Privacy Policy

This Privacy Policy describes how Badgeroo (“Badgeroo”, “we”, “us” or “our”) handles information when you use our website at badgeroo.com and the Badgeroo family-rewards application at app.badgeroo.com (together, the “Service”). Badgeroo lets parents and guardians set up chores, achievements and rewards that children earn points toward and redeem with a parent’s approval.

By using the Service you agree to the practices described here. If anything here doesn’t sit right, please email us before you sign up — we’d rather answer your questions than lose your trust.

1Who we are

Badgeroo is a small, independent product, based in Germany and currently offered free while in beta. Badgeroo is the “data controller” responsible for the personal information described in this policy. A parent or guardian creates a family account and is the account holder responsible for that family’s space, including any child profiles they set up. Each family’s data is kept separate and isolated from every other family.

Because we’re based in the European Union, we handle personal data in line with the EU General Data Protection Regulation (GDPR) and applicable German law. If you have a question about this policy or your data, you can reach us any time at [email protected].

2Information we collect

We aim to collect only what Badgeroo needs to work. That falls into a few groups:

Information a parent gives us to set up the family

• Family details — a family name and a family code used to keep your space separate from others.
• Parent account — a display name, an email address, and a password. Parents sign in with their email and password, so an email address is required to create a parent account. We use it to identify your account and for essential account-related messages — never for marketing.

Information about children in your family

• Child profiles you create — a display name, a simple username, and a PIN or password you set so the child can sign in. Children do not need to provide an email address or any other contact details, and Badgeroo does not ask them for any.
• Child profiles are created and managed by the parent account holder. Children only ever sign in to their own family’s space.

Activity you create inside the app

• The chores, achievements, penalties and rewards you set up, and what each is worth in points.
• Points awarded or deducted, reward redemptions and their approval status, any notes you add, and the running points history for each child.

Information we collect automatically to keep accounts secure

• Sign-in and security data — to protect accounts from password-guessing and abuse, we briefly log sign-in and sign-up attempts: the identifier used and the network (IP) address it came from, with a timestamp. These records are short-lived — automatically deleted after a short window, and a successful sign-in clears the earlier attempts for that account.
• Session cookie — after you sign in, we set a single cookie that keeps you signed in. See Cookies & local storage.

We do not use third-party advertising, analytics, or tracking scripts to profile you, and we do not track you across other websites.

3How we use information

We use the information above only to run Badgeroo and keep it safe:

• To provide the Service — create and run your family’s space, record points, and process reward redemptions with parent approval.
• To keep each family’s data isolated and to sign users in to the correct family.
• To secure accounts — for example, rate-limiting sign-in attempts and detecting abuse.
• To respond to you when you contact us for support.
• To meet legal obligations where they apply.

We do not use your family’s information to serve advertising, and we do not sell or rent it to anyone (see How we share information).

4Our legal bases for using your information

Under the GDPR, we use your personal information only where we have a valid legal basis to do so. Depending on the activity, we rely on:

• Providing Badgeroo to your family — setting up and running your family’s space, recording points, and processing reward redemptions with parent approval. Lawful basis: performance of our contract with you (GDPR Article 6(1)(b)).
• Keeping accounts and data secure — rate-limiting sign-in and sign-up attempts, briefly logging failed attempts, and preventing abuse. Lawful basis: our legitimate interests in protecting the Service and its users from fraud and unauthorised access (Article 6(1)(f)).
• Helping you when you get in touch — answering your questions and support requests. Lawful basis: our legitimate interests in supporting our users, and performance of our contract with you (Article 6(1)(b) and (f)).
• Meeting our legal obligations — for example, responding to valid legal requests or keeping records the law requires us to keep. Lawful basis: compliance with a legal obligation (Article 6(1)(c)).
• Children’s information — a parent or guardian sets up and manages each child’s profile as part of using Badgeroo. Lawful basis: performance of our contract with the parent account holder, on the authority of the parent or guardian — we do not rely on a child’s own consent.

Where we rely on legitimate interests, we’ve weighed them against your rights and freedoms, and you can object at any time (see Your rights & choices). We don’t use your information for advertising or marketing, so we don’t ask you to consent to that.

5Children’s privacy

Badgeroo is designed to be set up and controlled by a parent or guardian. Children use the app under a profile the parent creates. Because a parent creates and manages that profile, the parent provides — and consents to — the limited information it holds, and can review, change or delete it at any time.

• We ask children for as little as possible: a display name, a username, and a sign-in PIN or password. We do not request a child’s email address, phone number, precise location, or any other contact information.
• The parent account holder can view, edit and delete their children’s profiles and activity at any time from within the app, and can ask us to delete them entirely (see Your rights & choices).
• We do not show advertising to children and do not build advertising or behavioural profiles of them.

6Cookies & local storage

We keep this simple and use only what’s necessary:

• Essential session cookie — set when you sign in, so the app knows you’re signed in as you move between pages. Without it, you can’t stay signed in. It isn’t used for advertising.
• Local storage on our website — the marketing website saves your light/dark theme choice in your browser so the site remembers it on your next visit. This stays on your device.

Our website loads fonts from Google Fonts to display text; when your browser fetches those fonts, Google may receive your IP address as part of serving them. We don’t use cookies for advertising or cross-site tracking anywhere on the Service.

7How we share information

We never sell your personal information, and we don’t share it with advertisers. We share information only in these limited ways:

• Within your family — parents and children in the same family see the shared points, rewards and history that make Badgeroo work. Nobody outside your family can see it.
• Service providers who help us run Badgeroo — we rely on a small number of trusted infrastructure providers — including Cloudflare, which provides our website and application hosting, content delivery, database (Cloudflare D1) and security — to operate the Service. They process data only to provide these services to us, under agreements that require them to protect it.
• Legal reasons — if we’re required to by law, or to protect the rights, safety and security of our users, the public, or Badgeroo.
• Business transfer — if Badgeroo is ever involved in a merger, acquisition or sale of assets, information may transfer as part of that deal; we’ll notify you of any change in who controls your data.

8How we protect information

We take practical steps to keep your family’s data safe:

• Passwords and PINs are never stored in plain text — they’re salted and hashed before storage, and compared in a way designed to resist timing attacks.
• Every family’s space is isolated so one family can’t see another’s data.
• Traffic to the Service is encrypted in transit (HTTPS), and sign-in attempts are rate-limited to slow down guessing.

No online service can promise perfect security, but we work to protect your information and to limit what we collect in the first place. If a security incident ever affects your family’s data, we’ll tell you promptly and explain what happened in plain language.

9Keeping & deleting data

We keep your family’s information for as long as your account is active so the Service works and points history stays accurate. Short-lived security records, such as sign-in attempt logs used for rate-limiting, are kept only as long as needed for that purpose.

You can remove children, rewards and other content from within the app. If you’d like your whole family account and its data deleted, email us at [email protected] and we’ll take care of it. We may retain limited information where we’re legally required to.

10Your rights & choices

Depending on where you live, you may have rights to access, correct, export or delete personal information, and to object to or restrict certain processing. As the account holder, a parent can already do much of this directly in the app for their family and children.

• Access & correct — view and edit your family’s profiles and activity in the app.
• Delete — remove content in the app, or ask us to delete your whole account.
• Export or ask questions — email [email protected] and we’ll help.

We won’t charge you for exercising these rights or treat you differently for doing so. To protect your family’s data, we may need to verify your request before acting on it.

If you’re in the EU or UK, you also have the right to lodge a complaint with your local data protection authority — in Germany, your regional supervisory authority — though we’d appreciate the chance to put things right first.

11Where your data is stored

Badgeroo is operated from Germany and runs on Cloudflare’s cloud infrastructure. Your information may be processed or stored on servers outside your own country, including outside the European Economic Area (EEA). Where information is transferred outside the EEA, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses — to protect it, and we apply this policy wherever it’s processed.

12Changes to this policy

We may update this policy as Badgeroo grows or as laws change. When we do, we’ll revise the “Last updated” date at the top, and for significant changes we’ll provide a more prominent notice. Please check back from time to time.

13Contact us

Questions, requests, or anything privacy-related — we’d genuinely like to hear from you.

Back to top