Privacy Policy

This Privacy Policy describes how Zorath LLC ("Company", "we", "us", or "our") operates ChoreSpark and collects, uses, and protects your information when you use our service.

Data Controller: Zorath LLC acts as the data controller for personal information collected through ChoreSpark.

International Compliance: This policy complies with the EU General Data Protection Regulation (GDPR), UK GDPR, California Consumer Privacy Act (CCPA), Children's Online Privacy Protection Act (COPPA), Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), and Australian Privacy Act 1988.

1. Information We Collect and Legal Basis

ChoreSpark collects information to provide and improve our family task management service. Below is a comprehensive list of data collected and the legal basis for processing under international privacy laws:

Personal Information (Legal Basis: Contract Performance)

• Parent email addresses and names (required for account creation and communication)
• Children's names, as typed by the parent when a child profile is created. We do not ask for a date of birth and a child profile has no age field
• Payment information (processed by Stripe, not stored by us)
• Account preferences and settings

Usage Data (Legal Basis: Legitimate Interest)

• Quest completion and progress data (service functionality)
• Photos submitted as quest proof, held in a private storage bucket that has no public web address. Reward images and saved drawings are held the same way, each in a private bucket of its own. Section 5 sets out who can open each one
• Login times and session duration (security and service improvement)
• Device and browser information (compatibility and security)
• IP addresses (security, fraud prevention, and geo-location)
• Error logs and diagnostic data (service improvement)

Optional Information (Legal Basis: Consent)

• Marketing preferences and newsletter subscriptions
• Feedback and survey responses
• Optional profile customizations

Information We Do NOT Collect

• Social security numbers or government ID numbers
• Biometric data or facial recognition
• Location tracking (except general geo-location from IP)
• Third-party account passwords
• Financial account details (handled exclusively by payment processors)

2. How We Use Information and Data Principles

Data Processing Principles

Our data processing follows internationally recognized principles:

• Lawfulness: All processing has a clear legal basis
• Purpose Limitation: Data used only for specified, legitimate purposes
• Data Minimization: We collect only necessary information
• Accuracy: We maintain accurate and up-to-date records
• Storage Limitation: Data retained only as long as necessary
• Security: Appropriate technical and organizational measures
• Accountability: We demonstrate compliance with privacy principles

Specific Uses of Your Information

We use collected information for these specific purposes:

Essential Service Functions (Legal Basis: Contract)

• Provide access to ChoreSpark features and functionality
• Track family progress and achievements
• Process and manage quest submissions and approvals
• Manage user accounts and authentication
• Process payments and manage subscriptions
• Provide customer support and technical assistance

Communication (Legal Basis: Contract + Legitimate Interest)

• Send essential account and service notifications
• Payment receipts, which Stripe sends directly to the address on your account
• Deliver security alerts and system updates
• Respond to support requests and inquiries

Service Improvement (Legal Basis: Legitimate Interest)

• Analyze usage patterns to improve platform features
• Identify and fix bugs and technical issues
• Develop new features and quest packs
• Conduct aggregate analytics (no individual identification)

Security and Legal Compliance (Legal Basis: Legal Obligation + Legitimate Interest)

• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations and regulatory requirements
• Protect the rights, property, and safety of users
• Enforce our Terms of Service and policies

Optional Features (Legal Basis: Consent)

• Send marketing communications and newsletters (opt-in required)
• Personalize user experience based on preferences
• Conduct optional surveys and research studies

Purpose Changes: If we wish to use your information for purposes other than those listed above, we will seek your consent or ensure we have a legitimate legal basis, and update this policy accordingly.

3. Children's Privacy (COPPA Compliance)

ChoreSpark is designed for family use with parental supervision:

• Parents must create and manage all children's accounts
• We do not knowingly collect personal information directly from children under 13
• Parents control all data shared about their children
• Parents can request deletion of their child's data at any time

4. Data Storage and Security

These are the protections ChoreSpark actually has in place:

• Hashed credentials: Parent passwords and child PINs are stored as bcrypt hashes. We never store or display them in readable form, and a password cannot be recovered from what we hold
• HTTPS in transit: The site is served over HTTPS and sends a Strict Transport Security header, so browsers refuse to fall back to an unencrypted connection
• Household scoped access: Every request that reads or changes family data is checked against the signed in account, and records are matched to the parent who owns them before they are returned or modified. One household cannot reach another household's data
• Parent approval gating: Approving or rejecting a submitted quest is a parent only action. A child account cannot approve its own work or award itself points
• Upload checks: Images are checked for size, and the file type is read from the leading bytes of the file itself rather than taken from what the browser claims, so a script or a page renamed to look like a picture is refused. API requests, uploads included, are rate limited per signed in account or network address
• Private storage for every image: Quest proof photos, reward images and saved drawings each go to a private storage bucket. None of them has a public web address. Opening one takes a signed in ChoreSpark account that the household check lets through, and the link handed out afterwards stops working 60 seconds later
• Names never taken from uploads: The stored name of an image is built from identifiers our server already holds plus a random value. The file name from the device is not used for it, for any of the three kinds

What we do not claim. We want this section to describe real practice rather than ambition, so it is worth being direct about what ChoreSpark does not have. We do not run penetration tests. We do not commission external security audits. We hold no SOC 2, ISO 27001 or comparable certification. We do not run an intrusion detection system or a monitored 24/7 alerting service.

Storage. Our database is hosted by Supabase and the application is hosted by Vercel. Any protection those platforms apply to data at rest is theirs rather than ours, and it is described in their own documentation. All three kinds of image live in private Supabase Storage buckets, one for quest proof photos, one for reward images and one for saved drawings. No image is sent to an outside image host. Who is allowed to open one is not the same in all three cases, so section 5 takes them in turn.

5. Information Sharing

We do not sell or rent personal information. Data leaves ChoreSpark only in these circumstances:

• With your explicit consent
• To comply with legal requirements
• To the service providers we run the product on, listed by name in section 11
• To protect the safety and rights of users

Community Access

Where a household joins through Community Access, an approved organization sponsors the access but does not administer the account. That organization can see only what it needs to run its own programme: the status of an invitation it sent, the status of a code it issued, that the household activated, the date it activated, the date its sponsored access runs to, whether the one extension is available or has been used, and a coarse label for whether the household has started using ChoreSpark. It cannot see children's names beyond what a parent tells it directly, quest names or details, proof photos, saved drawings, reward history, Sparks or XP, PINs, private household settings, notifications, or anything about a payment method. Households belonging to another organization are never visible to it.

Where a third party funds Community Access, that sponsor receives aggregate reporting only: households funded, households activated, sponsored household-months delivered, the retail value of the access delivered, and the beneficiary organizations. Figures covering fewer than five households are withheld rather than reported, so a small group cannot be identified from a total. No family level record, child name, parent email address or household activity ever reaches a sponsor.

Where images go

ChoreSpark handles three kinds of image: a photo a child submits as quest proof, a picture a parent attaches to a reward or a quest pack, and a drawing a child saves at the end of a doodle session. All three are sent from our server to private Supabase Storage buckets, one bucket for each kind. None of them is published, and none of them has a web address that opens the picture on its own.

What we keep against a quest, a reward or a doodle session is a storage key. A key is not a link, and it grants nothing to anyone who sees it. The only way to turn one back into a picture is a ChoreSpark endpoint that checks the signed in account first. If that check passes, we ask Supabase Storage for a temporary signed link and send the browser to it. That link stops working 60 seconds after it is created, so a copied address is worthless almost immediately.

Who can open which image

The three kinds do not share one rule, so here they are separately.

• A quest proof photo: the child the quest is assigned to, and that child's parent
• A reward image: the parent whose household it was uploaded into, and that parent's children. Children are included on purpose, because the reward shop is theirs and a prize they cannot see is not much of a prize
• A saved drawing: the child who drew it, and that child's parent

Nobody else can open any of them. Not another family, not another parent, not a sibling in the case of a drawing, and not ChoreSpark staff or an administrator. That is not a statement about how we choose to behave. It is what the product does: there is no administrator route to any of these images and no exception written into the checks that would let one through. A request from an account that does not pass the check is answered as if the image does not exist, rather than as a refusal, so the answer cannot be used to work out what a household has.

What is stored, and what is not

• The stored name is assembled by us from identifiers we already hold, such as the household, the child, and the quest or doodle session, plus a random value. The file name from your device is never used in it. Neither is the child's name or the parent's email address
• The file has to be a real image. We read the leading bytes of the file to work out what it actually is, rather than trusting the label the browser attaches, and we refuse anything that is not a PNG, JPEG, WebP or GIF, anything larger than 5MB, and anything whose label disagrees with its content. A saved drawing is held to a tighter limit of 2MB
• If storage is unavailable, the upload is refused and the person is asked to try again. There is no fallback that sends the picture to a public host instead

When an image is deleted

• Rejecting a quest deletes the proof photo from storage, not merely the link to it. The child is being asked to redo the chore and take a new picture, so the rejected one has no further purpose
• Replacing an image deletes the one it replaces. A fresh proof photo on the same quest, a new picture on a reward, a redrawn doodle: in each case the file it supersedes is removed
• Deleting your account deletes proof photos, reward images and saved drawings. They go first, before the records that name them, because once those records are gone the files could no longer be found
• There is no scheduled expiry. An approved quest keeps its photo, and a saved drawing stays saved, for as long as the account exists. Please do not read a retention period into this policy that the product does not enforce

Photo proof is optional. A quest created without it is handed in and approved with no image at all, and a reward with no picture uploads nothing.

6. Your Privacy Rights Worldwide

Your privacy rights vary by jurisdiction. We honor the highest applicable standard for all users:

Universal Rights (Available to All Users)

• Access: Request copies of your personal data
• Rectification: Correct inaccurate or incomplete information
• Deletion: Request deletion of your account and associated data
• Portability: Quest history can be exported as a CSV file from the history screen in the dashboard. Nothing else in the account has an export button, so a full copy is handled by request
• Communication Control: Opt out of non-essential communications

EU/UK GDPR Rights

• Right to Object: Object to processing based on legitimate interests
• Right to Restrict: Limit processing in certain circumstances
• Right to Withdraw Consent: Withdraw consent for optional features
• Right to Complain: File complaints with your local Data Protection Authority
• Right to Information: Receive clear information about processing
• Automated Decision Making: Opt out of automated profiling (we don't use automated decision-making)

California CCPA/CPRA Rights

• Right to Know: Categories and specific pieces of personal information collected
• Right to Delete: Request deletion (subject to legal exceptions)
• Right to Opt-Out: Opt out of sale of personal information (we don't sell data)
• Right to Non-Discrimination: Equal service regardless of privacy choices
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit: Limit use of sensitive personal information

Canadian PIPEDA Rights

• Right to Access: Access personal information we hold
• Right to Correction: Request correction of errors
• Right to Withdraw Consent: Withdraw consent (may affect service availability)
• Right to Complain: File complaints with Privacy Commissioner of Canada

Australian Privacy Act Rights

• Right to Access: Request access to personal information
• Right to Correction: Request correction of inaccurate information
• Right to Complain: Lodge complaints with Office of Australian Information Commissioner
• Right to Anonymity: Deal with us anonymously where practicable

How to Exercise Your Rights

There is one route, and it is the contact page. ChoreSpark has no in app help desk, no ticket portal and no knowledge base. A message sent from the contact page is delivered by email to our support address, and a confirmation goes to the address you entered.

• Choose General Inquiry as the reason, then write "Privacy request" at the top of the message. The form has no privacy category of its own
• Say which right you want to exercise, in your own words
• Send it from the email address on the account, or include enough detail for us to match your message to an account. We cannot act on a request we cannot tie to a household

Two things you can do yourself, without writing to us at all. Account settings let you change your name, your email address, your password and your notification preferences. Settings also holds the account deletion page, which runs immediately and is covered in section 8.

Response Time: We will respond to privacy requests within 30 days (or as required by applicable law). Complex requests may require up to 90 days with notification.

7. Cookies and Tracking

ChoreSpark uses essential cookies for authentication and platform functionality. We do not use third-party tracking cookies or advertising networks.

8. Data Retention and Deletion

While the account is open

We keep your account details and your household's quest history for as long as the account exists. There is no scheduled purge and no automatic expiry. A quest completed in your first week is still there in your second year unless you or we remove it. Proof photos follow the quest they belong to. A rejected quest loses its photo straight away, and an approved one keeps it until the account is deleted. Reward images and saved drawings work the same way: they stay until the thing they belong to is replaced or the account is deleted. We do not run a job that deletes images after a set number of days, so please do not read a retention period into this policy that the product does not enforce.

When you delete the account

Account deletion lives in Settings, under Account management. It asks you to type a confirmation phrase, and then it runs straight away. There is no waiting period, no soft delete and no archived copy held back for a window of time. In a single pass we remove:

• Every image in our private storage buckets: quest proof photos, reward images and saved drawings. These go first, before the records that name them, because once those records are gone the files can no longer be found
• Every quest assigned to a child in your household
• Every child profile, including names, PIN hashes and progress
• Earned badges, quest pack assignments and push notification subscriptions
• Sign in sessions and linked sign in records
• Your own parent record, including your name, email address and password hash

Any active subscription is cancelled at Stripe at the same time and the local subscription record is removed with it. Nobody at ChoreSpark can undo this or restore the household afterwards, because the rows are gone rather than hidden.

What deletion does not reach

Two things sit outside our database and our storage buckets, so deleting the account does not clear them:

• Payment records at Stripe. We never hold card numbers. Stripe holds the payment history and keeps it under its own retention rules and the financial record keeping law that applies to it. Cancelling and deleting on our side does not erase Stripe's copy
• Support email. A message from the contact page becomes an email in our support mailbox. It sits there until it is deleted by hand. ChoreSpark stores no support ticket in its database, so account deletion does not touch that mailbox

For support email, write to us through the contact page and we will clear what is in the mailbox. Stripe's payment records are a different matter. Those are kept to satisfy financial record keeping obligations and neither you nor we can have them erased on request. Your images are not on that list. They are in our own private buckets and account deletion removes them.

9. International Data Transfers

ChoreSpark operates globally, which requires transferring your data across international borders. We ensure all transfers comply with applicable privacy laws:

Primary Data Locations

• United States: Primary servers and databases (Supabase/PostgreSQL)
• Global CDN: Vercel edge locations worldwide for performance
• Payment Processing: Stripe (global infrastructure with local processing)
• Email Service: Zorl Mail, operated by Zorath LLC
• Images: Supabase Storage, in private buckets, for quest proof photos, reward images and saved drawings alike

Transfer Safeguards

For transfers outside your country, we implement:

• EU Transfers: Standard Contractual Clauses (SCCs) approved by European Commission
• UK Transfers: UK International Data Transfer Agreement (IDTA)
• Swiss Transfers: Swiss-approved Standard Contractual Clauses
• Canadian Transfers: Adequacy determinations where applicable, contracts otherwise
• Other Countries: Adequacy decisions or appropriate safeguards as required

Data Localization

Where required by local laws, we implement data localization:

• Russia: Data localization requirements (currently, ChoreSpark is not available in Russia)
• China: Data localization requirements (ChoreSpark is not available in China)
• India: Critical personal data localization for Indian residents when required

Your Rights: You have the right to obtain information about safeguards relating to transfers of your personal data and, where applicable, obtain a copy of the safeguards.

10. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to know what personal information we collect and how it's used
• Right to delete personal information (subject to legal exceptions)
• Right to opt-out of sale of personal information (we don't sell personal info)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate personal information

To exercise these rights, send a message from the contact page and say that you are a California resident. The route is the same one described in section 6.

11. Third-Party Services

We use trusted third-party services that may access your data:

• Stripe: Payment processing. Card details are entered on Stripe's own checkout page and never reach us. We send Stripe your name and email address so it can identify the customer, and we store only the Stripe customer and subscription identifiers
• Supabase: Hosts the PostgreSQL database that holds accounts, children, quests and progress, and the private storage buckets that hold quest proof photos, reward images and saved drawings
• Vercel: Application hosting and delivery. Vercel Speed Insights also runs on every page and reports page load timings to Vercel. It sets no cookie and carries no account information
• Zorl Mail: Email delivery, including account email, quest notifications and everything sent from the contact page. Operated by Zorath LLC, the same company that runs ChoreSpark

Web push is the one other place data leaves us. When you turn on notifications, your browser gives us a delivery address at its own push service, run by Google, Mozilla or Apple, and a notification is handed to that service to pass on. The message body is encrypted before it leaves us. Everything else stays with the four above. ChoreSpark used to send reward images and saved drawings to an outside image host, which is why an earlier version of this policy named one. It does not any more. Every image now goes to a private Supabase Storage bucket and nowhere else.

Each of these operates under its own privacy policy and its own security standards, which are theirs to describe rather than ours. We have not audited them.

12. Data Breach Response

Breach Detection and Response

This is how a personal data breach would be handled:

• Detection: The application writes error and security event logs, including blocked uploads and rate limit trips. There is no automated alerting service watching them, so detection depends on those logs being read and on reports reaching us
• Assessment: Risk evaluation within 24 hours of detection
• Containment: Immediate steps to prevent further unauthorized access
• Investigation: Work out the scope and the cause before notifying
• Remediation: Security improvements to prevent recurrence

Notification Procedures

In case of a personal data breach, we will:

• Regulatory Notification: Notify relevant authorities within 72 hours (GDPR, state AGs, etc.)
• User Notification: Notify affected users within 72 hours unless breach poses no risk
• Public Disclosure: Post security notices on our website if required by law
• Media Notification: Issue press releases for significant breaches affecting large numbers of users

Information Provided

Breach notifications will include:

• Description of what happened and when it was discovered
• Types of personal information involved
• Steps we have taken to address the breach
• Steps you can take to protect yourself
• Contact information for questions and assistance
• Whether law enforcement has been notified

Preventive Measures

The measures we actually rely on are the ones listed in section 4: hashed credentials, HTTPS with strict transport security, household scoped access checks on every request, parent only approval of quests, and validation and rate limiting on uploads. ChoreSpark does not have multi factor authentication, a penetration testing programme, a scheduled security audit or a standing incident response team.

13. Policy Updates

We may update this Privacy Policy periodically. Material changes will be communicated via in-app notifications or email at least 30 days before taking effect. Continued use after changes constitutes acceptance of the updated policy.

14. Automated Decision Making and Profiling

No Automated Decision Making: ChoreSpark does not use automated decision-making systems or profiling that would significantly affect you. All decisions about your account, subscription, or service access are made by humans.

Algorithm Use: We use basic algorithms for:

• Quest pack content chosen by the parent, not by us. Nothing profiles a child to pick their chores
• Progress tracking and XP calculations (transparent mathematical formulas)
• Rate limiting on sign in attempts and on API requests, which can slow a request down or refuse it for a short window but never makes a decision about your account
• Technical performance optimization (no personal impact)

You have the right to request human intervention in any automated processing that affects you.

15. Sensitive Personal Information

ChoreSpark minimizes collection of sensitive personal information:

We DO Collect (with explicit consent):

• Photos submitted for quest verification, and drawings a child saves. Both are kept in a private bucket, are opened only by the child and that child's parent, and are deleted when the account is deleted. A proof photo is also deleted when the quest is rejected. See section 5

We DO NOT Collect:

• Racial or ethnic origin
• Religious or philosophical beliefs
• Political opinions
• Health or medical information
• Sexual orientation or preferences
• Biometric or genetic data
• Criminal history or background

California Residents: You have the right to limit our use and disclosure of sensitive personal information. Contact us to exercise this right.

16. Data Protection Authorities

If you're not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with your local data protection authority:

Key Regulators

• EU: Your local Data Protection Authority or European Data Protection Board (edpb.europa.eu)
• UK: Information Commissioner's Office (ico.org.uk)
• Canada: Privacy Commissioner of Canada (priv.gc.ca)
• Australia: Office of the Australian Information Commissioner (oaic.gov.au)
• California: California Privacy Protection Agency (cppa.ca.gov)
• Switzerland: Federal Data Protection and Information Commissioner (edoeb.admin.ch)

We encourage you to contact us first to resolve any privacy concerns, but you have the right to go directly to your local regulator.

17. Contact

For privacy questions, or to exercise any of the rights in section 6, use the contact page.

What happens to your message

The form asks for your email address, a reason and your message. It sends that to our support mailbox as an email and sends you a confirmation at the address you gave. It is the only contact channel ChoreSpark has. There is no chat widget, no in app help desk, no ticket portal and no knowledge base, and there is no priority queue or urgent flag to set. Privacy requests are read by the same people who read every other message.

Legal Entity and Registration

• Data Controller: Zorath LLC
• Jurisdiction: Delaware, United States
• Business Registration: Delaware Limited Liability Company
• EU Representative: Available upon request for EU residents
• UK Representative: Available upon request for UK residents

Privacy Policy Effective Date: Sep 21, 2026
Last Updated: Sep 21, 2026
Version: 2.0 (Worldwide Compliance Update)
Data Controller: Zorath LLC