01Who we are
BrightPoints is operated by:
SIA SneedsRegistration number: 40203301249Klusā iela 18–55Rīga, LV-1013LatviaContact: hello@brightpoints.appFor the purposes of the EU General Data Protection Regulation (GDPR), SIA Sneeds is the data controller for personal data processed through BrightPoints.
02The short version
- BrightPoints is a family reward tracker. Parents award points for effort; children spend points on rewards the parent sets.
- Children do not have email addresses in BrightPoints. A parent creates a username and PIN for each child. We never ask a child for an email address, a phone number, a photo, a date of birth, or their location.
- We do not sell personal data. We do not show advertising. We do not use your family's data to build advertising profiles.
- Only members of your family can see your family's data.
- You can delete your family's data at any time, and we will help if the app can't do it for you.
03Who BrightPoints is for
BrightPoints is designed to be set up and controlled by a parent or legal guardian aged 18 or over. Children use it only through a profile that a parent creates for them.
Children cannot sign up on their own. There is no way for a child to create a family, invite anyone, or share anything outside their family.
04What we collect, and why
Your parent account
| Data | Why we have it |
|---|---|
| Email address | To identify your account, let you sign in, and send password resets and essential account emails |
| Password (stored only as a cryptographic hash — we never see it) | To secure your account |
| Sign-in method (email and password, or Google if you choose it) | To let you sign in |
| Your family memberships and role | To show you the right family, with the right permissions |
| Co-parent invitations you send or accept, and when they expire | So the other adult can join the family you invited them to |
Email address
Why we have it
To identify your account, let you sign in, and send password resets and essential account emails
Password (stored only as a cryptographic hash — we never see it)
Why we have it
To secure your account
Sign-in method (email and password, or Google if you choose it)
Why we have it
To let you sign in
Your family memberships and role
Why we have it
To show you the right family, with the right permissions
Co-parent invitations you send or accept, and when they expire
Why we have it
So the other adult can join the family you invited them to
If you sign in with Google, Google provides us with your email address and basic profile information. We do not receive your Google password, your contacts, or any other Google data.
Your child's profile — created by you
| Data | Why we have it |
|---|---|
| First name or nickname (chosen by you) | So your child recognises themselves in the app |
| Avatar emoji | To tell children in the family apart |
| Age band | To show a view suited to your child's age. We ask for a band, never a date of birth |
| Username (chosen by you) | So your child can sign in |
| PIN (stored only as a cryptographic hash) | So your child can sign in |
| Points, XP, level, and rewards earned or spent | The core purpose of the service |
| Record of failed sign-in attempts | To temporarily lock a profile after repeated wrong PINs, protecting your child's account |
First name or nickname (chosen by you)
Why we have it
So your child recognises themselves in the app
Avatar emoji
Why we have it
To tell children in the family apart
Age band
Why we have it
To show a view suited to your child's age. We ask for a band, never a date of birth
Username (chosen by you)
Why we have it
So your child can sign in
PIN (stored only as a cryptographic hash)
Why we have it
So your child can sign in
Points, XP, level, and rewards earned or spent
Why we have it
The core purpose of the service
Record of failed sign-in attempts
Why we have it
To temporarily lock a profile after repeated wrong PINs, protecting your child's account
Your family's data
Your family name; the behaviours, rewards and categories you create or customise; approvals and rejections; redemption history; the difficulty setting; and the record of points awarded and spent.
Notifications, if you turn them on
Push notifications are off until they are switched on, from the settings area of the app. If you switch them on, we store what your browser needs in order to deliver a notification to that device: a notification endpoint address issued by your browser vendor, two encryption keys generated by your browser, and the browser and device description your browser reports. This is stored against the account that enabled it.
Notifications exist for one purpose — telling a parent that something is waiting for their approval. We never use them to market anything, and we cannot reach anyone outside the app: we hold no phone number for anybody, and no email address at all for a child. Turning notifications off, in the app or in your browser settings, removes the subscription.
Technical data
Like any website, our servers and service providers record the technical information needed to operate and secure the service: IP address, browser and device type, and access logs. If the app hits an error, our hosting provider records the error, the page it happened on, and technical diagnostic detail so we can fix it.
What we never collect
- Children's email addresses or phone numbers
- Dates of birth — for a child or for you
- Photographs, video, or audio of anyone
- Location data
- Contacts, calendars, or files from your device
- Biometric data
- Advertising identifiers
- Any special-category data (health, religion, ethnicity, and similar)
05Legal bases for processing
Under Article 6 of the GDPR, every use of personal data needs a lawful basis. Ours are:
| Purpose | Legal basis |
|---|---|
| Providing the service to you and your family | Performance of a contract with you (Art. 6(1)(b)) |
| Creating and maintaining child profiles | Consent of the holder of parental responsibility, given by you when you create the profile (Art. 6(1)(a), read with Art. 8) |
| Keeping accounts secure, preventing abuse, sign-in rate limiting | Our legitimate interests in a secure service (Art. 6(1)(f)) |
| Essential service emails (password reset, account confirmation) | Performance of a contract (Art. 6(1)(b)) |
| Push notifications | Your consent, given when you switch them on (Art. 6(1)(a)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
Providing the service to you and your family
Legal basis
Performance of a contract with you (Art. 6(1)(b))
Creating and maintaining child profiles
Legal basis
Consent of the holder of parental responsibility, given by you when you create the profile (Art. 6(1)(a), read with Art. 8)
Keeping accounts secure, preventing abuse, sign-in rate limiting
Legal basis
Our legitimate interests in a secure service (Art. 6(1)(f))
Essential service emails (password reset, account confirmation)
Legal basis
Performance of a contract (Art. 6(1)(b))
Push notifications
Legal basis
Your consent, given when you switch them on (Art. 6(1)(a))
Complying with legal obligations
Legal basis
Legal obligation (Art. 6(1)(c))
We do not process personal data for marketing purposes. If we ever want to send optional product news, we will ask parents to opt in first, and we will never send marketing messages to a child.
06Children's data
Because BrightPoints is used by children, we have written a separate, plain-language Children's Privacy Notice covering exactly what we collect about a child, how parental consent works, and how you can review or delete it. Please read it alongside this policy.
08Connecting other apps to your account
BrightPoints can be connected to other software you use — for example an AI assistant — so that you can check on your family or approve requests without opening the app yourself. This is entirely optional and off unless you set it up.
If you choose to connect something, you will be shown a consent screen naming the application before anything is granted. Once you approve it, that application can, acting as you:
- list the children in your family, with their names, avatars, points and levels
- list the behaviours and rewards you have set up
- see requests waiting for your approval
- approve a task or a reward redemption, and award points for a behaviour
A connected application can only ever do what the account that authorised it could do, and only within that family. Once you connect one, whatever it does with the data it receives is governed by that application's privacy policy, not this one. Please read it before you connect, and only connect software you trust with your family's information.
You can withdraw a connection at any time by signing out of the connected application or contacting us at hello@brightpoints.app. We do not receive payment from anyone for these connections and we do not connect anything on your behalf.
09Where your data is processed
Our infrastructure providers process data within the European Union and, for some operational and diagnostic functions, in the United States.
Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards under Chapter V of the GDPR — normally the European Commission's Standard Contractual Clauses, together with the technical measures described in How we protect data. You may request details of the safeguards that apply by contacting us.
10How long we keep data
| Data | How long we keep it |
|---|---|
| Parent account and family data | For as long as your account is active, subject to the inactivity rule below |
| Child profile and points history | For as long as the child's profile exists in your family |
| Data after you delete an account or a child | Removed from our live systems immediately; residual copies in provider backups are overwritten in the normal backup cycle and in any case within 90 days |
| Server and security logs | No longer than 90 days |
| Queued and sent transactional email records | No longer than 90 days |
| Push notification subscriptions | Until you turn notifications off, or the browser vendor's push service reports the subscription as expired |
Parent account and family data
How long we keep it
For as long as your account is active, subject to the inactivity rule below
Child profile and points history
How long we keep it
For as long as the child's profile exists in your family
Data after you delete an account or a child
How long we keep it
Removed from our live systems immediately; residual copies in provider backups are overwritten in the normal backup cycle and in any case within 90 days
Server and security logs
How long we keep it
No longer than 90 days
Queued and sent transactional email records
How long we keep it
No longer than 90 days
Push notification subscriptions
How long we keep it
Until you turn notifications off, or the browser vendor's push service reports the subscription as expired
Inactive families
We do not want to hold a child's information indefinitely for a family that has stopped using BrightPoints. If nobody in a family signs in for 24 months, we will email the parent account to say so, and if there is still no sign-in after 30 days we will delete the family and its children's profiles.
11Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data (the "right to be forgotten")
- Restrict or object to processing
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with a supervisory authority
As a parent, you may exercise all of these rights on behalf of your children.
What you can do yourself, and what to ask us for
Most of what we hold about your family is visible in the app, and much of it you can change or delete there directly: you can edit or delete an individual child at any time, and you can delete a family you are the only member of, provided it is not your only family.
To close your account entirely, to delete your only family, or to receive a machine-readable copy of your family's data, email us at hello@brightpoints.app. We action deletion requests within 30 days and confirm to you when it is done. We are building a self-service version of both; until it ships, email is the route and we treat those requests as a priority.
We respond to all requests within one month, as the GDPR requires. You do not need to give a reason, and exercising any of these rights will never disadvantage you.
Complaints
If you are unhappy with how we have handled your data, please tell us first at hello@brightpoints.app — we would rather fix it. You also have the right to complain to the Latvian supervisory authority at any time:
Datu valsts inspekcija, Elijas iela 17, Rīga, LV-1050, Latvia — www.dvi.gov.lv
If you live in another EU country, you may complain to your local supervisory authority instead.
12How we protect data
- All traffic is encrypted in transit (HTTPS; our domain is enrolled in HSTS preloading).
- Passwords and children's PINs are stored only as cryptographic hashes — they cannot be read by us or recovered by anyone.
- Database access is governed by row-level security, so one family's data cannot be reached by another family. This is enforced by the database itself, not merely hidden in the interface.
- Repeated failed child sign-in attempts trigger a temporary lockout.
- Administrative actions run through restricted, audited server-side functions rather than direct access from the browser.
No system is perfectly secure, but we take these measures seriously and review them as the service changes. If you believe you have found a security problem, please report it to us at hello@brightpoints.app — see the responsible disclosure section of our Terms.
14Changes to this policy
If we change this policy in a way that materially affects how we handle your family's data, we will update the date at the top of this page and notify parents by email or in the app before the change takes effect.
15Contact
Questions about this policy or your data:
SIA SneedsKlusā iela 18–55Rīga, LV-1013Latviahello@brightpoints.appThis document was last updated on . We will say so here, and tell parents directly, whenever it materially changes.