Family PointsPrivacy policy
Version draft-2026-10 · October 27, 2026
Family Points is a points app for one family. This page says what we store, why, who else touches it, and how you delete it. It is written in plain words from how the app actually works.
Who we are
Family Points is made and run by SoftLabNY LLC, New York. Write to us at hello@getfamilypoints.app.
What Family Points is
Parents give points for good things. Kids spend them on rewards the family agreed on, and practice spelling and math. Family Points is invite only: a parent sets up a family from an invite we send, and kids use the app inside that parent's account. There is no public sign-up.
What we store about a parent
- Your name and email address.
- Your password, as a one-way hash (Argon2id). We never store the password itself.
- Whether your email is verified, and the version and date of the terms and this policy you accepted.
- Your role in the family (parent).
- Your logins: a hashed token, the device's name (for example "iPhone app" or "Chrome on Mac"), when it was last used, and when it expires. A login that is not used for 30 days ends by itself.
- A record of the changes you make in the app (what changed, from what to what, when, and by whom), so the parents in a family can see who did what.
What we store about a kid
- A first name (up to 20 letters), a color and an icon chosen from fixed lists.
- A 4-digit PIN, as a one-way hash, and counters for wrong tries and lockouts.
- Every points entry: the amount, the reason, the kind of good thing it was, and when.
- Requests a kid sends to a parent (points, a reward, a gift to a sibling), with an optional note.
- Stickers earned.
- Practice lists a parent made, and every practice answer the kid typed, with whether it was right.
Nothing else: no last name, birthday, photo, school, address or location. The kids' privacy notice says more, written for parents of children under 13.
What kids can type
A kid can type two things: a reason when they tap "I did something good", and answers in practice. Each is up to 200 characters. Parents in the family see what the kid typed. Nothing a kid types is sent to the AI service or to anyone outside your family. Please ask your kid not to type names, addresses or phone numbers.
How we use it
To run the app for your family, and for nothing else. We send these emails and no others: a password reset link, a link to verify your email, invites, a notice when a password changed, a notice when a family is scheduled for deletion, and a notice when a parent is removed from the only family they belong to. Our emails contain no tracking pixels.
We show no ads. We run no analytics or trackers in the apps or on this site. We do not sell data, share it for marketing, or build profiles. To stop floods, the servers count requests per internet address per minute; those counters are not kept beyond that.
Who processes it for us
- Amazon Web Services, in the United States (Northern Virginia): the database, the servers, and sending email (Amazon SES).
- Anthropic's Claude, through Amazon Bedrock, only for the AI help a parent asks for when making a practice list. We send the kind of list, the grade and level, how many items, the words the parent typed, and the photo the parent chose, if any. For "make the next list", we also send the previous list's items with how many tries and misses each had. The photo is sent once and is never stored by us. We never send a kid's name, color, icon or id, a parent's name or email, anything a kid typed, or anything about your family. For each request we keep only the provider, the model, how many tokens it used, and an error code if it failed. A parent reviews the draft before any kid sees it.
Security
- Every connection is encrypted (HTTPS only).
- The database is encrypted at rest and only accepts encrypted connections.
- Passwords and PINs are stored as Argon2id hashes; login and device tokens are stored as hashes.
- Wrong PINs lock a kid's login for a while; wrong passwords are rate limited.
- The database keeps each family's data apart: a request for one family can never read another's.
- Secrets live outside the code, in AWS's parameter store.
How long we keep it
- Your family's data: as long as your family uses Family Points.
- After you delete a family or an account: 30 days in which you can undo it, then everything is deleted for good.
- Database backups: 7 days.
- Server logs: 30 days.
- Records of emails we sent: 90 days.
- Email you send to us: forwarded to our inbox, and the copy that arrived on our servers is deleted after 30 days.
Deleting your data
- A kid: remove them in the app. The kid is hidden and can be restored; their history is kept until you choose "Delete permanently" or delete the family.
- The family: delete it in the app. Everyone's access stops at once. You can undo it for 30 days; after that everything about the family is deleted for good.
- Your account: the apps do not have this screen yet. Email hello@getfamilypoints.app from your account's address and we delete it within 30 days. Deleting your account also deletes every family where you are the last parent.
Your choices
You can see and change everything about your family in the app. Email us for a question, a copy of your family's data, or a deletion.
Children
Family Points stores information about children under 13, entered by their parent and typed by the kids themselves. The kids' privacy notice explains what, why, and your rights as a parent.
Changes to this policy
The version at the top of this page changes when the policy does. The app shows the version you accept when you join. If a change matters, we email every parent first.
Contact
SoftLabNY LLC · hello@getfamilypoints.app