Privacy

Privacy Policy

Last updated: July 16, 2026

Prickly Jar ("we," "us") is a parent-led digital token system for families, published as Prickly Jar App on the Google Play Store. This policy explains what information we collect, why, how we protect it, and how you can review or delete it at any time.

Prickly Jar is built and run by a single parent developer, for other parents — it is not designed for or marketed to children, and children do not create accounts or sign in.

Who uses Prickly Jar

Prickly Jar accounts are created and controlled entirely by a parent or legal guardian. Children never sign in, never create their own account, and never interact with Prickly Jar independently of the parent using the app. Every piece of information about a child in the app — their name, age, and token activity — is entered by their parent or guardian, not by the child.

What we collect

About you, the parent or guardian:

• Email address, used to create and secure your account (via Google Sign-In, Apple Sign-In, or email/password)
• Basic account metadata (sign-in method, account creation date)

About each child profile you create:

• First name
• Age
• An avatar/color you choose for their profile
• Token activity — when tokens are added, removed, or redeemed, and any label or note you attach (e.g. "cleaned room," "movie night")

We do not collect birthdates, addresses, phone numbers, photos, school information, or any information directly from a child. We only collect what the app needs to function — nothing more.

How your data is protected

Child names and activity labels are encrypted on your own device before they're ever sent anywhere, using industry-standard AES-256 encryption (via Google's open-source Tink library). The encryption key is generated and stored in your device's secure hardware (Android Keystore) and never leaves it in readable form.

A backup copy of this key is also stored, itself encrypted under a separate server-side key that only our infrastructure can use — this exists solely so that reinstalling the app or switching devices doesn't permanently lock you out of your own family's data. It does not give us, or anyone else, easier access to your data than you already have.

All data in transit between the app and our servers is encrypted (HTTPS/TLS). Our infrastructure runs on Google Firebase and Google Cloud, both of which maintain independent security and compliance programs.

How we use your data

Solely to run the app: showing balances, recording activity, syncing between a parent's own devices, and enabling optional partner/co-parent sync if you choose to link accounts. We do not use your family's data for advertising, and we do not build advertising profiles from it.

What we share, and with whom

We do not sell your data, or your child's data, to anyone.

We do not share child names, ages, avatars, or token activity with any third party for marketing or advertising purposes.

A limited set of service providers help us run the app, each scoped to only what they need:

• Google Firebase / Google Cloud — hosts our database, authentication, and backend functions. Bound by Google's standard data processing terms.
• EmailOctopus and Zapier — used only for business operations like our website's "notify me" signup list. These tools never receive child names, ages, or token activity — they are deliberately walled off from that data entirely.

We may disclose information if required to by law, or to protect the safety of a user, but we do not otherwise share your family's information with anyone outside the app.

How long we keep your data

We keep your account and your children's data for as long as your account is active. If you delete your account, everything — your account, every child profile, and all token history — is deleted immediately and permanently. There is no backup or grace period; once deleted, it cannot be recovered, by you or by us.

We do not keep data indefinitely for accounts that are simply inactive — if you have concerns about a long-inactive account, contact us using the information below.

Your rights — review, correct, or delete

As the parent or guardian who controls a Prickly Jar account, you can at any time:

• Review your children's information directly in the app — every name, balance, and activity entry is visible to you in Settings and Activity.
• Correct any child's name, age, or avatar directly in the app, any time.
• Delete your entire account and all associated data — see our account deletion page for exact steps, both in-app and by emailing us directly.

Children's privacy

Prickly Jar is not directed to children, is not listed in any "kids" app category, and does not knowingly allow children to create their own accounts or provide information directly to us. Every child profile is created and controlled by a parent or legal guardian through their own authenticated account.

We recognize that, because parents enter their children's names and ages, we knowingly hold personal information about children under 13. We treat that information according to the protections described throughout this policy, consistent with the Children's Online Privacy Protection Act (COPPA). If you are a parent or guardian and have questions about your child's information, or wish to review or delete it, contact us using the information below — we will respond directly.

Voice assistant features

If you choose to enable voice assistant integrations (such as Siri, Google Assistant, or Alexa) to check a balance or log a token, that request is processed by the respective platform (Apple, Google, or Amazon) under their own privacy practices. We do not store or retain voice recordings ourselves — our systems only receive the resulting action (for example, "add 2 tokens"), not audio.

Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date above and, where appropriate, notify you directly (such as by email or an in-app notice).

Contact us