BuzzChores — Privacy Policy

This Privacy Policy explains how KODOLAB S.R.L. ("we", "us"), a company registered in Romania (CUI 53158991, Trade Register no. J2025099484007, registered office Str George Topirceanu 38 A, Otopeni, Ilfov, Romania), collects and uses personal data in the BuzzChores mobile application (the "App").

We are the data controller for this data. You can reach us at office@kodolab.dev.

The App is not currently offered to users in the United Kingdom. If we extend availability there, we will update this policy to name a UK GDPR representative as required by law.

1. Our approach in short

2. What we collect

An email address is required to create an account — without it, you cannot use the App. Everything else below is provided voluntarily as you use the App's features.

a) Account data

• Email address — to create your account, sign you in, and send account emails.
• Password — stored only as a secure cryptographic hash; we never see it in readable form.
• Account creation and sign-in timestamps.

b) Family and profile data (entered by you)

• Family name.
• Member profiles: a name or nickname, a role (parent or child), and a colour/emoji avatar.
• Invite codes used to let a family member sign in on their own device.

c) Chore data (entered by you)

• Chore titles, optional notes, checklists, and categories.
• Due dates/times, repeat settings, reminder settings.
• Assignments, reward points, completion records (who completed what and when) and parent approvals.

d) Device data

• Notification permission and reminders scheduled locally on your device.
• If you enable push notifications, a push token — a device identifier used only to deliver the notifications you enabled.
• The text of each notification — for example a chore title and the name or nickname of the family member who completed or skipped it, which can be a child's. It is sent through Expo's push service to Apple's or Google's notification service so it reaches your device.

e) Subscription data

• Whether your family is on the free trial or a paid plan, which plan, and the relevant start, renewal and expiry dates.
• A store transaction / subscription identifier and your app account identifier, used to match a purchase to your family and keep access in sync.
• We do not receive or store payment card details — Apple, Google and our subscription processor (see section 5) handle payment; we only see that a subscription is active.

f) What we do NOT collect

• No location data, contacts, photos, or microphone/camera access.
• No advertising identifiers, ad networks, or third-party tracking analytics. No cookies.
• No payment card, bank or billing-address details.
• No special category data under Article 9 GDPR — health, biometric, genetic, racial or ethnic origin, religious belief, political opinion, or similar sensitive data.

3. Children's data

BuzzChores is designed to be set up and managed by parents or guardians — a child never creates their own account independently. Child profiles are created by an adult and normally contain only a first name or nickname and a colour/emoji — no email, no birthdate, no contact details.

A parent may optionally invite an older child to sign in on their own device, which requires an email address and password for that child. To do this, the parent must already be signed in to their own adult account and actively choose to create that login — a child cannot request or create it themselves.

Legal basis. For a child's profile data, our legal basis is legitimate interests (Article 6(1)(f) GDPR): the family's interest in organising household chores together. We have weighed this against the child's interests and rights, and we limit what we collect to a nickname, an avatar and chore data, with no ads, no tracking and no data shared beyond the providers listed in section 5. For the parent's own data we rely on our contract with the parent (Article 6(1)(b)). The email confirmation above is a safeguard, not the legal basis. A parent can object to the processing of a child's data, or have it deleted, at any time (see sections 7 and 8).

The age at which a child can consent alone differs by law: 16 in Romania (each EU country sets its own, between 13 and 16) and 13 in the United States (COPPA). We do not check a child's age, so every child profile and every invited child login is treated the same way: it needs the parent's confirmation described above.

We do not knowingly collect personal data directly from a child without a parent's involvement. If you believe a child's data was provided without proper consent, contact us at office@kodolab.dev and we will delete it.

4. Why we process your data (legal bases)

• Performance of a contract — to provide the App's core features (accounts, chores, reminders) to the parent or adult account holder.
• Legitimate interests — to process the child profiles a parent creates (see section 3), and to keep the service secure, prevent abuse, and fix problems.
• Consent — for device notifications (you can withdraw this anytime in your device settings).
• Legal obligation — where we must keep records (e.g. accounting for paid subscriptions).

We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you.

5. Who processes data on our behalf

We use a small number of service providers ("processors"), bound by contract to protect your data:

• Supabase — database, authentication and hosting (EU region).
• Resend — sending account emails such as confirmations, invites and password resets (EU region).
• Apple / Google — app distribution and payment processing for subscriptions.
• RevenueCat — managing subscription status on our behalf. It receives your app account identifier, purchase receipts and basic device/platform information from the app stores; it does not receive payment card data.
• Expo — delivery of push notifications, if you enable them. It receives your push token and the text of each notification (see section 2d), and delivers them through Apple Push Notification service and Google Firebase Cloud Messaging.

We do not sell or rent personal data to anyone.

If KODOLAB is involved in a merger, acquisition, or sale of some or all of its assets, personal data may be transferred as part of that transaction. We will require any acquiring party to honour the commitments made in this Privacy Policy, and we will notify you before your data becomes subject to a different privacy policy.

6. International transfers

Supabase and Resend process data in the EU region, so no international transfer occurs for the data they handle.

RevenueCat, Apple, Google, and Expo are US-based, so data they handle is transferred outside the EEA. The safeguard in place depends on the processor:

• RevenueCat transfers data under the European Commission's Standard Contractual Clauses.
• Apple and Google participate in transfer mechanisms including the EU-US Data Privacy Framework and/or Standard Contractual Clauses for their respective services.
• Expo states it complies with the EU-US Data Privacy Framework and GDPR.

Because a processor's certification status can change, you can check any US company's current EU-US Data Privacy Framework status at dataprivacyframework.gov/list.

7. How long we keep data

• Account and family data: for as long as your account exists. We delete it within 30 days of account deletion (deleting in the App takes effect straight away). Deleting your account also deletes the customer record we hold for you at our subscription provider, RevenueCat. Our database is backed up daily and each backup is kept for 7 days, so deleted data leaves the backups within 7 days.
• Chore and completion history: until you delete it or delete your account.
• Subscription and accounting records: for the periods required by Romanian accounting law (Law 82/1991), generally 5 to 10 years depending on the record.

8. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, or object to processing of your data, and the right to data portability. Where we rely on your consent, you can withdraw it at any time. To exercise any right, email office@kodolab.dev. We answer within one month; for complex requests we may extend this by up to two further months, and we will tell you if we do.

To delete your account and data, use the App or follow how to delete your account.

You may also lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or your local EU authority.

9. Security and governance

Data is transmitted over encrypted connections (HTTPS) and stored with access controls that isolate each family's data from every other family. Passwords are stored only as hashes. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information. If a breach affecting your rights occurs, we will notify you and the relevant supervisory authority as required by law.

KODOLAB has assessed that, given the App's current scale and the categories of data it processes, a Data Protection Officer is not required under Article 37 GDPR, and a formal Data Protection Impact Assessment is not currently required under Article 35 GDPR. These assessments are documented and reviewed periodically, and we will revisit them as the App grows or if the nature of our processing changes.

10. Changes to this policy

We may update this policy as the App evolves. We will update the "Last updated" date above and, for significant changes, notify you in the App or by email.

11. Contact

KODOLAB S.R.L.
Str George Topirceanu 38 A, Otopeni, Ilfov, Romania
Email: office@kodolab.dev