Nivaash
PocketSprout

Privacy Policy

Last updated: 21 October 2026

In short:

  • A parent creates the account and gives consent for their child. Children never sign up themselves.
  • For children we store only a nickname, an avatar and a birth year, plus what they do in the app. No real names, email addresses, photos or locations.
  • All money in PocketSprout is pretend money. No real money or bank details are involved.
  • No ads, no tracking, no analytics, and we never sell data.

This policy explains what information the PocketSprout app ("the app", "we", "us") uses and why. The app is published by Nivaash (nivaash.nl), based in the Netherlands, which is the data controller.

1. Information about parents

To create a parent account we ask for:

We use your email address only to sign you in, to let you reset your password and to send a one-time email to confirm the address.

A family can have more than one parent. Each parent has their own account and gives their own consent when joining with an invitation. All parents in a family can see and manage the children's information, and see what the kids call each of them.

2. Information about children

The parent creates each child's profile with:

We don't ask for or store a child's real name, email address, phone number, photo or location.

3. What happens in the app

To run the app we store the child's activity: pocket money and side-job pay that arrived, how it was split, savings, interest, pretend investments and orders, moves between pots, streaks and to-dos. When a parent enters side-job pay, the amount and date from the payslip are stored; we don't store employer details or payslips. When a parent uses the app as their child, those actions are recorded as done by the parent.

4. A child's phone

A child's phone is linked to the family with a one-time code from the parent. The phone then gets an anonymous account (no name, email or password). For each linked phone we store its type (iPhone or Android), the date it was linked and, if notifications are allowed, a push token so we can say when money has arrived. Parents can see and remove linked phones.

The child's 4-digit PIN never leaves the phone. It is stored in the phone's secure storage, as a scrambled (hashed) value only. If the child chooses to unlock with Face ID, Touch ID or a fingerprint, the phone checks it itself and only tells the app whether it matched; we never receive or store face or fingerprint data.

5. Notifications

If notifications are allowed on a child's phone, the app sends a message when pocket money, side-job pay or a chore reward arrives, including the amount. If notifications are allowed on a parent's phone, the app sends a message when a child says they did a chore, with the child's nickname, the chore and the amount. For this we store a push token for each parent's phone (up to five), and remove it when the parent signs out. These messages are delivered through Expo's push notification service and Apple's or Google's push services.

6. Who processes the data

Where data is processed outside the European Economic Area, this is covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Investment prices in the app are practice prices that we generate ourselves. Exchange rates come from the European Central Bank; we fetch them on our servers, and no information about you or your child is sent to the bank. Company logos are served from our own website, so the app doesn't load images from other companies.

7. What we don't do

The app has no advertising, no third-party analytics or tracking, and doesn't use the advertising identifier. The anonymous crash reports described above are only used to fix errors. We don't sell or share data for marketing. PocketSprout doesn't connect to any bank and never moves real money.

8. Children and parental consent

PocketSprout is meant for children of about 11 to 14, together with their parents. Under the GDPR, in the Netherlands a parent's consent is needed for children under 16. That's why only a parent can create the family and children's profiles, and the parent confirms they are 18 or older, the parent or guardian, and consent to their child using the app.

9. Legal basis (GDPR)

We process the parent's account data to provide the service the parent signed up for (contract). We process the child's data based on the parent's consent, which the parent can withdraw at any time by deleting the child or the family in the app. We keep limited technical logs to keep the service secure and working, based on our legitimate interest.

10. How long we keep data

We keep the family's data for as long as the account exists. The details of what happened in the app (each payment, set-aside, payout and order) are kept for the current and the previous calendar year; after that, each year is reduced to a short summary (such as "2025: €120 in, €85 set aside"). Balances, savings goals and the streak stay. Technical server logs are kept for up to 30 days, and crash reports for up to 90 days.

Parents can delete data from within the app at any time, straight away and permanently:

You can also email us from the parent's email address and we will delete the data within 30 days.

11. Your rights

You can ask to access, correct or delete your and your child's data, to limit or object to how it is used, and to receive it in a portable format. Email us and we will reply within one month. You can also complain to your data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

12. Security

Data is sent encrypted. Our database rules only let a parent see their own family, and a child's phone only that child. Balances and other money values can only be changed by our servers, never directly by the app.

13. Changes to this policy

If we change this policy, we will update this page and the date at the top. If the changes are important, we will tell parents in the app.

14. Contact

Questions about privacy, or a request about your data: pocketsprout@nivaash.nl