Security and privacy
A children's app is the wrong place to be clever with data
You're handing us your household's money picture and your kids' first names. Here is exactly what we do with both, in the plainest words we can manage.
Never
Sold, shared or advertised against
No ad networks, no data brokers, no third-party analytics following your kids around. Our own visit counter runs on our own server and sets no cookies. Push notifications go through Expo, Apple and Google, who see the token, the notification text and the record numbers the app needs to open the right screen, and nothing else. Email goes through Amazon SES, which sees the address and the message; if one bounces, Amazon sends the address and the reason back to our support mailbox and nowhere else.
Always
Yours to keep and to end
Every entry stays visible in the app for as long as the household exists, and an export of your household's data is one tap away. Delete the household and that export is emailed to you first, then everything is purged after 30 days.
What we collect, and why
Seven things. Each one earns its place or we don't ask for it.
A grown-up's name and email, and the household's name
Your name labels what you did in the household's history; the household's name is what your kids see when they sign in. The email gets you back into your account and carries the emails the app needs — verification, invites, a locked PIN, your download link, a notice if the household is scheduled for deletion — and, if you leave it on, one email every Sunday about your own household, which one click turns off. Not a mailing list; there isn't one.
Each kid's first name, birth year and username
The first name labels the jars. The birth year is there so a grown-up can tell two kids apart and so we can act on age rules if we ever need to. The username and a PIN are how they sign in on their own device; on a family tablet you signed in, they tap their name. We don't ask for surnames, birthdays, schools, photos or a kid's email.
The money you record
Chores, jars, asks, Save growth, transactions, budgets. Kept so the app can add up. Visible to the grown-ups in your household and to nobody else.
A statement file, if a grown-up imports one
You can upload a bank or card statement instead of typing. We keep the transactions it lists while you review them and a fingerprint of the account number, never the number itself. An OFX or QFX file is read once and thrown away; a CSV's text is kept only until you tell us which column is which. Dismissed rows are gone after 90 days. Kids cannot import.
A receipt file, if a grown-up attaches one
You can attach a photo or a PDF of a receipt to a transaction. It sits in your household's own storage, only grown-ups can see it, and it is deleted with its transaction's history and when the household is deleted. Kids can't attach photos.
A record of each device you sign in from
A random id the app generates, the platform, the device's model name, the push token on the phone app, and when it was last seen. So the sessions from one device can be ended together: signing out removes that device's token (a nightly job catches a phone that was offline at the time), a grown-up resetting a kid's PIN signs that kid out everywhere, and a password reset signs you out everywhere, including any family tablet you signed in for the kids. The id is not an advertising id, and it is never shared. A device unseen for 60 days, or with nothing signed in on it, is dropped.
A push token, if you allow notifications on the phone app
Notifications are delivered through Expo's push service, which hands them to Apple (APNs) for iPhones and Google (Firebase Cloud Messaging) for Android. They receive the token, the text of the notification, such as a chore's name or "Payday!", and the record numbers the app needs to open the right screen when you tap it, and nothing else. Signing out removes the token; a nightly job catches a phone that was offline at the time.
How the kid side is protected
A child's account isn't a small version of an adult's. It's a different thing, with less in it on purpose.
No open text field a stranger could reach
There is no chat, no comments, no sharing and no way for anyone outside your household to contact a kid through CubbyJar.
Nothing to buy, nowhere to spend
Kid mode has no prices, no upgrade prompts and no payment method attached. A kid cannot spend real money in this app.
A kid sees their own jars and no further
Not household accounts, not your income, not what a sibling earns. The wall is in the data model, not a setting you have to remember. On a family tablet a grown-up signed in, the kids can switch between each other's jars; the household's accounts stay out of reach either way.
A family tablet holds a kid sign-in, not yours
A grown-up can sign a shared device in for the kids with their own email and password. The device holds a kid sign-in, not the grown-up's, so it can never reach the household's money. It does show every kid, and switching between them takes no PIN, so it belongs at home. Your password reset signs it out.
The grown-ups hold the keys
You create each kid's access, you can end it, and you can see or delete their history. Five wrong PINs pause sign-in for 15 minutes and email the grown-ups. Your password is also what signs a family tablet in for the kids, and your password reset is what signs it back out.
The technical part, briefly
Encrypted in transit; backups and files encrypted at rest
TLS on every connection. The app and its database run on a server we operate at Hostinger in Boston, Massachusetts. Backups, receipt images and export files sit on encrypted storage at Amazon Web Services in the United States.
Backed up, and restorable
Backups run nightly. Backups are kept for 30 days, so a mistaken deletion is recoverable. Delete the household on purpose and the backups age out too.
Every change is logged
Each change to your household's data is recorded with who made it and when, so we can answer "what happened" without guessing.