Privacy Policy

Effective date: July 17, 2026 · TokenBank: Chores & Rewards, by Ampersand Works

1. Who we are

TokenBank: Chores & Rewards ("TokenBank," "the app," "we," "us") is operated by Ampersand Works. This policy explains what information we handle when you use the app or this website, and what we do with it.

2. End-to-end encryption of family data

All family content in TokenBank — including children's names and emoji, star and token balances, tasks, deductions, rewards, wish lists, redemption requests, activity history, and adult profile names and PINs — is encrypted on your device with a 256-bit key (the "master key") before being sent to our servers. The master key is protected by your password and by your recovery code, and it never leaves your family's devices in usable form.

This means:

• We cannot read your family's data. Neither can our infrastructure providers, and neither could an attacker who obtained a copy of our database.
• We cannot recover your data if you lose both your password and your recovery code. There is no back door — for anyone.
• Support can help with account access and billing, but can never view or restore the contents of your family's data.

3. Information we do collect

To run the service, we handle a small amount of information in readable form:

• Account email addresses. Each adult signs in with an email and password. Passwords are handled by our authentication provider using standard secure hashing; we never see them in plain text.
• Family and membership records. A family identifier, a short family code, which adult accounts belong to which family, and their role (owner or adult).
• Device records. A random identifier for each device using your family account, an optional device label, and whether the device slot is active. This enforces your plan's device limits.
• Invite records. When you invite an adult, we store a hashed version of the invite code and whether and when it was used. The code itself is never stored readable.
• Purchase status. Whether your family owns the one-time unlock and whether a Family add-on subscription is active (see section 5).
• Basic technical logs. Standard server logs (such as timestamps and IP addresses of requests) used for security and reliability, retained briefly.

4. Children's privacy

TokenBank is designed for parents and guardians, who must be adults to create an account. Children do not create accounts, do not provide email addresses or passwords, and cannot be contacted through the app. Any information about children that parents choose to enter (such as a first name or nickname and their activity in the app) exists on our servers only in end-to-end encrypted form that we cannot read. We do not knowingly collect personal information from children in readable form, we do not show advertising to anyone, and we do not sell any data.

5. Purchases

Purchases are processed by Apple (App Store) or Google (Google Play) — we never see your payment card details. We use RevenueCat, a subscription-management service, to verify purchase receipts and determine which features your family has unlocked. RevenueCat receives an anonymous identifier for your family and purchase receipt data from Apple or Google; it does not receive your family's encrypted content.

6. Service providers

We use a small number of providers to operate TokenBank:

• Supabase — authentication, database, and realtime sync. Stores account emails, membership/device/invite records, and your family's encrypted data blob.
• RevenueCat — purchase verification and entitlement management.
• Apple and Google — app distribution and payment processing under their own privacy policies.
• Email delivery provider — used solely to send account emails such as password reset links.

These providers process data only to provide their service to us. We do not sell or rent any information to anyone, and we do not use third-party advertising or cross-app tracking of any kind.

7. Data retention and deletion

Your data is retained while your account is active. You can delete your account at any time from Settings inside the app:

• If the family owner deletes their account, the entire family is permanently deleted — every adult login, all membership, device, and invite records, and the encrypted family data.
• If a non-owner adult deletes their account, their login and membership are removed; the family and its data remain for the other members.

Deletion is immediate and irreversible. Because the data is encrypted, there is nothing we could restore afterward even on request.

8. Security

Beyond end-to-end encryption of family content, we use industry-standard protections: encrypted connections (TLS) for all traffic, hardware-backed secure storage for keys on your device, hashed invite codes, and database access rules that limit every record to the family it belongs to. No system is perfectly secure, but our design goal is that a breach of our servers would yield nothing readable about your family.

9. Your rights

Depending on where you live (including under state privacy laws in the US and PIPEDA in Canada), you may have rights to access, correct, or delete your personal information. Because we cannot read your family data, the readable information we hold about you is essentially your email address and account records — and you can delete all of it yourself in-app at any time. For anything else, contact us at the address below.

10. Changes to this policy

If we make material changes, we'll update the effective date above and, where appropriate, notify you in the app. Continued use of TokenBank after changes take effect means you accept the updated policy.

11. Contact

Questions about privacy? Email support@gettokenbank.com.