Last updated: 19 May 2026

This Privacy Policy explains how Crown Online ("the app", "we", "us", "our") collects, uses, stores and protects your information when you install or use the app on a mobile device. By using Crown Online you agree to the practices described below.

1. Who we are

Crown Online is a private family tracker that lets family members share a calendar, assign and complete tasks, exchange rewards through an in-app shop, hold polls and keep shared notes. The app is provided as-is by the Crown Online team. For any privacy related question please write to mileshenderson@novalelok.com.

2. Information we collect

We only collect the information that is strictly necessary to provide the service.

a) Account data. When you sign up we ask for an email address and a password. The password is never stored in clear text — authentication is delegated to Supabase Auth, which keeps a one-way hash on its servers.

b) Profile data. You may add a display name and an avatar image. The avatar, if provided, is uploaded to a Supabase storage bucket and served via a public URL only to other members of your family hub.

c) Family content. Tasks, calendar events, shop items, purchases, polls, votes and saved family passwords that you or your relatives create inside the hub are stored in our Supabase database and are visible only to members of the same family hub, enforced by row level security policies.

d) Device & push tokens. To deliver push notifications we use OneSignal. OneSignal assigns each install a random push token and links it to your Supabase user id. We never share this token with third parties for advertising.

e) Attribution data. To measure how new users discover the app we use Affise / AppsFlyer SDK. The SDK collects standard mobile attribution signals (advertising identifier where the user has not opted out, install timestamp, referrer) and sends them to our attribution provider. No personally identifying content is sent.

f) Crash & diagnostic logs. Standard Flutter and platform logs may be generated locally on your device. The app does not upload these logs automatically.

3. How we use the information

We use the information collected to:

- create and maintain your account;

- show you your family hub and synchronise tasks, events and the shop between family members;

- send push notifications about activities inside your family hub;

- improve the app and measure marketing campaigns;

- comply with legal obligations when required.

We do NOT sell your personal information and we do NOT use it for targeted advertising outside the app.

4. Legal basis (GDPR)

Where the EU General Data Protection Regulation applies, we process your data on the following legal bases: performance of the contract that allows you to use the app (Art. 6.1.b GDPR), your consent for push notifications and attribution (Art. 6.1.a GDPR), and our legitimate interest in keeping the app secure and improving it (Art. 6.1.f GDPR).

5. Sharing your information

We share data only with the processors that are necessary to operate the app:

- Supabase (database, authentication, storage);

- OneSignal (push notifications);

- Affise / AppsFlyer (mobile attribution);

- Apple TestFlight, App Store and Google Play — when you install or update the app.

We do not share your data with any other third party. We never sell it.

6. Data retention

Account, profile and family data are kept for as long as your account exists. When you delete your account inside the app (Profile → Delete account), we immediately call our server-side function delete_my_account() which removes your row from auth.users; all dependent rows (profile, family memberships, tasks you created, calendar events you created, polls, votes and family passwords) are cascaded and physically deleted from the database in the same transaction. Backups containing data are rotated within 30 days.

7. Your rights

You have the right to access, correct, export and delete your personal data. The simplest way to exercise the deletion right is to use the Delete account button inside the app. For any other request please email mileshenderson@novalelok.com — we respond within 30 days.

8. Children

Crown Online is intended for use within a family. Children below the age of 13 (or the age required by local law) must use the app only under the supervision of a parent or legal guardian, and must not register an account on their own.

9. Security

Connections to our backend use HTTPS exclusively. Database access is protected by row level security policies that limit each user to data belonging to the family hubs they are a member of. Avatars are uploaded over signed sessions to a per-user storage prefix. We review our security configuration regularly.

10. International transfers

If you access the app from outside the country where our infrastructure is hosted, your information will be transferred to and processed there. By using the app you consent to this transfer.

11. Third-party services

The app may load remote content inside an in-app WebView. The privacy practices of any external website opened in the WebView are governed by that website's own privacy policy, which we do not control.

12. Changes to this policy

We may update this policy from time to time. When we do, we update the "Last updated" date at the top. Material changes will be announced inside the app.

13. Contact

For any question, complaint or data subject request related to this Privacy Policy, please contact:

mileshenderson@novalelok.com

Thank you for trusting Crown Online with your family.