ChoreCheersScope and essential choices
This policy explains how 杨楠 processes personal information through ChoreCheers and its website, including local trial use, accounts, household collaboration, reports, notifications, collections, subscriptions and support. The contact at the end handles privacy requests.
Information needed for the feature you request is processed to provide that service and protect accounts. Optional sharing, photo saving, notifications and support details depend on your choice. Refusing an optional permission does not prevent local chore recording. Without login information we cannot provide a signed-in account; without the corresponding household data we cannot provide cloud collaboration. Where processing requires consent, you may withdraw it as described below. Merely reading this policy is not consent to every optional feature.
Your information
Before cloud use, people aged 14 or older actively confirm the age declaration and agreements on the sign-in screen. For a child under 14, a guardian reads the notice and child privacy rules, actively confirms their role and consent, and verifies their own email address with a one-time code. Consent records contain the declared age band, policy version, confirmation method and time, and account association. Guardian confirmation also stores an encrypted guardian contact address, a keyed address digest and verification time. Email verification confirms access to that mailbox, not legal identity or the guardian relationship. We do not request a birth date, identity document or facial image.
You can configure a trial household and record chores on your device without signing in. Signing in and upgrading that household uploads its configuration and records to your account. Unsynced data may be lost if you uninstall the app.
Email addresses, verification challenges and their digests, Apple identifiers and authorization credentials support authentication and account security. Names, household roles and preset avatars identify members in the interface, not account ownership.
For signed-in accounts, theme rewards store permanent ownership, reward eligibility and claims, plus each shared report month, its household identifier and the time the share intent is recorded. These account-linked records prevent duplicate rewards and support collection access. Tapping the external share entry records intent even if you cancel. This feature does not read the external destination or verify publication. Saving locally does not create a share-reward record. Guest-mode records stay on this device; upgrading the household attempts to synchronize verifiable rewards and share records.
Saving a report image requests permission to add photos to your library only when you choose to save. This permission saves the selected poster; the feature does not read other photos in your library.
Household names, memberships, invitations, chores, timestamps, duration, points, multipliers, notes, reactions, achievements and layouts support collaboration and reports. Session identifiers, device descriptions, token digests, request IP addresses, timestamps and necessary error information support sessions and security. Avoid sensitive information in notes.
Notifications and devices
When you sign in and the app registers this installation for remote notifications, the server receives an installation identifier, the APNs device token, your account and session association, permission status, app version, notification language and push environment. These identify the destination, select the notification language and prevent delivery to an old account after a device changes accounts. An APNs token is not an advertising identifier. Sign-in sessions also receive the vendor device identifier (IDFV), device name, platform and app version for device management and account security.
The server stores notification categories, the daily remote push limit, preview, sound and badge choices, quiet hours and time zone. These account preferences can synchronize across devices. Your local daily reminder schedule stays on this device; it is not uploaded as a remote notification preference.
The signed-in inbox stores message titles and bodies, types, related household and participant identifiers, destinations, and creation, expiry, invalidation and read times on the server. Queued events and per-installation delivery records include status, attempt counts, retry times, errors and the time Apple accepts a notification. They support the inbox, unread counts, duplicate prevention, push limits and troubleshooting. Apple acceptance does not prove display or reading.
Local monthly reminders and device storage
In guest mode, the monthly-report reminder switch, preview, sound, badge and quiet-hour choices are stored for the local household on this device. The local inbox stores achievement and monthly-report messages, related household and month identifiers, destinations and read times. A separate record maps report months to scheduled reminder times to prevent duplicates. A past scheduled time does not prove that iOS displayed a notification or that you read it. These preferences, inbox records and scheduling records are not sent to our notification server.
Local monthly reminders use the household time zone and dates of locally recorded chores. iOS receives the scheduled time, title, body, sound choice and local workspace, household and month identifiers for display and routing on this device. This local scheduling does not use APNs. Opening the reminder opens the report preview; it does not automatically share the report, save a photo or create a share-reward record.
The app also keeps local trial households, pending uploads, account-specific caches, layouts and display choices in app storage to support offline use. Login credentials are kept in Keychain. Some app data may be included in device backups according to your system settings; clearing data in the app does not erase an existing device backup.
Household visibility
Members can see activity, names, avatars, duration, points and reports according to their permissions. The owner manages membership and records. Achievement visibility controls achievements, not chore activity. Email addresses and login credentials are not displayed in activity.
Share invitations only with people you trust. Notifications may contain household activity or achievement information; turn off previews for generic push text. System sharing sends exports to the app or recipient you choose. Leaving a household does not delete your account or its historical shared activity.
Service providers
Alibaba Cloud provides the backend and database in Beijing, mainland China, including storage of notification preferences, installations, messages and delivery records. Its email service processes destination addresses, verification email content and delivery information. Your email provider also processes the message.
Apple handles Sign in with Apple and App Store payments. Subscription verification exchanges signed transaction information and an app account token with Apple services; we do not receive your payment card or bank account details. For remote notifications, Apple Push Notification service (APNs) receives the device token, notification identifier and payload, including title, body, sound and badge settings when included. Turning off previews changes pushed text to a generic message; it does not delete the full server inbox message. Apple authentication, subscription processing, APNs, email and user-selected sharing may involve processing outside mainland China.
Login tokens are stored in system Keychain. The app currently has no advertising-tracking SDK; this website has no advertising, analytics or external fonts.
Provider privacy and contact information: Apple, https://www.apple.com/legal/privacy/ and https://www.apple.com/privacy/contact/; Alibaba Cloud, https://security.aliyun.com/trust-center/privacy. These providers describe their own processing and rights-request channels. Their notices do not replace our responsibility for the service data described here.
Permissions and optional features
Notification permission lets iOS display reminders and remote pushes with the sound and badge options you allow. Photo-library add permission is requested when saving a report. You may change these permissions in iOS Settings; refusing or withdrawing photo permission prevents saving to Photos but does not delete a photo already saved there. You control exported copies through Photos or the receiving app.
When you tap Paste in the household invitation field, the app reads clipboard text to fill the invitation code; it does not continuously read the clipboard. Copying an invitation writes that code to the system clipboard. Online invitation validation sends the entered code to our server to find the household you intend to join.
Chore recording and reports do not request microphone, camera, contacts or location permission. Household time zone is a setting, not GPS location. The website stores a language choice locally; the public feedback form does not require an app login.
Subscriptions and roadmap
When you purchase or restore an Apple subscription, the app sends signed transaction information to our server for verification. We process transaction and original transaction identifiers, product identifiers, purchase and expiry times, refund or revocation and replacement status, environment, an app account token, the purchasing app account and the benefiting household. Apple server notifications also supply event identifiers and types. These records verify access, restore purchases, apply subscription rewards and prevent duplicate or incorrectly assigned benefits. This describes data handling, not a guarantee that a product is available in every storefront.
Local report insights use recorded chores without calling AI. AI report insights and voice input are roadmap ideas, not available paid benefits. The app does not currently collect recordings for voice input or send report data to an AI provider. New processing would require an updated explanation and necessary permissions.
Support requests
The optional support form on our website sends the category, message and any email address or app version you provide to our backend. It also stores a SHA-256 digest of the request IP address, submission and update times and handling status. The digest limits abuse; it is not a guarantee of anonymity. The form does not require an app login. When you open support from a signed-in app account, the app can place your account ID in the URL fragment to prefill an editable field in your browser. The fragment is not sent to the server with the page request. You can edit or clear the account ID before submitting; if you keep it and submit the form, it is saved with your feedback message to help us find the relevant account. The account ID is a lookup hint, not proof of account ownership. An account ID, email address or other identifying details may link the request to you.
If you email support, we receive the sender address, message and any attachments you choose to send through our email provider. These help us answer the request. Email correspondence is separate from the app account and is not automatically deleted when that account is deleted. It currently has no fixed automatic deletion interval; contact us to request handling of correspondence that identifies you.
Support records have no implemented automatic age-based deletion or account-deletion linkage. Please contact us to request access, correction or deletion of a support request. Do not include passwords, verification codes, payment-card details or unnecessary sensitive information.
Retention and protection
We use the shortest retention needed for the stated purpose, subject to applicable legal requirements. Account and household information supports the service while the account is active. Deletion below concerns the live database, not guaranteed removal from every backup or others’ exports. General security logs and database backups currently have no verified uniform age-based automatic deletion schedule. We do not promise that those records disappear after a fixed number of days or that account deletion removes them immediately. Contact us about a request involving logs, backups or restored data; we will explain the scope that can be handled and any applicable limits.
Email-verification challenges, including the email address and verification digest, expire after 10 minutes. A background task runs every 60 seconds and removes up to 1,000 expired challenges per batch. Account deletion immediately removes challenges for the account’s linked email address. Already dispatched email cannot be recalled, but its deleted challenge cannot be verified.
To enforce verification-email limits across requests and account deletion, we retain security events for 24 hours. These contain keyed HMAC digests of email and IP addresses, an event type and timestamp. They are pseudonymous, not guaranteed anonymous. Expired events are removed in batches. Downtime, cleanup failures or a backlog can delay removal of expired challenges or security events; this cleanup does not remove backups or email providers’ own records.
Inbox messages expire 90 days after the notification service creates them and are removed in batches by background cleanup after expiry. Linked delivery records are deleted with them. This is not a guarantee that every copy disappears exactly on day 90. Queued events and delivery attempts also have processing deadlines; these can stop delivery without deleting the record.
Ordinary queued notification events older than 90 days are cleaned up in batches. Some character and report-style reward event records are excluded to prevent duplicate notices. Notification preferences and installation records have no implemented automatic age-based deletion period. They follow the account deletion and unregistration behavior below.
Session token expiry stops use of the expired credential; it does not mean the session record is erased immediately. An enabled background task runs every 60 seconds to remove invalid sessions, expired Apple sign-in challenges, expired guardian challenges and expired unbound consent permits, up to 100 records of each type per pass. Sessions with a push accepted within the previous 26 hours or an active delivery-processing lease are retained until that protection ends. Removing an eligible session also removes its refresh-token records, associated push installations and linked delivery attempts; it does not delete the account, household or inbox. A guardian code expires after 10 minutes and an unbound consent permit after 30 minutes. Expiry and deletion are separate; downtime, processing locks, errors or a backlog may delay cleanup. Bound consent records and permits are removed with account deletion. Ordinary login-email cleanup follows the rules above; this task does not erase backups.
Subscription transactions, subscription notification receipts and support records currently have no uniform automatic deletion interval. Subscription records remaining after account deletion support verification, refunds, restoration and duplicate prevention; they are not all deleted by account deletion. You may contact us to request access, correction or deletion. We will assess the records needed for that request, ongoing transactions and applicable retention requirements, and explain any records that cannot yet be deleted and the reason.
Local household preferences, inbox messages and past monthly reminder scheduling records have no fixed age-based cleanup period. Switching households or signing out clears active system notifications and future local monthly reservations, while the corresponding local preferences and historical inbox and duplicate-prevention records can remain. Use the local-data clearing option described below to remove the guest household data owned by that option.
HTTPS, session revocation, verification-code digests and encryption of authorization credentials help protect data. No system can guarantee absolute security.
Turning notifications off
Turning off a category stops new remote pushes in that category; it does not delete inbox messages, read status or delivery history. Push limits do not limit the inbox. Disabling the local daily reminder only cancels that device reminder. In guest mode, turning off monthly notifications cancels future local monthly reminders when settings are applied, but monthly inbox messages can still be created. Denying system permission likewise does not delete the local inbox or past duplicate-prevention records.
If you deny notifications in iOS Settings, the app attempts to unregister the device when it next checks permissions while signed in and online. Successful unregistration clears the token, revokes the installation and cancels pending delivery work. It does not delete the installation record or delivery history. System permissions control display before the server learns of the change.
Sign-out and deletion
Signing out clears the active local notification display and attempts to unregister this installation and revoke the session. Signing out of all devices revokes account sessions when the request succeeds. The server does not send new pushes through revoked sessions, but revocation does not itself erase all installation tokens or historical delivery records. Offline sign-out may not immediately change server state.
Permanent deletion: Profile → Account & Security → Delete Account. After the server confirms completion, account identities, sessions, personal chore records and collections are removed. Your notification preferences, installations, inbox, queued events and linked delivery records are deleted through their account relationships. System-held references to your account in other notifications, queued events, achievement events and reward eligibility snapshots are also cleaned up; necessary shared achievement participation references are anonymized. If you own a household with another active member, ownership transfers to an active member and other members’ data is retained. If no active successor remains but other membership history exists, the household is archived to preserve those members’ history. A household owned only by you is deleted. If household membership changes prevent a consistent deletion, the request is rejected without performing that deletion and you can refresh and try again.
This cleanup concerns system-held, identifiable account references. Other members’ free-text content is outside this automated cleanup. It cannot recall others’ exports or erase notifications already sent to Apple or displayed on devices. Subscription records also remain: the direct purchaser-account relationship is cleared, but transaction identifiers, the app account token, subscription periods, household references and notification receipts are not automatically erased. Separately submitted support requests are not automatically deleted with the app account. Verification-email security events follow the 24-hour retention and batch cleanup described above. These remaining records are not guaranteed to be anonymous. Contact us about these records.
After deletion is confirmed, the app clears the deleted account’s login credentials, account caches, pending chore records and account-scoped reminder preferences and cached inbox. Other accounts’ cached data and pending records, and separate guest households, are preserved on the device. The device installation identifier and independent guest household preferences, inbox and monthly duplicate-prevention records are not all removed by this account-deletion flow. A local sign-out or expired session is not server confirmation of account deletion. Contact us if deletion is not confirmed.
In guest mode, “Clear local data” removes the current local household and its local reminder preferences, inbox, achievement notification batches, monthly preferences and monthly scheduling records. It also clears the active system notifications. It preserves other app accounts’ caches and pending uploads. Clearing local data does not delete a cloud account, cancel an Apple subscription, remove exported photos or erase an existing device backup.
Your choices
For an account with completed guardian confirmation, open Account & Security → Withdraw guardian consent and delete account to withdraw that consent and request deletion. Read and confirm the deletion consequences first. Once withdrawal is recorded, ordinary cloud access stops. If deletion is incomplete, including when Apple is temporarily unavailable, the account remains restricted to necessary management and retrying deletion. A new confirmation does not cancel a pending withdrawal. The permanent account-deletion entry and contact channel are also available for privacy requests.
You can edit your profile, edit or delete authorized records, control achievement visibility, leave a household and sign out. Contact us to request access, correction, a copy, deletion or withdrawal of consent; we verify only what is necessary. Include the feature and request you want handled, and the account email or feedback reference when relevant. Do not send passwords or verification codes. If a request cannot be fulfilled, we will explain the reason and available next steps. Leaving and signing out are not account deletion.
Deleting an app account does not cancel an Apple subscription. Purchasers must manage renewal separately through Apple.
Children and changes
For a child under 14, the guardian reads the short notice and Child privacy rules and guardian agreement, actively confirms their role and consent, and verifies their own email address before cloud use. Being a household owner does not substitute for guardian confirmation. The child uses their own account, with a login email different from the guardian contact email; the guardian does not need a separate app account. Refusal leaves local recording available without uploading existing local content. Confirmation is stored with the account, so ordinary use does not require another code; a different account or a material policy change may require confirmation again. Email verification confirms mailbox access, not legal identity or the guardian relationship.
Children may participate in household collaboration and have their own accounts. Processing personal information about children under 14 requires their guardian’s informed consent and dedicated child privacy rules. We do not request or collect identity documents or facial information for account creation or verification of a guardian relationship. Do not add unnecessary child identity, school or location details to notes. Contact us about information processed without appropriate consent.
Material changes affecting your rights will be communicated in the app. We will seek renewed consent when required.
Contact
Personal information controller: 杨楠. Contact: 18730938002@163.com. Do not send passwords, verification codes or full identity documents.
Website language preference
The website uses your browser language by default. A manual choice is stored only in this browser, not sent to the server or used for tracking. You can switch back to Device language at any time.