Privacy Policy

This Privacy Policy describes how Badgeroo (“Badgeroo”, “we”, “us” or “our”) handles information when you use our website at badgeroo.com and the Badgeroo application at app.badgeroo.com (together, the “Service”). Badgeroo lets a parent, guardian or team leader set up chores, achievements and rewards that children or team members earn points toward and redeem with the account holder’s approval. Every Badgeroo account is either a family or a team — the same Service, under different wording — and this policy applies equally to both; where something works differently for one, we say so.

By using the Service you agree to the practices described here. If anything here doesn’t sit right, please email us before you sign up — we’d rather answer your questions than lose your trust.

1Who we are

Badgeroo is a small, independent product, based in the EU and currently offered free while in beta. Badgeroo is the “data controller” responsible for the personal information described in this policy. A parent, guardian or team leader creates a family or team account and is the account holder responsible for that space, including any child or member profiles they set up. Each family’s or team’s data is kept separate and isolated from every other one.

Because we’re based in the European Union, we handle personal data in line with the EU General Data Protection Regulation (GDPR) and applicable EU law. If you have a question about this policy or your data, you can reach us any time at [email protected].

2Information we collect

We aim to collect only what Badgeroo needs to work. That falls into a few groups:

Information a parent or team leader gives us to set up the space

Family or team details — a name and a code used to keep your space separate from others.
Parent/leader account — a display name, an email address, and a password. Parents and leaders sign in with their email and password, so an email address is required to create this kind of account. We use it to identify your account and for essential account-related messages — never for marketing.

Information about children or team members in your space

Child or member profiles you create — a display name, a simple username, and a PIN or password you set so they can sign in. They do not need to provide an email address or any other contact details, and Badgeroo does not ask them for any.
Child and member profiles are created and managed by the account holder. They only ever sign in to their own family’s or team’s space.

Activity you create inside the app

The chores, achievements, penalties and rewards you set up, and what each is worth in points.
Points awarded or deducted, reward redemptions and their approval status, any notes you add, and the running points history for each child or team member.

Information we collect automatically to keep accounts secure

Sign-in and security data — to protect accounts from password-guessing and abuse, we briefly log sign-in and sign-up attempts: the identifier used and the network (IP) address it came from, with a timestamp. These records are short-lived — automatically deleted after a short window, and a successful sign-in clears the earlier attempts for that account.
Session cookie — after you sign in, we set a single cookie that keeps you signed in. See Cookies & local storage.

We do not use third-party advertising, analytics, or tracking scripts to profile you, and we do not track you across other websites.

3How we use information

We use the information above only to run Badgeroo and keep it safe:

To provide the Service — create and run your family’s or team’s space, record points, and process reward redemptions with the account holder’s approval.
To keep each family’s or team’s data isolated and to sign users in to the correct one.
To secure accounts — for example, rate-limiting sign-in attempts and detecting abuse.
To respond to you when you contact us for support.
To meet legal obligations where they apply.

We do not use your information to serve advertising, and we do not sell or rent it to anyone (see How we share information).

4Our legal bases for using your information

Under the GDPR, we use your personal information only where we have a valid legal basis to do so. Depending on the activity, we rely on:

Providing Badgeroo to your family or team — setting up and running your space, recording points, and processing reward redemptions with the account holder’s approval. Lawful basis: performance of our contract with you (GDPR Article 6(1)(b)).
Keeping accounts and data secure — rate-limiting sign-in and sign-up attempts, briefly logging failed attempts, and preventing abuse. Lawful basis: our legitimate interests in protecting the Service and its users from fraud and unauthorised access (Article 6(1)(f)).
Helping you when you get in touch — answering your questions and support requests. Lawful basis: our legitimate interests in supporting our users, and performance of our contract with you (Article 6(1)(b) and (f)).
Meeting our legal obligations — for example, responding to valid legal requests or keeping records the law requires us to keep. Lawful basis: compliance with a legal obligation (Article 6(1)(c)).
Child or team-member profile information — the account holder (a parent, guardian or team leader) sets up and manages each profile as part of using Badgeroo. Lawful basis: performance of our contract with the account holder. Where the profile belongs to a child, this is on the authority of their parent or guardian — we do not rely on a child’s own consent.

Where we rely on legitimate interests, we’ve weighed them against your rights and freedoms, and you can object at any time (see Your rights & choices). We don’t use your information for advertising or marketing, so we don’t ask you to consent to that.

5Children’s privacy

This section covers child profiles specifically — Badgeroo’s family tenants, and any team tenant whose members are minors (for example, a classroom or a youth sports team). It does not apply to an adult team member, who uses the Service under their team leader’s account in the ways described elsewhere in this policy, but as an adult.

A child profile is designed to be set up and controlled by a parent or guardian (or, for a minor on a team, whoever holds that equivalent responsibility for them). The child uses the app under a profile that account holder creates. Because the account holder creates and manages that profile, they provide — and consent to — the limited information it holds, and can review, change or delete it at any time.

We ask children for as little as possible: a display name, a username, and a sign-in PIN or password. We do not request a child’s email address, phone number, precise location, or any other contact information.
The account holder can view, edit and delete a child’s profile and activity at any time from within the app, and can ask us to delete them entirely (see Your rights & choices).
We do not show advertising to children and do not build advertising or behavioural profiles of them.

Because the account holder sets up and manages each child profile, a child’s information is provided and controlled by them. If you believe a child has given us information without that involvement, please contact [email protected] and we’ll delete it.

6Cookies & local storage

We keep this simple and use only what’s necessary:

Essential session cookie — set when you sign in, so the app knows you’re signed in as you move between pages. Without it, you can’t stay signed in. It isn’t used for advertising.
Local storage on our website — the marketing website saves your light/dark theme choice in your browser so the site remembers it on your next visit. This stays on your device.

Our website loads fonts from Google Fonts to display text; when your browser fetches those fonts, Google may receive your IP address as part of serving them. We don’t use cookies for advertising or cross-site tracking anywhere on the Service.

We never sell your personal information, and we don’t share it with advertisers. We share information only in these limited ways:

Within your family or team — parents and children in the same family, or leaders and members in the same team, see the shared points, rewards and history that make Badgeroo work. Nobody outside your family or team can see it.
Service providers who help us run Badgeroo — we rely on a small number of trusted infrastructure providers — including Cloudflare, which provides our website and application hosting, content delivery, database (Cloudflare D1) and security — to operate the Service. They process data only to provide these services to us, under agreements that require them to protect it.
Legal reasons — if we’re required to by law, or to protect the rights, safety and security of our users, the public, or Badgeroo.
Business transfer — if Badgeroo is ever involved in a merger, acquisition or sale of assets, information may transfer as part of that deal; we’ll notify you of any change in who controls your data.

8How we protect information

We take practical steps to keep your data safe:

Passwords and PINs are never stored in plain text — they’re salted and hashed before storage, and compared in a way designed to resist timing attacks.
Every family’s or team’s space is isolated so one can’t see another’s data.
Traffic to the Service is encrypted in transit (HTTPS), and sign-in attempts are rate-limited to slow down guessing.

No online service can promise perfect security, but we work to protect your information and to limit what we collect in the first place. If a security incident ever affects your data, we’ll tell you promptly and explain what happened in plain language.

9Keeping & deleting data

We keep your information for as long as your account is active so the Service works and points history stays accurate. Short-lived security records, such as sign-in attempt logs used for rate-limiting, are kept only as long as needed for that purpose.

You can remove children, team members, rewards and other content from within the app. If you’d like your whole family or team account and its data deleted, email us at [email protected] and we’ll take care of it. We may retain limited information where we’re legally required to.

10Your rights & choices

Depending on where you live, you may have rights to access, correct, export or delete personal information, and to object to or restrict certain processing. As the account holder, a parent or team leader can already do much of this directly in the app for their family or team.

Access & correct — view and edit your family’s or team’s profiles and activity in the app.
Delete — remove content in the app, or ask us to delete your whole account.
Export or ask questions — email [email protected] and we’ll help.

We won’t charge you for exercising these rights or treat you differently for doing so. To protect your data, we may need to verify your request before acting on it.

If you’re in the EU or UK, you also have the right to lodge a complaint with your local data protection authority — in the EU, your national supervisory authority — though we’d appreciate the chance to put things right first.

11Where your data is stored

Badgeroo is operated from the EU and runs on Cloudflare’s cloud infrastructure. Your information may be processed or stored on servers outside your own country, including outside the European Economic Area (EEA). Where information is transferred outside the EEA, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses — to protect it, and we apply this policy wherever it’s processed.

12Changes to this policy

We may update this policy as Badgeroo grows or as laws change. When we do, we’ll revise the “Last updated” date at the top, and for significant changes we’ll provide a more prominent notice. Please check back from time to time.

13Contact us

Questions, requests, or anything privacy-related — we’d genuinely like to hear from you.

Email us at

[email protected]