Privacy Policy

Last updated: September 12, 2026

House Cup ("we," "us," or "our") operates the House Cup application (the "Service"), a household points and reward system for adult parents, guardians and authorized adult household members. This Privacy Policy explains how we collect, use, disclose, and protect information about you and your children when you use our Service.

This release is for adults aged 18 or older. Adults enter and manage household records about their children. Child Access, child sign-in and child-operated features are unavailable. Please do not let children use your account or submit information through the Service. If you believe a child has provided information directly, contact privacy@housecup.app so we can assess and address it.

Information We Collect

Parent Account Information

When you create an account, we collect:

• Email address
• Display name
• Optional profile photo supplied by a sign-in provider, such as Google
• Authentication credentials (password hash or OAuth token)
• Account preferences and settings

Household Information Adults Provide

Adult account holders provide child nicknames, profile emoji and themes, point transactions, activity notes, goals, reward selections and redemption records. Use nicknames and avoid entering sensitive details, full names or contact information in free-text fields.

We also process adult account and service information, such as IP addresses, device/browser information, authentication records, preferences and security logs, to operate the Service. Our authentication provider also derives approximate location from IP addresses, such as country, region, city, time zone and approximate coordinates, and links it to the adult account and sign-in session for authentication, account management and security. This is not GPS location, and the app does not request location permission. We record the account, timestamp and notice version when a parent confirms the household data notice. That confirmation is a parent representation; it does not verify identity or enable child use.

How We Use Children's Information

We use children's information solely for the following purposes:

• Show adults the household nicknames, point balances and reward status
• Enable parents to track and manage their children's behavior points and rewards
• Provide the core functionality of the Service as a family behavior management tool

We do not use children's information for advertising, profiling, behavioral targeting, or any purpose other than providing the core Service functionality.

Third Parties That Receive Data

We use the following third-party service providers ("sub-processors") to operate the Service. These providers may process data, including children's data, as necessary to provide their services to us:

We do not sell, share, or disclose children's personal information to third parties for advertising, marketing, or any purpose unrelated to providing the Service. Our sub-processors are contractually required to use data only for the purposes specified above.

House Cup stores subscription identifiers, plan and status, and paid or grace-period dates. Card numbers are handled by the payment provider and are not stored by House Cup. Our native billing integration does not send child names or account email addresses to RevenueCat. Apple and Google process store purchases under their own account and privacy terms.

Parental Rights

As a parent or legal guardian, you have the following rights regarding your child's personal information:

• Access and review — You can view all information collected about your child at any time through your parent account dashboard
• Request deletion — You can delete your child's profile and all associated data from the Settings page, or by contacting us
• Withdraw and delete — Settings lets you withdraw a recorded parent notice and permanently delete all child profiles and related data in your current household. The confirmation screen explains the effect before you proceed.
• Data export — You may request a copy of your child's data in a machine-readable format from Settings or by contacting us

To exercise any of these rights, use the in-app settings or contact us at privacy@housecup.app.

See the public House Cup account-deletion instructions for the protected in-app steps and subscription details.

Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected. Our retention periods by data type are:

When you delete your account or a child profile, we delete all associated personal information from our active systems within 30 days. Backup copies may be retained for up to 90 days before being permanently purged.

Contact Information

For questions or concerns about this Privacy Policy or our data practices, including requests related to children's data:

• Email: privacy@housecup.app

We will respond to all privacy-related inquiries within 30 days.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes to how we collect, use, or disclose children's personal information, we will notify you by:

• Posting a prominent notice within the Service before the changes take effect
• Sending an email notification to the address associated with your account
• Updating the "Last updated" date at the top of this page

Any future child-access service will require a separate assessment of its data practices, notices and any legally required parental consent before it is made available. A parent confirmation in this release does not authorize direct collection from children.

Data Controller

House Cup is the data controller responsible for your personal data. You can contact us at:

• Email: privacy@housecup.app

Lawful Basis for Processing

We process personal data on the following legal bases:

• Consent — Where you choose optional storage or another optional activity for which we request consent; you can withdraw that choice
• Contract performance — Processing necessary to provide the Service as agreed in our Terms of Service (parent account data)
• Legitimate interests — For providing the household records service requested by adults, maintaining security and preventing fraud, subject to applicable law and the rights and interests of children and other individuals

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you
• Right to rectification — Request correction of inaccurate or incomplete personal data
• Right to erasure — Request deletion of your personal data (subject to certain legal exceptions)
• Right to data portability — Receive your personal data in a structured, commonly used, machine-readable format
• Right to object — Object to processing based on legitimate interests
• Right to restriction of processing — Request that we limit how we use your data in certain circumstances
• Right to lodge a complaint — You have the right to lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at privacy@housecup.app. We will respond within 30 days (or as required by applicable law).

International Data Transfers

Your data is processed and stored in the United States. If you are located outside the United States, your personal data will be transferred to and processed in the United States. We rely on the following safeguards for international transfers:

• Standard contractual clauses approved by the European Commission
• Data processing agreements with our sub-processors that require appropriate technical and organizational security measures

Data Protection Officer

Given the current scale of our operations, we have not appointed a dedicated Data Protection Officer. For all data protection inquiries, please contact us at privacy@housecup.app.

California Privacy Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

Categories of Personal Information Collected

• Identifiers — name, email address, account credentials
• Internet activity — usage data, session information, interaction with the Service
• Inferences — behavioral point patterns derived from parent-entered data

Purposes of Collection

• Providing and maintaining the Service
• Account authentication and security
• Transactional communications (e.g., email notifications)
• Service improvement and troubleshooting

Your California Rights

• Right to know — Request what personal information we have collected, used, disclosed, or sold about you
• Right to delete — Request deletion of your personal information
• Right to opt-out of sale/sharing — We do not sell or share personal information as defined by the CCPA/CPRA
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights

We do not sell or share personal information as defined by the CCPA/CPRA.

Children and teenagers may not use this release. Adults can contact us about information they have supplied concerning a child and the privacy rights that apply to that information.

To exercise your California privacy rights, contact us at privacy@housecup.app.

Data Security

We implement appropriate technical and organizational measures to protect personal information, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest
• Access controls limiting data access to authorized personnel
• Regular security reviews of our systems and practices

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.