The short version. CrumbleKeep is in a small pilot. I keep only what the game needs, and you, the grown-up, are in charge of your child's account. There are no ads, I never sell your data, and no other family can see yours.
Who I am. Robin Nurse, trading as CrumbleKeep, TL 47 Menzies Road, Aberdeen, AB11 9AT. Email: hello@crumblekeep.com. I am the "controller" of your family's information: I decide how it is used and I am responsible for it. ICO registration number: ZC249011.
This notice explains how I use information about you and your children. It sits alongside the CrumbleKeep Terms of Use. It is information for you to read, not something you sign or agree to.
What I hold, why, and the legal basis
| What | Why | Legal basis |
|---|---|---|
| Your email address, password (stored scrambled) and the name you choose | Your account, and the Terms of Use | Contract |
| Your child's account name (typed by you), hero, hero name and pet companion | To run the game | Legitimate interests |
| Quests, gold, XP, levels, streaks, boss progress, rest-day and reward requests, and the rewards and calendar entries you write | To run the game and family organiser | Legitimate interests |
| Optional initials for your child (1 to 3 letters) | Only if you add them | Your consent. Clear them at any time and they are deleted |
| Security records and error reports | To keep the app safe and working | Legitimate interests |
| Your check-in answers and other feedback | To improve the app (answering is optional) | Legitimate interests |
| Quotes from you | Only with your permission, and never with names | Your consent |
Legitimate interests means I use the information because you asked for CrumbleKeep, your child gets a game that makes chores visible and rewarding, and I provide and improve it. I have weighed those interests against your family's privacy and written that down. You can ask to see it, and you can object (see Your rights).
I don't collect surnames, school names, photos, location or health information. You may write names and everyday events in free-text boxes, but please don't include sensitive details such as addresses, financial or health information.
Your child's information
- Your child signs in with a PIN on a device you set up. I don't collect any email address or contact details for your child.
- Anyone holding a device you've set up can see your family's hero names on the sign-in screen.
- Every grown-up in your family can see everything your child does in CrumbleKeep, and your child sees a sign saying so. A new grown-up can join only if an existing grown-up approves them.
- You can give each child optional initials (1 to 3 letters). They're shown only in the grown-ups' area of the app, never to other families. You can clear them at any time, and they are deleted.
- You can remove a player yourself in the grown-ups' area. This deletes their login and everything that belongs to them. The family's shared progress stays, with nothing left that links it to them.
- Hero names, and from late November other text your child can see, are checked automatically against a list of blocked words. A blocked word simply can't be saved; the check makes no decisions about your child.
- I can technically see your family's data, to run and fix the service and to look into a safety report. I look only when needed and keep it confidential.
- No other family can see anything about yours.
Who helps me, and where your data is held
Your family's app data is stored in London. A few providers help me run CrumbleKeep. Each works under a data processing agreement and may use your information only on my instructions.
| Provider | What for | Where the data is held |
|---|---|---|
| Supabase | Database and sign-in | London, UK |
| Vercel Inc. | Runs the app's code | Servers in London. Vercel is a US company certified to the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework) |
| Resend | Sends sign-in and service emails, and updates-list emails | Stored in the United States (emails are sent from Ireland). Protected by the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework) and the UK-approved contract terms in Resend's data processing agreement |
| Sentry | Error reports, with personal details removed before sending | European Union |
| Tally | The updates-list sign-up form | Belgium (EU) |
If you choose to message me on WhatsApp, Meta handles those messages under its own terms.
How long I keep it
- During the pilot (12 weeks): for as long as your family uses CrumbleKeep.
- At the end of the pilot: your progress is kept so your child doesn't lose it if you carry on. If you tell me you don't want to continue, I delete your family's data within 30 days. If I ask and hear nothing for 60 days, I delete it within the following 30 days.
- If you leave during the pilot: I delete your family's data within 30 days, and send you a copy first if you ask.
- If I end the pilot early: I give you at least 30 days' notice, and send you a copy if you ask.
- Removing a player deletes their data straight away.
- Backups: deleted data can stay in encrypted backups for up to 7 days before it is overwritten.
- Check-in notes are kept without names and deleted by 28 February 2027.
Updates-list details are kept as set out in the next section.
CrumbleKeep updates list
If you sign up, I'll send you occasional emails about CrumbleKeep. The list is for grown-ups only and is separate from the app: joining the pilot doesn't add you to it, and leaving it doesn't affect your account.
- What I keep: your email address, which of my links you used to sign up (for example "pinterest"), when you signed up, and a record that you ticked the consent and "I'm 18 or over" boxes. Nothing about children.
- No tracking: I don't track whether you open my emails or click their links, and I use no other tracking.
- Legal basis: your consent, which you give by ticking an unticked box. You can unsubscribe at any time using the link in every email, or by emailing hello@crumblekeep.com.
- Who helps: Tally runs the sign-up form (Belgium, EU) and Resend sends the emails (from Ireland, with your details stored in the United States, protected as described above).
- How long: until you unsubscribe. I then delete your details within 30 days, keeping only your email address and the date you unsubscribed on a "do not email" list. I use that only to make sure you are never emailed again.
Your rights
You can ask to see, correct, delete or get a copy of your family's information, including your child's. You can object to how I use it, and withdraw any consent you've given (initials, quotes, the updates list). Your child has these rights too, and you can use them on their behalf. Email hello@crumblekeep.com and I'll reply within one month.
Complaints
If you're unhappy with how I've used your information, please tell me first at hello@crumblekeep.com. I'll acknowledge your complaint within 30 days.
You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF.
What I never do
No ads. No selling or renting your data. No profiling or automated decisions about you or your child. No leaderboards or contact with other families. No tracking tools. No AI features, and children never talk to an AI.
Cookies
CrumbleKeep stores one essential sign-in item on your device so you stay signed in, a device pass on devices you set up for your child, and a few small settings that stay on that device and are never sent to me (for example, that your child has seen "About my stuff"). Nothing for advertising or tracking.
Changes to this notice
I'll email each grown-up before any change that affects your family.
Last updated: 11 November 2026.