Karmakidos Privacy Policy

We collect the following categories of data:

• Account data: Email address, full name, and account role (parent/admin)
• Family data: Children's names, ages, and emoji avatars — no children's email addresses are collected
• Usage data: Chores, school tasks, activities, rewards, and KTC (Karma Token Currency) balances
• Google account data (if using Google Sign-In): Your Google email address and display name only — we do not access your Google contacts, Drive, or any other Google services through sign-in
• Google Calendar data (if connected): Calendar events you explicitly choose to sync — only read/write access to calendars you authorise
• Technical data: Device type, browser, IP address, and app usage logs for debugging and security

We do not collect payment card details (handled by Stripe), government IDs, or biometric data.

Your data is used solely to:

• Provide, operate, and improve the Karmakidos service
• Authenticate your account via email/password or Google OAuth
• Send transactional emails (reminders, notifications) you have opted into
• Sync your family calendar with Google Calendar (only if you connect it)
• Process subscription payments via Stripe
• Comply with applicable legal obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Karmakidos uses Google OAuth 2.0 solely for the following purposes:

• Sign-In: We request your Google email and profile name to create and authenticate your account. No other Google data is accessed during sign-in.
• Google Calendar (optional): If you choose to connect Google Calendar, we access only the calendar events you authorise, to display and sync your family schedule. This connection can be disconnected at any time from Settings.

Karmakidos's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We only share your data with:

• Stripe: For payment processing. Stripe has its own privacy policy.
• Base44: Our app infrastructure provider, who hosts and stores app data securely.
• Google: Only for OAuth authentication and calendar sync as described above.

We do not share your data with any other third parties.

We implement industry-standard security measures including encrypted data transmission (HTTPS) and secure credential storage. However, no method of electronic transmission or storage is 100% secure.

Children's accounts are protected by family-specific PINs and family codes. Parents are responsible for keeping these credentials secure.

Karmakidos is designed for parents to manage their children's tasks and rewards. We do not knowingly collect personal information directly from children under 13. All child profiles are created and managed exclusively by verified parent accounts.

Children log in via a PIN only — no email address, phone number, or personal contact information is collected from children.

If you believe a child has provided personal data without parental consent, contact us at support@karmakidos.app and we will remove it promptly.

We retain your data for as long as your account is active. Upon account deletion, your personal data will be removed within 30 days, except where retention is required by law.

To request data deletion, email us at support@karmakidos.app.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability

To exercise any of these rights, contact us at support@karmakidos.app.

Karmakidos uses only essential cookies and local storage required for authentication and session management. We do not use advertising or tracking cookies.

We may update this Privacy Policy from time to time. We will notify users of material changes via email or an in-app notice. Continued use after changes constitutes your acceptance of the updated policy.