Privacy Policy
Last updated: 5 August 2026
This Privacy Policy explains how Choreward (“we”, “us”, “our”) collects, uses, and protects your personal data when you use our app and website (the “Service”). We handle your data in line with the EU General Data Protection Regulation (GDPR) and applicable Dutch law.
1. Who we are
The data controller responsible for your personal data is:
- Hayo Ottens (operator of Choreward)
- Country: the Netherlands
- Email: hayo.ottens@gmail.com
If you have questions about this policy or how we handle your data, contact us at the email above.
2. The data we collect
We collect the following categories of personal data:
Account and profile data — information you give us when you create an account, such as display name, email address, password (stored in hashed / encrypted form by our auth provider), and optional avatar URL. Household admins may create child memberships with a first name and PIN (no email required for those members).
Household and membership data — household name, invite code, role (admin or member), savings goals, and (when payouts are enabled) an IBAN used as the payout destination.
Chores and activity data — tasks, points values, assignments, deadlines, completion requests, approval or rejection decisions, timestamps, and related status history.
Financial and payment data — when a household enables payouts, we store payout records (points deducted, euro amount, status, references) and IBANs entered for members. Payments are initiated via TrueLayer. You authenticate with your own bank; we do not receive or store your online banking login credentials.
Technical and usage data — limited information needed to run and secure the Service, such as session cookies and server logs (for example IP address and request metadata), for authentication, abuse prevention, and troubleshooting.
Communications — messages you send us for support or feedback.
We do not use third-party advertising trackers in the Service.
3. Why we use your data and our legal basis
Under the GDPR we may only process your data where we have a valid legal basis. We rely on the following:
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Running household chores, points, goals, and approvals | Performance of a contract (Art. 6(1)(b)) |
| Initiating payouts through open banking | Performance of a contract (Art. 6(1)(b)) and, where required, your consent given in the bank authentication flow (Art. 6(1)(a)) |
| Keeping the Service secure and preventing fraud | Legitimate interests (Art. 6(1)(f)) |
| Improving reliability of the Service | Legitimate interests (Art. 6(1)(f)) |
| Service-related communications (for example account confirmation) | Performance of a contract, or legitimate interests |
| Complying with legal and financial-record obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. Bank SCA consent is managed through your bank / TrueLayer flows.
4. Open banking and TrueLayer
Optional payout features are powered by TrueLayer, a regulated open-banking provider operating under the EU PSD2 framework. In short:
- When an admin starts a payout for one member, they are redirected to authenticate and approve the payment with their own bank using Strong Customer Authentication.
- Banking credentials are entered only with the bank — never with Choreward.
- We and TrueLayer process payment details needed to initiate the transfer (for example bank selection, beneficiary name, IBAN, amount, and remittance text).
- TrueLayer’s handling of data is also described in its own privacy notice: https://truelayer.com/privacy.
We use this data only to provide the payout features you request. We do not use financial data for advertising.
5. Who we share your data with
We do not sell your personal data. We share it only with:
- TrueLayer and the relevant banks, to initiate payouts when that feature is used.
- Service providers acting as processors under appropriate agreements:
- Vercel — hosting and delivery of the web application;
- Supabase — authentication, database, and related backend infrastructure.
- Authorities or advisors, where we are legally required to disclose data or need to establish, exercise, or defend legal claims.
- A successor, if Choreward is involved in a transfer of the Service (you will be notified where required).
Household members can see other members’ display names, balances, goals, and task-related activity within their household, as part of how the Service works.
6. International transfers
Our primary infrastructure providers may process data in the European Economic Area and, in some cases, other countries. Where personal data is transferred outside the EEA, we rely on appropriate safeguards provided by those vendors (for example Standard Contractual Clauses or an adequacy decision), as described in their documentation.
7. How long we keep your data
We keep your data only as long as necessary:
- Account, household, and activity data — while your account / household is active, and for a reasonable period afterwards so you can export or we can resolve disputes.
- Payout and financial records — for the period required by applicable Dutch record-keeping rules (commonly up to seven years for certain financial records).
- Technical logs — for a limited period for security and troubleshooting.
When data is no longer needed, we delete or anonymise it. Household admins can export or delete household data via Settings where that feature is available.
8. How we protect your data
We use appropriate technical and organisational measures, including encrypted connections (HTTPS), access controls, hashed passwords / PINs where applicable, and row-level security in the database so household data is isolated. No system is completely secure; we work to protect your information and to respond promptly to incidents.
9. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data (“right to be forgotten”) in certain circumstances;
- Restrict or object to processing in certain circumstances;
- Data portability — receive your data in a portable format;
- Withdraw consent at any time where processing is based on consent.
To exercise these rights, contact us at hayo.ottens@gmail.com. We will respond within one month.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local supervisory authority.
10. Children
Choreward is designed for households, including children who may use a PIN login without an email address.
- An adult household admin creates and manages child memberships and is responsible for parental consent where required.
- In the Netherlands, the age for a child’s own consent to information-society services is generally 16. Below that age, a parent or guardian must consent and supervise use of the Service.
- Child profiles are kept minimal (typically a first name and PIN). We do not run advertising analytics on child screens.
- Payout destinations (IBANs) for minors should be controlled by a parent or guardian. Multiple members may share a parent IBAN.
11. Cookies and similar technologies
We use cookies and similar technologies that are necessary to keep you signed in and to operate the Service securely (session / authentication cookies). We do not use non-essential advertising cookies. Where a browser or platform requires consent for non-essential storage, we will ask before enabling it.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, for significant changes, notify you within the Service where practical.
13. Contact
Questions or requests about your privacy? Contact us at hayo.ottens@gmail.com.