Privacy Policy

1. Who we are

FlowState Family is operated by Qassem Shaia, a sole trader based in Western Australia, Australia, trading as "FlowState Family". Qassem Shaia is the data controller for the personal information described in this notice and decides why and how it is processed. Contact: flowstatefamilyy@gmail.com.

2. Information we collect and why

• Email address — to create your account, sign you in, and send password resets and family invites.
• First and last name / display name — shown to your family members so everyone knows who completed what.
• Phone numbers — used only to send SMS invitations to family members you choose to invite. We do not sell or share numbers, and we do not send marketing texts.
• Camera and photo uploads — used strictly for chore verification, visible only to members of your family.
• App activity — chores, coins, streaks, rewards and audit-log entries needed to run your family economy.
• Technical data — device/browser information, IP address and error logs, used for security, fraud prevention and diagnosing problems.
• Subscription status — whether your family is on the free plan, a trial or Pro. Card numbers and billing details are collected and stored by Paddle, not by us.

3. Legal basis for processing

• Performance of a contract — creating your account, running the family workspace and providing Pro features you purchase.
• Legitimate interests — keeping the service secure, preventing fraud and abuse, and improving the product.
• Consent — camera/photo uploads and sending SMS invitations to contacts you choose; you can withdraw consent at any time.
• Legal obligation — tax, accounting and responding to lawful requests.

4. Payments and Merchant of Record

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders and acts as an independent controller for payment data. Paddle collects and processes your billing name, address, payment method and tax information to take payment, issue invoices, calculate taxes and handle refunds and chargebacks; we receive only your subscription status and a non-sensitive customer reference. See Paddle's privacy notice.

5. Camera and photo permissions

The camera is only accessed when you tap to attach proof to a chore. Chore photos are restricted to authorised members of your own family and to no one else. Photos are never used for advertising, facial recognition, or training models, and are never shared outside your family.

6. Account architecture

FlowState Family has two account types. Parent dashboards can approve or reject chores, award bonuses and deduct coins; they are protected by an adult PIN chosen by the family creator. Child dashboards can complete chores, submit photo proof, and spend earned coins, but can never approve their own work or adjust balances.

7. Children's privacy

Child accounts are created and supervised by a verified parent or guardian. We collect the minimum information needed for a child to take part, and a parent can delete all family data at any time from Settings.

8. Who we share data with

We do not sell your personal information. Data is shared within your own family group and with:

• Service providers / subprocessors — cloud hosting and database providers, email and SMS delivery, and error-monitoring tools, acting on our instructions.
• Paddle.com — our Merchant of Record, for sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where required by law or to protect a child from harm.

9. International transfers

Our hosting and service providers may process data outside your country, including in the United States and the European Union. Where data leaves the UK/EEA or Australia, we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

10. Data retention

We keep account and family data for as long as your account is active. If you delete your family or account, personal data and chore photos are deleted or anonymised within 30 days, except backups which cycle out within 90 days. Chore-verification photos are retained for a maximum of 12 months unless deleted sooner. Transaction records held by Paddle are retained by Paddle for up to 7 years to meet tax and accounting obligations.

11. Security

We apply appropriate technical and organisational measures: encryption in transit (TLS) and at rest, row-level database access controls so a family can only ever read its own records, hashed adult PINs, private storage buckets with signed URLs for chore photos, least-privilege server-side access to billing data, and secrets held only in server environments. No system is perfectly secure, but we review these controls regularly.

12. Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in, remember your theme preference and hold your family session. Paddle sets cookies during checkout to process your order and prevent fraud. We do not use advertising or cross-site tracking cookies. You can clear cookies and local storage in your browser settings, though this will sign you out.

13. Your rights

Depending on where you live, you may request access to, correction, deletion, restriction, portability of, or object to the processing of your personal data, and withdraw consent at any time. You can edit your profile, revoke invites, and reset or delete family data from Settings, or email us and we will respond within one month. If you are in the UK/EEA you may complain to your supervisory authority; in Australia you may complain to the Office of the Australian Information Commissioner.

14. Contact us

Privacy questions or data requests: flowstatefamilyy@gmail.com.