1. Who is the data controller?
Bizsaclabs Softtech Private Limited is the controller of the personal data you provide when you use Sproutz. Our contact details are at the bottom of this page.
2. Information we collect
Account information
- Email address, name and password (hashed).
- Family name, kid display name, avatar, age band, preferred language.
- PIN codes you set for kid-mode and parental controls (stored hashed).
Activity within the app
- Meals logged, water intake, nutrition goals, body metrics.
- Pocket-money transactions, savings goals, chore claims.
- Activity calendar entries, attendance, reminders.
- Cheers sent / received, XP, streaks, badges.
Device & usage
- Browser type, OS, device label (for the "Your devices" notifications list).
- Web Push subscription endpoints supplied by your browser.
- Error logs (no personally-identifying details).
We do not collect precise location, biometric data, contacts, or government IDs. We do not sell your data, ever.
3. Children's data
Kid profiles are created and managed by a parent or legal guardian. The parent is the data controller for the kid profiles in their family. Kids cannot register their own account independently. We do not knowingly market to children, do not show ads, and do not share kid data with any third party for advertising.
4. How we use your data
- To operate the app's features (nutrition logging, allowance scheduling, activity reminders, gamification, cheers, etc.).
- To send web push notifications to devices you've subscribed.
- To generate AI-powered family insights (only aggregate, anonymised inputs are sent to AI providers).
- To improve product quality, debug crashes, and detect abuse.
- To comply with applicable law.
5. Third-party processors
The minimum set of providers we share data with:
- MongoDB Atlas / hosting — stores your data at rest.
- Web Push services (Apple, Google, Mozilla) — deliver notifications to your phone via VAPID endpoints. We never share your raw email with them.
- AI providers (OpenAI / Anthropic / Google) — receive only the prompt text strictly necessary for AI features. No persistent training rights.
- Emergent Auth (Google login) — if you choose Google sign-in, your Google profile (name + email) is shared with us at the moment of sign-in.
- Razorpay (payments) — if you subscribe to the family plan, your name, email and Sproutz family reference are shared with Razorpay to set up and charge the yearly recurring subscription. Card, UPI and bank details (including the recurring-payment mandate) go directly to Razorpay; we never store them.
6. Cookies & local storage
We use a small number of cookies / local-storage keys: a session cookie for login, a kid-mode cookie when a child is using the device, and a few preference keys (language, dismissed banners, draft forms). We do NOT use third-party advertising or analytics cookies.
7. Data retention
We keep your account data for as long as the account is active. You can delete your own account at any time from inside the app — see "Deleting your account" under Your rights below. Deleting your account deactivates it (you can no longer log in) after a 7-day grace period, during which logging back in cancels the deletion. Your family's historical records (nutrition logs, pocket-money transactions, activities, etc.) are kept, not erased, so an accidental deletion never causes data loss. If you want your personal data permanently erased instead of just deactivated, email us and we'll complete the erasure within 30 days, with backups purged within a further 90 days.
8. Your rights
- Access — request a copy of the data we hold about you.
- Correction — fix anything that's inaccurate.
- Deletion — deactivate your account yourself in-app, or request full erasure of your personal data by emailing us.
- Portability — export your data in a machine-readable form.
- Object / restrict — limit how we use your data for specific purposes.
Deleting your account
Open Profile → Parental Controls and scroll to the "Danger zone" section at the bottom, then tap Delete my account (parental PIN required). This immediately signs you out; your account is deactivated after a 7-day grace period during which logging back in cancels the deletion. A previously deleted account is never automatically restored — signing up again with the same email or Google account afterwards creates a brand-new account.
For access, correction, portability, object/restrict requests, or a full erasure of your personal data, email us. We respond within 30 days.
9. Security
We use TLS in transit, encrypted database storage, hashed passwords and PINs (bcrypt), VAPID-signed push, and role-based access control. No system is perfectly secure — please notify us immediately if you suspect unauthorised access.
10. Where your data is stored
Data is stored in cloud infrastructure with our hosting providers. By using Sproutz you consent to processing in India and, where our sub-processors operate, the United States and the European Union, with appropriate safeguards.
11. Changes to this policy
We will update this policy when our practices change. Material changes will be notified inside the app or by email. Continued use after a change means you accept the updated policy.