iOS Privacy Policy

Who we are and who this policy covers

This policy covers StarJar for iPhone and iPad, provided by James Cullimore – Software Engineering. StarJar helps parents and children manage family chores, stars and rewards. Parents set up and manage the app. Contact info@jamescullimore.dev or see our legal notice for provider details.

The Android app has a separate policy. Visiting this website is also subject to our website privacy information.

Local family data and optional Google Drive sync

StarJar stores profiles, chores, rewards, star balances and activity history on your device. Children use profiles managed by a parent; they do not need a StarJar email account. Use nicknames where possible. Parent profiles and PINs stay local and are not included in family sync.

In versions offering Family sync, a parent with Premium can choose to connect Google Drive. Each device communicates directly with Google and uses the same parent-selected Google account. Only children explicitly added to the cloud family are synchronized. Their names, appearance choices, tasks, rewards, balances and activity histories, including pending requests and historical snapshots, are stored in the account’s hidden StarJar application-data folder. StarJar requests access to its application storage, not your other Drive files. We do not operate a server storing this family content.

Google processes account authorization and stored content under its own terms and privacy policy. The app retains an account identifier to prevent synchronization to the wrong account. Network connections expose technical information such as IP addresses to the receiving service. Sync uses HTTPS and Google’s storage protections; optional additional file encryption is described below. Each authorized installation has access to the family folder. A parent PIN protects app controls, not a separate child-only cloud credential.

Cloud credentials are stored separately from family data: iOS Keychain on that device. The sync cache and StarJar’s stored cloud credentials are excluded from the app’s ordinary cloud backup. Other local data may be included in operating-system backups according to device settings. Keep your device and parent PIN secure.

Optional extra encryption for family sync

In versions offering extra cloud encryption, you can encrypt family files on your device before uploading them. This uses AES-256-GCM and a randomly generated family recovery key, separate from your parent PIN. Each connected device stores its key in protected device storage. StarJar does not upload the recovery key to your cloud account.

Update every family device first. Finish encryption setup on one device, then connect the others using the same Google account and recovery key. Keep a backup of the key in a safe place. If you lose it and every device holding it, StarJar cannot recover your encrypted files. Changing the parent PIN does not change the key. Copying the key puts it on the system clipboard at your request; the clipboard is not a backup and may be accessible to operating-system clipboard features.

Setup copies and verifies existing family files before removing their readable originals. Interrupted setup can be resumed. This upgrade currently cannot be undone. The cloud provider still processes account information and file metadata. This feature does not encrypt the local database or manually exported recovery files. Deleting cloud content does not remove exported copies or copies on other devices. Without this option, HTTPS and the provider’s storage protection still apply.

Local reminders

You can configure optional reminders on each device with selected weekdays and a time. Settings stay on that device and are not synchronized through Google Drive. The operating system delivers these local notifications; we do not use a push server for them. Scheduled reminders contain generic text, not child names or task text. Turn them off in StarJar or block notifications in system settings. Clear All Data also removes scheduled local notifications.

Purchases and Premium

Apple processes payments and subscriptions. StarJar uses RevenueCat to validate purchases, maintain Premium access, restore purchases and provide purchase reporting. RevenueCat initializes at app launch and receives a pseudonymous app identifier, purchase history, transaction information and technical information such as app version, operating system, device details and activity timestamps. Network requests expose connection information to the receiving service. A pseudonymous identifier does not mean that all data is anonymous.

When connecting a family, StarJar links purchase access to a random family identifier also stored in the private Drive folder. Other authorized family devices use this identifier to check access. We do not send family names, parent PINs, chore or reward content or activity histories to RevenueCat. We do not receive your payment-card number. Purchase and restore controls are in the parent area.

RevenueCat describes encrypted transport and storage in US data centers. Processing on our behalf is subject to the applicable service agreements and data-processing terms. See RevenueCat’s privacy policy and Apple’s privacy policy.

Optional usage analytics

Where available, a parent can choose to share usage statistics through Google Analytics for Firebase. This is off by default. Choosing not to share does not limit StarJar features. Change your choice in Parent Settings at any time.

If enabled, Firebase processes an app-installation identifier, app and device information, approximate location derived from network information, and usage/session and purchase events. StarJar records setup completion, the first observed approved task and redeemed reward, Premium views and purchase outcomes. These technical data are pseudonymous, not anonymous. We do not send profile names, PINs, task or reward text, Google Drive contents or your email address as analytics events.

We disable advertising identifier collection, advertising consent and personalised-ad signals for this feature. We do not use these events to build advertising audiences. Google processes analytics under its applicable service and data-processing terms; processing may take place outside your country. See Firebase privacy information. The legal basis for this optional analytics is your consent.

Turning analytics off stops future collection by this feature and resets the local analytics identifier and stored analytics data. It does not automatically erase previously received server data or aggregated reports. For deletion questions contact info@jamescullimore.dev. RevenueCat purchase processing, optional cloud sync and support correspondence are separate from this choice.

The iOS app does not include Crashlytics or third-party advertising.

Why information is processed

Family information provides the features configured by parents, including optional synchronization. Purchase information provides and restores paid access, supports fraud prevention and purchase reporting. Support correspondence is used to answer requests. Applicable grounds include performance of requested services, legal obligations, and legitimate interests in reliable administration and support; consent applies where required. We do not use children’s profiles for advertising or marketing.

Retention and deletion

Disconnect in Family sync stops that device’s sync and removes cloud credentials saved by StarJar, while preserving local data and unsent changes. You can also revoke authorization in your Google account settings. StarJar does not maintain a separate server-side device-revocation list.

Deleting an individual synced child retains a deletion record and recovery history. To erase the cloud family, use the parent area’s cloud-family removal control. This deletes family content through Google’s API; a small marker without child content remains to prevent older devices from recreating it. Interrupted removal can be retried. Google’s retention and backup policies may still apply.

Current child activity history is retained while the child is kept. Older full recovery snapshots are periodically compacted, retaining recent recovery versions and small ancestry records for conflict detection. Recovery exports contain child snapshots and history, but no parent PINs, cloud credentials, provider account identity or RevenueCat family identifier. Export files are not encrypted by StarJar; protect the destination.

After disconnecting or removing the cloud family, Clear All Data removes this installation’s local profiles, PINs, tasks, rewards and progress. Copies on other devices, exported files and operating-system backups need separate deletion. Uninstalling does not erase the cloud family or previously exported files.

Data deletion and uninstalling do not cancel subscriptions or delete store, RevenueCat or other providers’ records. Cancel recurring subscriptions in your Apple subscription settings. For help with access or deletion requests, contact info@jamescullimore.dev. Purchase records may be retained to provide paid access, restore purchases, resolve disputes or meet legal obligations; we do not promise a fixed deletion period for those records.

Your choices and rights

You can use StarJar without connecting Google Drive. Parents can manage family information and use the available export and deletion controls. Depending on applicable law, you may have rights to access, correct, delete or receive a copy of personal information, restrict or object to processing, withdraw consent, and complain to a data-protection authority. Contact us about these rights or a child’s information. We may need enough information to locate the relevant record without requesting unnecessary information about a child.

Security and changes

No storage or transmission system can be guaranteed completely secure. Protect devices, provider accounts, parent PINs and exported files. We update this page when processing changes and show the effective date above.