The Fine Print, In Plain English

Privacy Policy

Last updated October 11, 2026

The short version. Kids are a first name and a PIN. Parents are an email and a password. No ads, no tracking, no analytics, and we never sell or share anyone's information. A parent can delete a kid, or the whole household, whenever they want.

Who We Are

Chores Wars (choreswars.com) is run by Horizen LLC, based in North Carolina. Questions about this policy or your information go to hello@choreswars.com.

Children's Privacy

Chores Wars is built for families, so children under 13 use it. We designed it to know as little about them as possible, in line with the Children's Online Privacy Protection Act (COPPA):

• Only a parent can add a child. Kids cannot sign up on their own. A parent creates the household, adds each child, and sets each child's PIN. Adding a child is the parent's consent to the information below.
• What we keep about a child: a first name (no last name), a PIN stored only as a one-way scrambled hash (we cannot read it), a count of wrong PIN tries with a short lockout time, and the sign-in sessions on that child's phone.
• What we never ask a child for: an email, a phone number, a photo, a birthday, a location, or anything else. Children cannot send messages, post publicly, or talk to strangers in Chores Wars.
• Parents stay in control. In HQ a parent can see each child's profile, change their name or PIN, sign their phones out, and remove them. Removing a child deletes their profile and sessions right away. A parent can also email us to review or delete anything.

What We Collect

From parents

• Your name (what your kids call you), your email, and your household's name.
• Your plan (trial, active, lapsed), the date it runs to, and Stripe's ids for your customer and subscription if you subscribe.
• Your password, which our sign-in provider stores only as a one-way hash. To keep you off known breached passwords, we send the first 5 characters of a scrambled (SHA-1) version of a new password to the Have I Been Pwned service; it never sees your password or your email.

From the waitlist

• Your email and, if you choose, how many kids you have. That is it.

When anyone signs in

• One cookie (cw_sid) that keeps you signed in. It holds a random code; we store only a scrambled version of it, with when it was created, last used, and when it expires. Parent sessions end after 30 days (7 idle), kid sessions after 90 days (30 idle).
• On a kid's phone, the family's Base Code is saved in that browser so tomorrow's sign-in is one tap. Tap "Different Base Code" to clear it.
• An activity record of account actions (for example "a parent added a kid" or "a kid signed in"), with who did it and when. It uses internal ID numbers, not names, and exists to keep accounts secure. It cannot be edited.
• A second cookie (cw_hq) only while a parent plays as a Test Recruit from their own device. It parks the parent's sign-in code so "Back To HQ" can restore it, and it is cleared on any fresh sign-in or sign-out.
• Rate counters: to slow down password guessing and spam, we count sign-in, sign-up, reset and waitlist attempts per internet address for a short window (minutes to an hour) and then discard the count.
• Password reset links: when a parent asks for one, we store a scrambled version of the link's code for one hour, or until it is used.

Game progress

• For each kid: the chores they checked off and which ones a parent approved, their points, coins, Dust, the gear they have won and what they wear, the character look they built (skin tone, hair, eyes, outfit, an accessory, all picked from a fixed list, no photo), reward claims, and a record of each germ battle (stage, win or loss, and a random seed that replays it). This is what makes the game a game; a parent can reset a Test Recruit's progress in HQ and can remove a kid, which deletes all of it.

What We Do Not Do

• No ads. No selling or renting information. No sharing for marketing.
• No third-party analytics, tracking pixels, or cookies for tracking. On our public pages (not the app) we count visits ourselves: which page, which site sent you there, a campaign tag if the link had one, and whether it was a phone, tablet or computer. No cookie, no IP address, nothing that identifies you, and nothing is counted when your browser asks sites not to track it.
• No artificial intelligence reads your family's information unless a parent chooses to use Sarge (below).
• No public profiles and no messaging between families.

Sarge, The Optional AI Setup Helper

In HQ a parent can describe their chores to Sarge by typing, recording a voice memo, or sending a photo of a chore chart. Sarge drafts a chore list for the parent to review; nothing is saved until the parent deploys it.

• What is sent: exactly what the parent types, says, or photographs, plus the first names of the kids in the household so Sarge can match them. Nothing else.
• Where it goes: through OpenRouter to an AI model provider, with a setting that allows only providers that do not keep or train on what is sent.
• What we keep: the voice memo and photo are not stored. We keep only the chores and rewards the parent chooses to deploy, and a note that Sarge was used.
• Only parents can use Sarge. Kids never talk to it.

Notifications

Each parent and kid can turn on phone notifications for their own device, and turn them off any time. To deliver them we store that device's push address (made by the browser; it contains no name or contact details). Notifications say only a first name and a chore or reward title, for example "Mariah finished Unload The Dishwasher". Kids never get notifications between 9 PM and 7 AM. The push address is deleted when notifications are turned off or the browser reports it expired. Notifications travel through the browser maker's push service (Apple, Google or Mozilla). Two are on a timer: around 6 PM a kid with daily chores still unchecked gets a streak warning, and around 8 PM parents with chores waiting for sign-off get a reminder, both only on devices that turned notifications on.

Who Helps Us Run It

A few service providers process information only to run Chores Wars for us:

• Supabase stores the database and handles parent sign-in (United States, us-east-1).
• Vercel hosts the site. Like any web host, its servers see your IP address and keep standard request logs.
• Resend delivers email we send you, such as account notices or, for the waitlist, the launch announcement.
• Stripe handles subscription payments on its own checkout page. Stripe sees your card details and email; we never do. We keep only Stripe's customer and subscription ids and whether the plan is active.
• Google Fonts serves the site's typefaces, so Google receives your IP address when a page loads.
• Have I Been Pwned checks new passwords as described above.
• OpenRouter and the AI model provider it routes to, only when a parent uses Sarge, as described above.

How Long We Keep It

• Household, parent and kid information: until you delete it or ask us to.
• Sign-in sessions: until they expire or someone signs out.
• Waitlist emails: until launch email goes out and you are invited, or until you ask us to remove you.
• The activity record: kept for security; it holds ID numbers, not names.

Security

Information is encrypted in transit and at rest. Every database table is locked so that only our server can read it, never a web browser directly. PINs and passwords are stored only as hashes, wrong PINs lock a profile for ten minutes, and each household can only ever reach its own data. No system is perfect; if something goes wrong we will tell affected parents promptly.

Your Choices And Rights

Parents can review, change, and delete their children's information in HQ at any time, delete the whole household in Profile (it is gone right away; only the id-only security record stays), and can ask us by email to see, correct, export, or delete anything about their household. We will answer within 30 days. Depending on where you live (for example California), you may have additional rights; we honor them for everyone.

Changes

If we change this policy in a way that matters, we will update the date above and tell parents by email or in HQ before the change applies. We will never start collecting more information about children without a parent's consent.

Also see the Terms Of Service.