Privacy & Children's Privacy Policy

PrettySure (“PrettySure,” “we,” “us,” or “our”), operated by PrettySure, provides a family motivation app at prettysure.io. This policy explains what we collect, why, who helps us process it, how long we keep it, and the choices and rights you have. PrettySure is intended for parents and legal guardians; children use it only under a parent's account and supervision. For the specifics that apply to children's information under COPPA, see our Children's Privacy notice, which forms part of this policy.

The short version

• We collect the minimum needed to run your family's weekly progress loop.
• We never show ads, and we never sell or “share” personal information.
• Children don't have their own logins and don't give us contact details.
• You can review, export, or delete your family's data at any time.

Who we are (operator & contact)

The operator responsible for your information is PrettySure. You can reach us about privacy at privacy@prettysure.io. Our postal mailing address is available on request by email.

Information we collect

• Parent account: your email address, your name, and a family name, used to create and secure your account.
• Child profile: a first name or nickname and an avatar/color that youenter for your child. We do not ask for a child's last name, home address, email, phone number, or date of birth.
• Quest activity: reading minutes, math and quiz practice attempts, check-ins, and chore completions logged in the app.
• Photos: only the photos a child submits for a photo quest. They are stored privately and shown to you for approval. We do not use them for any other purpose.
• Billing: if you subscribe, our payment processor (Stripe) handles your card details. We never receive or store your full card number; we keep only a subscription status and identifiers needed to manage your plan.
• Essential technical data: a login/session cookie and minimal server logs (such as IP address and request metadata) needed to operate, secure, and debug the service.

We do not collect biometric identifiers, government-issued identifiers, precise geolocation, contacts, or audio, and we do not build advertising or behavioral profiles.

How we use information

We use information solely to operate PrettySure: to calculate weekly progress, show quests, enable your approvals, send the account and (optional) digest emails you ask for, process subscriptions, keep accounts secure, and meet legal obligations. We do not use it for advertising or to build profiles. Where the law (such as the EU/UK GDPR) requires a legal basis, we rely on performance of our contract with you, your consent (which you may withdraw), our legitimate interest in running and securing the service, and compliance with legal obligations.

Children's privacy (COPPA)

PrettySureis designed to comply with the U.S. Children's Online Privacy Protection Act (COPPA). Children do not create their own accounts. Because a parent creates the account, provides any child information, and approves activity, the parent acts as the consenting adult. We practice data minimization, collecting only a first name/nickname, an avatar, and the activity a child logs.

How we obtain verifiable parental consent.Account creation requires a parent to provide a verifiable email address and to affirmatively agree to this policy before any child information is collected. Because we use children's information only to operate the service internally and never disclose it to third parties for advertising or their own purposes, COPPA permits this email-based (“email plus”) consent method. We will obtain a higher level of verifiable consent before introducing any feature that would disclose a child's personal information to a third party.

As a parent or guardian, you can at any time:

• Review the information associated with your child in the app.
• Edit your child's profile, or delete your child entirely, which removes their profile, quest activity, and photos.
• Delete your whole account from Data & privacy in settings, or by contacting us.
• Refuse further collectionby deleting the child or account. We do not condition a child's participation on collecting more information than is reasonably necessary.

See our full Children's Privacy notice for the COPPA direct-notice details.

What we never do

• No advertising, ad networks, or third-party advertising trackers.
• No selling, renting, or “sharing” (cross-context behavioral advertising) of personal information.
• No behavioral advertising to children, ever.
• No real-money transfers, debit cards, or financial products. Rewards are arranged offline by you.

Service providers (subprocessors)

We share data only with the vetted providers that help us run the app, each acting as our processor under contract and not for their own purposes:

• Supabase: authentication, database, and private photo storage.
• Vercel: application hosting and content delivery.
• Stripe: subscription payments (parent billing only).
• Resend: sending transactional and (opt-in) digest emails.

We also use anonymous, cookieless performance analytics (Vercel Speed Insights) that measures page load speed only. It collects no names, emails, or other personal information and does not track individuals across sites. We may also disclose information if required by law or to protect the rights, safety, and security of our users and the service.

Data retention

We keep personal information only for as long as is reasonably necessary to provide the service and for the purposes described here; we do not retain it indefinitely. Specifically:

• Account, child profiles, and activity are kept while your account is active so we can show your history and progress.
• Deleting a childpromptly removes that child's profile, activity, and photos. Deleting your accountremoves your family's data.
• Quest photos are kept only as long as needed for review and your records, and are removed when the child or account is deleted.
• Demo (anonymous) sessions are automatically deleted within about 24 hours.
• We may retain a limited record where a law (for example, tax or accounting rules for payments) requires it, for the period that law requires.

After deletion, residual copies in our providers' encrypted backups are purged on their normal backup-rotation cycle.

How we protect data (security)

We maintain a written information-security program with administrative, technical, and physical safeguards appropriate to the sensitivity of children's data:

• Encryption in transit (HTTPS/TLS) and at rest in our database and file storage.
• Database row-level security so each family can only access its own data, enforced by the database itself rather than just the app.
• Quest photos kept in a private storage bucket, served only through short-lived signed links.
• Least-privilege access controls, secret management, and security response headers.
• Rate limiting and abuse protection on public endpoints.

No method of transmission or storage is perfectly secure, but we work to protect your family's information and to address issues promptly. If a breach affecting personal information occurs, we will notify affected users and regulators as required by law.

Your rights & choices

Depending on where you live, you may have rights to access, correct, delete, or port your information, to object to or restrict certain processing, and to withdraw consent. Under California law (CCPA/CPRA) you have the right to know, delete, and correct your information and to non-discrimination for exercising those rights; because we do not sell or “share” personal information, there is nothing to opt out of. Under the EU/UK GDPR you also have the right to lodge a complaint with your supervisory authority. We honor these requests for you and your child. To exercise any right, email privacy@prettysure.io from the address on your parent account so we can verify the request.

International users & data transfers

PrettySureis operated from, and stores data in, the United States. If you use the service from outside the U.S., you understand your information will be processed in the U.S. Where required, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for international transfers.

Cookies

We use only essential cookies required to keep you signed in, plus the privacy-friendly performance analytics described above. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for the full list.

Changes to this policy

If we change this policy, we'll update the date above and, for material changes, provide notice in the app or by email. For changes that affect previously collected children's information, we will obtain any further parental consent the law requires.

Contact us

Questions or data requests: privacy@prettysure.io. A postal mailing address is available on request.