Privacy Policy

Last Updated: 16/12/2025

1. Introduction

Erny ("we", "us", or "our") is committed to protecting your privacy and the privacy of your children. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our family points and rewards management service.

2. Information We Collect

2.1 Parent Account Information

  • Email address (for authentication)
  • Account credentials
  • Profile information you choose to provide

2.2 Child Profile Information

  • Child's first name (or nickname)
  • Avatar selection
  • Points balance and transaction history
  • Task and reward activity data
  • Access tokens for child view

2.3 Usage Information

  • Device information and browser type
  • IP address and general location data
  • Usage patterns and feature interactions
  • Error logs and diagnostic data

3. COPPA Compliance

We comply with the Children's Online Privacy Protection Act (COPPA). Our service is designed for parental control:

  • Only parents/guardians (18+) can create accounts
  • Children do not have independent accounts or login credentials
  • Parents have full control over child data and can delete it at any time
  • We do not knowingly collect personal information directly from children under 13
  • Child data is only accessible through the parent's account or via a secure, parent-controlled access token

4. How We Use Your Information

We use the collected information to:

  • Provide and maintain the Service
  • Authenticate users and prevent fraud
  • Track points, tasks, and rewards within family accounts
  • Send important service notifications
  • Improve and optimize the Service
  • Comply with legal obligations

5. Data Storage and Security

We use industry-standard security measures to protect your data. Our infrastructure is provided by Vercel and Supabase, which maintain SOC 2 Type II compliance and other security certifications.

Security measures include:

  • Encryption of data in transit (TLS/SSL)
  • Encryption of data at rest
  • Secure authentication using Supabase Auth
  • Regular security audits and updates
  • Access controls and monitoring

6. Data Sharing and Disclosure

We do not sell your personal information. We may share data only in these circumstances:

  • Service Providers: With trusted partners who help us operate the Service (Vercel, Supabase)
  • Legal Requirements: When required by law or to protect rights and safety
  • Business Transfers: In connection with a merger, acquisition, or sale of assets (users will be notified)

7. GDPR Rights (European Users)

If you are located in the European Economic Area, you have certain rights under the GDPR:

  • Right to Access: Request a copy of your data
  • Right to Rectification: Correct inaccurate data
  • Right to Erasure: Request deletion of your data
  • Right to Restriction: Limit how we use your data
  • Right to Portability: Receive your data in a portable format
  • Right to Object: Object to certain data processing

To exercise these rights, contact us at privacy@erny.app.

8. Parental Rights and Controls

As a parent, you have complete control over your child's profile data:

  • View all data associated with your child's profile
  • Edit or update child information
  • Delete child profiles and associated data
  • Revoke access tokens at any time
  • Export child data

9. Data Retention

We retain your data only as long as necessary to provide the Service and comply with legal obligations:

  • Active accounts: Data retained while account is active
  • Deleted accounts: Data deleted within 30 days unless legal retention required
  • Backup data: May persist in backups for up to 90 days

10. Cookies and Tracking

We use essential cookies and similar technologies to:

  • Maintain your session and authentication
  • Remember your preferences
  • Analyze usage to improve the Service

We do not use advertising or third-party tracking cookies.

11. Third-Party Services

Our Service uses the following third-party providers:

12. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

15. Children's Privacy Rights

Parents can review, modify, or delete their child's information at any time by accessing their account settings or contacting us directly. We will respond to such requests within 30 days.