Privacy Policy

1. Introduction

StarrySteps ("the Service") is operated by Starry Steps ("we" or "us"). This Privacy Policy explains what information we and our service providers collect, how we use and share it, and the choices available to you and your family.

2. Information We Collect

We collect the following types of information:

• Account and sign-in information: Your account identifier, name, email address, and profile image where provided. Clerk manages authentication, linked accounts, and sessions. If you choose single sign-on (SSO), Clerk receives information from your chosen identity provider, such as your provider identifier, name, email address, and profile image, according to the permissions you approve. Authentication credentials are handled by Clerk or your identity provider; we do not receive your identity provider's password.
• Family and routine data: Children's names or nicknames, chosen icons, routine schedules, task descriptions, and completion records, including dates and times. This includes changes and task completions made on your family dashboard by you, authorized household members, or a child under your supervision.
• Household information: Invitees' email addresses, invitations and their status, membership records, and account identifiers used to share access to family routines.
• Preferences: Settings such as timezone, theme choices, and display preferences.
• Billing information: Clerk Billing and Stripe process payment and billing details, such as billing contact information, payment method details, and transaction records. We receive subscription, plan, and feature-access information and may access payment status, payment history, and limited payment method details through these providers. Our application databases do not store full payment card numbers or card security codes.
• Device and usage information: We and our providers may process IP addresses, browser and device information, pages visited, referring pages, approximate location, timestamps, security logs, errors, and performance measurements to operate, protect, and improve the Service.
• Support information: Messages and information you provide when contacting us about your account, billing, or privacy.

3. Children's Privacy

Sign-in accounts, household invitations, and subscriptions are for adults. Parents or guardians create and manage child profiles; children do not need a separate Clerk or SSO account to use their family dashboard under supervision. You may use a nickname instead of a child's full name. Child profiles do not require an email address, photo, date of birth, or payment information. Please avoid including sensitive information in names or task descriptions.

We store the child profile, routines, and completion history associated with the adult-managed account, including when a child marks a task complete. Device, session, and usage information described in this Policy may also be processed when that dashboard is used. Parents or guardians can review and edit this information, remove child profiles in the Service, or contact support@starrysteps.com to request access or deletion. If you believe a child has created a sign-in account or provided information without appropriate parental involvement, contact us so we can investigate and address it.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Display your routines and track task completion for your family
• Personalize your experience (themes, fonts, timezone)
• Authenticate users and protect accounts against misuse
• Manage household invitations and shared access
• Process payments and manage subscriptions and paid features
• Send important service-related communications (e.g., account security, household invitations, and billing) and respond to support requests
• Analyze usage patterns to improve the Service
• Meet legal obligations and resolve billing or other disputes

5. Data Sharing & Third Parties

We do not sell your personal information. We share information as needed to provide the Service with the following providers and recipients:

• Authentication and subscriptions: Clerk processes account, SSO, session, and subscription information to provide sign-in, account management, and Clerk Billing. See Clerk's Privacy Policy. Your chosen SSO provider also processes information when you use its sign-in service, under its own privacy policy.
• Payment processing: Stripe processes payment and billing information for subscriptions, including payment method details and transaction records. See Stripe's Privacy Policy.
• Data storage and synchronization: We use MongoDB and Convex to store family profiles, routines, completion history, preferences, and household access records, and to synchronize changes between devices.
• Hosting & infrastructure: The Service is hosted on Vercel, which processes requests and technical information to deliver and secure the application.
• Analytics and performance: We use Vercel Web Analytics and Speed Insights for usage and performance measurements. We also use Google Tag Manager to load and manage website tags, which may process device and usage information and use cookies depending on their configuration. See the Cookies & Analytics section below.
• Email delivery: Our email delivery provider processes recipients' email addresses and message content to deliver household invitations and other service messages.
• Household members: Adults who join your household can view and edit the shared child profiles, routines, completion information, and preferences. The household owner can manage members and invitations. Only invite people you trust with this information.

Providers may process information on our behalf and, for activities such as operating their own identity services, fraud prevention, or meeting legal obligations, under their own privacy policies. We may also disclose information when required by law or necessary to protect the Service or the rights and safety of our users.

6. Data Storage & Security

We use access controls and our providers' security measures to protect information. No system can guarantee complete security. Information may be processed in the United States or other countries where our providers operate, whose data protection laws may differ from those where you live.

We retain information as needed to provide the Service and meet legal, accounting, security, or dispute-resolution obligations. Subscription cancellation does not delete your account or family data. Deleting your Clerk sign-in account does not automatically remove routine or household records from our other databases. To request deletion across the Service, contact support@starrysteps.com. Backup copies and records needed for legal or financial obligations may be retained separately. Clerk, Stripe, and your SSO provider may also retain information as described in their own policies.

7. Cookies & Analytics

Clerk uses cookies and similar technologies for sign-in, sessions, and account security. SSO providers and payment services may also use cookies or similar technologies when you interact with their services. Browser storage may be used to remember preferences.

Vercel Web Analytics uses a temporary identifier derived from request information rather than analytics cookies, and Speed Insights collects performance measurements without identifying individual visitors. These features are described in Vercel's Web Analytics privacy documentation and its Speed Insights privacy documentation. Other providers' cookies and data practices are described separately in this Policy.

Google Tag Manager is also included in the Service. The cookies and information used by tags loaded through it depend on the configured tags. See Google's Privacy Policy for Google's practices. You can restrict or clear cookies and site storage using your browser settings, although blocking essential cookies can prevent sign-in or payment features from working.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Object to or request restriction of certain processing
• Withdraw consent where processing relies on consent
• Complain to your local data protection authority

To exercise these rights, including requests about a child profile you manage, email support@starrysteps.com. We may need to verify your identity and authority to act for the account or child before fulfilling a request. You can manage your sign-in details and linked SSO accounts through Manage account in your account menu. Removing an SSO connection does not by itself delete Service data or cancel a subscription.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Service or by other means. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact Us

StarrySteps is operated by Starry Steps. For privacy questions, concerns, or requests about your or your child's information, email support@starrysteps.com.