Star Stash privacy notice

Version 2.1 — October 2026. Last updated: 22 October 2026.

Star Stash is a family rewards app. A grown-up sets it up on their own phone, and children use it on their own tablet or phone with the grown-up in charge. This notice explains what Star Stash keeps, why, who helps us look after it, and what you can do about it. It is written for parents and carers.

The short version

Who looks after your information. Matt Collins, an individual in the UK, who runs Star Stash. Write to starstash@qwilverly.co.uk about anything here.
Who sets it up. A parent or legal guardian, with an email address and password. Children never make an account and never type anything about themselves.
What we keep. The grown-up's email address and sign-in. Your family's name. Your children's first names or nicknames and chosen characters. The jobs, rewards and star history. Anonymous IDs for the phones and tablets you pair.
What we do not do. No adverts. No analytics or tracking tools. Nothing you have to buy (some versions have an optional tip, see section 3). No selling your information. No location, photos, contacts or microphone. No chat. No child email addresses.
Where it is kept. Your family's records are stored in Google's data centres in London. Google's sign-in service for grown-ups processes data worldwide, including in the United States. Notifications to a grown-up's phone pass through Expo and Apple or Google.
You are in charge. In the app, under Settings and then Account and data, you can copy your family's information, change it, remove a child, or delete everything. You can also delete from a web page.
Worried? Talk to us first. You can also complain to the Information Commissioner's Office (ICO) in the UK, or your own regulator.

1. Who we are

"We" in this notice means Matt Collins, who runs Star Stash on his own. Matt is an individual based in the United Kingdom. He decides how your information is used, so under the UK GDPR he is the "controller". He is registered with the Information Commissioner's Office as Matthew Collins, registration number ZC173417.

Contact for anything in this notice, including privacy requests: starstash@qwilverly.co.uk.
If you would rather write by post, email us first and we will give you an address.
Matt has administrator access to the systems that hold Star Stash's data, because he is the only person who runs the service. He also has a private operations console, described in section 3 under "Behind the scenes".

2. How Star Stash works

A grown-up creates a family on their own phone with an email address and password, and checks their email.
They add each child with a first name or nickname and a character.
They set up jobs (for example "Brush teeth") and rewards (for example "Film night") and the stars each is worth.
They pair each child's tablet or phone with a short-lived code or a QR code. The child's device is given an anonymous ID. The child types in no personal details.
A child can tap "I did it!" or ask for a reward. A grown-up says yes or no. Only a grown-up can add or take away stars.

Star Stash is designed for children from under 5 up to 12, used with a parent or carer. The grown-up account is for adults. You must be a parent or legal guardian of the children you add. If you think a child has made a grown-up account, please tell us and we will delete it.

3. What we keep, and why

From the grown-up

What	Why	How long
Your email address, and your password as a one-way scramble that nobody at Star Stash can read. Google's sign-in service (Firebase Authentication) holds these, along with when you signed in and technical details it sees, such as your IP address and the type of device.	To create and secure your account, to let you get your family back on a new phone, and to send you the emails you ask for (checking your address, resetting your password, a deletion link).	While your account exists. If you never check your email address, we delete the sign-up after 7 days.
Our own record of your account: when it was created, when your email was checked, whether you own the family or share it, and a masked version of your address that shows only the first letter of each part, so the Grown-ups list can tell accounts apart. Your full address is not in our family database.	To run the family and show who is who.	While your family exists.
Your family's name, the word your children use for you (for example "Mum") and your time zone.	So the app uses the right words and knows when a new day starts.	While your family exists.
A record that you confirmed you are the parent or guardian and had the chance to read this notice: which version, when, and the type of phone.	So we can show what you were told and agreed to.	While your family exists. A minimal copy, without your email address, is kept for 12 months after deletion.
Your phone's notification address (a "push token"), only if you turn notifications on.	To tell your phone when a child has asked for something.	Until you turn notifications off, remove the phone, or delete the family, or the phone stops accepting them.

About each child, typed in by the grown-up

What	Why	How long
First name or nickname, chosen character and colour.	So the child recognises their own jar.	While your family exists, or until you remove the child.
Jobs, rewards and goals the family creates, and the star history: requests, approvals, declines, awards, deductions and spends, with the date and time, and which device did it. Also the trophies a child earns and the prizes the family sets and gives.	This is what the app is for.	The same. Removing a child erases their trophies and prizes too; prizes the family shares between children stay for the others.

Please use a first name or nickname. Do not use surnames, dates of birth, photos or health information. You can type your own words for jobs and rewards. Anything you type is kept like the rest of your family's information, so please keep it everyday.

From each phone or tablet

What	Why	How long
An anonymous ID (a random number, not linked to a name), the device's name (chosen by the grown-up or a default), its type (for example Android), the app version, which family and child it belongs to, and when it was paired and last used.	To check that this device may see this family, and only this child's jar.	Until the device is removed or the family is deleted. A removed device leaves a small record (its name, role and dates) so that history can still say which device approved something.
Requests a child makes, such as "I did it!" or a reward request, and the child's own choice of character or goal.	To show the grown-up.	Same as the family's other records.

Children do not enter an email address, phone number, photo or location, and they do not type their own name.

Behind the scenes

What	Why	How long
Pairing codes.	A code works once and lasts 10 minutes.	Cleared within an hour.
Safety counters. These count tries by device and by a scrambled version of the IP address, so people cannot guess pairing codes or flood the service. We read the IP address only for the moment of the request, scramble it with a secret key that changes every day, and store only the scrambled value. We also keep short records that stop a repeated tap doing something twice.	To keep the service safe and working.	Up to two days.
A count of how many changes your family's devices make each day: a number for each day, with your family's ID, and nothing about what the changes were. A rolling summary of the same numbers for the last 31 days, the last day there was a change, and a deletion time.	To stop a fault or misuse from running up the cost of the service for everyone, and so we can see which family is behind a sudden rise in cost. We can look at these counts for one family when we are looking into a fault or misuse. They are kept on our servers; your family's devices cannot read them.	31 days from the start of each day (deletion usually happens within a day after that, and occasionally a few days later if an automatic clean-up is delayed). The rolling summary never keeps a day for longer: every update removes days older than 31 days, a daily clean-up removes them for families that have stopped making changes, and the whole summary expires 31 days after its oldest day. Erased with your family.
Switches that can pause the saving of new stars. (a) A pause marker on your family's record, if your family's devices made an unusually large number of changes in one day: a time, ending at midnight (UTC). (b) A suspension marker, if we have paused your family by hand: the time and a short note of why. (c) A whole-service maintenance switch, which we or an automatic cost limit can turn on and which holds nothing about anyone. Your family's devices can read these and the app tells you when one is on.	To protect the service from misuse, or from a fault that is costing money, and to keep the whole service within its budget. A pause never deletes anything and never stops you copying or deleting your family's information. The app keeps what has been done on the device and sends it when the pause ends. Older installed versions of the app can lose changes made while a pause that we set by hand, or the emergency stop below, is on.	(a) Until midnight (UTC) the same day. (b) Until we lift it. (c) Until we switch it off. (a) and (b) are deleted with your family.
An emergency full stop: one switch that stops the whole service for a while, for example during a security problem or a runaway cost. While it is on, devices cannot read or save family records. They show an "offline for a moment" screen. Nothing is deleted and devices stay paired.	To protect everyone's information and the service's running cost in an emergency. Only Matt can turn it on or off.	Until Matt turns it off. It is a switch, not a record about anyone. Each use of it through the console is written to the log of controls below.
A private operations console that only Matt can sign in to, using a separate sign-in and an allow-list that names only him. It shows numbers for the whole service and, for each family, a short code (not a name) with the counts, dates and pause status described above. The page for one family also shows the family's ID, so that a support email can be matched. It never shows names, email addresses, device names, jobs, rewards or anything a child entered. We keep a log of each time Matt uses a control in it (pause, resume or unpause a family, maintenance on or off, the emergency stop): what he did, the short code of the family if there was one, his reason in his own words, the time, a scrambled reference to his account, and whether anything changed. It never holds anything your family wrote.	To keep the service running and affordable, to answer support emails, and to keep a trustworthy record of the choices we make about a family's access to the service.	The log of controls: 12 months, then removed automatically. It is kept after a family is deleted, because it holds a scrambled code, not the family's ID or anything the family wrote.
Break-glass read logs. Only while Matt is investigating an unexpected rise in database activity, he can switch on extra logging from Google that records who read the database: the anonymous ID of a device or the account ID of a grown-up, their IP address, which records were asked for (the path includes the family's ID), the time and how many were returned, but not what the records said. It is off by default, is switched on for a planned number of minutes, and an alarm emails Matt if it is left on past that time.	To find the cause of a surge in cost or of abuse.	1 day, in a separate store in London, and only for the time it was switched on for an investigation.
A short-lived marker, held only while we remove a sign-up whose email address was never checked. It holds the sign-up's anonymous ID and a time, and nothing else.	So that clean-up can never delete an account at the moment it is creating or joining a family.	Lapses after 10 minutes and is removed within a day.
A record of each notification sent (a request number and whether it went), and delivery receipts from Expo. No names.	To make sure each request sends one notification, and to stop sending to phones that no longer exist.	Up to 7 days.
Our technical logs: which part of the service ran, a short scrambled piece of the device ID, whether it worked, a reason code and how long it took. They contain no names, email addresses, notification addresses, pairing codes or IP addresses.	To fix problems and spot abuse.	30 days, stored in London.
The last day your family used Star Stash: one date, with no time and no detail of what was done. It is replaced by a new date on each day the family is used, so it is not a history.	To count how many families use Star Stash, so we can plan running costs. It is stored on your family's record, so your family's own devices can read it.	While your family exists.
Daily totals for the whole service, for example how many families used Star Stash in the last week, how many children and devices there are in total, and how many devices are Android or iPhone. Numbers only; they say nothing about any family.	To plan running costs.	400 days.
A record that a deletion happened: what was deleted and when, with the grown-up's ID scrambled so it cannot be traced to an email address. A short marker that a family was deleted.	To prove we deleted, to stop a deleted family coming back, and to delete it again if a backup is ever restored.	The deletion record for 12 months. The marker for 30 days.
Backups of the family database.	To recover from a serious fault.	Where we keep a backup, it is kept for at most 14 days.

What we do not collect

We do not collect advertising IDs, location, contacts, photos or videos, audio, browsing history, health information or payment details. Star Stash needs no purchases. On the Google Play and iPhone and iPad versions there is an optional tip, described below. The camera on a device that is joining a family is used only to scan the pairing code on screen. Nothing it sees is saved or sent anywhere, and you can type the code instead.

Star Stash contains no advertising, analytics or tracking tools. To plan running costs we count how many families use it on our own servers, as daily totals with nothing about any one family (see "Behind the scenes" above). To protect the service we also count, for each family, how many changes its devices make each day: a number, never what the changes were (see "Behind the scenes" above). Google, Apple and Amazon, whose stores you download the app from, collect their own information about downloads and crashes under their own privacy policies.

Optional tips

On the Google Play and iPhone and iPad versions, a grown-up can leave an optional tip to support Star Stash. It is in the grown-up Settings, where children cannot reach it, and on iPhone and iPad it also sits behind a short grown-up check. A tip is a one-off purchase made through Apple's App Store or Google Play. It unlocks nothing. The Amazon Appstore version has no tip.

Apple or Google takes the payment and is the seller. They deal with it under their own terms and privacy policies, not on our instructions. We never receive your card or payment details, your Apple or Google account details, or a receipt. The app on the phone sees only that the purchase went through, for the moment it takes to tell the store it is finished. It does not save that and does not send it to us or to anyone else, so Star Stash does not know who left a tip. Apple and Google do show Matt records of sales in their developer accounts (for example the amount, the date and the buyer's country). They are not linked to any family or child. No information about a child is involved in a tip.

4. Why we are allowed to use your information

The law says we need a reason. Ours are:

To run the service you asked for. Your account, your family and the jar. This includes your children's names and records, which you add as their parent or carer.
Your agreement. For notifications to your phone, which you can switch off at any time. We also ask you to confirm that you are the parent or legal guardian and have read this notice.
Keeping the service safe (our "legitimate interests"). Limiting guessing of pairing codes, keeping short technical logs, and keeping a record that we deleted something. Counting how many changes each family's devices make in a day, so that we can pause a family whose devices make an unusually large number (a limit that lifts itself at midnight, not a decision about a person), pausing a family by hand if something looks wrong, the emergency full stop, our private operations console and its log of the controls Matt uses, and break-glass read logs while we investigate a surge or an attack.
Planning running costs (our "legitimate interests"). Counting, in daily totals, how many families use Star Stash, so we know what it costs to run and can keep it going.
Legal duties, for example answering a regulator.

We do not make decisions about people by computer, and we do not build profiles of anyone.

5. Who helps us, and where your information goes

We never sell your information and we never share it for advertising. These companies help us run Star Stash. They act on our instructions.

Who	What they do	Where
Google Firebase and Google Cloud	Store your family's records (Firestore). Run the service's code. Host our web pages. Keep our logs.	Family records, code and logs: London (europe-west2). Web pages are delivered from Google's worldwide network.
Firebase Authentication (Google)	Handles grown-ups' email and password sign-in, the emails it sends (checking your address, password reset, deletion links) and the anonymous IDs of devices. It sees your email address and IP address.	Processed worldwide, including the United States.
Expo	Delivers notifications to grown-ups' phones and, where we use them, small app fixes (see "App updates").	A US company, so this involves processing outside the UK.
Apple (APNs) and Google (FCM) push services	Carry notifications to a grown-up's iPhone or Android phone.	Worldwide.
Google Play Integrity	On Google Play versions, once switched on, tells us whether the app looks genuine (see "Checking the app is genuine").	Google.
Apple (App Store) and Google (Google Play)	If a grown-up leaves an optional tip, they take the payment and sell it to you under their own terms (see "Optional tips" in section 3). They do not act on our instructions. We receive no card or payment details.	Worldwide.

Anything about a child that appears in a notification (see "Notifications") passes through Expo and Apple or Google.

We may also share information if the law requires it, or to protect someone's safety. We would tell you unless we were not allowed to.

Moving information abroad. Some of these companies handle information outside the UK, including in the United States. We rely on the safeguards the law recognises, such as the standard contract terms each provider offers.

6. Notifications

Notifications go to grown-ups' phones only. A child's tablet never receives them and never registers for them. They are sent by our server.

By default a notification says only "Something is waiting for you". A grown-up can turn on "Show names in notifications" on their own phone. Then a notification includes the child's first name and what they asked for, for example "Maisie says: I did it!". These words then pass through Expo and Apple or Google, and they appear on that phone's lock screen. Notifications are optional. If you say no at your phone's prompt, or turn them off later, nothing is sent and your notification address is removed.

7. Checking the app is genuine

To help stop people abusing the service, some versions of the app will ask the phone's maker to confirm that the app is a genuine copy of Star Stash.

Google Play versions will use Google's Play Integrity service. This is not switched on yet. When it is, Google gives our server an answer about the app and device (for example that the app came from Google Play and has not been tampered with). We use the answer once and do not store it.
iPhone and iPad versions will use Apple's App Attest. This is not switched on yet. When it is, it gives us a random key for that copy of the app. It does not contain your name, account or a hardware ID.
Amazon Appstore versions do not use it.

When it is on, it only helps us spot abuse. The app works as normal if the check fails or is unavailable, and we do not block anyone because of it. It does not start until a grown-up has chosen to set up or join a family.

8. App updates

Some versions of Star Stash can download small fixes in the background ("over-the-air" updates), delivered by Expo. When the app checks, Expo receives the app version, the type of device, an identifier for that copy of the app, and the device's IP address.

Google Play and iPhone and iPad versions: updates are on for grown-up phones only. A child's device never checks for updates or contacts Expo for them. Children get fixes through normal app store updates.
Amazon Appstore version: updates are off. Fixes come through the Appstore.

Families who started before accounts: see section 13.

9. How long we keep things

What	How long
Your family's records: children, jobs, rewards, star history, trophies and prizes, devices, and your confirmation record	Until you delete them. We plan to also delete a family that nobody has used for 24 months, and to email you first. That is not running yet. We will update this page when it is.
Your sign-in	Until you delete your account. Sign-ups whose email is never checked are deleted after 7 days.
A sign-in made only so a deletion link could be sent to an address that had no account	Until you delete it on the deletion page. We plan to clear any left over automatically.
An anonymous device ID that is not in any family	We aim to remove it after 30 days of no use. This clean-up is paused for the moment while we make it safer, so it can be kept for longer. It holds no name or email address.
Pairing codes	10 minutes live. Cleared within an hour.
Safety counters and repeat-tap records	Up to two days.
Daily count of changes made by your family's devices, and the rolling 31-day summary (numbers only)	Up to 31 days (deletion usually happens within a day after that, and occasionally a few days later if an automatic clean-up is delayed), cleaned up every time it is updated and once a day, and removed with your family.
Pause marker, suspension marker and maintenance switch	A pause until midnight (UTC) the same day. A suspension until we lift it. Maintenance and the emergency full stop until we switch them off. The markers on your family's record are deleted with your family.
Log of controls Matt used in the operations console	12 months.
Break-glass read logs (only during an investigation)	1 day.
Purge marker for an unchecked sign-up	Lapses after 10 minutes; removed within a day.
Notification records	Up to 7 days.
Technical logs	30 days.
The last day your family used Star Stash (one date)	While your family exists.
Daily totals for the whole service (numbers only)	400 days.
Deletion records and "family deleted" markers	12 months, and 30 days.
Proof that you confirmed this notice, after your family is deleted	12 months, without your email address.
Backups of the family database	At most 14 days each.
Update requests held by Expo, sign-in records held by Google	As set out in their own policies.

When you delete, a copy can remain in a backup for up to 14 days after the deletion finishes. Google's own systems also remove replicated and backup copies on their own schedule, which can take longer than ours.

10. Your choices and rights

What you can do in the app

Grown-ups can do all of this in Settings:

See and change: children's names and characters, jobs, rewards, goals and the family name, at any time.
Take a copy: under Account and data, "Share family data" gives you your family's information as a file and a spreadsheet of the star history.
Remove a child: erases that child's profile, stars, requests, trophies and prizes, and removes that child's devices. Prizes the family shares between children stay for the others.
Remove a device: stops a lost phone or tablet seeing your family. The jar stays.
Delete the family: only the person who set it up can do this. It permanently erases the family, all children and records, and their devices' IDs. You can choose to delete your own sign-in too.
Delete your account: if you share a family you own with other grown-ups, hand over ownership first.
Change your mind about notifications: in Star Stash's Settings or your phone's settings.

Deleting from a web page

If you have lost your phone or cannot open the app, you can delete your account and the families you own at https://star-jar-f35e2.web.app/delete-account. Enter your email address and we will send a one-time link, so we know it is you. The page saves your email address in your browser until you use the link, and uses your browser's storage to keep you signed in while you are on it. It sets no cookies. If you cannot open your email either, write to starstash@qwilverly.co.uk. We will ask you to describe what is in the family to check that it is yours. We cannot decide who owns a family from names alone, because names are not secret.

How fast deleting is

We aim to remove most of it within an hour and everything from our live systems within 24 hours. The longest it should take is 30 days. Copies in backups clear within 14 days after that (see section 9). A tablet that is switched off or offline finds out when it next connects. Information already saved on a device that stays disconnected cannot be wiped from a distance. We cannot recover anything once it is deleted.

Your legal rights

Under the UK GDPR, and the EU GDPR if you are in the European Economic Area, you can ask us to:

tell you what we hold about you (access);
correct it;
erase it;
restrict how we use it;
give you a portable copy;
stop using it where we rely on our legitimate interests (object);
and you can withdraw your agreement at any time (deleting the family does this).

Most of this you can do yourself in the app. For the rest, write to starstash@qwilverly.co.uk. We reply within one month and we do not charge, unless a request is clearly unreasonable.

If you are unhappy, please talk to us first. You can also complain to:

In the UK: the Information Commissioner's Office, ico.org.uk, 0303 123 1113.
In the EU or EEA: your national data protection authority.
Elsewhere: your local regulator.

11. Children

Children do not hold accounts, cannot sign in, cannot change settings or add stars, and cannot message anyone. A grown-up decides what is in a child's jar.

Children have the same rights as adults over their information. While they are young, their parent or carer uses those rights for them. An older child can also write to us, and we will take it seriously and talk to the family.
Grown-ups can see everything in the family: stars, requests and history. The child is told this in the app, in words they can understand.
Other grown-ups. If you invite another guardian to your family, they will see the family's records. You can remove them at any time. We cannot settle disagreements between guardians. If a family separates, the owner can hand ownership to another guardian.

12. Families outside the UK, and parents in the United States

Star Stash is available worldwide. Information is stored in London and handled by the providers in section 5, some of which work outside the UK. Some countries have their own extra rules about children's information, and we are looking at them as Star Stash becomes available in more places.

If you are in the US. Star Stash is built to be set up and run by a parent or guardian, and that is you.

What we collect from children's devices. An anonymous device ID, the requests a child makes (such as "I did it!") with their times, and the character or goal they choose. You, not your child, type the first name or nickname. We do not collect a child's email address, phone number, photo, voice, video or location. Children cannot post or chat.
How we use it. Only to run Star Stash: to show a child their jar, let you decide, keep the service safe and keep it running. We do not use children's information for advertising or profiling.
Who we share it with. Only the companies in section 5 that help us run the service. We do not sell it.
Your part. You tell us you are the parent or guardian, and we check that your email address works. We plan to add an email a day or so later, saying what was set up and giving you a link to delete the family if it was not you. That email is not sent yet.
Your choices. You can review everything stored for your child in the app, or take a copy. You can delete a child or the whole family, in the app or on our website. You can stop further collection by removing a child's device or the child. You can write to us at starstash@qwilverly.co.uk. A child does not have to give more information than is needed to use Star Stash.
Keeping it. See section 9.

13. Families who started before accounts

Star Stash began as a private app for one family. That family's phone and tablets were set up before grown-up accounts existed, and they keep working. For those devices:

No email address or sign-in is held. Each phone and tablet has an anonymous ID.
The family's information (names, jobs, rewards, stars) is stored in the same London database as everyone else's.
The grown-up phone's notification address is stored with the family's records, where the family's other devices can read it. Until the family moves to an account, a child's tablet sends the notification to the grown-up phone itself, through Expo, instead of our server.
Devices in these older families may check Expo for app updates when the app opens.
The in-app delete buttons need the family to be moved to an account first ("Protect my family"). Before that, write to us and we will delete the family.

We will tell these families before anything about this changes.

14. Our websites

Our privacy, help and deletion pages are served by Google Firebase Hosting, which handles the technical request needed to deliver a page. They have no adverts, no analytics and no cookies. The deletion page uses your browser's storage in the ways described in section 10.

15. Keeping information safe

Information travels over encrypted connections.
Each family's records can only be read by that family's paired devices.
Deleting a family or an account needs a recent password entry or a fresh email link, so a borrowed phone cannot do it casually.
Pairing codes are short-lived and limited, and our own records keep IP addresses only in scrambled form.
The operations console accepts only Matt's own sign-in, checks it on our server on every request, and writes a log of every control he uses (section 3).
Information saved on a phone or tablet itself relies on that device's own protection. We do not add encryption on the device, so please use a screen lock.

If a breach puts anyone at risk, we will tell the people affected and the ICO, as the law requires.

16. Changes to this notice

This is version 2.1, from October 2026. It replaces version 2.0, which was published on 20 October 2026, and the earlier notice before it, which described a private app used by one family before accounts existed. What is new in 2.1: the optional tip on the Google Play and iPhone and iPad versions; a count of how many changes each family's devices make each day, kept up to 31 days (deletion usually happens within a day after that, and occasionally a few days later if an automatic clean-up is delayed), and the last day a family used Star Stash, with daily totals for the whole service; the switches that can pause saving new stars (a daily pause, a suspension and maintenance) and the emergency full stop; Matt's private operations console and its 12-month log of the controls he uses; break-glass read logs, kept 1 day and only during an investigation; the short-lived marker used when we remove an unchecked sign-up; and a clearer statement that removing a child also erases their trophies and prizes. We have not asked grown-ups who agreed to version 2.0 to agree again. If we make a change that matters, such as a new provider or a new kind of information, we will say so in the app and on this page, and ask grown-ups to read the new version where the law requires it. Children are never blocked from using the app. Small changes, such as clearer wording, will be noted here with the date. On 22 October 2026 the app's public name changed from Star Jar to Star Stash; nothing about your information, or who looks after it, changed with the name.

17. Contact

starstash@qwilverly.co.uk

Deletion page: https://star-jar-f35e2.web.app/delete-account