Privacy Policy

1. Who we are

Thomas Pappas, trading as Crunchski, is the controller of the personal data described here. Registered address: 100 Lofts Drive, Princeton, NJ 08540. For anything about privacy or your rights, contact privacy@crunchski.com.

This policy explains what we collect when you use the Crunchski website and apps, why, who it is shared with, and what control you have.

2. What we collect

Account data: your name, email address, password (stored only as a cryptographic hash), profile picture URL if you set one, and two-factor authentication settings including backup codes.

Household data: which household you belong to, your role, your colour, whether you have finance access, and invitations sent to or by you.

Content you enter: chores and their history, points, calendar events, recipes and their ingredients, meal plans, grocery lists, and any notes you add.

Dietary information: diet tags and allergen labels on recipes and meal plans. Depending on why you record it, this can reveal information about health or beliefs. You choose whether to enter it, and you should not enter more than your household needs.

Financial data: the accounts you create, balances and balance history you record, transactions, budget lines, income and deduction figures, tax-profile settings such as filing status and state, subscription and entitlement records, and vehicle details you enter for valuation. We never ask for and never store bank credentials, card numbers or account numbers, and Crunchski has no connection to your bank.

Device and technical data: IP address, browser and device type, and server logs generated when you use the Service. If you turn on reminders in the mobile app, we store a push-notification token for your device.

Usage measurement: our analytics provider records page views on the website, together with the page address, the referring page, and a coarse location and device type derived from your request. It does not set cookies, does not use a device fingerprint or any identifier that follows you between sites, and does not record anything you have typed into the Service. We see counts and trends, not individuals.

Payment data: if you subscribe, our payment processor handles your card details directly. We receive only a customer and subscription reference, the plan, and its status — never your full card number.

3. Where it comes from

Most of it comes from you. Some comes from other members of your household — for example, an administrator who invites you, assigns you a chore, or records a shared account balance. Some is generated automatically by your device when you use the Service. If you sign in with Google or Apple, we receive the basic profile information you approve at that point.

4. Why we use it, and our legal bases

To provide the Service you asked for — creating your account, running your household, showing your data back to you: performance of our contract with you.

To keep the Service secure and working — authentication, rate limiting, fraud and abuse prevention, diagnostics and backups: our legitimate interests in a secure, reliable service, and our legal obligations.

To take payment and manage subscriptions: performance of our contract, and compliance with tax and accounting law.

To send service messages — verification, password resets, invitations, and notices about changes: performance of our contract and our legitimate interests.

To send push reminders: your consent, given when you enable them on your device. You can withdraw it at any time in the app or in your device settings.

To improve the Service: our legitimate interests, using aggregated or de-identified information wherever that is sufficient.

We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use it to build advertising profiles or to train third-party models.

5. Who can see your data

Your household. This is the most important thing to understand about Crunchski: it is a shared workspace. Other members of your household can see shared content — chores, calendar, meals, recipes, points and activity. Members with finance access can see the household's shared financial records. Administrators can see and manage members, roles and invitations, and the household owner can delete the household and everything in it.

Accounts and tasks marked personal are hidden from other members in the product. Treat that as everyday privacy between people who live together, not as protection against someone with administrative access to your household or your device.

Service providers who process data on our behalf under contract: application and database hosting, caching, transactional email, payment processing, app-store billing, push-notification delivery, website analytics, and authentication providers where you choose to use them. They may only use the data to provide their service to us.

Legal and safety: we may disclose data where required by law, court order or a valid legal request, or where reasonably necessary to protect rights, safety or property, or to enforce our Terms.

Business transfers: if we are involved in a merger, acquisition, financing or sale of assets, data may transfer as part of that transaction. We will tell you if that changes who controls your data.

6. International transfers

We and our providers may process data in countries other than yours, including the United States. Where data leaves a region with data-transfer restrictions, we rely on an appropriate safeguard such as standard contractual clauses or an adequacy decision. Contact us at privacy@crunchski.com for details of the safeguards in place.

7. How long we keep it

We keep your data while your account is active and for as long as needed to provide the Service. When you delete your account we delete your personal data, and when a household is deleted its content is deleted with it, both within 30 days except where we must keep something longer.

We keep what the law requires — for example, records of payments for tax and accounting purposes — for as long as it requires. Backups are retained on a rolling basis and are overwritten within 90 days.

Content you contributed to a household — a chore you created, a recipe you added — may remain part of that household's shared records after you leave, because it belongs to the household's history rather than to your account alone.

8. How we protect it

Traffic is encrypted in transit. Passwords are stored only as salted hashes and are never recoverable. Two-factor authentication is available and we recommend it, particularly for household owners and administrators. Invitation links carry a random token stored only as a hash, expire, and can be used once. Financial data is additionally gated behind a per-member permission. Authentication and invitation endpoints are rate limited.

No service can promise perfect security. You are responsible for your password, your devices, and who you invite into your household. Tell us promptly at privacy@crunchski.com if you believe your account has been compromised.

9. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, and not be discriminated against for exercising these rights.

You can exercise the main ones yourself: your account settings let a household administrator export the household's data as a machine-readable file, and let you delete your account. For anything else, contact privacy@crunchski.com and we will respond within the time the law allows, normally within one month.

If you are in the UK or EEA you may complain to your local supervisory authority. If you are in California you may have additional rights under the CCPA/CPRA, including the right to know and to delete; we do not sell or share personal data as those terms are defined.

10. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to keep the Service secure. We do not use advertising cookies, and we do not track you across other websites. Blocking essential cookies will stop the Service working.

Our website analytics sets no cookies at all and assigns you no identifier, which is why you are not asked to consent to it: there is nothing stored on your device and nothing that follows you elsewhere.

The mobile app stores your session securely on your device rather than in cookies.

11. Children

The Service is not directed at children under 13, and we do not knowingly collect their personal data. A household administrator may add family members, including minors, and is responsible for supervising their use and for any consent required in their country. If you believe a child has given us personal data without appropriate consent, contact privacy@crunchski.com and we will delete it.

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed, and for material changes we will take reasonable steps to notify you before they take effect.

Questions, requests or complaints: privacy@crunchski.com.