Privacy Policy
Last updated: 2026-05-22
This is the privacy policy for Smiley Bank (“the app”). We’ve written it in plain English instead of legalese because we want you to actually read it.
TL;DR
- We collect your email and name to sign you in. That’s it on the personal side.
- Your family’s data (kids, smiles, transactions, rewards, pet) lives in your private Firebase account.
- We don’t sell your data, run ads against it, or share it with third parties.
- Kids never sign in to anything outside the app.
- You can delete everything at any time — right from Settings, no email required.
What we collect, why, and where it lives
When you sign in as a parent
- Email and display name — supplied by Apple Sign In, Google Sign In, or your email/password registration. We use these to identify your account and show your name in-app.
- Stored at: Google Firebase Authentication (your account record).
When you use the app
- Family roster — the names, avatars, balances, and 4-animal passwords for the kids you create.
- Transactions — every smile earned, spent, or adjusted. Reasons, amounts, timestamps, and which kid the transaction belongs to.
- Rewards catalog — the rewards you create (titles, costs, categories, descriptions).
- Behavior templates — the templates you create or use.
- Pet state — your kid’s adopted pet, happiness, bond, and care history.
- Stored at: Google Firebase Firestore, under your family’s private document. Only authenticated members of your family (parents you invite via the in-app co-parent flow) can read or write your family’s data.
Co-parent invitations
When you invite another parent to your family, their email is stored in your family document under pendingInviteEmails. Once they accept by signing in, their UID joins your family’s parentUids list and the email is removed from the pending list. The invitation is in-app only — no email is sent.
What we do NOT collect
- No location data
- No device identifiers (we don’t use IDFA, ad attribution, or anything like that)
- No analytics SDKs (no Mixpanel, Amplitude, Segment, etc.)
- No third-party trackers
- No data about your kids beyond what you, the parent, type into the app
How kids are handled
Kids do not have separate sign-in accounts. There is no email address, no phone number, no third-party login for any kid using Smiley Bank. The kid login screen uses a 4-animal icon password that you (the parent) set when you create the kid’s profile. That password is stored as a sequence of emoji strings in your family’s Firestore document, alongside the kid’s name and avatar selection.
This is intentional: it means we collect zero personal information about minors directly. Everything attributed to a kid is data you, the parent, entered.
In-App Purchases
Smiley Bank offers a one-time Smiley Bank Premium unlock ($4.99). Purchase processing is handled entirely by Apple. We never see your payment method, billing address, or full Apple ID. Apple notifies us only that your account is entitled to Premium content; we use that signal to unlock the relevant features in your app.
Restoring purchases on a new device works automatically when you sign in with the same Apple ID and tap “Restore Purchase” in Settings.
Data sharing
We do not share your data with any third party for marketing, analytics, or advertising. Period.
The one technical exception is Google Firebase, which is the storage backend for your account and family data. Firebase processes data on Google Cloud Platform infrastructure under Google’s terms. We use Firebase as a vendor; Firebase does not have rights to use your data for its own purposes beyond running the service.
Your rights
- See your data — sign in to the app and you can read everything we have.
- Edit your data — change kid names, avatars, transactions, rewards, behaviors, etc. in-app at any time.
- Delete a kid — Family tab → tap kid → Remove this kid. Hard-deletes the kid profile, all transactions, and the pet from Firestore.
- Delete your entire family / account — Settings → Delete Account. This deletes your Firebase Auth account and all family data immediately. You can also email us (see Contact below) as a fallback.
If you live in a jurisdiction with formal data-protection laws (GDPR, CCPA, PIPEDA, etc.), you have the legal rights those laws describe in addition to what’s listed above. We honor those requests in good faith.
Children’s privacy (COPPA / GDPR-K)
Smiley Bank is designed for families with children ages 4–12, but it does not collect personal information from children directly. Kid accounts are created by parents and contain only data the parent inputs (name, chosen avatar, chosen 4-animal password). No email, phone number, photo, voice recording, geolocation, or any other COPPA-defined personal information is collected from a child.
If you believe your child has somehow been associated with personal data we collected without your knowledge, please email us and we will remove it.
Changes to this policy
If we change anything material, we’ll update the “Last updated” date at the top and post the new version at this URL before the change takes effect. Continued use of the app after a change means you accept the new version.
Contact
Questions, requests, deletions: ricoxxo@gmail.com
We respond to privacy requests within 7 business days.