Privacy Policy

Last updated: March 25, 2026

House Cup ("we," "us," or "our") operates the House Cup application (the "Service"), a family behavior tracking and reward system. This Privacy Policy explains how we collect, use, disclose, and protect information about you and your children when you use our Service.

We are committed to protecting the privacy of all our users, especially children. We comply with the Children's Online Privacy Protection Act (COPPA), the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

Information We Collect

Parent Account Information

When you create an account, we collect:

• Email address
• Display name
• Authentication credentials (password hash or OAuth token)
• Account preferences and settings

Information We Collect from Children

House Cup includes a child-accessible view (the "Child View") accessed via a parent-set PIN. Through normal operation of the Child View, we collect the following information about children:

• First name or nickname — provided by the parent when creating a child profile
• Behavioral point totals — points assigned by parents for positive and negative behaviors
• Reward redemption history — records of rewards redeemed by or for the child
• Session data — when a child accesses the Child View via PIN, we collect basic session information (timestamp, session duration)
• Persistent identifiers — through normal device operation, standard identifiers such as IP addresses and device information may be collected

We do not collect from children: full names, dates of birth, physical addresses, phone numbers, photos, videos, audio, precise geolocation, or social media identifiers.

How We Use Children's Information

We use children's information solely for the following purposes:

• Display the child's name, point balance, and reward status in the Child View
• Enable parents to track and manage their children's behavior points and rewards
• Provide the core functionality of the Service as a family behavior management tool

We do not use children's information for advertising, profiling, behavioral targeting, or any purpose other than providing the core Service functionality.

Third Parties That Receive Data

We use the following third-party service providers ("sub-processors") to operate the Service. These providers may process data, including children's data, as necessary to provide their services to us:

We do not sell, share, or disclose children's personal information to third parties for advertising, marketing, or any purpose unrelated to providing the Service. Our sub-processors are contractually required to use data only for the purposes specified above.

Parental Rights

As a parent or legal guardian, you have the following rights regarding your child's personal information:

• Access and review — You can view all information collected about your child at any time through your parent account dashboard
• Request deletion — You can delete your child's profile and all associated data from the Settings page, or by contacting us
• Revoke consent — You may revoke your consent for the collection and use of your child's data at any time. Revoking consent will result in the deletion of your child's data and deactivation of their Child View access
• Data export — You may request a copy of your child's data in a machine-readable format by contacting us

To exercise any of these rights, use the in-app settings or contact us at privacy@housecup.app.

Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected. Our retention periods by data type are:

When you delete your account or a child profile, we delete all associated personal information from our active systems within 30 days. Backup copies may be retained for up to 90 days before being permanently purged.

Contact Information

For questions or concerns about this Privacy Policy or our data practices, including requests related to children's data:

• Email: privacy@housecup.app

We will respond to all privacy-related inquiries within 30 days.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes to how we collect, use, or disclose children's personal information, we will notify you by:

• Posting a prominent notice within the Service before the changes take effect
• Sending an email notification to the address associated with your account
• Updating the "Last updated" date at the top of this page

Your continued use of the Service after such changes constitutes acceptance of the updated Privacy Policy. We will obtain new verifiable parental consent if any changes materially affect the collection, use, or disclosure of children's personal information.

Data Controller

House Cup is the data controller responsible for your personal data. You can contact us at:

• Email: privacy@housecup.app

Lawful Basis for Processing

We process personal data on the following legal bases:

• Consent — For children's data, we rely on verifiable parental consent as required by COPPA and GDPR Article 8
• Contract performance — Processing necessary to provide the Service as agreed in our Terms of Service (parent account data)
• Legitimate interests — For maintaining security, preventing fraud, and improving the Service, where such interests are not overridden by your rights

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you
• Right to rectification — Request correction of inaccurate or incomplete personal data
• Right to erasure — Request deletion of your personal data (subject to certain legal exceptions)
• Right to data portability — Receive your personal data in a structured, commonly used, machine-readable format
• Right to object — Object to processing based on legitimate interests
• Right to restriction of processing — Request that we limit how we use your data in certain circumstances
• Right to lodge a complaint — You have the right to lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at privacy@housecup.app. We will respond within 30 days (or as required by applicable law).

International Data Transfers

Your data is processed and stored in the United States. If you are located outside the United States, your personal data will be transferred to and processed in the United States. We rely on the following safeguards for international transfers:

• Standard contractual clauses approved by the European Commission
• Data processing agreements with our sub-processors that require appropriate technical and organizational security measures

Data Protection Officer

Given the current scale of our operations, we have not appointed a dedicated Data Protection Officer. For all data protection inquiries, please contact us at privacy@housecup.app.

California Privacy Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

Categories of Personal Information Collected

• Identifiers — name, email address, account credentials
• Internet activity — usage data, session information, interaction with the Service
• Inferences — behavioral point patterns derived from parent-entered data

Purposes of Collection

• Providing and maintaining the Service
• Account authentication and security
• Transactional communications (e.g., email notifications)
• Service improvement and troubleshooting

Your California Rights

• Right to know — Request what personal information we have collected, used, disclosed, or sold about you
• Right to delete — Request deletion of your personal information
• Right to opt-out of sale/sharing — We do not sell or share personal information as defined by the CCPA/CPRA
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights

We do not sell or share personal information as defined by the CCPA/CPRA.

For children under 13, we obtain verifiable parental consent before collecting personal information. For consumers under 18, we comply with California's enhanced protections under AB 1949.

To exercise your California privacy rights, contact us at privacy@housecup.app.

Data Security

We implement appropriate technical and organizational measures to protect personal information, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest
• Access controls limiting data access to authorized personnel
• Regular security reviews of our systems and practices

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.