1. Introduction

Star Rewards is a family reward tracking app that helps parents motivate children through a points-based system. This policy explains what personal data we collect, why we collect it, who processes it on our behalf, and what rights you have.

Star Rewards is operated by Martin Jeppesen, Ebeltoft, Denmark. You can contact us at [email protected].

2. What Data We Collect

2.1 Account data

When a family registers, we collect:

• Family name
• Email address (optional — used for the welcome email and support replies)
• A hashed password (we never store your password in plain text)
• A unique family code generated at registration (e.g. JEPPES-1443)

2.2 App data

Data created while using the app is stored on your behalf:

• Names and emoji avatars of children
• Activity lists, shop items, and wheel prizes you configure
• Points balances and activity completion timestamps
• Reward requests and their approval status
• Notification preferences (Discord webhook URL, email addresses)

2.3 Spark AI Companion data (Family Plan only)

If you enable the Spark AI feature for a child:

• Challenge tags and private notes you set per child (visible to admins only, never to children)
• AI conversation exchanges — the child's button choices and Spark's responses

This data is used solely to provide personalised encouragement. It is never used to train AI models.

2.4 Subscription data

If you subscribe to the Family Plan, we store your Stripe customer ID, subscription ID, plan name, status, and renewal date. We do not store payment card details — all payment processing is handled by Stripe.

2.5 Technical data

We store push notification subscription tokens if you enable browser notifications. We also maintain a deletion log that records the family code, family name, and timestamp when an account is deleted — no personal content is retained in this log.

3. Why We Collect This Data

Data	Purpose	Legal basis (GDPR)
Account data	Create and authenticate your family account	Contract (Art. 6(1)(b))
App data	Deliver the reward tracking service	Contract (Art. 6(1)(b))
Spark AI data	Provide personalised AI encouragement	Consent (Art. 6(1)(a))
Subscription data	Manage your paid subscription	Contract (Art. 6(1)(b))
Push tokens	Send approval/denial notifications to children	Consent (Art. 6(1)(a))
Deletion log	GDPR audit trail	Legal obligation (Art. 6(1)(c))

4. Third-Party Data Processors

We use the following sub-processors. All are subject to EU-adequate data protection standards via Standard Contractual Clauses or equivalent frameworks.

Processor	Purpose	Privacy policy
Cloudflare	Infrastructure, database (D1), and edge computing. All data is stored in the EU.	cloudflare.com/privacypolicy
Stripe	Payment processing for Family Plan subscriptions. Stripe is PCI-DSS certified.	stripe.com/privacy
Resend	Transactional email (welcome email, notifications, support).	resend.com/legal/privacy-policy
Anthropic	AI responses for the Spark AI Companion feature (Family Plan only). Data is not used for training.	anthropic.com/privacy

We do not sell your data to any third party. We do not share your data with advertisers.

5. Data Retention

• Account and app data is retained for as long as your family account exists.
• When you delete your account, all personal data is permanently deleted from our database immediately. The deletion log retains only your family code, family name, and deletion timestamp — no personal content.
• Stripe retains billing records for the period required by applicable tax law (typically 5–7 years). We have no control over Stripe's retention of payment records.
• AI conversation history is deleted immediately when you delete your account.

6. Children's Data

Star Rewards is designed to be used by families with children. We collect minimal data about children: a first name (or nickname) and an emoji avatar chosen by the parent. Children do not create accounts and cannot register independently.

Parents and guardians are responsible for deciding what information to enter on behalf of their children. We recommend using nicknames rather than full names.

If the Spark AI Companion feature is used, the child's button choices during conversations are stored. Parents can view and delete this history at any time from the Admin panel.

7. Your Rights Under GDPR

As a resident of the EU/EEA, you have the following rights:

• Right of access — you can request a copy of the data we hold about your family.
• Right to rectification — you can correct inaccurate data directly in the app at any time.
• Right to erasure — you can delete your account and all associated data at any time via Admin → Settings → Delete Account. This is immediate and permanent.
• Right to restriction — you can ask us to restrict processing of your data while a complaint is being resolved.
• Right to data portability — you can request an export of your family data.
• Right to object — you can object to processing based on legitimate interest.
• Right to withdraw consent — where processing is based on consent (Spark AI, push notifications), you can withdraw it at any time in the app settings.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet) at datatilsynet.dk.

8. Security

• Passwords are hashed using SHA-256 with your family code as salt. We never store plain-text passwords.
• All data is transmitted over HTTPS/TLS.
• Email action links use HMAC-SHA256 signed tokens with a short expiry window.
• Push notification subscriptions use VAPID (RFC 8292) for authenticated delivery.
• The super-admin panel is protected by a separate master password and Cloudflare's infrastructure.

9. Changes to This Policy

We may update this policy from time to time. When we make significant changes, we will notify active families by email. The date at the top of this document always reflects the most recent version.