My Crescender Family, Privacy Notice

Introduction

Who the app is for

COPPA, GDPR-K, and the Australian Privacy Principles

1. Requiring the parent or guardian to create the account.
2. Requiring the parent to explicitly add each child (name, date of birth, instrument) from inside their own signed-in session.
3. Issuing a parent-generated 6-digit code to authorise the child's device for kid-mode access, children never sign in themselves.

What we collect about a child

We collect only the minimum information needed to render the child's surface in the app:

1. First name, for greeting the child and labelling their profile.
2. Date of birth, for age-appropriate UX and goal calibration.
3. Instrument(s), for personalising the practice surface.
4. Practice sessions (start, end, instrument, optional notes), for the streak and minutes-today counters, and for the parent's history view.
5. Avatar colour or image, for visual identification in the family view.
6. We do not collect: child email addresses or phone numbers (they don't have accounts); child location, contacts, photos (other than an optional avatar the parent uploads), or any biometric data; behavioural tracking data for advertising in My Crescender Family.

What we collect about the parent or guardian

1. Email address and display name, for sign-in and family identification.
2. Avatar colour or optional image.
3. Notification preferences.
4. Diagnostic crash data (via Sentry; no message bodies, no personal identifiers).

Where the data lives

What we DO with the data

1. Render the app for the parent and the child. That's the primary purpose.
2. Compute streak and progress numbers locally on the device.
3. Send notifications the parent has opted into (event reminders, practice-completed pings to coparents).
4. Sync between devices in the same family so practice logged on one device shows up on others.

What we DO NOT do with the data

1. No advertising in My Crescender Family.
2. No selling or renting family data to third parties.
3. No profiling for marketing. Your child's practice habits are not a product.
4. No third-party analytics SDKs that profile children.

How a parent reviews, exports, or deletes

Inside the app, under Settings:

1. Review, Open any child's profile to see their full record.
2. Export, Tap "Export my data". You receive a JSON file containing the parent record plus every child plus every practice session plus every event. Sent to your email within 24 hours.
3. Delete a single child, Open the child's profile, tap "Retire". Practice history is preserved but the child is hidden from the active roster.
4. Delete the whole account, Settings → "Delete account". A double-confirmation flow runs the cascade across every table; you have a 30-day grace period in which we can restore the account on request to hello@crescender.com.au.
5. Outside the app, contact hello@crescender.com.au with proof of account ownership.

Sharing with third parties

We use the following service providers strictly to operate the app. None of them receive or process child personal information for their own purposes:

1. Supabase (database + auth + edge functions). Hosts the data we collect. Data residency: Australia, on globally recognised public cloud infrastructure.
2. Expo / EAS (build + over-the-air updates), does not see app data.
3. Apple / Google (app distribution + push notifications), see only the device push token and notification payload.
4. Sentry (crash + error reporting), opt-out by setting the per-account preference (planned).

Changes to this notice

Contact