Privacy Policy

1. Who We Are

Veckopeng ("we", "our", "us") is a family chore and allowance management application. We help parents assign tasks, track earnings, and facilitate payments.

Under the General Data Protection Regulation ("GDPR"), we are the Data Controller for all personal data processed through our service.

2. What We Do

Veckopeng is a SaaS platform using:

• Vercel (frontend hosting)
• Railway (backend API)
• Neon PostgreSQL (database)
• Stripe (subscriptions, billing)
• Resend (transactional emails)
• WebSockets (real-time updates)

We collect and process personal data to operate the service for families.

3. Personal Data We Collect

3.1 Parent Accounts

• Name
• Email address
• Hashed password
• Email verification status
• Last login
• Account timestamps
• Family ID and role

3.2 Children's Profiles

• First name or nickname
• 4-digit PIN (securely stored)
• Avatar
• Balance and total earned
• Weekly allowance (optional)
• Preferred payment method
• Currency
• Phone number (for payment links)

Parents should only enter minimal information for children.

3.3 Tasks & Rewards

• Task title, description
• Reward amount
• Assigned user
• Task status
• Completed/approved timestamps
• Recurring task rules
• Approving parent ID

3.4 Payment Records

Veckopeng only tracks payments — it does not process them.

We store:

• Amount
• Method (Swish or parent-managed manual payout)
• Child ID
• Parent who marked it as paid
• Timestamp
• Notes (optional)

3.5 Subscription & Billing

• Stripe customer ID
• Stripe subscription ID
• Subscription status
• Plan type (monthly/yearly)
• Billing period end
• Currency

Stripe handles and stores full payment card details.

3.6 Savings, Achievements & Referrals

• Goals (title, target amount, progress)
• Achievements unlocked
• Referral relationships (referrer, referred family, status)

3.7 Authentication & Security Data

• Refresh tokens
• Password reset tokens
• Email verification tokens

3.8 Audit Logs

• Action type/category
• Resource changed
• Details (JSON)
• IP address
• User agent
• Timestamp

3.9 Technical Data

• IP address
• Device/browser information
• Error logs
• Usage analytics (aggregate, non-advertising)

We do not use third-party advertising trackers.

4. Why We Use Personal Data

We use data to:

• Operate the Veckopeng app
• Authenticate parents and children
• Provide task management and real-time updates
• Deliver email notifications
• Enforce Free/Pro usage limits
• Maintain subscription billing
• Provide customer support
• Improve performance and security
• Detect and prevent abuse
• Maintain audit logs for safety and compliance

We never sell data or share it with advertisers.

5. Legal Bases (GDPR)

Processing is based on:

• Contract – to provide the Veckopeng service
• Legitimate interest – security, fraud prevention, analytics
• Consent – children's data, browser notifications
• Legal obligation – Stripe billing records

6. Children's Data

Parents/guardians must:

• Create and manage child profiles
• Provide consent for child data
• Use minimal information (nicknames recommended)

Parents may delete a child's data at any time.

7. Data Processors

We use GDPR-compliant third-party processors:

We configure all services in EU regions where possible.

8. Real-Time Features & Notifications

We use WebSockets and push notifications for:

• Task completion
• Task approval
• Achievement unlocks
• Subscription events

Browser notifications require explicit permission. You can revoke permission at any time.

9. Data Retention

• Active accounts: retained indefinitely
• Free tier inactivity: may delete after ~6 months, with notice
• Billing data: retained as required by law
• Audit logs: retained as needed for security
• Backups: auto-deleted on a rolling schedule

You may request full deletion at any time.

10. Your Rights

You may:

• Access your data
• Correct inaccurate data
• Delete your account
• Object to processing
• Restrict processing
• Request data portability
• Withdraw consent

Parents may exercise all rights on behalf of children.

Contact: support@veckopeng.app

If you believe we have violated GDPR, you may file a complaint with IMY (Sweden) or your local authority.

11. Security Measures

We use:

• HTTPS/TLS encryption
• Database encryption at rest
• Secure password hashing
• PIN authentication for children
• Rate limiting
• Input validation & SQL injection protection
• Audit logging
• Helmet security headers
• Content Security Policy
• Abuse prevention controls

No system is fully secure, but we maintain industry-standard practices.

12. Cookies & Local Storage

We use:

• localStorage for tokens and preferences
• No advertising cookies
• No tracking cookies

If cookie usage expands in the future, we will update this policy.

13. Changes to This Privacy Policy

We may update this page over time. Material changes will be communicated in-app or by email.

14. Contact

For privacy concerns: