PointSprout

Privacy Policy

Effective date: April 2026 · Developer: Cypress Avenue Design, LLC

  The short version: PointSprout is built by parents, for parents.
  We collect only what is strictly necessary to run the app for your family.
  We never sell your data. We never advertise to you. We never track you across apps or websites.
  This is a one-time purchase — you own it, your data is yours.

1. Who We Are

PointSprout is published by Cypress Avenue Design, LLC, a limited liability company. When this policy says "we," "us," or "our," it refers to Cypress Avenue Design, LLC.

Questions? Email us at patrick@cypressavenuedesign.com.

2. Who This App Is For

PointSprout is designed for parents and legal guardians (18+) to manage a behavior point system for children in their care. The parent-facing interface requires an adult Apple ID. A simplified child-facing mode exists for children, but all content visible in that mode is set by the parent — children cannot independently create an account, modify settings, or submit personal information without parent action.

3. What Information We Collect

Information You Provide

Data	Who provides it	Why we need it	Where it is stored
Parent name (e.g., "Mom")	Parent, during onboarding	Stamped on transactions for attribution ("Mom awarded 5 pts")	Device (UserDefaults) + Firestore
Email address	Apple, via Sign in with Apple — only if parent chooses to share it	Account identification; Apple may provide a private relay address	Firebase Authentication
Child name	Parent, during onboarding or kid setup	Identify each child's point account	Device (SwiftData) + Firestore
Child birthday (optional)	Parent	Display age and birthday reminders	Device (SwiftData) + Firestore
Child profile photo (optional)	Parent	Display kid avatar in the app	Device (SwiftData) + Firebase Storage (private)
Point transactions and history	Parent (by recording earn/lose/spend actions)	Core functionality — tracking points	Device (SwiftData) + Firestore
Rewards, activities, schedules	Parent	App configuration	Device (SwiftData) + Firestore
Kid-to-kid messages and transfer history	Children (via the kid-facing interface)	Messaging and point transfer features	Device (SwiftData) + Firestore
Screen Time selection (apps to shield)	Parent	Screen Time enforcement feature	Device only (UserDefaults, not uploaded)

Information Collected Automatically

Data	Why we need it	Where it is stored
Firebase Authentication UID	Unique account identifier; links parent and kid devices to the correct family	Firebase Authentication + Firestore
Firebase Cloud Messaging (FCM) device token	Required to deliver push notifications (check-in reminders, reward approvals, Screen Time alerts)	Firestore (under your user record)
Anonymous Authentication UID (kids)	Links a kid's device to the family account without requiring an Apple ID	Firebase Authentication + Firestore

What we never collect:

Advertising identifiers (IDFA, GAID, or any equivalent)
Location data
Contacts or address book
Browsing history or cross-app activity
Behavioral analytics or usage telemetry sent to us
Any data used for advertising or profiling

4. How We Use Your Information

To operate the app — sync point data between parent devices, display balances and history, enable the rewards shop, and run the scheduling system.
To send push notifications — check-in reminders for scheduled activities, reward request notifications, Screen Time enforcement alerts, and make-up challenge notifications. You can disable notifications at any time in iOS Settings.
To enforce Screen Time — when you enable Screen Time features, we use Apple's Family Controls framework locally on the device to shield apps. We send silent push notifications to the child's device to apply or lift restrictions when you lock, unlock, or grant a time extension.
To sync between your devices — family data is stored in Firestore so that two parents on separate devices see the same information in real time.

We do not use your data for any purpose beyond operating PointSprout for your family.

5. How We Share Your Information

We share data with no advertising networks, data brokers, or analytics companies. The only third-party service that processes your data is:

Google Firebase (Alphabet Inc.) — provides our database (Firestore), authentication, cloud storage, and push notification infrastructure (FCM). Firebase processes data under Google's privacy terms as a data processor on our behalf. Google does not use your family's data for advertising. See Firebase Privacy & Security.
Apple — processes Sign in with Apple and App Store purchases. Apple's privacy practices are governed by Apple's Privacy Policy.

We may disclose information if required by law, but we will notify you to the extent we are legally permitted to do so.

6. Children's Privacy (COPPA)

PointSprout is designed to comply with the Children's Online Privacy Protection Act (COPPA).

We do not knowingly collect personal information directly from children under 13. All information about a child (name, birthday, photo) is entered by a parent or guardian.
Children use the app in a simplified, parent-configured mode. Children cannot independently create accounts, modify settings, or contact us.
Information entered about children is stored privately within your family's account and is never shared with third parties for advertising or profiling.
Parents can delete all data about their children at any time by deleting the family account (Settings → Delete Account). This permanently removes all Firestore data and the Firebase Auth account.

If you believe a child under 13 has independently provided personal information to us without parental consent, please contact us immediately at patrick@cypressavenuedesign.com.

7. Data Security

All data is transmitted over encrypted connections (TLS/HTTPS).
Firebase encrypts data at rest.
Firestore security rules restrict data access to authenticated members of your specific family group. No other user can read or write your family's data.
The kid-mode PIN is stored only in the iOS Keychain on the device — it is never uploaded to our servers.
Profile photos are stored in private Firebase Storage buckets and are not publicly accessible.

8. Data Retention

Your family's data is retained in Firestore for as long as your account exists. When you delete your account (via Settings → Family Settings → Delete Account), all of the following are permanently deleted:

All Firestore records (kids, transactions, rewards, reasons, messages, requests)
Your Firebase Authentication account
Your Apple Sign in with Apple token (revoked)

Local data on your device (SwiftData store, UserDefaults, Keychain PIN) is also cleared automatically during account deletion.

9. Your Rights

All users:

Access — all your family's data is visible directly in the app.
Correction — you can edit any record in the app at any time.
Deletion — delete your account in Settings to permanently remove all data.
Notification opt-out — disable push notifications at any time in iOS Settings.

California residents — under the California Consumer Privacy Act (CCPA), you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information. To exercise any right, contact us at patrick@cypressavenuedesign.com.

10. Third-Party Links and Services

PointSprout does not contain links to third-party websites and does not integrate with social media platforms, advertising networks, or third-party analytics SDKs beyond Firebase (described above).

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of the app after changes are posted constitutes acceptance of the revised policy. We will make reasonable efforts to notify users of material changes via the app or App Store release notes.

12. Screen Time and Family Controls

PointSprout optionally uses Apple's Family Controls framework and Screen Time API to restrict access to selected apps on a child's device. This feature:

Is entirely optional and must be explicitly enabled by the parent.
Stores the selected apps only on the parent's device (not uploaded to Firestore).
Uses Apple's APIs, which are governed by Apple's own privacy policies.
Sends silent push notifications (via FCM) to the child's device to enforce restrictions or lift them — no personal information is included in these payloads.

13. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your data, please contact us:

Cypress Avenue Design, LLC
Email: patrick@cypressavenuedesign.com

We will respond to privacy-related requests within 30 days.