Privacy Policy

Last updated: September 2026

This policy explains what personal data Chore Quest collects through ChoreQuest and CareVault (together, "our apps"), why, and what rights you have over it. It applies whether you use our apps as a parent, carer, or the person completing tasks or being supported.

Who we are

Chore Quest is the data controller for the personal data described in this policy. You can contact us at support@chore-quest.co.uk about anything in this policy, including to exercise any of the rights listed below.

What we collect

ChoreQuest

• Account details: display name, email address, and a PIN used as your account password (stored as a secure one-way hash, never in plain text).
• Task ("quest") data you or a linked family member create: titles, descriptions, due dates, rewards, and completion status.
• Photos submitted as proof a task was completed, where that feature is used.
• In-app progress data: points, virtual currency balances, and unlocked collectible cards.
• Which family member(s) your account is linked to (a "Warrior" and their linked "Strategist").

CareVault

• Account details, as above.
• Care-record document templates you upload, and the text extracted from them to build a fillable form.
• Answers you provide when filling in a care record, and the completed PDF documents generated from them.
• Recipient email addresses you specify for a completed record to be sent to (for example, a council contact).

Care-record content in CareVault may include health-, disability-, or support-need-related information about the person being cared for. We treat this as a special category of data under UK GDPR and handle it with additional care — see "Special category data" below.

Why we process your data

We rely on two lawful bases:

• Contract — most processing (account creation, task tracking, generating and sending care records) is necessary to provide the service you've asked us for.
• Consent — for optional features, such as enabling photo proof of task completion or biometric login, which you can decline or turn off at any time in the app's settings.

Who we share it with

We use a small number of specialist providers ("processors") to run our apps. None of them may use your data for their own purposes.

• Supabase — hosts our database, file storage, and user authentication. Our project's data is hosted in Supabase's EU (Frankfurt) region.
• Resend — sends transactional emails on our behalf: sign-in verification codes, and completed CareVault records to the recipients you specify.
• Anthropic — CareVault only: used to read an uploaded care-record template and identify its form fields (name, date, etc.) so it can be turned into a fillable form. This happens once per template, not per record you fill in.

Resend and Anthropic are US-based companies. Where your data is transferred outside the UK, we rely on the data protection safeguards each provider commits to in their own terms (such as the EU-U.S. Data Privacy Framework or standard contractual clauses) to ensure it stays protected to UK standards.

We do not sell your data, and we do not share it with anyone else for marketing purposes.

Special category data

Where CareVault content reveals health, disability, or support-need information, we process it only to the extent necessary to generate the care record you've asked us to produce, and we do not use it for any other purpose. Access to this data is restricted to the account holder who created it and the recipients they choose to send a completed record to.

Children's data

ChoreQuest is designed for anyone who wants a gamified way to manage chores and routines, whether that's an adult using it independently, an adult linked to a support person for accountability, or a child using it under a parent or carer's supervision (a "Strategist" account). Where a Warrior account does belong to a child, it's set up and linked by their parent or carer, who retains oversight of the data associated with it. In every case, we collect no more data than is needed for the app to function, and we don't use any user's data for marketing or profiling.

How long we keep it

We keep your data for as long as your account is active. If you ask us to delete your account, we delete your account records and any files you've uploaded (photos, documents, generated PDFs) within a reasonable time, and in any case within 30 days.

How we protect it

• All traffic between our apps and our servers is encrypted in transit.
• Data at rest is encrypted by our hosting provider's infrastructure.
• Access to your data is restricted by row-level security policies, so one family's data is never visible to another's.
• We don't embed administrative credentials in the apps themselves.

Your rights

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you, and get a copy of it (right of access).
• Ask us to correct inaccurate data (right to rectification).
• Ask us to delete your data (right to erasure), subject to any legal reason we may need to keep it.
• Ask for a portable copy of data you've provided to us (right to data portability).
• Object to certain kinds of processing.

To exercise any of these rights, email support@chore-quest.co.uk. If you're not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

Changes to this policy

If we make significant changes to how we handle your data, we'll update this page and, where appropriate, notify you in the app.