How Bopstars looks after your family's information

The short version

• Bopstars stores only what it needs to run your family's stars, tasks, rewards and calendar.
• Only the parents and guardians in your family can see your family's information.
• We use Google Analytics to see how Bopstars is used, but only if you say yes, and never on children's screens (more below).
• We don't show ads or send marketing emails. We may add them in future; if we do, we'll update this policy first and ask for your permission where the law requires it (more below).
• Parents can get helpful emails from Bopstars (more below), and choose which ones or switch them off. Children never receive emails from Bopstars.
• You sign in with Google, so Bopstars never sees or stores a password.
• Email us at any time to get a copy of your data or have it deleted.

Who we are

Bopstars is run by Phosphorus Design, who is responsible for your information (the "data controller"). You can contact us at info@phosphorusdesign.com.

What we store

About parents and guardians

• Your name, email address and Google account ID, which Google shares with us when you sign in. We ask Google for nothing else: not your contacts, calendar, files or photos.
• Which family you belong to, and whether you created it.
• Your kid mode PIN, stored only in scrambled (hashed) form so no one, including us, can read it.

About children

A parent adds each child and manages their information:

• Name, date of birth, whether they're a girl or a boy (if the parent chooses to say), and the avatar picked for them.
• Their email address and Google account ID, only if a parent adds the child's own Google account (for example a Family Link account) so the child can sign in on their own device.
• The stars they've earned, including what each was for and who gave it.
• Their tasks, when they completed them, the rewards they've asked for, and ideas for new rewards they've suggested.
• Stars they've claimed for calendar activities, and whether a parent said yes.

Family calendar

• Events you add: what they are, dates and times, where, notes, who they're for, and who added or last changed them.
• Calendars you subscribe to, such as your school's: the link you give us, and a copy of that calendar's events, which we download from that link every few hours. Remove the calendar and its copy is deleted.
• If you make a private calendar link (to see Bopstars in Outlook, Google Calendar or Apple Calendar): the link's code, what it shows, and when a calendar app last collected it. Anyone with the link can see those events, so keep it private; you can make a new one or turn it off at any time.

Games

• For the Réiltín word game: which words each person (parent or child) has played, how many guesses they took, whether they got it, and whether they used the hint. We use it to give each person a new word each time and to show them the words they've done.

Invites

• When you invite another parent or guardian, we store a scrambled copy of the invite link, when it expires, and who used it.

Emails

• Which Bopstars emails you've chosen, what time you'd like the evening one, and a private code for the unsubscribe link in each email.
• A record of the emails sent to you (what kind, when, and whether it was delivered), kept for up to 90 days so we can fix problems.

Technical information

• Two cookies that keep you signed in, both essential for the site to work. One lasts until you close your browser. The other keeps you signed in on that device for 30 days after your last visit, so you don't have to sign in with Google every time; it's removed when you log out.
• If you say yes to analytics: Google Analytics cookies (named _ga and _ga_ followed by letters and numbers), which last up to 13 months. Your yes or no is remembered on your device. We don't use any other cookies.
• When each account last signed in, so we can see how Bopstars is being used and spot problems.
• Like all websites, our hosting company's servers keep short-term logs of visits (such as IP address, browser type and pages requested) for security and to fix problems.

Why we use it

We use your information only to provide Bopstars to your family: signing you in, showing your family's stars, tasks, rewards and calendar, letting the adults in your family share them, and keeping the service secure. Under data protection law (GDPR), our legal basis is that we need it to provide the service you've signed up for. We use technical logs because we have a legitimate interest in keeping the service secure and working.

If you agree to analytics, we use it to understand how Bopstars is used so we can improve it; our legal basis is your consent, which you can withdraw at any time. We don't use your information for advertising or marketing, and we don't make automated decisions about you or your children.

Who can see it

• The adults in your family. Every parent or guardian in your family can see and change your family's children, stars, tasks, rewards and calendar. Only adults you invite can join, and the person who created the family can remove anyone.
• Your children. A child, in kid mode on your device or signed in on their own, sees only their own stars, tasks and rewards. A parent PIN is needed to leave kid mode.
• Us, only when needed to run, fix or secure the service, or when you ask us for help.
• Companies that help us run Bopstars: our hosting company, Jolt (jolt.co.uk), which stores the data on its servers; Google, which handles sign-in and, if you agree to it, analytics (Google Ireland Limited); and Brevo (Sendinblue SAS, France), which delivers our emails to parents. They act on our instructions and may not use your data for their own purposes.
• Authorities, only if the law requires it.

Google sign-in

When you or your child signs in with Google, we receive the name, email address and Google account ID of that Google account, and use them only to create and identify the Bopstars account. Bopstars' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we keep it safe

• The site only works over an encrypted (HTTPS) connection.
• There are no passwords to leak: sign-in goes through Google.
• Kid mode PINs and invite links are stored scrambled, and repeated wrong PINs are locked out.
• Each family's information is only ever shown to that family.

How long we keep it

We keep your family's information for as long as your family uses Bopstars. If you ask us to delete your account or family, we'll delete it within 30 days, except where the law requires us to keep something. If someone accepts a parent's request to join a family as a child, their own earlier Bopstars family and everything in it is deleted straight away. Server logs are kept only for a short time by our hosting company. Unused invite links expire after 7 days.

Your rights

You can ask us to:

• give you a copy of the information we hold about you and your children;
• correct anything that's wrong (you can also change most things yourself in the app);
• delete your account, a child, or your whole family;
• stop or limit how we use your information, or give it to you in a format you can take elsewhere.

Email info@phosphorusdesign.com and we'll reply within one month. If you're unhappy with how we've handled your information, you can complain to the Data Protection Commission in Ireland, or the Information Commissioner's Office in the UK.

Children

Bopstars is for parents and guardians. Children can't create accounts. They use Bopstars through kid mode on a device a parent has handed them, or, if a parent adds the child's own Google account (such as a Family Link account), by signing in on their own device. Either way they only see their own stars, tasks and rewards. Parents decide what information about their children goes into Bopstars, can remove a child's email at any time, and can ask us to delete everything.

Google Analytics

We use Google Analytics to see which parts of Bopstars families use, so we can make it better. It only runs if you tap “Accept” when we ask, and it never runs on children's screens: not when a child signs in, and not in kid mode.

If you say yes, Google Analytics records:

• which pages you visit, with anything personal taken out of the address (for example, which child's page it was);
• the kind of device and browser you use, your rough location (country or city), and how you found us (for example, a Google search);
• a few simple actions: signing in, signing up, giving a star (and whether you used an everyday star, a search or your own words), adding a calendar event, and pinning a note.

It never receives your name, your email address, your children's names, what a star was for, or anything you type. We've turned off Google's advertising features and Google signals, and Analytics data is kept for 14 months. Google may process this data outside the EU, under the EU–US Data Privacy Framework.

You can change your mind at any time: (or “Cookie settings” at the bottom of our home page). Saying no removes Google's cookies from this device.

Emails to parents

Bopstars can email parents and guardians about their own family, for example when a child asks for a reward or claims stars, a note of tomorrow's plans, or a pinned note that another parent in your family chooses to email you (each parent can email at most one a day). You choose which of these you get, and when, under More → Emails, and every email has a link to unsubscribe. Our legal basis is that these emails are part of the service you've signed up for; we'll always also send emails that keep your account safe, such as when someone joins your family.

These emails are sent for us by Brevo, an email company based in France, which receives your name, email address and the email itself only so it can deliver it. They are never sent to children.

Ads and marketing emails in future

Bopstars is free, and to keep it that way we may add these in future:

• Ads on the website.
• Marketing emails to parents and guardians, for example news about Bopstars. Children will never receive emails.

Neither is in use today. Before we add either, we'll update this policy and tell you. Where the law requires your permission, for example for advertising cookies or marketing emails, we'll ask first, and you'll be able to change your mind at any time. Every marketing email will have a simple way to unsubscribe.

Changes to this policy

If we change how we use your information, we'll update this page and the date at the top, and we'll tell you about important changes before they take effect.