Privacy policy

2026-09-27 · Erkan Özkan

KidTask is a free family task and reward app published by Erkan Özkan. Privacy and support contact: support@duocross.com.

Information we process

Parent name, username, recovery email, account and family identifiers; password hashes and secure session information (never plaintext passwords). Child names or nicknames, avatars and family memberships entered by parents; we do not request a child’s email, birth date or location. Tasks, notes, recurring dates, completion records, star transactions and reward requests. Only task photos you select or take, re-encoded to remove EXIF metadata. Operation times, API requests, security/rate-limit records associated with IP addresses and error logs to operate and secure the service. If you email support, your email address and message.

Why we use this information

To authenticate accounts, sync family devices, manage tasks and rewards, approve photos, recover accounts, prevent abuse and answer support requests. We do not sell data, display advertising or track users across services.

Children and family access

An adult must create the parent account and be authorized to provide information about the child. Parents add child profiles and connect a child’s device using a single-use invitation. Choose invited adults carefully. Adults in the family can view tasks and photos; child accounts access only their own records. You may use nicknames. Do not include unnecessary personal or sensitive information in photos.

Permissions and device storage

The camera is used only when you choose to take a photo. We upload only selected photos, not your entire library. Notifications are optional. Task reminders are scheduled locally; device push tokens are stored on the server for family updates delivered through Apple APNs and Google Firebase Cloud Messaging. Push content contains no child names or photos. Read-aloud uses operating system speech; we do not record the microphone. Device preferences, including language, and pending actions are stored locally; mobile session tokens use secure operating system storage. The web session uses an essential secure cookie, with no advertising or analytics cookies.

Infrastructure and retention

Railway hosts the server, database and private backups in the United States; information may be processed outside Türkiye to provide the service. Transfers use HTTPS and photos are not served through public links. Infrastructure providers may access data to operate the service. Verification and password reset emails are sent from support@duocross.com using Google Workspace Gmail API. Apple and Google process device tokens and generic notification text for delivery. The selected language is used for emails and stored with the device registration for notifications.

Retention periods

Account and family records remain until deleted. Email codes expire after 15 minutes; only their HMAC digest is stored and expired entries are cleaned up. Notification queue entries are removed within 24 hours. Signing out removes that device’s notification registration. Expired sessions, invitations and security rate-limit records are regularly removed. Daily database backups are kept for 30 days. Deleted live data ages out of backups through this retention cycle; deletion requests are reapplied if a backup is restored. Technical logs follow the infrastructure’s operational retention periods.

Control and deletion

Parents can delete a child’s profile, photos and history from the child profile screen, and revoke device access under Family members. Delete your account with your password under Settings → My account → Delete my account. If you own the family, its records are deleted as well. For access, correction, export or deletion requests, email support@duocross.com. We may need to verify that the requester is the person concerned or an authorized parent. Never email your password or verification code.

Changes

This policy may be updated as the service changes. The current version is published here. Significant changes to data use will be communicated in the app.