Privacy policy
What the MamaPoints apps collect, why we need it, how long we keep it and the choices you have. We wrote it for busy parents, so it is as plain as we could make it.
Who we are and what this covers
MamaPoints is made by Clever Hub Private Limited, a company in Sri Lanka ("we", "us", "our"). We are responsible for the personal information described here (the "data controller" in European terms).
This policy covers two apps for iOS and Android, and this website:
- MamaPoints, the parent app, used by parents and other grown-ups who look after the children.
- MamaPoints Kids, the children's app, made for children aged about 5 to 10 and used under a parent's control.
If you have a question about anything here, email info@mamapoints.app.
What information do we collect?
From parents and other grown-ups (MamaPoints app)
- Account details: your name, email address, the colour you pick for yourself, and how you sign in. You can sign in with an email and password, with Google or with Apple. Passwords are handled by Firebase Authentication and we never see them. If you use Google or Apple, we receive the name, email address and (for Google) profile picture that the service shares with us. Apple may give us a private relay email instead of your real one.
- Family details: family name, time zone, quiet hours for notifications and your notification choices.
- What you create: tasks, routines, events (including any location, notes or checklist you type), rewards, approvals and notes on them, star adjustments, and your own personal to-do items.
- What you type into Mama AI and the suggestions it gives back (see AI features).
- A notification token for your device, if you allow notifications, so we can send the alerts you asked for.
About children (entered by the parent)
- First name or nickname, date of birth, an avatar colour, a panda character and an optional "focus area" (for example Kindness or Reading).
- The child's date of birth is used to work out their age, so tasks, reward ideas and Ask Panda's answers suit them. It is not shown to other children and is never shared with advertisers.
Created when a child uses MamaPoints Kids
- Activity: which tasks were started, finished or sent for review, stars earned and spent, reward requests, streaks and focus timer sessions.
- Task photos: if a parent sets a task to need a photo, the child takes one (or picks one from the device) to show it is done. Only the grown-ups in that family and the child's own device can see it, and it is deleted automatically (see How long do we keep it?).
- Ask Panda questions and answers: the text of each question and Panda's answer are saved to that child's history. If Ask Panda thinks a question contains private details such as a phone number, email address or home address, the question is not sent to the AI and is saved only as "Private info". Ask Panda takes typed questions only; asking with a photo or by voice is not available.
- A device link: the kids app signs in with an anonymous, random identifier. We store which family and which child ("player") the device is linked to, the device platform (iOS or Android), the app version, when it was last used and a notification token if notifications are allowed.
We do not ask a child for an email address, phone number, password, surname, school or location.
Collected automatically
- Technical identifiers that Google Firebase uses to run sign-in, notifications and App Check (a check that requests really come from our genuine apps).
- Server logs that record events such as "account deleted" or an error, with account and family identifiers. They do not contain task content, photos or Ask Panda questions.
What we do not collect
We do not include any advertising, analytics or crash-reporting tools in the apps. We do not collect precise or approximate location, contacts, advertising identifiers, browsing history, health data or payment details.
Permissions the apps ask for
- Camera and photos (kids app): to take task photos and to scan the family code. Used only when the child taps to do one of these things.
- Notifications (both apps): optional. You can say no and still use the apps.
How do we use it, and on what legal basis?
| What we do | Legal basis (UK and EU GDPR) |
|---|---|
| Create and run your family account; sync tasks, stars, rewards and photos between your family's devices | Performing our contract with you |
| Send notifications you have switched on, such as "a task is waiting for review" or the weekly report | Your consent (the device permission) and our contract |
| Run Mama AI and Ask Panda when you or your child use them | Performing our contract; for children, the parent's choice to set up the child and keep Ask Panda switched on |
| Keep the service secure, stop abuse and fix problems | Our legitimate interest in a safe, working service |
| Reply when you contact us | Our legitimate interest in helping you, or our contract |
| Keep records the law requires | Legal obligation |
We do not use your family's data for advertising, we do not build marketing profiles, and we do not make decisions about you that have legal or similarly significant effects using automated processing.
How do the AI features work?
Mama AI (parent app) turns a sentence you type into a task, event, routine or note, suggests star values and reward ideas, helps plan your day, spots clashes between events and writes the weekly summary. To do that it sends what you typed and the details it needs, such as task and event titles, dates, children's first names and ages, to the AI model.
Ask Panda (kids app) answers a child's questions. It sends the question, the last few questions in the same conversation, the child's first name and age, and their focus area. Answers can be read aloud using the device's own text-to-speech.
- Both use Google's Gemini models through Google Firebase AI Logic. Google processes this content as our service provider to produce the answer. We do not allow it to be used for advertising.
- Ask Panda checks every question before it is sent. Questions that look like they share private details, contain links, or touch on adult or unsafe topics get a gentle, pre-written reply instead, which may suggest asking a grown-up. A child who sounds worried or hurt is pointed to a trusted grown-up.
- A parent can switch Ask Panda off for each child, or set how many questions a day they can ask (10 a day to begin with, up to 50, or no limit), in the parent app under Family, then the child's profile, then Ask Panda.
- If the AI cannot be reached, the apps fall back to simple built-in answers that run without sending anything to the AI.
- AI answers can be wrong. They are not medical, legal or other professional advice. See our Terms of use.
How do we protect children's privacy?
MamaPoints Kids is made for children under 13, and we designed it with the US Children's Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code and the GDPR rules for children in mind.
- The parent is in charge. Only an adult with a MamaPoints account can create a child's profile. A kids device can join the family only with the 6-character family code (or QR code) shown in the parent's app, and the parent chooses whether to share it. Setting up the child and sharing the code is how the parent gives permission for the kids app to collect the information listed above.
- We collect as little as we can. First name, date of birth and what the child does in the app. No email, phone number, password or location from a child.
- No contact with strangers. There is no chat, no public profile and no sharing outside the family. A child's photos and activity are visible only to the grown-ups in their family and to their own device.
- No ads, no tracking, no selling. Children's data is never used for advertising or profiling.
- Parents can see and control it. Parents can view and edit a child's profile and activity, review every task photo, switch Ask Panda off or limit it, unlink a kids device and delete the family's data.
A parent can ask us at any time to show them the information we hold about their child, to delete it, or to stop collecting more. Email info@mamapoints.app from the email address on the parent account. To stop further collection straight away, unlink the kids device (Family, then Family code, then Unlink) or delete your account.
If you think a child has used MamaPoints without a parent's knowledge, please tell us and we will delete the information.
Who do we share information with?
- Your own family. Grown-ups in the same family see the family's tasks, children's activity and photos. A kids device sees only the player chosen on it (plus the names and colours of the family's players, so a child can pick themselves).
- Google, as our service provider, through Firebase and Google Cloud: sign-in, database, file storage, notifications, App Check, cloud functions and the Gemini AI models. Google processes the data on our instructions under its data processing terms.
- Apple and Google deliver push notifications to your devices through their notification services, and handle sign-in if you choose Sign in with Apple or Google.
- When the law requires it, or to protect someone's safety, we may share information with authorities. We will only share what is required.
- If the business changes hands, the new owner would have to keep protecting your data in line with this policy, and we would tell you first.
We do not sell, rent or trade personal information, and we do not share it with advertisers or data brokers.
Where is your data stored?
Your data is stored on Google Cloud servers in the United States. Clever Hub Private Limited is in Sri Lanka, and you may be anywhere in the world, so your information is transferred across borders. Where the law requires it (for example from the UK, EU or Sri Lanka), we rely on Google's data processing terms, which include the European Commission's standard contractual clauses and the UK equivalent, to protect those transfers.
How long do we keep it?
We keep your family's information while your account is open, with the shorter limits below. When the family owner deletes their account, the family's data is deleted straight away.
| Information | How long we keep it |
|---|---|
| Account, family, children's profiles, tasks, stars, rewards and events | Until the account is deleted. Deleted immediately when the family owner deletes their account. |
| Task photos | Deleted automatically 30 days after a grown-up approves the task or sends it back. Any task photo file older than 60 days is deleted too, even if nobody reviewed it. The clean-up runs once a day. |
| Ask Panda questions and answers | Kept until the family's data is deleted. When a question is deleted from the history in the kids app, it is hidden from the apps but not erased straight away: we keep it so deleting a question does not reset the daily question limit. Hidden questions are erased when the family owner deletes their account, or sooner if you ask us by email. |
| Archived children | Archiving hides a child from the apps but keeps their stars and history. Their data is deleted with the account, or sooner if you ask us by email. |
| In-app notifications in the parent app | Removed automatically about 60 days after they are created. |
| Kids device links and notification tokens | Until the device is unlinked or the account is deleted. |
| Deleted photos and files | Google keeps deleted files in a recovery area for up to 7 days before they are gone for good. |
| Server logs | Up to 30 days. |
| Emails you send us | As long as we need to deal with your request and keep a record of it. |
We may keep information longer only where the law requires it, and then only what is required.
How do we keep it safe?
- All data travels over encrypted connections and is encrypted at rest by Google.
- Strict database and file storage rules mean only members of your family, and the kids devices you linked, can read your family's data. A kids device can read only the player chosen on it.
- Star balances are calculated on our servers, so a modified app cannot change them.
- Firebase App Check helps block requests that do not come from our genuine apps.
- Deleting an account asks you to confirm it is really you first.
No system is perfectly secure. Please keep your password private and tell us straight away at info@mamapoints.app if you think your account has been misused. If a data breach affects you, we will tell you and the authorities as the law requires.
What choices and rights do you have?
In the app
- Edit your name in Settings, then Personal information, and a child's details in Family, then the child, then Edit profile.
- Turn each kind of notification on or off, and set quiet hours, in Settings, then Notifications.
- Switch Ask Panda off or set a daily limit for each child.
- Unlink a kids device in Family, then Family code, then Unlink.
- Delete your account in Settings, then Delete account. See how account deletion works.
By email
Depending on where you live, you may have the right to:
- get a copy of your personal information (and your child's), including in a portable format;
- correct information that is wrong or incomplete;
- have information deleted;
- object to, or ask us to restrict, how we use it;
- withdraw consent you gave, without affecting what happened before;
- complain to a data protection authority.
Email info@mamapoints.app, ideally from the email address on your account. We may need to confirm it is you before we act. We reply within one month, and we do not charge for reasonable requests.
Extra information for some countries and states
UK and European Economic Area
You have the rights listed above under the UK GDPR and the EU GDPR. You can complain to your local data protection authority, such as the Information Commissioner's Office in the UK, though we would like the chance to put things right first.
California (CCPA/CPRA)
In the past 12 months we have collected identifiers (such as name, email address and account IDs), personal information you give us (such as children's names and dates of birth), and content you create (tasks, photos, questions). We use it only for the purposes in this policy. We do not sell or "share" personal information for cross-context behavioural advertising, including of children under 16. You have the right to know what we collect, to get a copy, to correct it and to delete it, and we will not treat you differently for using these rights. You can use an authorised agent; we will ask them for proof of your permission.
Sri Lanka
We process personal data in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022. You have the right to access your data, withdraw consent, have it corrected or completed, and have it erased, and to complain to the Data Protection Authority of Sri Lanka.
United States: children under 13
See How do we protect children's privacy? for how parents can review, delete or stop the collection of their child's information under COPPA.
Will this policy change?
We will update this page when the apps or the law change, and change the date at the top. If a change is significant, for example a new use of children's data, we will tell you in the app before it takes effect and ask for your consent where the law requires it.
How do I contact you?
Clever Hub Private Limited, Sri Lanka. Email: info@mamapoints.app
We aim to reply within 2 business days.