Privacy policy

1. Who is responsible

Controller: [full name or company name], [tax ID], [postal address]. Contact for anything about privacy: [hola@creatribu.es].

2. What we keep

About adults (whoever creates the family and adults who join it):

• email, to sign in with a link; if you choose to sign in with Google, Google gives us that email;
• the name you go by at home;
• a 4-digit PIN, stored encrypted (we cannot read it).

About kids, who have no account and no email:

• their name, the avatar drawing they pick and their birth year;
• a 4-digit PIN, stored encrypted.

What you do in the app: chores, approvals, points and their history, rewards, investments with points, badges, streaks and the avatar's look.

About the device, only if you turn notifications on: the encrypted address the browser provides to send them.

Technical data: server logs (IP address, browser, time) kept by our providers so the service works and stays secure.

We never ask for photos, location, contacts or payment details. Points are not money.

3. Why, and on what legal basis

• To provide the service you ask for when you create a family (performance of a contract).
• Kids' data is added by an adult in the family, who states they are the kid's parent or legal guardian or has their permission (consent of the holder of parental responsibility; in Spain, for children under 14).
• Security: limiting PIN attempts, ending sessions, preventing abuse (legitimate interest).
• Sending notifications, only if you turn them on for each device (consent; turn them off in Settings).
• Answering when you write to us.

No advertising, no selling data, no profiling. We do not use the data to train models.

4. Cookies

We only use technical cookies the app needs to work: one keeps your account signed in and another remembers which family profile the device is using. No analytics or advertising cookies.

5. Who else processes the data (processors)

• Supabase: database and sign-in. Region: [production project region].
• Resend: sends the sign-in emails (EU region).
• Vercel: hosts the website. Function region: [configured region].
• Google: only if you choose to sign in with Google.
• Your browser's notification service (Google, Mozilla, Apple or Microsoft), only if you turn notifications on.

If a provider processes data outside the European Economic Area, it does so with GDPR safeguards (standard contractual clauses or an adequacy decision). [confirm with each provider]

6. How long

For as long as the family exists. Whoever created it can delete it from Settings, with everything in it, after seeing exactly what will go. Any other adult can ask us to delete their account by writing to the contact in section 1.

If the CreaTribu team has to disable or delete a family or an account (for example, for abuse), we record what was done, when and why, with the family name or the email concerned, to stay accountable.[retention period for that record]

7. Your rights

You can ask for access to your data and your kids' data, and to correct, delete, restrict, object to or take a copy of it, by writing to [hola@creatribu.es]. If we don't answer properly, you can complain to the Spanish Data Protection Agency (aepd.es) or your local authority.

8. Changes

If something important changes, we will tell you in the app and by email before it applies.