Privacy Policy

Kredz is operated by MHB Software, LLC (“Kredz,” “we,” “us,” or “our”). Kredz is available on iPhone, iPad, Apple Watch, and the web. This policy applies to all of those surfaces and to the shared backend behind them.

For any privacy question, or to exercise the rights described below, contact us at support@kredz.app.

We collect only what we need to provide the service:

• Account information. When an adult signs up, we collect their name, email address, and a securely hashed password (or the identifier from a third-party sign-in provider, if used).
• Family profiles. The name you give your family and the settings you configure for it.
• Child profiles. When an admin adds a child, we collect only the child’s name and the email address used for the child’s view-only login. We do not collect a child’s birthday, phone number, photos, location, or any other personal details.
• Balances and transactions. The credit balances for each family member and the append-only ledger of credit awards, deductions, and adjustments.
• Rules. The configurable rules an admin creates that award or deduct credits.
• Adult-attestation consent record. When an adult affirms they are 18 or older and creates a family or adds a child, we store a consent record (timestamp, the admin’s account ID, and the version of these terms in effect) as an audit trail.
• Subscription and billing status. Whether a family is on a free trial or a paid subscription, and related entitlement status. Payment card details are handled by our payment processors and are never stored on our servers.
• Limited technical data. Basic logs and device/diagnostic information needed to operate the service securely and reliably.

We use the information above to:

• Provide, maintain, and secure the Kredz service across web and mobile.
• Authenticate users and enforce that each family can only access its own data.
• Calculate and display balances, transactions, and rules for your family.
• Process subscriptions, free trials, and billing through our payment processors.
• Send essential service communications (for example, account, security, and billing notices).
• Understand product usage in aggregate to improve Kredz — never using children’s personal data.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use children’s information for advertising or share it with advertisers.

Kredz is designed to be controlled by a parent or guardian. Our approach to children’s data is built around adult control and data minimization:

• An adult provides consent. Only an adult can create an account and a family. When signing up and when adding a child, the adult must affirm that they are 18 or older. By adding a child, the adult — as the child’s parent or guardian — provides consent for the minimal child information involved and represents that they have authority to do so.
• Only an admin can add a child. Children cannot create their own accounts or join a family on their own.
• Children are strictly read-only. A child’s login can view only their own credit balance and the family’s rules. Children cannot record transactions, change balances, edit rules, invite others, or manage the family in any way.
• We minimize child data. For a child we store only a name and the login email. We deliberately do not collect a birthday or any other child personal information, and we exclude children’s personal data from analytics.

A parent or guardian can review, correct, or delete a child’s information at any time from within the app, or by contacting us at support@kredz.app. If you believe a child’s information was provided without proper authority, contact us and we will delete it.

We share information with a small set of vendors that process data on our behalf to run Kredz. They are bound by contract to use the data only to provide their service to us:

• Supabase — database, authentication, and backend hosting for your family’s data.
• Vercel — hosting and delivery of the Kredz web app.
• Resend — transactional email delivery (for example, invitations and account emails).
• RevenueCat and Stripe — subscription management and payment processing. Card details are entered with and handled by these processors; we never receive or store full card numbers. On iOS, purchases are processed by Apple.
• PostHog — product analytics at the parent/family level, used to understand and improve Kredz. We do not send children’s personal data to analytics.

We keep your information for as long as your account and family exist, so the service can function. When you delete your account, we delete your account and your family’s associated data — including profiles, balances, transactions, and rules — except where we are required to retain certain records to meet legal, tax, or fraud-prevention obligations. Backups are purged on a rolling schedule.

You can exercise the following at any time:

• Access and correction. View and edit your family’s profiles, rules, and settings from within the app.
• Deletion. Kredz provides in-app account deletion. Deleting your account removes your authentication record and cascade-deletes your family’s associated data (profiles, balances, transactions, and rules), subject to the limited legal-retention exceptions above. This action is permanent.
• Data export. You can request a copy of your family’s data in a portable format via the app’s “download my data” path, or by emailing support@kredz.app.

To make any of these requests outside the app, email support@kredz.app. We will not discriminate against you for exercising your rights.

If you are a California resident, you have the right to know what personal information we collect, to access and delete it, to correct inaccuracies, and to be free from discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under California law, and we do not use sensitive personal information for purposes beyond providing the service. The categories of information we collect and how we use them are described above. To exercise your California rights, contact support@kredz.app.

Kredz is operated from the United States, and our service providers may process and store information in the United States and other countries. If you access Kredz from outside the United States, you understand that your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where required, we rely on appropriate safeguards for such transfers.

Kredz uses essential cookies and local storage only — for example, to keep you signed in, remember your theme preference, and keep the service secure. We do not use advertising cookies or cross-site tracking cookies. See our Cookie Notice for details.

Access to family data is enforced at the database layer so that one family can never read or write another family’s data. We use encryption in transit, scoped access controls, and reputable infrastructure providers. No method of transmission or storage is perfectly secure, but we work to protect your information and to respond promptly to any issue.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app or by email. Your continued use of Kredz after an update means you accept the revised policy.

Questions about this policy or your data? Email support@kredz.app. Kredz is operated by MHB Software, LLC.