Privacy

Who is responsible

Pegboard is run by Ibad Ullah Zuberi, an individual based in London, United Kingdom, who is the data controller for everything described here. That means the decisions about what is collected, why, and how long it is kept are ours, and we are the ones answerable for them.

A parent using Pegboard for their own family is doing something personal and domestic, so the law does not make them a controller as well. They decide what goes into their household; we decide how the service handles it. Reach us at hello@getpegboard.co.uk.

What we hold

• An email address for parents, or a username for kids. Kids need no email address.
• A display name, and a birth year and month if a parent enters them. Never a full date of birth.
• Chores, who claimed them, and what they were worth.
• Proof photos, but only if a parent switches them on. They are off when a household is created.
• An append-only record of money owed and paid.
• If you turn notifications on for a device, a label for that device (such as "Chrome on Android") and the address and keys your browser gave us to reach it. Off unless you switch it on, and for a child off until a parent allows it.
• Technical records we cannot run the service without: errors, and the times an account signs in.

Why we are allowed to hold it

Our lawful basis is contract: a parent asks us to run a chore board for their family, and none of the above can be done without this data. Keeping an accurate, unalterable record of money owed rests on our legitimate interest in the ledger being trustworthy. A record a parent could quietly edit would be worth nothing to the child it is about.

We do not rely on consent for anything essential, so nothing stops working if you decline something optional, and there is nothing optional to decline in order to use the app.

Children

Pegboard is built for children to use, so it is designed to the ICO's Children's Code: high privacy by default, the least data that works, and nothing designed to keep a child using it longer than they meant to.

• A child account needs no email address, no phone number and no date of birth.
• Photos are off unless a parent turns them on.
• No profiling, no advertising, no tracking of a child across other sites, and no nudges engineered to extend use.
• A parent creates every child account, and can delete it and everything in it.

What we do not do

• We do not profile anyone, adult or child.
• We do not sell or share data with advertisers.
• We do not hold or move money. The ledger records what a parent owes; the cash changes hands in real life.

Photos

Off by default. If a parent turns them on, proof photos live in a private bucket and are only viewable through short-lived links issued to members of that household. Location and camera data are destroyed before storage, because the image is re-encoded rather than merely stripped, so a photo of a child's room never carries where that room is. Photos are deleted automatically after a household's retention window, 90 days by default.

A photo can be reported from the approvals screen. It is hidden from everyone immediately and reviewed by us, and we then delete it for good or restore it. A child who wants a photo of themselves taken down can ask their parent, or email us directly at hello@getpegboard.co.uk; anything about a child's safety is dealt with the same day.

Who else touches it

Three processors, each under contract and none of them permitted to use the data for their own purposes: Supabase (database and file storage, EU region), Clerk (sign-in), and Vercel (hosting). Email is sent through Resend. Data is held in the EU and the UK; where a provider's support operates from outside, the transfer relies on the UK's standard contractual clauses.

If you turn on notifications on a device, your browser's own push service (Google's for Chrome and Edge, Mozilla's for Firefox, Apple's for Safari) delivers them. What it carries is encrypted so that only your device can read it: it learns that a notification exists for your device and nothing about what it says. We use no other company for this.

How long we keep it

• Household data: until the household is deleted, then it goes within 30 days.
• Photos: the household's retention window, 90 days unless a parent shortens it.
• Error records: 90 days.
• Notification devices: until you remove them, the device stops answering, or it has gone unused for 90 days, whichever comes first, and with your account if it is deleted.
• Reports about a photo: two years once dealt with, or sooner if the household is deleted, and never with the photo, which goes first. A record that something was raised and what was done about it is the point of having a report at all.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, or to object. A parent can do the first and third of those immediately from the settings screen: export the household, or delete it or any single member, without asking anyone. Deletion removes the rows and the stored photos.

The append-only ledger is the one exception worth naming: individual entries cannot be edited, because a record of money owed that could be rewritten would be useless. Erasing the household erases the ledger with it.

Ask us anything through the contact form You don't need to be signed in, because if you've lost access to your account that's exactly when it has to work. We answer within a month.

If we get it wrong

Tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113, and you do not have to come to us first.