data at rest is encrypted by our hosting provider. This protects it from outsiders, such as someone who steals a disk. It isn't end-to-end encryption, so it doesn't stop us or our hosting provider accessing it (see "Who at Chore Scape can see your data").
• In the app, access to your data is controlled by security rules in our database (row-level security), so you see only your own data and the data of the accounts you're linked to. Payout requests and our safety records (the 7-day wait, email history and sign-up phone records) can't be read or changed by the app directly at all, only through server functions that check who's asking.
• Since 1 October 2026, the copies of our database that we take before an update are encrypted with a key only we hold. Since 3 October 2026, so are our nightly copies, and each one is stored locked, so it can't be changed or deleted early by mistake.
• Quest photos are stored privately. The app shows them through links that stop working within an hour.
• Codes we email you are stored only as scrambled copies (hashes), and we limit how many can be asked for and how many wrong tries are allowed.
• We don't embed administrative credentials in the app itself.
• We send third-party processors only what each one genuinely needs to do its job.

If there's a data breach, we'll act quickly to contain it, and we'll tell the regulator and the people affected wherever the law requires it. "Laws and regulators in each country" below explains when.

Laws and regulators in each country

We follow the privacy law of each country this policy covers. Here's what each one gives you, how quickly we reply, and when we report a breach.

United Kingdom

• Laws: the UK GDPR and the Data Protection Act 2018, and the Information Commissioner's Age Appropriate Design Code (the Children's Code).
• Regulator: the Information Commissioner's Office (ICO), ico.org.uk.
• Your rights: access, correction, erasure, restriction, portability, objection, withdrawing consent, and not being subject to decisions based only on automated processing that have legal or similarly significant effects.
• We reply: within one month. For complex requests, the law lets us take up to two more months; we'll tell you if we need to.
• Breaches: if a breach is likely to put people at risk, we tell the ICO within 72 hours of finding out. If the risk to you is high, we tell you without undue delay.

Australia

• Laws: the Privacy Act 1988 and the Australian Privacy Principles (APPs). We'll also follow the Children's Online Privacy Code once it's registered.
• Regulator: the Office of the Australian Information Commissioner (OAIC), oaic.gov.au.
• Your rights: access to your personal information (APP 12), correction (APP 13), and complaint.
• We reply: within 30 days.
• Breaches: under the Notifiable Data Breaches scheme, if a breach is likely to cause serious harm, we tell the OAIC and the people affected as soon as practicable.
• Complaints: please complain to us first. If you're not happy with our answer, or we haven't replied within 30 days, you can complain to the OAIC.

Canada

• Law: the Personal Information Protection and Electronic Documents Act (PIPEDA).
• Regulator: the Office of the Privacy Commissioner of Canada (OPC), priv.gc.ca.
• Your rights: access, correction, withdrawing consent (with reasonable notice, subject to legal or contractual limits), and complaint.
• We reply: within 30 days. The law lets us extend this by up to 30 more days; we'll tell you if we need to.
• Breaches: if a breach creates a real risk of significant harm, we report it to the OPC and tell you as soon as feasible. We keep a record of every breach for at least 24 months.

Quebec

• Law: the Act respecting the protection of personal information in the private sector, as amended by Law 25.
• Regulator: the Commission d'accès à l'information du Québec (CAI), cai.gouv.qc.ca.
• Person in charge of the protection of personal information: our privacy officer (see "Who we are").
• Your rights: access, correction, withdrawing consent, asking us to stop sharing your information or to de-index it, a copy of information you gave us in a structured, commonly used format, and being told when a decision about you was made only by automated processing, with the chance to have it reviewed by a person.
• Children: for a child under 14, consent comes from a person with parental authority. We ask for a parent's OK up to 15.
• We reply: within 30 days.
• Confidentiality incidents: if there's a risk of serious injury, we tell the CAI and the people affected promptly. We keep a register of every incident.

New Zealand

• Law: the Privacy Act 2020 and its Information Privacy Principles (IPPs).
• Regulator: the Office of the Privacy Commissioner, privacy.org.nz.
• Your rights: access to your personal information (IPP 6), correction (IPP 7), and complaint.
• We reply: as soon as we reasonably can, and within 20 working days.
• Breaches: if a privacy breach has caused, or is likely to cause, serious harm, we tell the Privacy Commissioner and the people affected as soon as practicable.

Singapore

• Law: the Personal Data Protection Act 2012 (PDPA).
• Regulator: the Personal Data Protection Commission (PDPC), pdpc.gov.sg.
• Data Protection Officer: our privacy officer (see "Who we are").
• Your rights: access, correction, withdrawing consent (we'll tell you what that means for your account first), and complaint.
• We reply: as soon as we reasonably can, and within 30 days. If we can't, we'll tell you within 30 days when we will.
• Breaches: if a breach is likely to cause significant harm, or affects 500 or more people, we tell the PDPC within 3 calendar days of assessing it. If it's likely to cause you significant harm, we tell you too.

Your rights

Depending on where you live (see "Laws and regulators in each country"), you have the right to:

• ask what personal data we hold about you, and get a copy of it (access);
• ask us to correct data that's wrong (correction);
• ask us to delete your data (erasure), unless the law requires us to keep it — use "Delete My Account" in the app's Settings or on My Account, or email us;
• get a copy of data you've given us, in a format you can reuse (portability);
• object to anything we do because of our legitimate interests (see "Your right to object" in "Why we use your data"). We'll stop, unless we have strong reasons to carry on that outweigh yours, and we'll tell you what they are;
• ask us to restrict how we use your data, for example while we check something you've told us is wrong;
• withdraw consent at any time, including a parent's OK for their child;
• be told about decisions made automatically, and ask a person to look at them again;
• complain to us, and to the regulator where you live.

Children have these rights too, and a parent or guardian can use them on behalf of their child.

Making a request or a complaint

How to ask

Email our privacy officer at privacy@chorescape.co.uk or support@chorescape.co.uk. Please email from the address your account uses, so we can check it's you, and tell us what you'd like. Making a request is free.

We reply within the time the law where you live allows: one month in the UK; 30 days in Australia, Canada, Quebec and Singapore; and 20 working days in New Zealand. If we need longer and the law allows it, we'll tell you why.

Requests from parents and guardians

To protect children, we act on a request about a child's account only when it comes from the verified email address of an adult Strategist who is linked to that child in Chore Scape at the time. We check this against our records before we do anything. We also think about what's best for the child. If the child is old enough to understand their rights (often from about 12), we may ask them first, or reply to them instead.

• Deleting a child's account: we schedule it for deletion. It's deleted 30 days later, and can be cancelled in that time. We tell the child, and the child's other linked Strategists.
• A copy of a child's data: we send it to that verified email address, within the time limit above. We leave out anything that could put the child or someone else at risk, such as a report the child made, or a message telling us a Strategist isn't their parent or carer.
• Anything else, or a request from a parent or guardian who isn't linked in the app, goes to our privacy officer, who may ask for more information to confirm who you are and your relationship to the child.

Children can also ask for themselves. Someone they trust can help.

If you support an adult Warrior, you can make a request for them only if they agree, or if you have legal authority to act for them, such as a lasting power of attorney or a court order. Adult Warriors can always ask for themselves.

Complaints

If you're unhappy with how we've handled your data, please tell our privacy officer first. We'll acknowledge your complaint within 30 days and do our best to put things right. You can also complain to the regulator where you live:

• United Kingdom: the Information Commissioner's Office, ico.org.uk
• Australia: the Office of the Australian Information Commissioner, oaic.gov.au
• Canada: the Office of the Privacy Commissioner of Canada, priv.gc.ca
• Quebec: the Commission d'accès à l'information du Québec, cai.gouv.qc.ca
• New Zealand: the Office of the Privacy Commissioner, privacy.org.nz
• Singapore: the Personal Data Protection Commission, pdpc.gov.sg

Changes to this policy

When we make a significant change to how we handle your data, we publish a new version of this policy with a new version number, keep each version at its own address (this one is privacy-v3.html), and tell you in the app. If a change affects a parent's OK for their child, we'll ask the parent again. If we only correct details, without changing how we handle your data, we keep the version number, say below what we corrected, and keep the earlier wording unchanged at its own address.

Corrections, 7 October 2026. We corrected four details in Version 3: how testers join our tests on iPhone and Android, and what we see about them; that GitHub, which runs our nightly backup job, isn't our processor; and that Cloudflare also uses some of what it learns from its bot check to improve its own bot detection. These corrections make the policy match what was already happening. We haven't started collecting anything new or using your data in a new way. The wording first published on 5 October 2026 is kept unchanged at privacy-v3-2026-10-05.html.