Draft, pending legal review (COPPA and GDPR-K). Not yet in force.

Privacy policy

Last updated October 29, 2026

TokenTwirl ("we") runs a token-board service for families. This policy explains what we collect, why, and the choices you have. The short version: we collect as little as possible, we never sell it, and you can export or delete it whenever you like.

Who uses TokenTwirl

Accounts belong to parents and guardians, who must be 18 or older. Children do not create accounts, log in, or enter information. A parent adds a child’s profile and controls everything about it.

What we collect

• About you: your email address, a password (stored only as a one-way hash), and your time zone.
• About each child, entered by you: a first name or nickname, birth month and year, a favourite colour, an animal avatar, and optional focus areas (such as "potty training"). We do not collect photos, full birthdates, schools, or locations.
• Board activity: which task tile was tapped, when, and on which of your paired devices, plus that device's IP address and browser type, so you have a reliable history.
• Billing: handled by Stripe. We store your Stripe customer and subscription IDs, plan, status, and the brand and last 4 digits of your card. We never see or store full card numbers.
• Messages you send through the contact form.

How we use it

To run the service (show the board, keep score, sync your devices), to bill you, to keep the service secure, and to answer you. We do not use your data for advertising, and we do not build profiles of children.

AI task suggestions

When you ask for task ideas, we send an AI provider (through OpenRouter) only your child’s age in months, the focus areas you ticked, and your optional note with names and contact details removed. We never send names. We keep a record of each request's size, cost and a fingerprint of the prompt, not the prompt itself.

Who we share it with

Only the service providers we need: Stripe (payments), our email provider (account and billing emails), and the AI provider above. We don’t sell or rent personal information, and we don’t allow third-party ads or trackers.

How long we keep it

While your account is open. Board history is kept for 2 years. When you delete your account, we delete your household, children's profiles and history straight away; billing records Stripe must keep for tax law stay with Stripe.

Your choices and rights

From your Account page you can download everything we hold as a file, and delete your account. You can also edit or remove any child’s profile at any time. To ask about your data, or to exercise rights you have under laws such as COPPA, GDPR or CCPA, contact us.

Security

Passwords are hashed with Argon2, connections are encrypted, board devices use revocable tokens, and the star history is append-only so it can’t be quietly changed.

Changes

If we change this policy in a way that matters, we’ll email account holders before it takes effect.