Privacy Policy

Lootti is a chore-and-rewards app built for families with children aged 5–12. Parents are in control, children don't create their own accounts, and we take your family's privacy seriously. This policy explains what we collect, why, and the choices you have.

This policy covers the Lootti mobile app and this website. If you have any questions, email privacy@lootti.app.

What we collect

• Parent account: your email address and a family name, used to sign you in and group your family's data.
• Child profiles (created by you, the parent): a first name or nickname, an optional birthday, and an optional avatar photo. Children do not have their own accounts, email addresses, or logins.
• Task photos (optional "photo proof"): when you set a task to require a photo, your child attaches one. It is stored privately, scoped to your family, and reviewed by you. We do not run automated analysis on these photos and do not send them to any third-party AI service.
• Notifications: a device push token, stored only if you turn on notifications.
• Purchases: subscriptions are processed by Apple or Google. We receive your entitlement status (whether Lootti Pro is active) through RevenueCat — never your card number.
• Analytics: anonymous, aggregated product-usage events (via PostHog) that help us improve the app. You can opt out in the app's settings.
• Diagnostics: anonymized crash and error reports (via Sentry) to keep the app stable.

What we never do

• We never show ads.
• We never sell or rent your data or your child's data.
• We never run third-party AI analysis on your children's photos.
• No public profiles, friend lists, messaging, or any communication between children or between families.
• We never store your payment card — Apple, Google, and RevenueCat handle billing.

How your children's photos are handled

• Stored encrypted and scoped to your family only, enforced by database row-level security.
• Visible only to parents in your family.
• Deletable at any time — and deleting your account removes them entirely.

Data retention & deletion

We keep your data while your account is active. You can permanently delete your family and everything in it at any time — see Delete account. Deletion removes parent and child profiles, tasks, rewards, coin history, and any stored photos, typically within 24 hours (routine backups are purged on their normal cycle).

Your rights

You can access, correct, export, or delete your family's data, and withdraw consent or opt out of analytics at any time. To exercise any of these, use the app or email privacy@lootti.app. If you're in the EU or UK, you also have the right to lodge a complaint with your local data-protection authority.

Children's privacy (COPPA / GDPR-K)

Lootti is parent-managed by design. A parent creates the family and adds each child; a child then joins on their own device using a one-time code the parent generates. Children cannot sign up on their own, cannot chat, and have no public presence anywhere in the product.

We collect only the minimum needed to run the app for a child — a first name or nickname, an optional birthday, an optional avatar, and the task photos you choose to enable. The parent's setup and consent is the basis for any child data we hold. If you believe we hold a child's data without a parent's involvement, email privacy@lootti.app and we will delete it.

Service providers

We use a small set of trusted providers to run Lootti: Supabase (database, authentication, and encrypted photo storage, hosted in the EU), Apple and Google (billing) with RevenueCat (subscription status), PostHog (anonymous analytics), and Sentry (crash diagnostics). Each processes only the data needed for its part of the service.

Changes to this policy

If we make changes, we'll update this page and the "last updated" date, and surface material changes in the app.

Contact

Questions about privacy? Email privacy@lootti.app.