Privacy Policy

StarSprout is a privacy-first family app that turns everyday chores into quests for children aged 6–12, with a calm dashboard for parents.

We believe privacy is not a feature. It is the foundation.

This notice explains what we store, why, for how long, and the rights you can exercise — all of which are built into the product itself.

About adults (parents and caregivers): email address, display name, and your consent history. Sign-in is handled by our infrastructure provider; we never see your password.

About children: a nickname chosen by the family, an age band derived from birth month and year (never a birth day), an avatar choice, and a PIN stored only as a secure hash. Children have no email, no phone number, no surname, and no location in StarSprout — the fields do not exist.

About family life in the app: quests, completions, points, streaks, badges, rewards, redemptions, goals, notifications, and optional proof photos.

Early-access waitlist: your email address and the consent wording you agreed to. Nothing else.

We never sell personal data. We never show advertising. We never place third-party trackers or analytics on any surface a child can reach. We never collect geolocation — anywhere, from anyone.

Family data is never used to train AI models — ours or anyone else's. Text generation uses only enumerated, non-identifying inputs (an age band, an avatar theme, a chore category), and generated text is safety-checked before a child can see it.

All family data is stored in the United Kingdom (London region). This includes Canadian families: if you are in Canada, your family's data is stored in the UK.

Under UK GDPR: we rely on contractfor running your family's account, consent for optional features (micro-lessons, the weekly email, any future friend connections — each recorded in an append-only consent history you can inspect), and legitimate interests for security logging such as PIN-attempt throttling.

Under PIPEDA, we collect with knowledge and consent, limit collection to what the product needs, and honour access and deletion requests through the in-app tools below.

Proof photos are deleted automatically 30 days after a quest finishes. Deleting your family ends access immediately and starts a 30-day recovery window; after it, every row and every photo is permanently erased by an automated job. The waitlist keeps your email until you unsubscribe (one click, in every email).

Export everything (Settings → Export: one structured file, every table, with documented exclusions), delete everything (Settings → Delete family), withdraw any consent (recorded as a new entry in your consent history — history is never rewritten), and complain to the ICO (UK) or the OPC (Canada). Children have their own plain-language explanation at Privacy for Kids.

A small set of infrastructure providers, each receiving only what their job requires — the full list, and exactly what each receives, is published on our Sub-processors page.

Questions or requests: hello@starsprout.io. We answer data-rights requests within 30 days.