Privacy policy

What we collect

We collect the minimum needed to run a family achievement app: your email and the names + ages of household members you add as players, the goals you create, the photos and screenshots players attach as proof of a win, and the resulting points and streaks.

If you connect a calendar, we read events to figure out who's home on which day. We don't read meeting bodies, attendees, or attachments — just date and a tag/title match against player names.

Children's data (COPPA)

This app is designed to be set up by a parent or guardian for use within their own household. Parents are the account owners; kids access via parent-issued logins. We don't advertise to kids, don't sell data, and don't share kid data with third parties beyond the infrastructure required to run the app (database, file storage, email, push delivery).

Parents can delete their household at any time, which removes all associated profiles, submissions, photos, and stat events.

How we store it

Data lives in a Postgres database (Supabase). Photos live in object storage (Supabase Storage). Both are encrypted at rest and in transit. Access is gated by row-level security so a household can only ever read its own data.

Third parties we use

• Supabase — database, auth, storage
• Vercel — hosting + analytics
• Resend — transactional email (parent digest)
• Web Push — browser notifications you opt into
• Anthropic Claude — optional photo verification, opt-in per goal

Your rights

You can export, correct, or delete your household's data at any time. Email privacy@halloffam.app and we'll respond within 30 days.

Changes

If we change this policy in a way that affects you, we'll notify the household coach by email before it takes effect.