Privacy Policy

This policy explains what Cultivate collects, why, and what you can do about it. It applies to the Cultivate mobile app and this website.

Who we are

Cultivate is an independent app made by a small developer based in Trinidad and Tobago. For anything in this policy, contact [email protected].

What we collect

Cultivate is built around a single shared family account. One parent creates the family and everyone else joins it with a join code. Here is everything stored, and why:

What	Why
The founding parent's email address	To verify the account at sign-up and to let that parent sign back in later. This is the only email address we ever collect.
Profile names and avatars	So family members can tell each other apart. You choose what to type — a first name, a nickname, anything. Avatars are picked from a set of illustrated characters, not photos.
Whether each profile is a parent or a child	To decide who can create tasks, log corrections and manage rewards.
What you write in the app	Task names, reward names, course corrections and your family values. This is content you create; we only store and display it back to you.
Stars, streaks and activity history	To show balances, growth and the family activity feed. Records the star amount at the time of each action so history stays accurate.
Profile PINs	Optional. Stored only as a scrambled (hashed) value with a random salt — never the PIN itself. Nobody, including us, can read a PIN back.
A push notification token	Only if you allow notifications. It identifies the device to send reminders to. You can revoke this in your phone's settings at any time.

What we do not collect

• No passwords — the app uses email verification and optional profile PINs.
• No photographs. Avatars are illustrated characters.
• No location data.
• No contacts, calendar, microphone or camera access.
• No advertising identifiers, and no third-party analytics or tracking SDKs.
• No payment card details — see "Payments" below.

Children's privacy

Cultivate is designed to be used by families, including children, but children do not create accounts. A parent creates the family and adds each profile. A child never enters an email address, never sets a password, and is never asked for personal details.

The information associated with a child's profile is the name their parent typed, an illustrated avatar, and their chores and star history. We ask parents to use first names or nicknames rather than full legal names.

We do not knowingly collect personal information from children beyond what a parent enters when setting up the family. A parent can edit or delete any profile, or delete the whole family account, at any time from within the app. If you believe a child's information has been provided to us in a way you didn't intend, contact us and we'll remove it.

Who we share it with

We do not sell your data, and we do not share it for advertising. We use a small number of service providers to make the app work:

Provider	What it does
Convex	Hosts the database and backend that stores your family's data.
Resend	Sends the account verification email. Only ever receives the founding parent's email address.
Expo	Delivers push notifications, and passes them to Apple or Google to reach your device.
Apple and Google	Distribute the app and process any purchases.

We may also disclose information if we're legally required to, or to protect someone's safety.

Payments

Cultivate offers a free tier and a paid tier, Cultivate Plus. If you subscribe, payment is handled entirely by Apple, Google, or our web checkout provider. We never see or store your card details. We only record whether your family's account is active, and when it renews or expires.

Where your data lives, and how long we keep it

Data is stored on servers in the United States. We keep your family's information for as long as the account exists. Completed-task history is trimmed automatically after about 400 days. Email verification codes are short-lived and expire within minutes.

If you delete your family account, the associated data is removed from the live database. Copies may persist in encrypted backups for a limited period before being overwritten.

Security

All traffic between the app and our servers is encrypted with HTTPS. Profile PINs are stored only as salted hashes. Permissions — such as which parent can manage rewards, or which rewards a child is allowed to see — are enforced on the server, not just hidden in the app.

Profile PINs are a family-grade convenience lock, meant to stop a sibling from tapping into a parent's profile. They are not bank-grade security, and we recommend against reusing a PIN you use for anything important.

Your rights

You can, at any time:

• See everything stored about your family — it's all visible in the app.
• Edit or delete any profile, task, reward or family value.
• Delete your entire family account.
• Turn off push notifications in your device settings.
• Ask us for a copy of your data, or ask us to delete it, by emailing [email protected].

Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA — including the right to object to processing or to lodge a complaint with your local data protection authority.

Changes to this policy

If we make a meaningful change, we'll update the date at the top of this page and, where the change is significant, tell you in the app.

Contact

Questions, requests, or concerns: [email protected].