Privacy Policy
1. Who is responsible
The Vector Foundry AB, org. no. 559535-5636, Sweden, is the data controller for Earnest Family. Contact: info@vectorfoundry.se.
2. What we process
| Data | Details |
|---|---|
| Parent account | Email address, name, password (stored hashed by our auth provider). |
| Child profiles | First name, age, avatar, virtual balances, task and reward history. Entered and managed by a parent or guardian. Children sign in with a personal login code; we collect no email, phone number or other contact data from children. |
| Subscription | Your plan, its status and renewal date. Payments are processed by Stripe as merchant of record — your card details go directly to Stripe and never reach us. |
| Feedback & support | Messages you send us, together with device type and app version. Your account email is attached only if you ask us to contact you about the feedback. |
| App settings | Product settings on your account, such as language preference and tutorial progress. |
| Usage analytics | Two levels, both via PostHog with servers in the EU. Anonymous counting (on for parents unless switched off in Settings): no cookies and no identifier stored on your device. To tell one visit from another, PostHog's server computes a hash from your IP address and browser details with a salt that changes every day and is then discarded; the IP address itself is not stored with the events. Full analytics (only if you allow it): product events (e.g. "task created") tied to an analytics ID stored on your device and to your account ID — never your name or email. Children's sessions are never tracked at either level. On the website (earnestfamily.se) we count visits the same anonymous way, without cookies; browsers that send Do Not Track or Global Privacy Control are not counted. No advertising, no sale of data. |
| Technical logs | Standard server logs (IP address, timestamps) kept briefly for security and troubleshooting. |
3. Why and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the app: accounts, tasks, balances, sync | Contract (Art. 6(1)(b)) |
| Managing subscriptions and entitlements | Contract (Art. 6(1)(b)) |
| Product analytics — anonymous counting | Legitimate interest (Art. 6(1)(f)) — you can object at any time by choosing Off under Analytics in the app's settings |
| Product analytics — with an analytics ID | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Ad conversion measurement (Google Ads) | Consent (Art. 6(1)(a)) — same choice as the analytics ID, withdrawable at any time |
| Security, abuse prevention, troubleshooting | Legitimate interest (Art. 6(1)(f)) |
| Bookkeeping and legal obligations | Legal obligation (Art. 6(1)(c)) |
4. Children's data
Child profiles exist so that families can track routines together. They are created, controlled and deletable by the parent or guardian at all times. We process this data only to provide the service to the family, never for advertising or profiling, and we never contact children. A child's session in the app sends no analytics data at all — nothing anonymous, nothing identified.
5. Who we share data with
| Recipient | Role |
|---|---|
| Supabase | Database, authentication and hosting for the app's data (processor). Our database is currently hosted in Singapore; the transfer is safeguarded by the EU Standard Contractual Clauses. |
| Vercel | Web hosting / content delivery (processor). |
| Stripe | Payment processing as merchant of record (independent controller for payment data — see Stripe's privacy policy). We share your email and name with Stripe to create your customer record. |
| PostHog (EU) | Product analytics (processor). Receives anonymous usage counts and, only if you allow it, product events tied to an analytics ID. Servers in the EU. |
| Google Ads | Conversion measurement, only if you allow analytics cookies and only in a parent session: when you create an account, subscribe or approve a task, Google learns that its ad led to it, without your name, email or what the task was. Ad personalization is switched off in the tag. No remarketing. |
We never sell personal data and share nothing with advertisers.
6. How long we keep data
Account and family data is kept while your account exists and is deleted when you ask us to delete the account. Analytics data follows PostHog's retention settings. Payment records are kept by Stripe and in our bookkeeping as required by law. Backups expire on a rolling basis.
7. Cookies and local storage
| Storage | Purpose | Consent? |
|---|---|---|
| Login session | Keeping you signed in (strictly necessary) | Not required |
| App preferences | Your settings, e.g. selected child, this consent choice (strictly necessary) | Not required |
| PostHog analytics | Analytics ID for the full level; anonymous counting stores nothing on your device | Required for the analytics ID — asked in the app, withdrawable |
| Google Ads click id (_gcl_aw) | Remembers for 90 days that you arrived via a Google ad, so a later account can be counted as that ad's result | Required — the same choice as the analytics ID |
Under Analytics in the app's settings you can choose Full, Anonymous or Off at any time: Full stores the analytics ID, Anonymous keeps only the cookieless counting, Off sends nothing from that device. You can also email us and we will delete the analytics data tied to your account.
8. Your rights
You have the right to access, correct, delete and receive a copy of your personal data, to restrict or object to processing, and to withdraw consent at any time. Contact info@vectorfoundry.se. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se) or your local supervisory authority.
9. Changes
We will update this policy when our processing changes and give notice in the app for material changes.