Privacy Policy

1. Information We Collect

Personal Information

We collect information that you provide directly to us:

Automatically Collected Information

When you use our service, we automatically collect:

• Device Information: Browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, time spent in app
• Log Data: IP address, access times, error reports
• Performance Data: App performance metrics, crash reports

2. How We Use Your Information

We use collected information to:

• Provide Services: Operate and maintain your family bank
• Process Transactions: Handle subscription billing through Stripe (web) or app store billing systems (mobile)
• Personalization: Customize content based on age and preferences
• Communication: Send important updates, security alerts, and support
• Improvement: Analyze usage to improve features and performance
• Security: Detect and prevent fraud or unauthorized access

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under one of the six lawful bases identified in Article 6(1) of the General Data Protection Regulation (GDPR):

Right to Object (Art. 21): Where we rely on legitimate interests, you have the right to object at any time. Where we process your data for direct marketing purposes (e.g., our newsletter), you have an absolute right to object and we will stop such processing. To exercise this right, email support@sproutsaver.com with subject line "GDPR Right to Object".

Withdrawing Consent: Where we rely on consent, you may withdraw it at any time with no effect on the lawfulness of prior processing. Analytics consent can be changed via the cookie banner or Settings. Newsletter consent can be withdrawn from any newsletter email's unsubscribe link.

International Transfers: We are based in the United States. Where we transfer personal data outside the EEA/UK/Switzerland, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms to ensure an adequate level of protection.

4. Children's Privacy (COPPA Compliance)

5. Information Sharing

We do not sell your personal information. We only share data in these situations:

6. Data Security

We implement industry-standard security measures:

• Encryption: All data encrypted in transit (TLS) and at rest (AES-256)
• Authentication: Secure password hashing (Firebase Auth)
• Access Controls: Strict employee access policies and audit logs
• Infrastructure: Hosted on Google Cloud Platform with SOC 2 compliance
• Monitoring: Continuous security monitoring and incident response

7. Data Breach Response

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the supervisory authority within 72 hours of becoming aware of the breach, where feasible (GDPR Article 33)
• Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms (GDPR Article 34)
• Document the breach including its nature, the categories and approximate number of individuals and records affected, likely consequences, and measures taken to address it

Notifications will include a description of the breach, the name and contact details of our data protection point of contact, a description of likely consequences, and a description of the measures taken or proposed to address the breach. For full details on our incident response procedures, see our internal Incident Response Plan.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide services. The following table describes our retention periods by data category:

Upon full account deletion request, personal data is soft-deleted immediately and permanently purged after a 30-day grace period (during which you may cancel the deletion). Backup data is purged within 90 days of the permanent deletion date.

iOS subscribers — important: Apple does not allow third parties (including Sprout Saver) to cancel App Store subscriptions on your behalf. If you delete your account while your iOS subscription is active, you may continue to be charged through your next renewal date unless you cancel the subscription manually in Settings → Apple ID → Subscriptions → Sprout Saver on your iPhone or iPad. The deletion confirmation flow surfaces this requirement and provides a deep-link to your subscription settings; we recommend cancelling there before confirming deletion. Stripe (web) and Google Play (Android) subscriptions are cancelled automatically as part of deletion.

Sign in with Apple: When you delete your account, we revoke your Apple Sign-In refresh token through Apple's /auth/revoke endpoint, so Sprout Saver no longer appears in your Apple ID privacy settings under "Apps Using Apple ID." This complies with App Store Review Guideline §5.1.1(v).

9. Your Rights

Regardless of where you live, you have the right to:

EEA/UK residents also have rights to restrict processing, object to legitimate-interest or marketing processing (see §3), and lodge a complaint with your local supervisory authority.

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights:

• Right to Know: What personal information we collect, use, disclose, or sell, and the categories of sources and recipients.
• Right to Delete: Request deletion of the personal information we hold about you.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: You may opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: Restrict the use of sensitive data to what is necessary to provide the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising these rights.

California residents under 16 (or their parents on their behalf) must opt-in affirmatively before any "sale" or "sharing" — a practice we do not engage in, but which we disclose here for clarity.

11. How to Submit a Request

To exercise any right described above (access, correct, delete, port, object, restrict, opt-out of sale, withdraw consent):

1. Email support@sproutsaver.com with subject line "Privacy Request" and a clear description of the right you are exercising (e.g., "Access request", "Deletion request", "CCPA opt-out", "DSAR").
2. We will verify your identity using reasonable means (matching your email against your account; for high-risk requests, we may request additional verification).
3. We will respond within 30 days (extendable by an additional 60 days where permitted by law, with written notice to you). No fee unless the request is manifestly unfounded or excessive.
4. You may authorize an agent to act on your behalf; we will require proof of authorization and may separately verify your identity.

If we decline a request, we will explain why and inform you of your right to lodge a complaint with your local data protection authority (EEA/UK) or the California Privacy Protection Agency.

12. Third-Party Services

We use the following third-party services:

13. Changes to This Policy

We may update this Privacy Policy periodically. When we make changes, we'll update the "Last updated" date and notify you via email for significant changes. Your continued use after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions about this Privacy Policy or our practices: