TicQuest Children's Privacy Notice

Effective date: 2026-09-02 Version: 1.7

*This notice is for parents and legal guardians. It supplements our full Privacy Policy with a focused explanation of how TicQuest, operated by Velynq, Inc., handles children's personal information under the Children's Online Privacy Protection Act (COPPA, 16 C.F.R. Part 312, including the FTC's 2025 amendments), GDPR Article 8, and equivalent laws.*

1. Our Commitment

TicQuest is built to collect as little about your child as possible. A child never creates an account, never signs in with credentials, and is never asked for any contact information. Only you — the parent or guardian — create and control the account.

2. What Child Data We Collect — and Why

2.1 What we collect

Category	What it is	Why	How long
Name or nickname	A name or nickname you choose when adding a child (no real name needed)	To show the child's name in the App	While the account is active; deleted with the child/account
Avatar	A preset illustration key (never a photo)	To personalize the child's view	Same
Stars, streaks, progress counters	Running totals of stars, active days, completion rate, streak state	To power the reward and motivation system	Same
Routine completion logs	Per-task on-time status, stars, timestamps	To show recent history to the parent	7-day rolling, then auto-deleted
Monthly / yearly summaries	Aggregate counts of days completed, stars, certificates	Parent progress dashboard; show progress over time	While the account is active; deleted with the child/account
Certificates	Date, routine names, stars, theme	To celebrate achievements	While the account is active
Alarm settings	Scheduled time, days, linked routine	Optional parent-set routine alarm	While the account is active
Quest-completion / daily-credit / rest-day records	Per-routine and per-day flags	To compute streaks and active days	While the account is active
Reward / unlock records	Which rewards the child has earned	To show reward status	While the account is active
Time zone	Your device's time zone (a coarse regional setting — not location)	To compute streak/activity dates in the child's local time	While the account is active
Device-pairing token	A UUID generated only if you pair a separate kid device	To link that device to your family	Until you unpair or delete the account

We keep child data only as long as reasonably necessary for these purposes and never indefinitely (see the Privacy Policy, Section 8).

2.2 What we deliberately do NOT collect

No child age or date of birth.
No child photographs or uploaded images (avatars are preset keys).
No child email, phone, or postal address.
No precise location / GPS.
No advertising profile and no advertising whatsoever — there is no ad SDK.
No third-party analytics, advertising, or crash-reporting SDK. (The optional product & attribution analytics described in Section 2.4 are first-party — they run in our own backend and the data reaches no third-party service. We read the install source with an open-source on-device bridge that calls Google Play's own Install Referrer API, not a third-party attribution service; no such service receives the data.)

2.3 Parent-authored free text

Routine titles, task names, and reward labels are your content. The App never asks for a child's surname, school, address, or medical details, and we advise against entering any sensitive data there.

2.4 Optional features that are off by default

A few features are off by default. They are minimised so that, unless you opt in, no analytics is uploaded or stored on our servers — and even then it carries no direct child identifier:

Optional product & attribution analytics. At first open the App reads Google Play's own install referrer once and keeps one minimised envelope only on your device for up to 30 days: coarse install source and medium (never a campaign name; click-identifiers stripped), broad device language and 2-letter country, and first-open time. It makes no server call then. Only if you, the authenticated parent, opt in is that envelope uploaded already keyed to your family, and family setup / activation / subscription milestones recorded (an allowlisted event name + timestamp). Opting in also derives your family's earlier setup milestones — such as when you first created a routine or completed a task — from activity already on your account, so the picture reflects your whole start rather than only what follows opt-in. This reads activity already on your account, but the analytics it stores is limited to your family account, an allowlisted milestone name, and its timestamp — with no direct child identifier, routine/task content, or free text. Milestone events carry no custom properties or free text, and the analytics carries no direct child identifier. Some milestones reflect your child's activity, so the same child-privacy safeguards apply (minimised, never used for ads/profiling, and covered by review, export, withdrawal, and deletion rights). It is first-party, stored only in our Supabase backend on our instructions, and no third-party analytics/attribution service receives it. Turning it off stops collection and deletes the family-linked analytics from our live systems.
Optional on-device reminder notifications. If you turn these on, they are scheduled locally on your child's device, send us no data, and the reminder shown on the lock screen is generic and carries no child name (just a prompt to start the next quest).

The core child-data protections above are unchanged: these features carry no direct child identifier and, where a milestone reflects your child's activity, we apply the same child-privacy safeguards as elsewhere in the App. See the full Privacy Policy §2.5 for details.

3. Who Controls the Account

Only a parent or legal guardian creates and controls a TicQuest account and is the only person who authenticates (email/password or OAuth). Children access the App on your device or on a "kid device" you pair using a time-limited 6-character code. A child never registers and never creates credentials.

Before any child profile can be created, we obtain your verifiable parental consent. Because we collect only a name or nickname you choose plus in-app activity, use it solely to operate the App for your family, show no ads, and never disclose it to third parties for their own purposes, COPPA permits a consent method reasonably designed to confirm you are the parent — which for us is:

Direct notice — we tell you exactly what we collect from your child (a name or nickname you choose, in-app activity, a device time zone for local-time dates, and a device-pairing token), that it is used only to run the App and is never disclosed for anyone else's purposes, and that you can revoke consent at any time.
A parent account with email confirmation — you create a parent account and we send a confirmation link to your email address (or, if you sign in through Apple, Google, or Facebook, we rely on the verified email that provider gives us), so the person consenting holds a real, contactable account they control and attests they are the child's parent or legal guardian.
Explicit parental consent — you confirm you are the child's parent or legal guardian and consent to TicQuest collecting the name or nickname you choose and their activity, both when you accept the Privacy Policy at sign-up and again when you add a child.
A confirmation email — once the profile exists we email your verified address, repeat the direct notice, and give you a one-tap link that removes that child and all of their data.

We record your consent and the timestamp; this record is included in your data export. You can revoke consent at any time by deleting the child's profile or your account, or by emailing privacy@velynq.co.

5. We Never Advertise to or Profile Children

TicQuest shows no advertisements, builds no behavioral profiles, and shares no child data with advertising networks, data brokers, or any third party for marketing. Three service providers see child data: Supabase (backend storage), PowerSync (offline sync), and Resend, which delivers the emails we send you about your child — the confirmation when you add a child, and the optional activity emails you can switch on, both of which carry the name or nickname you chose (Privacy Policy §2.6). Each of the three processes it only on our instructions, under a written data-processing agreement, solely to operate the App. Our subscription provider receives no child data at all. If you enable the optional product & attribution analytics (Section 2.4), Supabase also stores those records, keyed to your family account with no direct child identifier; because some milestones can reflect your child's activity, we apply the same child-privacy safeguards to them as to the rest of the App rather than treating them as outside child-privacy protection (Privacy Policy §6).

6. Review, Export, and Delete Your Child's Data

You are in full control:

Review — see your child's name, progress, routines, and rewards anytime in the parent section of the App.
Export — Settings → "Export my family data" generates a machine-readable file containing your family's data, including every item in Section 2 for each child.
Delete a single child — deleting a child profile removes that child's data immediately.
Delete the entire account — Settings → "Delete account" immediately deletes your account, all child profiles, and all associated data by a cascading deletion; it cannot be undone from within the App. We may retain limited billing/transaction records in de-identified form (family identifier removed) for financial/legal record-keeping. Offline copies on your device are cleared on sign-out/deletion, and hosting backups are overwritten on the provider's rolling cycle — currently 7 days — and never used to restore a deleted account.

To request review, correction, deletion, or consent revocation, you can also contact us at privacy@velynq.co. We respond to verifiable parental requests within 30 days.

6.5 A note for children (age-appropriate transparency — please read this to your child)

This short note is written for the child, in plain words, so they can understand it. Parents can read it aloud. It reflects the ICO Age-Appropriate Design Code's expectation that a child is told, in a way they can understand, what happens to their information.

Hi! Here's what TicQuest knows about you — in simple words. 🦉

We only ever ask you for the name your grown-up picked for you and your character — we never ask for your birthday, your photo, or where you live.

When you finish a quest, TicQuest also remembers the quests you did, your stars, and your days, so your map, your badges, and your rewards work. Your days only ever go up — you can't lose them. 🌟

A grown-up in your family can see how you're doing — your stars, your days, and the quests you finished. That's so they can help you and cheer you on. TicQuest is a family app you use together.

We never show you ads and never sell your information. A few trusted helper companies keep TicQuest running, but they can't use your information for anything of their own.

If you ever want your grown-up to remove everything about you, they can do that any time — it disappears from the app straight away (a safety copy can take a few days to clear).

If something about this feels confusing, ask your grown-up — they can always show you and change it.

7. Changes to This Notice

We will update this notice if our data practices change (for example, if we add a push-notification provider) and revise the effective date above.

Governing language. This notice was drafted in English. Any translation we provide is for your convenience; the English-language version is authoritative and controlling — except to the extent applicable mandatory consumer-protection or data-protection law requires that the local-language version govern.

8. Contact

Velynq, Inc. (data controller)
221 W 9th Street, PMB 858, Wilmington, DE 19801, United States
Phone: +34 919 933 168
Privacy / parental requests: privacy@velynq.co

EU / UK representative (GDPR Article 27). Velynq, Inc. is established in the United States and has appointed Prighter as its representative in the EU and the UK: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria (EU/EEA), and Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom (UK). Parents and supervisory authorities in the EEA or the UK may contact the representative, or lodge a request, at app.prighter.com/portal/12906258038. See the full Privacy Policy, Section 12.

This notice is maintained by Velynq, Inc. and supplements the TicQuest Privacy Policy.