Streaks Privacy Policy

App: Streaks: Family Goals (iOS, Android, and web)
Published at: https://kidstreaks.com/privacy
Effective: [CONFIRM effective date]

Who we are

Streaks is a family app. Parents set daily goals for their children, and each child keeps a streak.

Streaks is run by [CONFIRM publisher legal name], [CONFIRM publisher address], Canada. In this policy, "we" and "us" mean that operator. "You" means a parent who uses Streaks.

Questions: [email protected]. Our Privacy Officer, who is responsible for how we handle personal information, can be reached at the same address.

The short version

• A parent creates the account. Children never sign up and never give us an email address.
• About your child, we keep only what you enter: a first name, a preset avatar, a 4-digit PIN, and, if you choose, a birthdate.
• We have no ads, no analytics, no tracking, and no in-app purchases.
• We never sell your data. We never use it for advertising or profiling.
• We don't collect location, contacts, photos, or advertising IDs.
• Our app doesn't record your IP address. Our network provider, Cloudflare, does see it, and so does Expo when the iOS or Android app checks for updates (see "Who we share with").
• You can review, export, correct and delete your family's data. You can also tell us to stop collecting it.

Information we collect

From you (the parent)

• Your name and email address. You use your email to sign in and to reset your password.
• Your password. We store it only as a one-way hash. We can't read it.
• Your household's name and time zone. The time zone (for example, "America/Toronto") tells us when your family's day ends. We don't use it to locate you.
• Household settings. For example, quiet hours for reminders.
• A co-parent's email address, if you invite one. We email that person a link to join.

About your child (entered by you)

• First name and a preset avatar. You pick from built-in pictures. You can't upload a photo.
• A 4-digit PIN so your child can sign in. We store it only as a one-way hash.
• Birthdate (optional). If you enter it, we use it to set your child's age group and to give a birthday gift of points. We store the full date. Only parents can see it.
• Goals and settings. Goal names and icons, schedules, point values, bedtime, and game settings (for example, streak rules).
• Notes and rewards you write. Reward names, custom badge names, notes on pause days and reward requests, and similar text.
• Reward picture (optional). Which built-in picture a reward shows. You pick from pictures that come with the app. You can't upload a photo or link to one. See "Reward pictures" below.

Goal names and notes are free text. Please don't put sensitive details in them, such as health information.

Created when your family uses the app

• Check-offs: which goals were done each day, who marked them, and when.
• Streaks, points, badges, and game progress.
• Reward requests and whether you approved them.
• Your child's answers to the occasional "how is this feeling?" question (fun / okay / annoying).
• A record of which reminders we sent and when. This enforces the daily limit.
• When anyone in your household last signed in, and whether we have sent the notice described under "Households nobody uses". We use these only to delete households nobody uses (see "How long we keep it").
• Server logs. Each log line holds the page requested, the result, the time taken, and your account ID and household ID. Logs don't hold your name, email, IP address, or what you typed. Error logs are different: when something fails, an error message can include a fragment of data, for example an email address in a mail-delivery error. Our database server is set up to leave the values stored in your data out of its error logs. Error logs are kept and deleted the same way as other server logs (see "How long we keep it").

From your device

• A sign-in token. On the web, it's a cookie named streaks_session. In the app, it's kept in your device's secure storage. We store only a hash of it.
• A device credential. When a parent or child signs in on a device, that device gets a second token that lets it show your household's sign-in screen (your children's first names and avatars, so a child can pick theirs and enter a PIN) after you sign out. On the web, it's a cookie named streaks_device. In the app, it's kept in your device's secure storage. We store only a hash of it, your household ID, and when it was created, last used and expires. It holds no device identifiers. Without it, or a signed-in session in your household, nobody can see that screen.
• Push notification details, if you allow reminders. On the web, we store the browser's push address and keys, plus the browser's user-agent string (the text a browser sends to identify its type and version, stored up to 512 characters). We keep it so we can later show you which devices get reminders; the app doesn't display it yet. In the iOS and Android apps, we store an Expo push token (an address Expo's push service issues for that app on that device) and a short device label. The apps only ask for notification permission when a parent turns reminders on; they never ask on a child's device or in Kid Mode.
• On-device storage. The web app saves a few preferences on the device: mute, theme, which celebrations you've already seen, check-offs waiting to send while offline, your household ID, and the account IDs of people who signed in on that device (to remember each person's theme). They stay on the device. The iOS and Android apps keep the same kinds of preferences in app storage, and keep the sign-in token, the device credential and, if a parent turned reminders on, that device's push token in secure storage.

What we do not collect

• Precise or approximate location (no GPS, and no location from your IP)
• Contacts or address book
• Photos, camera, microphone, or file uploads
• Advertising IDs or hardware device IDs (IDFA, IDFV, AAID, IMEI). We do store a push token that a reminder service issues for the app, and Expo receives a random installation ID when the app checks for updates (see "Who we share with").
• Payment or financial information
• Children's email addresses, phone numbers, or home addresses
• Analytics, crash-reporting, or advertising tools of any kind
• Third-party cookies

How we use it

We use your information only to run Streaks:

• to sign you and your children in, and keep accounts secure
• to track goals and streaks, work out each day in your time zone, and award points and badges
• to send reminders and the nightly parent summary, if you turn them on
• to send password reset and co-parent invite emails
• to keep the service running, fix problems, and protect against abuse
• to meet legal obligations

We never sell your data. We never use it for advertising, ad targeting, or profiling, and we never share it with data brokers. We send no marketing email.

Children's privacy

Streaks is used by children, so we follow the rules for children's data in the US (COPPA) and Canada (PIPEDA, and Québec's privacy law, which requires a parent's consent for children under 14). We get a parent's consent with an email confirmation and a follow-up email, as described below. We use children's information only inside Streaks, and we don't disclose it to anyone for their own purposes. The only companies that receive it are the service providers listed under "Who we share with", which handle it to run Streaks; we disclose it to no other third party.

Parental consent comes first. Before anyone in a household can add a child, a parent must give consent:

1. The parent ticks two boxes: that they are an adult parent or guardian, and that they consent to us collecting and using their children's information as this policy describes.
2. We email that parent a link. Consent is recorded only when they open the link and press Confirm. Until then, the app won't let anyone in the household add a child. The link works for 7 days and only once.
3. About a day after confirming, the parent gets a second email saying consent was recorded and how to withdraw it.

One parent's consent covers the whole household. Households that existed before this step was added are asked once; children they already added stay as they are, but no new child can be added until a parent confirms. We keep a record of the consent: which parent gave it, when they ticked the boxes, when they confirmed, which version of this policy they agreed to, the method (email confirmation), and when we sent the follow-up email. The link itself is stored only in a scrambled (hashed) form.

Parents are in control.

• Only a parent can create a child's profile. Children can't sign up.
• Children never give us their email or contact details. They sign in with an avatar and a PIN you set.
• When your child uses the app, we record their activity: check-offs, theme choice, reward requests, and answers to "how is this feeling?" Children have no place to type messages to anyone. The child screens have no text boxes: a child taps, picks, and enters their PIN on a number pad. The only typing field on a child's device is the parent password a parent enters to leave Kid Mode.
• Accounts are for adults: you must be 18 or older, or the age of majority where you live if that is higher. At sign-up, a parent must confirm they are an adult and the parent or legal guardian of the children they will add. We take that statement as given and don't check age in any other way.

What your child can see: their own goals, streak, points, badges, and rewards. They also see siblings' names and avatars. If you turn on family features, they see shared family progress. They never see your email, any birthdate, or a sibling's missed days. Some text you write reaches your child's device: goal names, reward names, custom badge names and their notes, bounty labels, the Family Fire reward text, and any note you add when you answer a reward request. Please write everything in the app as if your child may read it.

Your rights as a parent. At any time, you can:

• Review your child's data in the parent screens.
• Export it in the app: Settings > Your account > Delete account > Download my data. Downloading doesn't delete anything. The export is a complete copy of the data we hold about your household: members (including birthdates and settings), goals and their history, check-offs, streaks, badges, points, pause days, rewards and reward requests, notes, invites, parental consent records, reminder devices and reminders sent, and family and sibling features. It leaves out only security secrets: passwords and PINs (we keep only scrambled hashes), sign-in sessions, password-reset links, invite links, consent-confirmation links, device keys, and the addresses and keys that let a device receive notifications.
• Correct it by editing the profile, goal or setting.
• Delete it. To delete one child, open Parent Settings, choose the child, and tap "Delete <child's name>'s profile". That deletes the child's profile and all of their data right away. You can also email [email protected] and we will do it within 30 days. You can delete your own parent account in the app. You confirm with your password. When the last parent in a household deletes their account, we delete the whole household, including every child's data. If another parent remains, only your own account is deleted and the household stays with them. You can download an export first. You can also start from the web at https://app.kidstreaks.com/delete-account. After any deletion, copies in backups are deleted within 30 days, and server logs are overwritten as described in "How long we keep it". Archiving a child only hides the profile. It doesn't delete anything.
• Refuse further collection. Delete your child's profile (see above), or ask us to stop. We will then stop collecting new information about that child.

To use any of these rights, use the app or email [email protected]. Before acting on a request, we confirm you're the account's parent. We reply within 30 days.

Who we share with

We don't sell or rent data. A few service providers handle data on our behalf, only to run Streaks:

We may also disclose information when the law requires it, for example under a valid court order. We may do the same to protect someone's safety. If Streaks is sold or merged, your data may move to the new owner under this policy. We will tell you first.

Reward pictures

A parent can give a reward a picture from a set built into the app. The pictures are drawn by the app itself, so showing a reward never loads anything from another website and no other company learns your device's IP address. Earlier versions let a parent paste a web address for a reward picture; we removed those addresses from our servers and the app no longer accepts them.

How long we keep it

• Account and family data: until you delete it (see "Children's privacy"), or until your household goes unused (next item).
• Households nobody uses: if nobody in your household, parent or child, signs in for 12 months, we email every parent in the household. The email gives the date, at least 30 days away, after which your family's data will be deleted, and says that signing in keeps it. If nobody signs in by then, we delete the household once it is both 13 months since the last sign-in and at least 30 days since that email, and the date in the email has passed, exactly as if its last parent had deleted their account: every child's data is deleted with it, and backup copies are gone within 30 days after that. Signing in at any time before the deletion cancels it: a parent with their password, or a child with their PIN. Using the app on a device that stays signed in counts too. We never delete a household this way unless that email was sent to every parent. If it cannot reach one of them, we try again the next day.
• Backups: we take a nightly database backup and also back up our servers. Backups are kept on our own equipment in Canada, with no copy elsewhere, for up to 30 days. Deleted data can stay in a backup for up to 30 days, then it's gone. We use backups only to restore the service.
• Server logs (including error logs): deleted automatically as new logs replace them. We keep about the last 50 MB for each service. The app server's logs are also erased every time we install an update. There is no fixed time limit, so how far back they reach depends on how busy the service is and how often we update it. The database server's log can reach back further, because it writes very little; it is set up to leave out the values stored in your data.
• Sign-in sessions: stop working after 30 days without use. A session in use is renewed, but never past 180 days after you signed in, so one renewed just before then can last up to 30 more days (210 days at most). Signing out deletes the session right away. Once a session expires, we delete its record within about an hour.
• Device credentials: expire after 400 days without use. Signing out keeps them, so the family sign-in screen still works. Resetting the parent password ends every device credential in the household, and deleting the household deletes them all.
• Password reset links: stop working after 1 hour. We delete the expired record (a hash of the link, never the link itself) within about an hour after that.
• Parental consent records: the record of the consent you confirmed is kept for as long as the household exists, and deleted with it. If the parent who gave consent deletes their own account while another parent remains, the record stays with the household and no longer names that parent. A confirmation link stops working for recording consent after 7 days. A confirmation request that is never confirmed is deleted 7 days after its link stops working: at most 14 days after we sent it, or 7 days after a newer request replaced it.
• Co-parent invites: an invite that isn't accepted expires after 7 days, and we then delete it, email and all. When someone accepts, we remove their email from the invite right away. Their email stays only on the account they just created. We keep a record that the invite was accepted, as part of the household's history.
• Push devices: removed when you turn reminders off on that device, when Apple or Google report the app was uninstalled, or after repeated delivery failures.

Security

• We hash passwords and PINs with argon2. We hash sign-in tokens, device credentials and reset tokens.
• All connections use HTTPS (TLS).
• Our app doesn't log IP addresses, passwords, PINs, or email content.
• PIN and password guessing is rate-limited.
• In the iOS and Android apps, the sign-in token stays on that device and is never copied to a backup.
• Backups are kept on access-restricted storage on our own equipment. The nightly database backup files are not separately encrypted.

No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.

Where your data is stored

Our servers and backups are in Canada. Cloudflare and our other providers may handle data in Canada, the United States, or other countries. Where they do, the laws of that country apply to it, including access by its authorities.

Your rights

Canada (PIPEDA and provincial law): you can ask to see your personal information, correct it, or withdraw consent. You can also complain to the Office of the Privacy Commissioner of Canada.

United States: depending on your state, you may have rights to know, access, correct, delete, or move your data. You may also be able to opt out of its sale or use for targeted ads. We never sell it or use it for ads. We won't treat you differently for using these rights.

To make a request, email [email protected].

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects your children's data or how we use it, we'll tell parents in the app or by email first. Where the law requires it, we'll ask for your consent again.

Contact

[CONFIRM publisher legal name] [CONFIRM publisher address] [email protected]