Pluck is made for families: parents assign quests on their own phones, and each kid sees them as a game on theirs. This policy explains what the app stores, where, and why. It is written to be read by parents; a kid never has to agree to anything inside the app.
Pluck is run by Jeevan Bhathal, who is responsible for the data described here (the data controller). Write to support@pluck.world with any question or request.
No passwords, an optional sign-in
Pluck does not ask for email addresses, phone numbers or passwords. Each phone signs in to our backend anonymously and receives a random identifier. A single-use code, valid for 15 minutes and shown on a parent’s phone, links another phone to the same family.
A grown-up may choose to keep the family with Sign in with Apple or Google, so that it comes back on a new phone. We then store the identifier that service gives us and, if it shares one, the email address of that account (Apple lets you hide yours). It is used only to sign you back in: we never email you, and nobody else in the family sees it.
What a family stores
- Family data: the family name, each kid’s first name, age and, if the parent set it, whether the kid is a girl or a boy (used only so that languages with grammatical gender address the kid correctly), the parents’ display names and chosen avatars, and the app’s settings (quiet hours, auto-approve threshold, the grown-up code stored as a hash).
- Game data: quests and their status, coins, levels, streaks, badges, rewards and redemptions, and a short activity feed.
- Proof photos: when a quest asks for a photo, the kid’s phone takes one. It is stored privately for the family so a parent’s phone can review it. The app never asks for location, so photos carry no location; they are capped at 5 MB, can be deleted by any parent, are removed from our servers as soon as a parent has approved the quest or asked for a redo, and any photo that slips past that (a quest reset, deleted or re-shot) is swept within a day or two. The copy on the kid’s phone is deleted at the same moment.
- Subscription: whether the family has Pluck Plus and until when, as reported by the App Store or Google Play through RevenueCat. We never see card or payment details.
- Push tokens: if a grown-up or a kid allows notifications, that phone’s push token is stored so that “quest submitted” and “quest approved” pings can reach the right phone. A token is visible only to the phone it belongs to and to the notification service, and it is deleted when the phone leaves the family or notifications are turned off.
Where it lives
Everything works on the phone first. When a backend is configured, family data is synced through Supabase (hosted Postgres, storage and realtime), with row-level security so that each phone can read only its own family, and a kid’s phone only its own kid. Data in transit is encrypted with TLS. The sign-in session on each phone is encrypted with a key held in the device’s Keychain or Keystore.
What we do not do
- In the app: no advertising, no ad identifiers, no third-party analytics or tracking SDKs. The app’s own usage statistics stay on our servers (see below).
- No chat, no social features, no contact with people outside the family.
- No sale or sharing of family data with anyone. Subprocessors are limited to hosting (Supabase), push delivery (Expo push service and the Apple / Google notification services), subscription status (RevenueCat, with App Store and Google Play billing) and, only when a grown-up chooses it, Sign in with Apple or Google. On the website only, and only if you accept its cookies, Google Analytics (Google Ireland Limited) counts visits.
Usage statistics in the app
The app counts how it is used: which screens are opened and which actions are taken, for example a quest created or approved, or a trial started. Each count carries the app version, the language and a random identifier created when the app is installed. On a grown-up’s phone the family’s identifier is attached too, so that we can see how a family uses Pluck over time.
On a kid’s phone only anonymous counts are kept: no family identifier, no install identifier and nothing about the kid.
The counts are stored on our own servers (Supabase, in the EU, in Frankfurt). They are not shared with anyone and never used for advertising. They are kept for 13 months and then deleted.
Website analytics and cookies
Our website, pluck.world, uses Google Analytics 4 through Google Tag Manager, and only after you accept in the cookie banner. Until then, and if you reject, the website loads nothing from Google and sets no cookies; it only remembers your choice in your own browser.
If you accept, Google Analytics sets the cookies _ga and _ga_* to count visits and see which pages are read. The legal basis is your consent (Article 6(1)(a) GDPR). Google Ireland Limited processes this data for us, and it may be transferred to the United States under the EU-US Data Privacy Framework. Google Analytics 4 does not log or store IP addresses. The data is kept for 14 months, and no advertising features are enabled. The cookies last up to two years unless you delete them or withdraw your consent.
You can change your choice at any time with “Cookie settings” in the footer of every page. If you withdraw your consent, the _ga cookies are deleted.
Children
Pluck is a mixed-audience app. Kids’ phones show only the game: quests, coins, rewards and a buddy character. Leaving the game on a parent’s phone requires the family’s grown-up code. We collect from kids only what the parent enters (first name, age, optionally girl or boy) and what the game itself produces (quest progress, optional proof photos). The buddy’s “repeat after me” feature records the kid’s voice for a few seconds, plays it back once on the phone and deletes it; it never leaves the phone. Parents control all of it and can delete it at any time.
Deleting your data
The grown-up who set up the family can erase it: open the Manage tab and choose “Delete family and account”. This deletes the whole family from our servers for everyone: every kid, quest, reward, feed entry and proof photo, and unlinks every phone. That grown-up’s sign-in is deleted with it, and so are the other grown-ups’ sign-ins, unless they still belong to another family. Any other grown-up sees “Delete my account” there instead: their sign-in and membership are deleted, and the family goes on. A kid’s phone is unlinked the moment a parent issues a new code for that kid or removes the kid; a removed kid’s name, age and game data disappear from every phone at once and are purged from our servers within 30 days. You can also write to support@pluck.world and we will delete a family on request.
Our database is backed up daily, and the backups are encrypted. They are kept for up to 30 days and then deleted, so data erased in the app can remain in an encrypted backup for up to 30 days before it is gone for good.
Changes
If this policy changes in a way that matters, the app will say so on the parent side before the change applies.
Contact
Jeevan Bhathal, support@pluck.world