Privacy Policy — Piggy Points

1. Who we are

Piggy Points is operated by BrainLayer Inc. ("BrainLayer", "we", "us"), 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States. BrainLayer is the controller of the personal information described in this policy.

This policy covers the Piggy Points iOS app, the Piggy Points backend service, and the piggypointsapp.com website. It does not cover the App Store itself, or any third-party site a parent chooses to link to from a reward.

Questions, requests, or complaints: [email protected].

2. Two kinds of people use Piggy Points

The distinction below runs through the whole product and through this entire policy, so it is worth stating up front.

Parent: The account holder. Signs in with Sign in with Apple, creates the household, invites a co-parent, defines tasks and rewards, approves completed chores, and is the only person who can buy a subscription or delete the account.
Child: A profile the parent creates inside the household. A child signs in on their own device with a short family code — not an Apple ID, not an email address, not a password of their own. A child can never become an account holder and can never make a purchase. Purchases, account settings, and any exit from the app sit behind a parental gate.

If a child ever reaches Sign in with Apple, we do not open a parent account for them: the flow applies an age-range check and redirects them to the family-code sign-in.

3. Information we collect

We collect only what the app needs to work. The lists below are exhaustive as of the date at the top of this page.

3.1 Parent account

Apple identifier: The stable, pseudonymous user identifier Apple returns from Sign in with Apple. This is the only thing that identifies your account to us — we do not store a password, because there is no password.
Email address: Only if Apple shares it with us, which Apple does at most once, on the first authorization. If you chose "Hide My Email", we only ever receive Apple's private relay address, not your real one. We do not require an email address to use the app.
Name: The name you supply at sign-up, or the one Apple passes through. A first name or nickname is enough.
Apple authorization code: Retained so we can complete a server-side token exchange and revoke your Apple sign-in when you delete the account.
Internal identifiers: An opaque account identifier that we generate. It reveals nothing about you on its own, and it is the identifier the app uses with our subscription, analytics, attribution and paywall providers instead of your name or email. See section 3.7.
Preferences: Your language, your time zone, whether onboarding is finished, and whether task reminders are switched on.
Profile photo: Optional, and handled the same way as a child's — private storage, no public address. See section 3.6.
Push token: The Apple push token for your device, the platform, your notification permission status, and when each was last updated.
Activity timestamp: When the app last loaded your profile. We use this as a proxy for "opened the app" so that a reminder is not sent to someone who is already using the app.
Held on your own device: Your sign-in session is kept in the iOS Keychain, and the app stores some settings locally — your answers to the setup questions, whether a welcome offer has been shown, and your notification token. This never leaves the device except where this policy says otherwise, and signing out or deleting the app removes it.

3.2 Child profile

A child profile is created by a parent, from the parent's device, with information the parent chooses to enter. It contains:

Display name: Whatever the parent types. A first name or nickname is sufficient and is what we recommend.
Profile photo: Optional, and uploaded by a parent — a child cannot set their own. See section 3.6.
Family sign-in code: A short code, generated by us, that lets the child sign in on their device. It is not derived from anything about the child.
Points balance and history: Points earned, spent, and adjusted, so the ledger adds up.
Push token: Only if notifications are allowed on the child's device, and only so their own reminders and approvals can reach them.
Reminder preference: Whether the child receives task reminders. A parent can switch this off for any child at any time.

We do not ask a child for an email address, a phone number, a date of birth, a home address, a password, or precise location. There is no chat, no friend list, no public profile, and no way for a child to communicate with anyone outside their own household.

3.3 The household

Household details: The family name and status, and which parent owns it.
Subscription state: Whether the household is on the free plan or premium, the store platform, the product identifier, the transaction identifier, and the renewal or expiry date. This comes from our subscription provider — we never see your card, and Apple never gives it to us.
Co-parent invite: A single-use invite code and its expiry, which we delete once it is redeemed, revoked, or expired.
Usage counters: For example, how many AI task insights the household has used this month, so the monthly allowance can reset.

3.4 Chore and reward activity

Tasks: Name, description, point value, daily limit, minimum duration, repeat schedule, whether photo proof is required, an optional image, and which children it applies to.
Rewards: Name, description, point cost, limits, an optional image, and an optional link the parent adds.
Completions: Which child completed which chore, when, any note they added, any photo proof, and the parent's approval or rejection.
Redemptions and point ledger: Every point movement, so a balance can always be explained.
Onboarding events: Which step of setup was reached, so we can tell where setup breaks. Tied to the Apple identifier and role, not to a child's name.
Notification records: Which notification was sent, over which channel, whether it succeeded, and the payload — so a notification is not delivered twice.

3.5 Photo proof of a chore

A parent can require a photo as proof that a chore was done. The child takes it in the app, and it is the most sensitive thing the app handles, so it is handled differently from everything else:

These photos are kept. They stay in the household's history so a parent can look back at them, and they are removed when a parent removes them or when the profile they belong to is deleted. Because they are kept, the controls below matter more, not less.

The photo never passes through our servers: The app uploads it directly to private storage using a signed URL that is valid for five minutes.
Location data is removed before it is uploaded: The app re-encodes every photo on the device first, stripping all metadata — including EXIF and any GPS coordinates — and reducing its size. Our servers then re-check the file and refuse it outright if any of that metadata is still attached, rather than taking the app's word for it. A stored proof photo does not record where it was taken.
Only the household can see it: The storage is private and there is no public address for a proof photo. The only way to view one is a short-lived signed link, and we issue those only to members of that household — both parents and the children. Nobody outside the family can see a proof photo, and only a parent can delete one.
A parent can delete any photo, at any time: Deleting one destroys the file itself. The chore and the points the child earned for it are untouched — only the photo goes.
Deleting the profile deletes the photos: Removing a child's profile, or deleting the account, permanently destroys every proof photo attached to it. Nothing is archived and nothing is retained for later recovery.

Profile photos are handled the same way — see section 3.6.

3.6 Profile photos

A profile photo is optional. A child's profile photo is chosen and uploaded by a parent — a child cannot set their own — and it is stored exactly like a proof photo:

Location data is removed before it is uploaded: The app re-encodes the photo on the device, stripping all metadata including EXIF and any GPS coordinates, and reducing it to a small square. Our servers re-check it and refuse anything that still carries metadata.
Storage is private: Profile photos live in private storage with no public address. They are readable only through a signed link that expires within minutes and is issued only to that household.
A parent can replace or remove it at any time: Both destroy the file that was there before, not just the reference to it.
Deleting the profile deletes the photo: So does deleting the account. The file itself is removed.
Nothing is shared: Profile photos are sent to no third party, are never used for advertising or training, and no facial recognition or analysis of any kind is performed on them.

3.7 Analytics, attribution and the paywall — parents only

To keep building the app we need to know how it is used and whether our marketing works. Four third-party tools help with that, and every one of them is subject to the same hard rule: they run for a parent, and they are switched off entirely for a child. See section 5.

None of them receives your name, your email address, or any photo. They are given the opaque account identifier described in section 3.1.

Product analytics: We use Mixpanel to see which features are used and where people get stuck: the opaque account identifier, whether you are a parent, your plan, your household identifier, how many children are on the account, in-app events such as creating a task, and — collected automatically by the tool — app opens, session length, and basic device and app-version information.
Install attribution: We use AppsFlyer to tell which advertising campaign or link brought someone to the app. It receives your device's vendor identifier (an identifier Apple scopes to us alone and resets when you delete the app), device and network information including your IP address, and Apple's privacy-preserving SKAdNetwork signals, plus a handful of milestone events. It runs in its strict mode: we do not request the advertising identifier (IDFA) and the app never shows the App Tracking Transparency prompt, because we do not track you across other companies' apps or websites.
Subscriptions: RevenueCat records what was purchased and whether the subscription is active. It receives the opaque account identifier and Apple's receipt data, and — so a purchase can be matched to the campaign that led to it — the attribution device identifier above.
Paywall: Superwall decides which subscription screen to show and measures whether it worked. It receives the opaque account identifier, which paywall was shown and what you did with it, and a few flags such as whether a welcome offer is active.

You can object to analytics and attribution at any time by writing to [email protected], and we will exclude your account. The app works exactly the same either way.

3.8 Device and diagnostic information

When a request to our API fails, we record what happened so we can fix it: the time, the endpoint and method, the HTTP status, an error code and message, the request identifier, your app's client identifier, the account identifier involved, the IP address, and the device's user-agent string. Request parameters are captured with sensitive values — email addresses, tokens, keys, secrets — filtered out before anything is written.

These records exist to keep the service working and secure. They are not used to profile you, and they are not shared for anyone else's purposes.

3.9 What we deliberately do not collect

No advertising identifier, and no advertising: We do not request the IDFA and the app never shows the App Tracking Transparency prompt. No advertising of any kind is displayed in the app, to a parent or to a child, and no ad network receives your data.
No cross-company tracking, and no profiling of children: The analytics and attribution described in section 3.7 tell us how our own app is used and which campaign led to an install. They do not follow you across other companies' apps or websites, they do not build an interest profile, and nothing is used to target advertising at you. None of it runs for a child at all.
No precise location: The app does not ask for location permission.
No contacts, photos library, microphone, or health data: The only camera or photo access is the one you initiate when attaching proof of a chore.
No payment details: Purchases run entirely through Apple. We never see your card number, and we never receive it.

4. How we use this information, and on what legal basis

For people in the European Economic Area, the United Kingdom, and other regions with equivalent law, the legal basis for each use is named in brackets.

Running the household: Signing you in, keeping the shared task and reward list in sync across parent and child devices, calculating points, and processing approvals. [Performance of a contract]
Managing subscriptions: Recording whether the household is on the free plan or premium, and applying the free-plan limits. [Performance of a contract]
Notifications: Telling a parent that a chore is waiting for review or a reward has been requested, and reminding a child about chores that are still open. Push delivery depends on the permission you grant on the device and can be revoked there or in the app at any time. [Consent, for push permission; legitimate interests, for the content of a message you have asked to receive]
Keeping the service working and secure: Diagnosing errors, blocking abuse, verifying that a request genuinely came from our app, and preventing replayed requests. [Legitimate interests]
Improving the product: Understanding, in aggregate, where setup breaks or a feature fails. [Legitimate interests]
Analytics and attribution, for a parent's use of the app: Measuring which features are used, which subscription screen works, and which campaign brought someone to the app. Never applied to a child's use of the app. [Legitimate interests — you can object at any time and we will exclude your account]
Meeting legal obligations: Responding to a verified rights request, or retaining what the law requires us to retain. [Legal obligation]

We do not use your family's data to train any machine-learning model, ours or anyone else's.

5. Children's privacy

Piggy Points is rated 4+ and is designed to be used by children under 13 alongside their parent. It is not listed in the Kids Category, and it does not override its age rating. We follow the Children's Online Privacy Protection Act (COPPA) in the United States and the equivalent protections for children's data in the EEA and the UK.

The parent is the gatekeeper: A child profile only exists because a parent created it, on the parent's own device, inside an account the parent controls. Everything we hold about a child was entered by, or is visible to, that parent. This is how we obtain and evidence verifiable parental consent.
Data minimisation is the design, not a policy line: A child profile has no email address, no password, no date of birth, and no contact information. The family sign-in code exists precisely so that a child never needs an identity of their own.
Child mode switches every third-party tool off: This is the strongest guarantee in this policy, and it is enforced in the app itself rather than by policy. From the moment a child signs in with their family code, the analytics, attribution, subscription and paywall tools described in section 3.7 are all disabled. A child's session sends nothing to any of them. The app talks only to our own servers.
No commercial use, ever: We do not serve advertising to children, we do not use behavioural advertising, we do not sell or share children's data, and a child cannot make a purchase — there is no in-app purchase in child mode at all. Purchase flows, settings, and any link that leaves the app are behind a parental gate.
No public exposure: A child cannot publish anything, message anyone outside the household, or be discovered by another user. Their data is visible only to the parents in their own household.
Parental control over the child's data: A parent can review, correct, or delete any child profile and the data attached to it at any time, directly in the app, and can refuse further collection by deleting the profile.

If you believe a child has provided us with information outside of the parent-created flow described here, write to [email protected] and we will delete it.

6. Purchases and subscriptions

Piggy Points has a free tier and an optional premium subscription. The free tier is not a locked door: a free household uses the app fully, within plan limits on how many children, tasks, and rewards it can have.

All purchases are made through Apple's In-App Purchase system on the parent's device. Payment is handled by Apple; we never receive or store payment card details. We use RevenueCat to reconcile the purchase and tell our backend whether the household's entitlement is active. RevenueCat receives an opaque account identifier we generate — not your name, and not your email address — along with the receipt information Apple provides.

Refunds, billing questions, and cancellation are handled by Apple through your App Store account.

7. The AI task insight (optional, premium)

Premium households can ask for a second opinion on a chore they are drafting — whether the points, the age fit, and the schedule make sense before the task is created. This feature is optional, is used only when a parent taps it, and creates nothing on its own.

When you use it, we send to OpenAI: the draft chore's name and settings (points, daily limit, minimum duration, repeat schedule, whether proof is required), the age band and motivation note the parent selected from a fixed list, the names and point values of the household's existing tasks so the advice is priced consistently, and the language to answer in.

We do not send your name, your child's name, your email address, your account identifier, any photo, or any point balance. The draft is not stored by us beyond the monthly usage counter, and the answer is returned to the parent and discarded. Under our agreement with OpenAI, this content is not used to train their models.

If you would rather not use it, simply do not tap it. Everything else in the app works without it.

8. Who we share information with

We do not sell personal information. We disclose information only to the service providers below, only for the purpose named, and only under contracts that bind them to process it on our instructions and not for their own purposes.

Four of them — Mixpanel, AppsFlyer, RevenueCat and Superwall — receive data only from a parent's session. A child's session reaches none of them.

Apple: Sign in with Apple (authentication), the App Store (purchases), and the Apple Push Notification service (delivering notifications to your device).
RevenueCat: Subscription state. Receives an opaque account identifier, Apple's receipt data, and the attribution device identifier. Parent sessions only.
Mixpanel: Product analytics — see section 3.7. Parent sessions only.
AppsFlyer: Install attribution — see section 3.7. Parent sessions only.
Superwall: Subscription screens and their measurement — see section 3.7. Parent sessions only.
Amazon Web Services: Storage of profile and proof photos. They live in a private bucket with no public access, plus the underlying infrastructure.
OpenAI: Only the AI task insight described above, and only when a parent requests it.
Our hosting and database providers: The platforms that run the Piggy Points backend, its database, and its background job queue.

We may also disclose information where we are legally required to, or where it is necessary to establish or defend a legal claim, or to protect the safety of a user. If Piggy Points is ever involved in a merger or acquisition, we will give notice before any personal information is transferred and this policy continues to apply to it.

9. How long we keep things

Account and household data: For as long as the account exists. Delete the account and it goes with it.
Photos (chore proof and profile): Kept for as long as the profile they belong to exists, so a parent can look back at them. A parent can delete any of them at any time, and deleting a child's profile or the account destroys all of them.
Co-parent invite codes: Seven days at most, and deleted the moment the invite is redeemed or revoked.
Diagnostic and error records: Kept only as long as they are useful for fixing and securing the service, then deleted.
Records we must keep: Where tax, accounting, or legal obligations require it, a minimal transaction record may be retained after deletion. It contains no child data.

10. Deleting your account and your data

You can delete your account from inside the app, without contacting us. What happens depends on whether anyone else is left in the household:

You are the only parent: The entire household is erased: your account, every child profile, every task, reward, completion, redemption, point transaction, and any remaining photo. Nothing is retained for later reactivation.
There is a co-parent: Only your own account is removed. The household survives for the remaining parent and the children, and the tasks and rewards you created are handed over to them so the household keeps working.

You can also delete an individual child profile at any time without deleting your own account. If you would rather we did it for you, write to [email protected] from the address on your account, or with enough detail for us to identify it.

11. How we protect it

Encryption in transit: All traffic between the app and our servers runs over TLS.
Signed, single-use requests: Every app request carries a cryptographic signature and a one-time value, so a captured request cannot be replayed against your account.
Short-lived sessions: Access tokens expire, and a token version on your account lets us invalidate every existing session at once if we ever need to.
Private storage for sensitive files: Proof photos are never publicly addressable and are reachable only through a signed link that expires in minutes.
Least-privilege access: Access to production data is limited to the people who need it to operate the service.

No system is perfect. If we discover a breach affecting your personal information, we will notify you and the relevant regulators as required by law.

12. Where your information is processed

BrainLayer Inc. is based in the United States and our infrastructure and service providers process data there. If you use Piggy Points from the EEA, the UK, or Switzerland, your information is transferred to the United States under the European Commission's Standard Contractual Clauses or another approved transfer mechanism, together with the contractual and technical safeguards described in this policy.

13. Your rights

Wherever you live, you can ask us to show you what we hold, correct it, or delete it — and the app already gives you direct control over most of it.

EEA, UK, and Switzerland: You have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting processing already carried out. You also have the right to lodge a complaint with your local data protection authority.
California: You have the right to know what personal information we collect and disclose, to request its deletion, to request correction, to opt out of any sale or sharing, and to be free from discrimination for exercising those rights. We do not sell personal information. We use an attribution provider to measure which campaign led to an app install, which we do not consider sharing for cross-context behavioural advertising — no advertising identifier is used and nothing follows you to another company's app. If you would rather be excluded from analytics and attribution altogether, tell us and we will exclude you.
Other US states: Where state law grants comparable rights of access, correction, deletion, portability, or appeal, we honour them on the same terms.
Parents, on behalf of a child: A parent may exercise every one of these rights for any child profile in their household, and may refuse further collection by deleting the profile.

To make a request, write to [email protected]. We will verify that the request comes from the account holder before acting on it, and we will respond within the period the applicable law allows — thirty days in most cases, forty-five in California. Exercising a right never costs you anything and never degrades your use of the app.

14. Links a parent adds

A parent can attach a link to a reward — for example, the item the child is saving up for. Following that link takes you to a site we do not operate and whose privacy practices are its own. Because a child could tap it, please only attach links you are comfortable with your child opening, and review them from time to time.

15. Changes to this policy

We will update this page when the product changes what it collects or how it is used, and the "last updated" date at the top will always tell you when. If a change is significant — a new category of data, a new recipient, or a materially different use — we will notify you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again.

We will never apply a materially different use to data we already hold about a child without fresh parental consent.

16. Contact us

For anything in this policy — a question, a rights request, a correction, or a complaint — write to [email protected].

BrainLayer Inc., 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States.

If you are in the EEA or the UK and are not satisfied with our response, you may complain to your local supervisory authority.

The short version