Privacy Policy & COPPA Disclosure

1. Introduction & Scope

Deedio ("we", "us", or "our") provides a positive habit-building and chore-management platform designed to empower children and support parents through collaborative routines. Because our platform is used within the family home and directly accessed by young children via tablet Kiosk stations and parent mobile devices, child privacy and data minimization are the core design principles of our software architecture.

This Privacy Policy articulates our data handling practices in strict compliance with the United States Children's Online Privacy Protection Act (COPPA) (15 U.S.C. §§ 6501–6506), the European Union General Data Protection Regulation for Kids (GDPR-K) (Regulation (EU) 2016/679, specifically Article 8), the UK Age Appropriate Design Code, Apple App Store Guideline 5.1.1, and the Google Play Families Policy.

2. Verifiable Parental Consent & Account Creation

Deedio is strictly designed so that only a parent or legal guardian aged 18 or older can create an account and register a household family. Children are never permitted or able to register standalone accounts. During account setup, we collect:

• Parent Name: First and last name of the parent or guardian for identification within the family circle.
• Parent Email Address: Used exclusively for authentication, account security, password and Master PIN recovery, and critical service notifications.
• Authentication Credentials: Secure, cryptographically hashed passwords and Master PINs (salted using bcrypt; plain text passwords and PINs are never stored or logged).
• Household / Family Title: An optional family label chosen by the parent (e.g. "The Miller Family").

3. Children's Data Collection Minimization (COPPA & GDPR-K)

In compliance with COPPA’s data minimization mandate, parents have exclusive control over creating, editing, and deleting child profiles. We collect only the absolute minimum information necessary to provide the gamified habit-tracking experience:

• Child Screen Name or Nickname: Parents are encouraged to use a first name or friendly nickname. Surnames, birth dates, and government identity numbers are never requested.
• Selected Character Avatar: A graphical preset icon selected by the parent or child to personalize their chore quest.
• Chore & Habit Records: Daily deeds assigned by parents, timestamps when marked completed, spendable Stars (⭐) earned, and XP accumulated toward Adventure Track milestones.
• Parent-Defined Reward Wishlists: Custom household rewards created by parents (e.g., "30 min weekend gaming", "Select Friday family movie").

Information We Strictly DO NOT Collect from Children:

• No children's email addresses or phone numbers.
• No precise or coarse geolocation data.
• No biometric identifiers, voice recordings, or facial scans.
• No device advertising IDs (the com.google.android.gms.permission.AD_ID permission is explicitly blocked from our application manifests).
• No open-ended chat rooms, social networks, or unmoderated communication channels between children.

4. On-Device Camera Processing for Kiosk Pairing

The Deedio mobile and tablet applications request optional camera access solely for optical scanning of local family pairing QR codes (e.g. connecting a stationary home tablet into a PIN-locked Kid Kiosk station).

5. EU & UK GDPR-K Rights (Articles 8, 12 & 17)

For families residing in the European Economic Area (EEA) and the United Kingdom, we process personal data under lawful bases provided in Article 6 and Article 8 of the GDPR:

• Lawful Basis & Parental Authorization (Article 8): We process child profile data based on explicit verifiable consent granted by the child's parent or legal guardian when setting up the family account.
• Transparent Communication (Article 12): We deliver privacy notices in clear, plain language understandable to parents and young readers.
• Right of Access & Portability (Articles 15 & 20): Parents may request an export of their family's chore history and profile data by writing to privacy@deedio.app.
• Right to Rectification (Article 16): Parents can modify child names, avatars, chore lists, and Star balances at any time directly in the Parent Hub.
• Right to Erasure ("Right to be Forgotten" - Article 17): Parents can execute an immediate, permanent cascading purge of all family data directly in the app or via our Web Account Deletion Portal.
• Right to Restrict or Object to Processing (Articles 18 & 21): Parents may revoke consent at any time, terminating all background data synchronization.

6. Third-Party Technical Sub-Processors

We do not sell or monetize personal data. Deedio utilizes a limited group of SOC 2 / ISO 27001 certified technical infrastructure providers exclusively to host and deliver our service securely:

7. Data Retention & Permanent Cascading Erasure

We retain family data only for the duration of the parent's active subscription and account usage. If a parent requests account deletion:

1. An immediate cascading database transaction removes the parent account, child profiles, habit records, Star balances, XP levels, and paired device tokens.
2. All associated database foreign keys are purged concurrently.
3. Automated database backup archives expire and are completely overwritten within our rolling 14-day retention cycle.

8. Security Measures

We implement defense-in-depth security standards:

• All network communications between mobile devices, kiosk stations, and servers require HTTPS with TLS 1.3 encryption.
• Parent passwords and Master PINs are hashed using bcrypt with adaptive salt work factors.
• Kiosk stations authenticate using short-lived cryptographic tokens without ever storing parent passwords on shared family tablets.
• Strict Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and Permissions-Policy headers prevent cross-site scripting and unauthorized browser capabilities.

9. Contact Our Data Protection Officer (DPO)

For privacy inquiries, GDPR-K data subject requests, or COPPA compliance questions, please contact our Data Protection Officer: