Privacy Policy

1. Introduction

Welcome to Kids Task Master ("we," "our," or "us"), operated by Gold Coast Info Tech ABN 87 681 238 139. We are committed to protecting your privacy and the privacy of your family. This Privacy Policy explains how we collect, use, store, and protect your information when you use our task management application at app.kidstaskmaster.com and our marketing website at www.kidstaskmaster.com.

Scope: This Privacy Policy, together with our Terms of Service and any other legal notices we publish, applies to the entire Kids Task Master service across all of our domains and subdomains, including but not limited to www.kidstaskmaster.com, app.kidstaskmaster.com, and any other subdomain of kidstaskmaster.com (that is, *.kidstaskmaster.com). References to "the service," "our site," "our app," or "our websites" in this policy cover all of these domains and subdomains.

This policy applies to users worldwide, including those in the European Economic Area (EEA), United Kingdom (UK), and Australia. Where specific regulations apply (such as the GDPR or Australian Privacy Act), we have noted the relevant provisions.

2. Data Controller

The data controller responsible for your personal data is:

• Gold Coast Info Tech
• Gold Coast, Queensland, Australia
• Email: privacy@kidstaskmaster.com

Given the scale of our operations, we are not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR. However, you may contact us at the above email for any data protection enquiries.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

• Email address (for authentication and account recovery)
• Password (hashed and encrypted via AWS Cognito — never stored in plain text)
• Social login identifiers (if you sign in with Google or Apple)

3.2 Task and Activity Data

When you use our app, we store:

• Child profiles (first names or nicknames, emoji avatars only)
• Tasks and rewards you create
• Task completion history and points earned
• Calendar events and schedules
• App settings and preferences

3.3 Payment Information

If you subscribe to Premium, payment is processed by Stripe. We do not store your credit card number or full payment details. We receive only: subscription status, customer ID, and subscription expiry date from Stripe.

3.4 Technical Information

• Device type and browser information (via standard HTTP headers)
• IP address (for security and abuse prevention)

4. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:

Processing Activity	Legal Basis
Account creation and authentication	Contract performance (Art. 6(1)(b))
Storing and syncing task data	Contract performance (Art. 6(1)(b))
Processing subscription payments	Contract performance (Art. 6(1)(b))
Sending service-critical emails (security alerts, account changes)	Contract performance (Art. 6(1)(b))
Sending welcome emails	Legitimate interest (Art. 6(1)(f))
Fraud prevention and security monitoring	Legitimate interest (Art. 6(1)(f))
Storing preferences in browser local storage	Strictly necessary (ePrivacy Directive exemption)

5. Cookies and Local Storage

5.1 Cookies

Our websites and app use no advertising, tracking, or analytics cookies. We do not use Google Analytics, Facebook Pixel, or any third-party tracking.

The only cookies that may be set are:

• AWS CloudFront edge cookies (technical, for content delivery routing) — strictly necessary, no consent required

5.2 Browser Local Storage (app.kidstaskmaster.com)

The app uses browser localStorage to provide its core functionality. Under the ePrivacy Directive, localStorage is treated the same as cookies. All items below are strictly necessary for the service you have explicitly requested, and therefore exempt from consent requirements.

Data Stored	Purpose	Category
Authentication tokens	Keep you signed in (via AWS Cognito)	Strictly necessary
Subscription status	Determine your plan (free/trial/premium)	Strictly necessary
Active child ID	Remember which child profile is selected	Strictly necessary
Tasks, rewards, points history	Core app data (for non-cloud users)	Strictly necessary
Parent PIN (hashed)	Protect parent-only settings	Strictly necessary
Storage mode preference	Remember local vs cloud choice	Strictly necessary
Color theme preference	Display the app in your chosen theme	Functional preference
Screensaver and display settings	Maintain your display configuration	Functional preference
Trial start date	Track 7-day trial period	Strictly necessary

No data stored in localStorage is shared with third parties or used for advertising. All localStorage data remains on your device unless you enable cloud sync.

6. Storage Options

6.1 Local Storage (Default for Non-Logged-In Users)

If you use the app without creating an account, all data is stored locally in your browser:

• Your data never leaves your device
• We cannot access, read, or process your data
• Data is lost if you clear browser storage
• Cannot sync across devices

6.2 Cloud Storage (For Logged-In Users)

When you create an account and enable cloud sync, your data is stored in AWS DynamoDB:

• Data syncs across all your devices
• Automatic backup and recovery
• Encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Stored in AWS ap-southeast-2 (Sydney, Australia)

You control your storage preference. You can switch between local and cloud storage at any time in the app settings.

7. How We Use Your Information

We use your information only to:

• Provide and maintain the Kids Task Master service
• Sync your data across devices (if cloud storage enabled)
• Authenticate your account and prevent unauthorized access
• Send service-critical communications (account security, password resets)
• Send a one-time welcome email when you create an account
• Process payments for Premium subscriptions via Stripe

We do not:

• Sell or rent your data to anyone
• Use your data for advertising or profiling
• Share your data with third parties for their marketing purposes
• Send marketing emails (unless you explicitly opt in to future features)

8. Data Security

We implement appropriate technical and organisational measures to protect your data:

• Encryption in transit: All connections use HTTPS/TLS 1.2 or higher
• Encryption at rest: Cloud data encrypted with AES-256 in AWS DynamoDB
• Authentication: Managed by AWS Cognito with secure password hashing (SRP protocol)
• Access control: Each user can only access their own data
• Infrastructure: Hosted on Amazon Web Services with SOC 2, ISO 27001 certifications
• Payment security: Stripe is PCI DSS Level 1 certified — we never see your card details
• No plain-text secrets: All credentials stored in AWS Secrets Manager

9. Eligibility and Children's Privacy

9.1 Accounts Are for Adults Only

Kids Task Master accounts are intended solely for adults. You must be at least 18 years of age (or the age of majority in your jurisdiction) to create an account, subscribe, or otherwise use the service as an account holder.

• The account holder is the parent or guardian, who registers and manages the account.
• The parent or guardian enters and manages all information on the child's behalf, and is responsible for that information.
• Children do not create accounts, log in, subscribe, make purchases, or contact us directly.
• By creating an account, you confirm that you are an adult parent or guardian and that you consent, on behalf of the child, to the limited information described in this policy being stored.

9.2 How We Protect Children's Information

Although the child is never our user, some of the information a parent enters (such as a child's first name) is personal information about a child. We take that seriously and keep it to a minimum:

• We do not collect personal information directly from children.
• Parents/guardians control all data entry and account management.
• Child profiles contain only a first name or nickname and an emoji avatar. We ask that parents use a first name or nickname rather than a full name.
• No photographs, birthdates, ages, home addresses, school names, or other sensitive identifiers are collected.
• Children cannot create accounts, make purchases, or contact us directly.
• Compliant with COPPA (Children's Online Privacy Protection Act) and GDPR provisions for minors.

10. Third-Party Services

We use the following trusted sub-processors:

Service	Purpose	Data Location
AWS (Amazon Web Services)	Hosting, database, authentication, email	Sydney, Australia (ap-southeast-2)
Stripe	Payment processing	USA (with EU SCCs)
Google (OAuth only)	Optional social sign-in	USA (with EU SCCs)

These services operate under their own privacy policies and maintain appropriate data protection safeguards, including Standard Contractual Clauses (SCCs) for international transfers where applicable.

11. International Data Transfers

Your data is primarily stored in AWS ap-southeast-2 (Sydney, Australia). Australia is recognised by the European Commission as providing an adequate level of data protection (Adequacy Decision 2001/497/EC).

Where data is processed by sub-processors outside the EEA (e.g., Stripe in the USA), appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs)
• Data Processing Agreements (DPAs) with each sub-processor
• Encryption of data in transit and at rest

12. Data Retention

• Active accounts: Data retained as long as your account is active
• Deleted accounts: When you delete your account, your login credentials, your task, reward, history, and settings data, and your operational subscription record are deleted from our live systems immediately. Residual copies held in routine encrypted backups are automatically purged within 30 days. The one exception is payment records held by our payment processor, which we are legally required to retain (see below).
• Subscriptions on deletion: If you have an active paid subscription when you delete your account, we cancel it so that no further charges are made after your current billing period. Consistent with our no-refund policy, the current period is not refunded, and access ends when your account is deleted.
• Inactive accounts: Accounts inactive for 2+ years may be deleted after email notification
• Payment records: Financial records (invoices, charges, and the associated email) are held by our payment processor, Stripe, and retained for 7 years as required by Australian tax law. Because we rely on Stripe as our system of record for payments, these records may persist there after your account is deleted. This retention is a lawful exception to erasure under applicable data protection law.
• Local-only data: Remains on your device until you clear it — we have no copy

13. Your Rights

Under the GDPR, Australian Privacy Act, and other applicable laws, you have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Correct any inaccurate or incomplete data
• Erasure: Request deletion of your account and all associated data ("right to be forgotten")
• Data portability: Receive your data in a machine-readable format (JSON export available in-app)
• Restriction: Request we limit processing of your data
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent, withdraw at any time
• Lodge a complaint: You have the right to lodge a complaint with a supervisory authority (see below)

To exercise any of these rights, email us at privacy@kidstaskmaster.com. We will respond within 30 days (or one calendar month under GDPR).

You can also delete your account directly within the app via Settings > Account > Delete Account.

13.1 Supervisory Authorities

If you are unsatisfied with how we handle your data, you may lodge a complaint with:

• Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
• EU/EEA: Your local Data Protection Authority — list of DPAs
• UK: Information Commissioner's Office (ICO) — ico.org.uk

14. Changes to This Policy

We may update this Privacy Policy from time to time. For significant changes, we will notify you via:

• Email notification (if you have an account)
• In-app notification
• Updated "Last Updated" date at the top of this page

Continued use of the service after changes constitutes acceptance of the updated policy. For material changes, we will seek re-consent where required by law.

15. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

• Email: privacy@kidstaskmaster.com
• General support: support@kidstaskmaster.com
• Website: www.kidstaskmaster.com

16. Summary

By using Kids Task Master, you acknowledge that you have read and understood this Privacy Policy.