Kochvaia · Privacy Policy

Last updated: May 25, 2026

Kochvaia is a family app for tracking stars kids earn and the rewards they can save up for. This policy explains what data the app stores, who can see it, and how to delete it. It applies to the Kochvaia mobile app and the Kochvaia backend service.

Who runs Kochvaia

Kochvaia is operated personally by the developer. There is no company. Questions about data or this policy: meldro364@gmail.com.

What we collect

When a parent signs in or uses the app, we store:

• A stable identifier from Google Sign-In (Google's sub id) and the email address tied to it. Used to recognize you across sessions.
• Family timezone, family name, and parent display name.
• Each kid you add: a display name, an emoji, and a colour. Kid names are visible only to people in your family group.
• Each star you award: the kid, the date, when it was awarded.
• Each star deduction: count, optional reason, when it was performed.
• Each reward (catalogue item): name, cost, emoji.
• Session tokens (random opaque strings, stored as hashes) for parent and kid devices.
• For each kid device: a "last seen" timestamp per kid profile they view, so we can show new stars as animations.

We do not collect: precise location, contacts, photos, browsing history, advertising identifiers, or any biometric data.

What we share

Nothing. Kochvaia does not sell or share data with third parties. We do not use advertising networks. The only third party that sees any data is:

• Cloudflare Inc. — runs the Worker that serves API requests and the D1 database that stores the records above. Data is hosted in Cloudflare's global network (primary region: ENAM / US). Cloudflare may process this data on our behalf under their privacy policy.
• Google — verifies the parent's identity when signing in with Google. We receive a Google identifier and email; Google does not receive your family data.

How kids' data is protected

Kochvaia is a parental tool: only a parent can create, rename, or remove a kid; only a parent can award or deduct stars; only a parent can add rewards. Kids' devices receive a read-only session that lets them view the family's current state. Kid sessions are paired by scanning a short-lived QR code generated on the parent's device — implicit parental consent for that device.

Retention and deletion

Data is kept as long as the family account is active. To delete a kid, use the trash icon in the parent app — that hides the kid from the family view and revokes any paired kid sessions. To delete an entire family (all parents, kids, stars, rewards, and sessions), email meldro364@gmail.com from the Google address you signed in with. We delete within 30 days and confirm by reply.

Security

Session tokens are random 32-byte values; we store SHA-256 hashes at rest so a database leak would not expose live tokens. Tokens are transmitted only over HTTPS. The Android app stores its session token in EncryptedSharedPreferences (AES-GCM, Android Keystore). Google ID tokens are verified server-side against Google's public keys before any session is issued.

Children's privacy

Kochvaia is designed for parents to use with their family. Kids do not enter any personal information into the app — a parent sets up the kid profile (name, emoji, colour) and pairs the kid device. We do not knowingly collect personal information from children. If you believe a child's information was collected without parental consent, email meldro364@gmail.com and we will delete it.

Changes to this policy

If we make a material change, we'll update the "Last updated" date at the top of this page. The current version is always at /privacy on the Kochvaia API host.