How Bopstars looks after your family's information

The short version

• Bopstars stores only what it needs to run your family's stars, tasks, rewards and calendar.
• Only the parents and guardians in your family can see your family's information.
• We never sell your data, show ads, or use tracking or analytics tools.
• You sign in with Google, so Bopstars never sees or stores a password.
• Email us at any time to get a copy of your data or have it deleted.

Who we are

Bopstars is run by Phosphorus Design, who is responsible for your information (the "data controller"). You can contact us at info@phosphorusdesign.com.

What we store

About parents and guardians

• Your name, email address and Google account ID, which Google shares with us when you sign in. We ask Google for nothing else: not your contacts, calendar, files or photos.
• Which family you belong to, and whether you created it.
• Your kid mode PIN, stored only in scrambled (hashed) form so no one, including us, can read it.

About children

A parent adds each child and manages their information:

• Name, date of birth, whether they're a girl or a boy (if the parent chooses to say), and the avatar picked for them.
• Their email address and Google account ID, only if a parent adds the child's own Google account (for example a Family Link account) so the child can sign in on their own device.
• The stars they've earned, including what each was for and who gave it.
• Their tasks, when they completed them, and the rewards they've asked for.

Family calendar

• Events you add: what they are, dates and times, where, notes, who they're for, and who added or last changed them.
• Calendars you subscribe to, such as your school's: the link you give us, and a copy of that calendar's events, which we download from that link every few hours. Remove the calendar and its copy is deleted.

Invites

• When you invite another parent or guardian, we store a scrambled copy of the invite link, when it expires, and who used it.

Technical information

• One cookie that keeps you signed in. It's essential for the site to work, and it's deleted when you close your browser or log out. We don't use any other cookies.
• Like all websites, our hosting company's servers keep short-term logs of visits (such as IP address, browser type and pages requested) for security and to fix problems.

Why we use it

We use your information only to provide Bopstars to your family: signing you in, showing your family's stars, tasks, rewards and calendar, letting the adults in your family share them, and keeping the service secure. Under data protection law (GDPR), our legal basis is that we need it to provide the service you've signed up for. We use technical logs because we have a legitimate interest in keeping the service secure and working.

We don't use your information for advertising, profiling or automated decisions, and we don't sell it or share it for marketing.

Who can see it

• The adults in your family. Every parent or guardian in your family can see and change your family's children, stars, tasks, rewards and calendar. Only adults you invite can join, and the person who created the family can remove anyone.
• Your children. A child, in kid mode on your device or signed in on their own, sees only their own stars, tasks and rewards. A parent PIN is needed to leave kid mode.
• Us, only when needed to run, fix or secure the service, or when you ask us for help.
• Companies that help us run Bopstars: our hosting company, Jolt (jolt.co.uk), which stores the data on its servers, and Google, which handles sign-in. They act on our instructions and may not use your data for their own purposes.
• Authorities, only if the law requires it.

Google sign-in

When you or your child signs in with Google, we receive the name, email address and Google account ID of that Google account, and use them only to create and identify the Bopstars account. Bopstars' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we keep it safe

• The site only works over an encrypted (HTTPS) connection.
• There are no passwords to leak: sign-in goes through Google.
• Kid mode PINs and invite links are stored scrambled, and repeated wrong PINs are locked out.
• Each family's information is only ever shown to that family.

How long we keep it

We keep your family's information for as long as your family uses Bopstars. If you ask us to delete your account or family, we'll delete it within 30 days, except where the law requires us to keep something. If someone accepts a parent's request to join a family as a child, their own earlier Bopstars family and everything in it is deleted straight away. Server logs are kept only for a short time by our hosting company. Unused invite links expire after 7 days.

Your rights

You can ask us to:

• give you a copy of the information we hold about you and your children;
• correct anything that's wrong (you can also change most things yourself in the app);
• delete your account, a child, or your whole family;
• stop or limit how we use your information, or give it to you in a format you can take elsewhere.

Email info@phosphorusdesign.com and we'll reply within one month. If you're unhappy with how we've handled your information, you can complain to the Data Protection Commission in Ireland, or the Information Commissioner's Office in the UK.

Children

Bopstars is for parents and guardians. Children can't create accounts. They use Bopstars through kid mode on a device a parent has handed them, or, if a parent adds the child's own Google account (such as a Family Link account), by signing in on their own device. Either way they only see their own stars, tasks and rewards. Parents decide what information about their children goes into Bopstars, can remove a child's email at any time, and can ask us to delete everything.

Changes to this policy

If we change how we use your information, we'll update this page and the date at the top, and we'll tell you about important changes before they take effect.