ChoreNut

Family Task Fun

Back to homepage

Privacy Policy

Note: This text describes what data ChoreNut processes and on what basis. It does not replace individual legal advice. Because the app can include profiles for children within a family and relies on services located outside the EU, a review by a lawyer or data protection officer is recommended before onboarding families beyond your own.

1. Controller

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:
Thomas Luister, Beim Kramer 10, 86923 Finning, Germany
Email: luistertom@gmail.com

2. This marketing page

This page (the one you're reading) does not use cookies and does not use any analytics or tracking services. Fonts (Caprasimo, Figtree) are served locally from this site rather than loaded from Google's servers, so no visitor data is sent to Google. Your language choice (German/English) is stored only in your browser's localStorage and never leaves your device.

3. The ChoreNut app (app.chorenut.app)

The actual to-do app is a separate service that processes personal data of family members who register for and use the app:

Sign-in via Google

To sign in, we use Google OAuth via our backend provider, Supabase. In the process, your name, email address, and optionally a profile picture link are transmitted from Google to Supabase and stored in our database. The legal basis is Art. 6(1)(b) GDPR (performance of the usage agreement) as well as your consent given at sign-in (Art. 6(1)(a) GDPR).

Profile and family data

Within your family, we store and process: your profile name and, optionally, a profile picture you upload, to-dos (title, description, size, due date, status), each person's chestnut balance per season, status levels/badges reached, and entries in the "Golden Book". This data is visible only to members of the same family (technically enforced via row-level security in the database) and is never displayed publicly or shared with third parties for advertising purposes.

Profiles for children

ChoreNut is designed as a family app; typically a parent or other legal guardian creates the profiles for the family's children. By creating a child's profile, the creating adult confirms they are authorized to do so and are acting on the child's behalf. There is no direct, child-targeted registration flow or advertising.

Push notifications

If you enable notifications, we store a push endpoint and the associated cryptographic keys for your browser in order to send you reminders. Delivery happens through your browser/operating system's push service (e.g. Google FCM, Apple Push Notification Service, Mozilla Autopush), which acts as an independent processor or third party in this process. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw this permission at any time in the app's or your browser's settings.

4. Recipients and processors

We use the following service providers, which process data either on our behalf or as independent controllers:

  • Supabase (database, authentication, file storage, server-side functions)
  • Vercel (app hosting)
  • Google (sign-in service; potentially push delivery via Firebase Cloud Messaging)

These providers may process data outside the EU/EEA (in particular the US). Where this is the case, transfers take place on the basis of EU Standard Contractual Clauses and/or, where certified, under the EU-US Data Privacy Framework.

5. Retention period

Your data remains stored for as long as your account or family exists in ChoreNut. The annual season reset on December 24th does not delete any personal data — it only resets the running chestnut counter for the new season; each season's top results remain permanently recorded in the "Golden Book". On request, we will delete your account and associated data entirely (see your rights below).

6. Your rights

You have the following rights under the GDPR:

  • Access to your stored data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Lodging a complaint with a supervisory authority (Art. 77 GDPR) — typically the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany

To exercise these rights, please contact: luistertom@gmail.com

7. Changes to this policy

This privacy policy will be updated to reflect changes to the app (e.g. new features such as the planned language-learning feature). The version published on this page at any given time applies.

For legal information about the operator, see the Legal Notice (Impressum).