Privacy Policy

This Privacy Notice for ParentPulse LLC, a Georgia limited liability company ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you visit our web application at myparentpulse.app, install ParentPulse as a Progressive Web App (PWA) on your device, or use the ParentPulse app for Android from Google Play. The Android app is this same application delivered in a native wrapper: it collects nothing additional, requests no additional device permissions beyond notifications, and everything in this notice applies to it identically.

1. Information We Collect

Personal Information You Provide

When you register for an account or use our Services, you may provide the following information:

Information Collected Automatically

When you use our Services, we automatically collect limited technical information:

Information We Do Not Collect

We want to be clear about what we do not collect:

• Phone numbers, except any you choose to write on a caregiver prep sheet you save to your family (a ParentPulse+ feature; see Section 1)
• Mailing or physical addresses, with the same single exception: an address you choose to write on a saved caregiver prep sheet
• Precise geolocation (GPS coordinates)
• Social media account information
• Dates of birth
• Ages, with the same single exception: an age you choose to write on a saved caregiver prep sheet
• Last names
• Financial information beyond card brand and last four digits

2. How We Process Your Information

We process your personal information for the following purposes:

• To provide and maintain the Services: creating and managing your account, syncing family data across devices in real-time, displaying behavioral charts, managing chore assignments and reward redemptions.
• To facilitate family collaboration: sharing chore lists, calendar events, reward shops, recognition messages, and behavioral data among linked family members within the same family unit.
• To provide AI-powered coaching: sending family behavioral data to Anthropic's API (server-side only) to generate personalized coaching reports for parents/guardians.
• To process payments: creating Stripe customer profiles and managing subscription billing for ParentPulse+ premium features.
• To deliver push notifications: sending alerts for new kid requests, partner messages, chore verifications, and streak milestones, and, for parents only, event reminders about the family calendar (when enabled by the user).
• To send parents event reminders: where Event reminders are available to your family, each parent can receive an evening summary of tomorrow's calendar events by email and by notification, and a notification shortly before an event that has a set time. The summary lists each event's title and time and the first names of the family members tagged on it, as entered or approved by a parent. These go only to the family's parents/guardians; children never receive them. Each parent controls their own reminders in Settings, and every summary email carries a link that turns that email off in one click.
• To send you email about your account: payment receipts, failed-payment notices, notice before a free trial converts to a paid subscription, account-deletion confirmations, and replies to support messages you send us. We also send a welcome message when you create a family and, during your first two weeks, at most two setup reminders, each sent only once: one if no child has been added to the family after a few days, and one if children have been added but no chores have been set up after a few days. The welcome and setup reminders are optional and every one of them carries an unsubscribe link; the account and billing notices are essential to the Service and are always sent.
• To diagnose and improve the Services: collecting error logs and performance telemetry to identify and fix issues.
• To understand and improve product usage: recording limited, non-identifying first-party analytics about key milestones (such as account creation, family setup, and checkout initiation) to measure activation and prioritize improvements. These analytics are never collected during a child or kiosk session. On our public pages, for signed-out visitors only, we also count visits with Cloudflare Web Analytics to see which pages and which websites bring visitors to ParentPulse (see Section 5).
• To protect the Services: enforcing Row Level Security policies that ensure users can only access their own family's data.

3. Legal Bases for Processing

If you are located in the EU or UK, we process your personal information based on the following legal grounds:

• Consent: You have given us permission to process your personal information for specific purposes, such as enabling push notifications, using AI coaching features, or joining our optional updates mailing list. For the mailing list, your consent is the only basis we rely on: we record when you gave it, which page you gave it on, and the confirmation click itself, and withdrawing it removes your address entirely.
• Performance of a contract: Processing your information is necessary to fulfill our obligations under the Terms of Service, including providing the Services, managing your subscription, facilitating family collaboration, and sending parents the event reminders they have left on.
• Legitimate interests: Processing is necessary for our legitimate interests, such as diagnosing errors, improving service reliability, understanding how the Service is used through limited first-party analytics so we can improve it, counting visits to our public pages with Cloudflare Web Analytics, sending the optional welcome email and at most two one-time setup-reminder emails so a new family can actually get started (you can opt out of these at any time from the link in the email), and preventing fraud, provided these interests are not overridden by your rights.
• Legal obligation: Processing your information may be necessary to comply with applicable laws.

4. When and With Whom We Share Personal Information

We share your personal information only in the following circumstances:

Within Your Family

All family data (clip chart positions, star balances, chore lists, calendar events, rewards, recognitions, and trophies) is shared among all members within the same family unit. Parent messages are visible only to guardian/admin profiles within the family. No data is shared between different families.

Third-Party Service Providers

GitHub, Cloudflare, and Google appear on this list because they operate infrastructure that necessarily handles data in transit or at rest. None of them are advertising or tracking providers. The one analytics service among them is the Cloudflare visit counter on our public pages, which sets no cookies (see Section 5).

Legal and Safety Disclosures

We may disclose personal information where we are required to do so by law or in response to valid legal process such as a subpoena or court order, or where we believe in good faith that disclosure is necessary to protect the safety of a child or another person, to investigate fraud, or to enforce our Terms of Service. Where we are legally permitted to do so, we will notify the affected account holder before disclosing.

Business Transfers

If ParentPulse LLC is involved in a merger, acquisition, or sale of all or part of its assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

We do not sell, rent, or trade your personal information to third parties. This is not limited to marketing or advertising: we do not sell it for any purpose. The only third parties who receive your information are the service providers listed above in this section, who receive it solely so that we can operate the Service, and the business-transfer scenario described immediately above.

We do not build commercial profiles of anyone. This applies to every person in the household, not only to children: we do not use a parent's, guardian's, or child's information for advertising, marketing, or profiling purposes, and we do not construct inferred or predictive profiles about any of you for our own commercial benefit or anyone else's.

5. Cookies and Tracking Technologies

We do not use cookies. We do not use advertising networks, tracking pixels, or fingerprinting technologies.

We do collect limited first-party product analytics (described in Section 1). This uses no cookies or cross-site identifiers, does not track you across other websites, is never collected during a child or kiosk session, and is never shared with third parties.

Visit counting on our public pages. Our public pages are the home page you see before signing in, our guides and stories, our free tools, and our legal pages such as this one. We use Cloudflare Web Analytics only on our public pages, and only while you are signed out, so we can see which pages and which websites bring visitors to ParentPulse. For each visit it reports the address of the page and of the web page that sent you there (in both cases without the part after a question mark), your country, your browser, device type and operating system, and technical measurements of how quickly the page loaded and responded to taps and clicks, including a technical label (such as “button”) for the part of the page that was slowest, and a random number that identifies only that one page view. Cloudflare says this visit counter sets no cookies, stores nothing in your browser, does not fingerprint you, and does not track you across other websites. Cloudflare receives your IP address as part of delivering the request, and says it discards it rather than storing it. The counter is never loaded inside the signed-in app, on a device in child mode or kiosk mode, or in our Google Play app. If you sign in from a public page without reloading it, the counter that page already loaded stays in that browser tab until you reload or close it. It does not count the app screens you go on to open as visits, but the first time you switch to another tab or app, or close the tab, it sends one last set of these measurements, which can include how quickly an app screen responded to a tap, labelled with the web address showing at that moment. Apart from this visit counter, we do not use third-party analytics services.

We do not track you across other apps, services, or devices. The ParentPulse app contains no third-party advertising or analytics SDKs (the visit counter above runs only on our public pages), sets no cross-app or cross-device identifiers, and takes part in no data exchange, cooperative, or identity graph that could link what you do here to what you do anywhere else. Nothing we collect leaves the Service to be matched against your activity elsewhere.

We do use browser localStorage for the following functional purposes:

• Maintaining your authentication session
• Remembering your active profile selection
• Storing kiosk mode state
• Buffering diagnostic events for retry when offline
• Recovering interrupted photo uploads
• Saving drafts of our free public tools (the caregiver prep sheet and the chore chart maker) on your own device

We also use the browser’s Cache Storage to keep a copy of the application itself (its page shell, scripts, stylesheets and icons) so ParentPulse still opens and shows you a usable screen when your device has no internet connection. This cache holds only the application’s own program files, which are identical for every user. No family, child, or account data is ever stored there, and it is cleared whenever you use the “Deep Reset App” option.

These are strictly necessary for the functioning of the application and do not track you across websites or share data with third parties.

One more localStorage entry is not strictly necessary: the first-party analytics record of how you first found us (the referring site’s name, any campaign labels, and the first page you visited, described in Section 1). It stays in your browser until you clear this site’s data or use the “Deep Reset App” option, and it is sent to us only with your signup and family-setup events.

6. Artificial Intelligence Features

ParentPulse uses AI in two specific features, both processed server-side through Supabase Edge Functions:

Pulse AI Coaching Reports

When a parent/guardian requests a coaching report, we send family behavioral data to Anthropic's Claude Haiku 5.5 model. This includes children's first names, current behavioral tiers, star balances, streak counts, chore completion rates, the names of chores, rewards, and goals you have created, each child's North Star goal progress, the family's Family Goal and Family Stars progress, recent Blue Ribbon recognitions, earned trophies, reward spending patterns, behavior trend data, and any optional focus note the parent has written. The AI generates a personalized coaching report that is cached in our database.

Coaching reports are limited to one generation per seven days. Free users receive one preview report; additional reports require a ParentPulse+ subscription.

Kid Request Event Extraction

When a child submits a free-text request (e.g., "Can we go to the park Friday?"), we send only the request text (up to 1,000 characters) and the creation date to Anthropic's API to extract structured event details (title, dates, category). No child names, family IDs, or other identifying information is sent for this feature.

Important: AI-generated content is informational only and does not constitute professional parenting, medical, or psychological advice. The Anthropic API key is stored exclusively on our servers and never exposed to client devices.

7. How Long We Keep Your Information

• Account data: Retained for as long as your account is active. If you request account deletion, we will remove your data within 30 days. Encrypted backups run on their own 90-day cycle (see Section 4), so data from a deleted account, or from a child profile you remove, can persist inside an encrypted backup file for up to 90 days after erasure. Those files are never used to restore a deleted account, and cannot be read without a key that is not stored alongside them.
• Optional reason for leaving: When you delete your account or start over, we ask why. Answering is optional and never affects the deletion. If you answer, we keep the reason you picked and any short note you write, together with the date and how many days old your family was, without your name, email address, family, or any link to your account. Because it cannot be traced back to you, it is not deleted with your account. We remove email addresses and phone numbers from the note before storing it, and we ask you not to include names.
• How you heard about us: If you answer this optional question when starting a family, the answer is kept with your family and deleted together with it (see Account data above).
• Family behavioral data: Retained until you manually wipe analytics via the Danger Zone in Settings, or until account deletion.
• Photos (chore proof): Stored in a private, access-controlled bucket. Purged weekly via our automated server-side cleanup process.
• AI coaching reports: Retained in the database until account deletion.
• Telemetry and diagnostic data: Retained for up to 30 days for debugging purposes, then automatically purged.
• Product analytics events: Retained for up to 30 days, then automatically purged.
• Daily family activity counts: Retained for up to 12 months, then automatically purged, and deleted together with your family (see Account data above).
• Saved caregiver prep sheet (ParentPulse+): If you choose to save a caregiver prep sheet to your family, it is retained until a parent/guardian removes it in the app or the account is deleted, whichever comes first. It is never subject to the 30-day analytics purge; it is your content, kept as long as you want it.
• Payment records: Retained as required by applicable financial regulations and Stripe's data retention policies.
• Evening event summaries: We do not keep the summary emails we send; each one is built at send time from your calendar. Once delivered, a summary is a copy in the receiving parent's own mailbox, kept until that parent deletes it, and Resend keeps a copy of each sent email in its delivery logs for the limited period its log retention allows, then deletes it. Removing a child's profile or deleting your account does not recall summaries already sent.
• Updates mailing list: If you confirmed your address, it is kept until you unsubscribe, at which point the address is deleted and only a one-way fingerprint (a SHA-256 hash) is kept so the same address cannot be re-added without you asking. If you never confirmed, the address is automatically deleted 30 days after you entered it.

Additional Retention Limits for Children's Data

In accordance with COPPA data minimization principles, we apply shorter retention periods to children's data:

• Chore proof photos: Purged weekly regardless of whether the child profile is active.
• Clip movement history: Automatically purged after 12 months.
• Kiosk session audit logs: Automatically purged after 6 months.
• Diagnostic telemetry: Anonymized at collection time for child sessions (no identifying information is stored). Purged after 30 days.
• All other child data: Retained until the parent removes the child's profile or until the parent's account is deleted. Removing a child's profile permanently deletes their data: most of it right away, and certain photos at our weekly photo cleanup, normally within about a week (see Section 9). Copies in our encrypted backups are deleted when those backups expire, up to 90 days after the data itself is deleted (see Section 4). Removing a profile does not recall evening event summaries already sent that named the child (see Evening event summaries above).

8. How We Keep Your Information Safe

We implement organizational and technical security measures to protect your personal information:

• Row Level Security (RLS): All database tables enforce row-level security policies that ensure users can only access data belonging to their own family.
• Authentication: Passwords are cryptographically hashed by Supabase Auth. Sessions use JWT tokens with automatic refresh.
• Admin PIN: Sensitive operations (profile switching, danger zone actions, kiosk mode) require a 4-digit admin PIN.
• Server-side API keys: All third-party API keys (Anthropic, Stripe, VAPID private key) are stored as server-side secrets in Supabase Edge Functions and are never exposed to client devices.
• Image compression: Photos are compressed client-side before upload to minimize data transmission.
• Encrypted transport: All data in transit is encrypted via HTTPS/TLS.

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

9. Information About Children (COPPA Compliance)

ParentPulse complies with the Children's Online Privacy Protection Act ("COPPA") as enforced by the U.S. Federal Trade Commission (FTC). Our Service is designed for families and includes features used by children under 13 under parental supervision.

How We Collect Children's Information

Child profiles are created and managed exclusively by parent/guardian accounts. Children do not independently create accounts. When a parent creates a child profile, they are presented with a detailed consent notice and must affirmatively acknowledge it by entering their admin PIN. This constitutes verifiable parental consent under COPPA. For child profiles created before the consent system was introduced, parents are prompted to provide retroactive consent upon their next visit to the Settings page. No child data is collected through any path that bypasses parental consent.

What We Collect

We collect only the minimum information necessary for the Service to function. Information stored about children is limited to:

• First name and color preference (entered by the parent/guardian for their avatar)
• Behavioral data generated through app usage (tier position, star balance, streak count, chore completion status)
• Content they create within the app (kid requests, goal proposals) while using a parent-supervised session, device login, or kiosk mode
• Chore proof photos (stored in a private, access-controlled bucket; purged weekly)
• A sign-in identifier, only if you set up device login for them. We generate it internally from their profile and family IDs at a domain that receives no mail; it is not an email address the child owns, provides, or can use.
• A 4-digit PIN, only if you set up device login, stored as a one-way hash and never in readable form.

We do not collect children's ages, dates of birth, last names, physical addresses, precise location data, or device fingerprints from child sessions. Telemetry from child sessions is anonymized and contains no identifying information.

One thing sits outside a child session and belongs here for completeness: if a parent saves a Caregiver Prep Sheet (a ParentPulse+ feature), whatever that parent chooses to write on it about a child (which may include an age, allergies, or medications) is stored with the family's data. That content is authored by the parent, not by the child, is readable only by the family's parents/guardians, and is described in Section 1.

How We Use Children's Information

Children's information is used solely for the family management features of ParentPulse. We never use children's information for advertising, marketing, or profiling purposes. We do not sell children's personal information to any third party.

Third-Party Disclosures

Children's data is shared with the following third parties, solely for providing the Service:

• Supabase Inc.: Infrastructure provider that stores and processes all data. Supabase maintains SOC 2 Type II compliance.
• Anthropic: Children's data is sent to Anthropic's servers (server-side only) in two situations: (1) when a parent/guardian explicitly requests an AI coaching report, children's first names and behavioral data are sent; and (2) when a child submits a request in the app, the text of that request is sent automatically so it can be parsed into a suggested calendar event for a parent to review. You consent to both of these disclosures as part of the parental consent you provide when adding a child, where the consent notice names Anthropic and describes both purposes. No child data is sent to Anthropic for any other purpose or in any other circumstance.
• Resend: Only for parents who leave evening event summaries on, the summary email that Resend delivers to a parent's own address includes the first names of any children tagged on tomorrow's events, alongside the event titles and times a parent entered or approved. It is sent only to the family's parents/guardians, never to a child, and carries no open or click tracking. Each parent can turn it off in Settings or from the link in the email. The parental consent notice you see when adding a child names this email and Resend too. Resend keeps a copy of each sent email in its delivery logs for the limited period its log retention allows, then deletes it, and a delivered summary stays in the parent's own mailbox until that parent deletes it; removing a child's profile does not recall summaries already sent (see Section 7).
• GitHub: Each night an automated job running on a GitHub-hosted machine reads a copy of the database, including children's records and any chore photos they have uploaded, encrypts it, and retains only the encrypted file for 90 days. The decryption key is never stored on GitHub, so GitHub cannot read the backup it holds. This exists so a family's data can be restored if the database is lost.

None of these providers use children's data for advertising, marketing, or any purpose other than providing services to ParentPulse LLC.

Parental Rights Under COPPA

As a parent or legal guardian, you have the following rights regarding your child's information:

• Right to review: You can view all data collected about your child within the app (dashboard, chores, requests, goals, trophies, clip history). You can also download a complete export of your child's data from the Settings page.
• Right to refuse further collection: You can disable your child's device login, disable push notifications for their profile, or restrict their access to the app at any time.
• Right to delete: You can remove your child's profile from Settings, which permanently deletes all associated data including their profile, behavioral history, requests, goals, trophies, photos, and authentication account. Most of it is deleted right away, including photos on your child's requests and on the chores and to-do items assigned to them. Photos your child added to something not assigned to them (such as a whole-family chore or a sibling's chore), and any leftover photo that is no longer attached to anything, are deleted by our automated weekly photo cleanup, normally within about a week. Copies in our encrypted backups are deleted when those backups expire, up to 90 days after the data itself is deleted (see Section 4). Removing a profile also does not recall evening event summaries already sent that named your child (see the Resend item above). This deletion cannot be undone from the app. One nuance: a saved caregiver prep sheet is family-level, parent-authored content (like a note you wrote), so removing a child's profile does not edit it; parents can update or delete the sheet themselves at any time, and it is included in the child-data export for transparency.
• Right to revoke consent: You may revoke consent at any time by removing the child's profile, which triggers complete data deletion as described above.

Data Retention for Children

• Chore proof photos are purged weekly by an automated server-side process.
• Clip movement history is retained for up to 12 months, then automatically purged.
• Kiosk session audit logs are retained for up to 6 months, then automatically purged.
• Details a parent chooses to write about a child on a saved caregiver prep sheet (for example allergies, medications, or routines) are parent-authored content, retained until a parent edits or removes the sheet, or the account is deleted.
• All other child data is retained until the parent removes the child's profile or deletes their account.

Push Notifications for Children

Push notifications for child profiles are disabled by default. A parent must explicitly opt in to enable push notifications for each child. This opt-in is recorded and can be reversed at any time.

If you are a parent or guardian and believe we have collected personal information about your child without your consent, please contact us immediately at privacy@myparentpulse.app and we will promptly delete it.

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Right to access: You can request a copy of the personal information we hold about you.
• Right to rectification: You can update your family member names, colors, and other profile information directly within the app at any time.
• Right to deletion: You can delete your account immediately and yourself, in-app, via Settings > Danger Zone > Delete My Account. This cancels any active subscription (refunding the unused, prorated portion to your card), and your data is purged within 30 days. You can also contact us at privacy@myparentpulse.app if you'd prefer we handle deletion for you. Within the app, you can also wipe analytics data, reset behavioral charts, and reset chore statuses via the Danger Zone in Settings. If you are the only parent and your family has never had a free trial or subscription, Settings > Danger Zone > Start Over removes your family, its children, and all of its history on the same 30-day schedule, and keeps your login so you can set up again.
• Right to restrict processing: You can disable push notifications per profile and choose not to use AI coaching features.
• Right to data portability: You can request an export of your data by contacting us at privacy@myparentpulse.app.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time by discontinuing use of the relevant feature.

Parental Rights Under COPPA

If you are a parent or legal guardian, you have additional rights under COPPA regarding your child's personal information. These are described in detail in Section 9 (Information About Children) and include the right to review, export, refuse further collection, delete, and revoke consent for your child's data. You can exercise these rights directly within the app or by contacting us.

To exercise any of these rights, please contact us at privacy@myparentpulse.app. We will respond to your request within 30 days.

11. Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting. Because there is no uniform technology standard for recognizing and implementing DNT signals, we do not currently respond to DNT browser signals. However, we do not use third-party tracking technologies or advertising networks. Our only third-party analytics is the cookie-free Cloudflare Web Analytics visit counter on our public pages for signed-out visitors (see Section 5), which Cloudflare says does not track you across other websites. The limited first-party product analytics we do collect (described in Section 1) does not track you across other websites or share your activity with third parties, regardless of your DNT settings.

12. United States Privacy Rights

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have specific rights regarding your personal information under state privacy laws.

Categories of Personal Information We Collect

In the past twelve months, we have collected the following categories of personal information:

• Identifiers: Email addresses, first names, Supabase user IDs, Stripe customer IDs
• Internet or network activity: User agent strings, network connection types, diagnostic events, first-party product analytics events, push notification endpoint URLs
• Professional or employment-related information: Not collected
• Education information: Not collected
• Inferences: AI-generated coaching reports derived from behavioral data (e.g., behavior trends, chore completion patterns)

Your Rights

• Right to know: You have the right to know what personal information we collect, use, and disclose.
• Right to delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to opt out of sales: We do not sell personal information.

To exercise your rights, contact us at privacy@myparentpulse.app.

13. Updates to This Notice

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised "Last updated" date at the top of this page. If we make material changes, we will notify you by posting a prominent notice within the Services.

14. How to Contact Us

If you have questions or concerns about this Privacy Notice or our data practices, you can contact us by email at:

• Privacy inquiries: privacy@myparentpulse.app
• General support: support@myparentpulse.app