Apparent Family — Privacy Policy

Effective date: October 18, 2026

Apparent Family ("Apparent") is a family app that helps a parent or caretaker set a child's daily tasks, and helps the child complete them and earn rewards, across their two devices. It is operated by Bear Audio LLC ("we," "us"), a Colorado limited liability company. This policy explains what we collect, why, and your choices. We built Apparent to collect as little as possible.

Who provides the information

A parent or caretaker creates the account and enters the household and child details. A child uses a linked device that a parent connects with a short-lived invite code. Claiming that parent-approved invite creates a pseudonymous Supabase authentication session for the device, but the child does not choose credentials or sign up independently. Children can complete tasks, may type a short task-submission note that is visible inside their family, and, on a task where a parent has asked to see one, may add an optional photo. The optional Settings feedback form is parent-only. Apparent is a parent-managed tool, not a service children sign up for on their own.

What we collect

We only collect what the app needs to work:

• Parent account and sign-in: your email address, including an Apple private-relay email if you choose Sign in with Apple; an internal Supabase account identifier; and the sign-in provider associated with the account. If you use Sign in with Apple, Supabase also keeps the Apple subject identifier needed to link and verify that identity. If you use email and password, the password is sent to Supabase Auth for authentication; Apparent does not store the plaintext password in its family database, local app-data cache, or logs.
• Household setup: a household name you choose. Apparent does not ask you to report household size or a parent/caretaker count in the current setup flow.
• Child profile and preferences: a display name you choose for the child, an age group (for example "elementary") — never an exact birthdate — and the child's selected visual-theme identifier.
• Linked child-device session: after a parent-approved invite is claimed, Supabase creates a pseudonymous anonymous-auth user/session identifier and links it to the approved family and child profile. The child provides no email address or password for this session, and an anonymous session can never hold parent authority.
• Tasks and rewards: the responsibilities, routines, star values, rewards, and completion history you create and track — which tasks a child ticks off and when, the rewards they claim, and any short note a child attaches when sending a task for a parent's review.
• Task photos (optional): on a task where a parent has asked to see one, a photo the child takes of the finished task when sending it for review. The child can always send without one. It is stored privately, visible only to the family's parents, used only for that review, and deleted when the parent approves the task or sends it back, and always within 30 days.
• Help requests: when a child taps the Help button on their device, we record that the request happened and when, linked to the child's profile, so a parent can be told. There is no message and no free text — the button sends nothing a child types.
• School grades (optional): if a parent chooses to track them, the subject names and short grade values the parent types in (for example "Math: A-"). Grades are entered by the parent only, are visible only inside your family, and are never used to gate rewards, never shared with a school, and never read from any school system. Removing a subject, a child, or your account removes them from the active service.
• Device and caregiver connection: short-lived, single-use child-device and caregiver invite codes (stored only as hashes), together with the family, creator/claim, expiration, and status records needed to issue, validate, and retire those invites.
• Optional Screen Time gate status: whether a Daily Unlock's on-device gate is off, on, or needs attention. Apparent does not send the selected-app tokens, Screen Time selections, or app-activity/usage data to its servers; those stay on the child's device in Apple's Family Controls storage.
• Feedback and support (optional): if a signed-in parent sends a note from Settings, we collect the feedback type and message they choose to provide, together with the app version, build number, device platform, and submission timestamps. The note is linked to the parent's account so we can investigate, follow up, and improve Apparent. We do not attach a separate family identifier. Please do not include children's full names, contact details, grades, health information, passwords, invite codes, or other sensitive details that are not needed for the request.
• Error reports: if the app hits an error, the signed-in app may send the error type, a short technical message and code location/stack, app version and build, platform, capture time, and server receipt time so we can fix it. A narrow deterministic scrubber removes URL-, push-token-, JWT-, Supabase-key-, email-, UUID-, contextual invite-code-, and long opaque-token-shaped text on the device and again on the server. This is defense in depth, not a promise that arbitrary free text can identify every possible sensitive value. The report row does not contain an account, family, or device identifier, but the authenticated request and short-lived infrastructure logs can still be associated with the account that sent it.
• Parent notification device identifiers: a random installation identifier stored securely on the parent device, plus its notification token, so we can route an alert. Only a signed-in active parent can register; our server rejects child-device registration. The installation identifier lets the app request deactivation of that exact installation when the parent signs out. A random per-attempt identifier and a short-lived cancellation record prevent a registration that finishes late from reactivating a signed-out device. Those client-inaccessible cancellation records are purged after seven days by a daily job (schedule timing can add up to about one day), and account deletion removes them sooner. Each successful signed-in registration refresh renews a 90-day active lease; a daily job deactivates an unrefreshed registration and deletes its token after 30 more inactive days. A provider rejection can deactivate only the exact registration at the unchanged version captured for that notification. A refreshed registration wins, and an older delivery record with no trustworthy captured version cannot deactivate the current registration. These identifiers are not used for advertising or tracking.
• Network and security metadata: Supabase automatically records limited request and authentication metadata such as IP address, IP-derived approximate location, user agent or app-client information, request route and time, response status and timing, and — for authentication events — account identifier. We use this only to authenticate requests, prevent abuse, troubleshoot failures, and keep the service secure and reliable.

Identifiers from a child's device support internal operations only. The pseudonymous session identifier a linked child device holds, and the request records our infrastructure keeps about it, are used solely to operate, secure, maintain and troubleshoot the service. They are never used to contact the child, to build a profile, for advertising, or for any other purpose.

Apparent does not request GPS location, financial or health information, contacts, or browsing or search history. For certain parent-only actions, Apparent invokes Apple's on-device authentication prompt, which can use Face ID, Touch ID, or the device passcode. Apple evaluates that credential on the device; Apparent receives only a local success, cancellation, or failure outcome and does not receive, store, or transmit a face/fingerprint template or the device passcode. Please do not add biometric or other sensitive details to optional free-text fields. If you do include them, they are handled as part of the note you submitted under the same access and retention rules described here. Our infrastructure may derive coarse location from an IP address for security logging; it is not used to track a person's movements. The camera is used to scan a parent-provided invite QR code and, only on tasks where a parent has asked to see a photo and only after that parent has agreed to the notice describing photos, to let the child take an optional photo of the finished task. No other photos are taken or stored.

How we use it

• To provide the service: create and sync your family's tasks and rewards across the parent and child devices.
• To send a parent a push notification when a child submits a task for review or another configured family action needs the parent. Notifications contain generic text and a minimal action type — never a child or family identifier, child's name, task details, grade, or note.
• To personalize family labels, child themes, and age-appropriate starter tasks from the choices a parent or child makes, and to sync only the coarse state of an optional on-device Screen Time gate.
• To respond to optional parent feedback, diagnose reported problems, and plan improvements to Apparent.
• To secure accounts, prevent abuse, and keep the service reliable.

We do not use your information for advertising, and we do not sell or rent it.

Tracking and analytics

Apparent contains no advertising, no tracking SDKs, and no automatic behavioral analytics. We do not track you or your family across other apps or websites. We may review feedback a parent deliberately submits and privacy-scrubbed technical error reports to troubleshoot and improve Apparent. Reviewing those deliberately submitted notes is not automatic monitoring of in-app behavior.

Who we share it with

We share information only with infrastructure providers that run the app, and only as needed to operate it:

• Supabase — hosts our database, authentication, secure sync, server functions, limited security logs, and scheduled feedback, diagnostic, push-attempt cancellation, push-receipt processing, and stale-notification- registration deletion.
• Resend — delivers the emails we send to a parent: account confirmation and recovery, the message confirming that you gave permission for a child's device (see Children's privacy), and the warning before an unused family is deleted. For those messages, Resend processes the recipient address, sender/domain metadata, full email subject and content, and delivery/security events. None of those emails names a child or carries anything a child's device sent. Resend also sends a generic alert to Apparent when new feedback is ready in Supabase; that alert contains no feedback text and no user, family, or feedback-record identifier.
• Expo Push Service and Apple Push Notification service (APNs) — receive a parent device's push token and the generic, identifier-free notification payload needed to deliver an alert. Apparent sets a short delivery lifetime; Expo clears delivery receipts after its documented 24-hour window.
• Apple — provides Sign in with Apple when you choose it; Apparent requests only the email scope, not your Apple profile name. Apple also provides the system authentication used for parent gates: Face ID, Touch ID, or the device passcode is evaluated on-device, while Apparent receives only the local outcome. Apple provides the on-device Family Controls framework when a family enables optional Screen Time gating. Selected-app tokens and activity data remain on the child's device.

These providers process data on our behalf under their own terms. We do not share family data with advertisers, data brokers, or unrelated third parties. We never make any of it public. Nothing a child does in Apparent — no task, note, reward, help request or theme — is visible to anyone outside your family, and we do not disclose a child's information to any third party.

Children's privacy

Apparent is designed for parents to manage on behalf of their children:

• A parent creates the account and provides the child's display name and age group. A child does not choose account credentials or sign up independently; the device's pseudonymous anonymous-auth session is created only after a parent-approved, short-lived invite is claimed.
• Child-entered task notes stay attached to a specific task submission and are visible only to the family. The general feedback form is not available to a child session, and the server rejects child feedback requests.
• A child can add an optional photo to a task only on tasks the parent chose to invite one for, and only after the parent agreed to the notice that describes photos (version 2026-09-08.1). The child can always send without one and the parent cannot require it. Only the family's parents can see it; it is deleted when the parent approves the task or sends it back, and always within 30 days.
• We minimize children's data by design — an age group, not a birthdate, and no profile photos, GPS or precise location, or contact data.
• We do not use children's data for advertising, profiling, behavioral analytics, or tracking.

Before a child's device connects, we ask for your permission. The child side of Apparent is made for children, and we treat every child profile as a child under the Children's Online Privacy Protection Act whatever age group you choose. So, before any child device can connect:

• You read a notice, in the app, on the child's own screen. It lists what the device will send — which tasks are ticked off and when, an optional review note, rewards claimed, the theme chosen, Help-button taps, Daily Unlock gate status, and the device's own pseudonymous identifier — what we use it for, and that we share none of it outside Apparent Family. The notice links to this policy.
• You give permission from your signed-in parent account, by tapping "I agree". Only the child's parent or legal guardian may give it, whichever adult in the family that is, and by giving it you confirm that you are; an invited caregiver who is not the child's parent or guardian cannot. Until you do, no connect code exists and nothing is collected from the child.
• We then email every adult in your family to confirm. That message says what was agreed to and tells you how to take it back, so that a parent who did not give permission hears about it from us. If the message to the account that gave permission cannot be delivered, the app tells you and offers to send it again; if it has not been delivered a week later, the child's device is disconnected until it is. This is the "email plus" method of verifiable parental consent.
• If what the device sends ever changes materially — a new kind of information, or a new recipient — we show you a new notice and ask again before anything new is collected. Photo evidence was one such change: it took effect only for families who agreed to notice version 2026-09-08.1, and no photo is collected from a child whose parent has not agreed to it.
• You can withdraw at any time with Withdraw permission on the child's screen; see below.

The operator responsible for this is Bear Audio LLC, at the address under Contact.

If you believe a child's information has been provided to us in a way you did not intend, contact us at privacy@apparentfamily.com and we will delete it.

What you can do as a parent

You do not have to ask us for any of this. Each of it is a control in the app, on the child's own screen in Family:

• Review what we hold. Everything a child's device sends about their day is shown on that child's screen — the tasks they ticked off and when, any note they added to a task sent for review, rewards claimed, the theme chosen, Help-button taps and Daily Unlock gate status. The only records about a child's device that are not on that screen are the short-lived request logs our infrastructure keeps for security, described under Retention and deletion.
• Refuse any further collection, without losing anything. Withdraw permission takes back the consent you gave for that child: we stop collecting anything from them, and their device is disconnected if one is connected. It is available whether or not a device has ever been connected. Disconnect device is the narrower control — it releases the device the child is using without changing your permission, which is what you want when they simply switch devices. Nothing already recorded is deleted by either, so refusing collection does not cost your child their history or their stars. You can give permission again, or reconnect with a new code, whenever you like.
• Delete. Individual tasks, rewards and notes can be removed from that same screen. Delete a child — the last control on their screen — permanently removes that child's profile and everything we hold about them: tasks, rewards, stars, history, notes, and the permission record, and disconnects their device if one is connected. Nobody else in the family is affected. We keep one thing: a record that permission was given and, if it was, withdrawn — the date, the notice version and the account that gave it — with nothing that identifies your child, so we can show the permission was obtained. It is deleted three years later. Settings → Delete account removes the whole family — children, tasks, rewards, grades, history and connected-device access — immediately and permanently.
• Ask us instead. If you would rather we did any of it, write to the address above and we will. We may need to confirm you are the parent on the account before acting, so that someone else cannot use this to reach your child's information.

How your data is protected

• App-to-server connections use HTTPS/TLS. Email delivery also uses provider transport protections, but transport after an email leaves our provider can depend on the recipient's mail system.
• Access is enforced on our servers with per-family, per-role rules — a device can only reach the data its family and role allow.
• Parent capabilities require a permanent, non-anonymous parent account. Parent-approved anonymous sessions are reserved for linked child devices and cannot create families or hold active parent membership.
• The on-device cache is encrypted.
• Feedback can be submitted only by an active parent account, is rate-limited, and cannot be read directly by an app client.
• The feedback limit is five submissions per account in a rolling hour. The diagnostic limit is 20 reports per account in a fixed hour. A separate, short-lived account counter enforces the diagnostic limit but is not copied to the stored report; diagnostic report rows contain no account, family, or device identifier.

Retention and deletion

This is our written retention schedule. Each row says why we keep the information, for how long, and what deletes it sooner. The paragraphs after the table say the same things in more detail.

You control your data. You can permanently delete a parent account from Settings → Delete account, or from the setup flow before a family has been created. Deletion removes feedback linked to the account, family membership, and access to Apparent. Every family the deleting parent created — including its children, tasks, rewards, grades, history, and connected-device access — is also deleted from the active service. If the account joined a family created by another parent, that family remains available to its creator and other active members; only the deleting account's membership and account-linked data are removed. Active-service deletion is immediate and cannot be undone through the app.

A child's optional note on a task submission is cleared the moment a parent decides on that submission — approving it, sending it back, or excusing it — because the note explains one submission at the moment a parent reviews it. A submission nobody decides on keeps its note for at most 90 days; hourly cleanup means deletion can occur up to about one hour after that point. Either way the note is kept for far less time than the task record it was attached to. The task and its status history remain; only the child-written text is removed.

A child's task and reward activity — status changes, completions, review submissions, and reward claims — is automatically deleted after it becomes 24 months old. That window covers two school years, so year-over-year views remain whole, and daily scheduling can add up to about one day at the boundary. Deleting the parent account removes it sooner.

A family that nobody has used for 12 months is deleted in full, including its children, tasks, rewards, grades, history, and connected-device access. This is the same deletion described above, performed on our side because data nobody has opened in a year is not data we should still be holding.

About a month before that, we try to email the parent, so the account can be kept simply by opening the app. We say "try" deliberately: email is filtered, forwarded and rewritten by services we do not control, and we have measured our own notices landing in spam. So the message is an attempt to reach you rather than a guarantee, and the deletion does not wait for it to succeed — if it did, an address that no longer works would keep a child's data here indefinitely, which is the opposite of what this section is for.

"Used" means both: no parent has signed in, and nothing in the family has changed. We check both deliberately. Staying signed in is normal — a parent who opens the app every day may not sign in again for months — so measuring sign-in alone would eventually delete families that are being used daily. Requiring both means we always delete later than this window, never earlier.

Optional feedback and first-party error reports are automatically deleted after they become 90 days old; hourly cleanup means deletion can occur up to about one hour after that point. Deleting the parent account removes its linked feedback sooner. New feedback email alerts contain no user content or account identifiers, so they do not create a second copy of the note.

A parent notification registration is active for 90 days after its latest successful signed-in refresh. Private daily cleanup then deactivates an expired registration and deletes its notification token after another 30 inactive days; daily scheduling can add up to about one day at each boundary. Signing out or deleting the account can deactivate or remove it sooner. Deleting the token does not require deleting the delivery outcome and its defined relationship to the family's notification history; that history follows the family/account deletion rules above. Arbitrary provider messages and response bodies are not stored in that outcome.

The separate per-account diagnostic rate-limit counter uses a fixed one-hour window. Its client-inaccessible row is eligible for scheduled deletion roughly 24 hours after the start of its last active window (hourly scheduling can add up to about one more hour), and account deletion removes it sooner.

A pending, privacy-scrubbed fatal-error record may remain in encrypted device storage until it can be uploaded after sign-in or cleared. The app discards it when it is more than 90 days old. Signing out or deleting the account also attempts to clear stored diagnostics on that device.

Supabase retains provider-managed request, authentication, and response-timing logs for a limited operational window. We configure those logs for the shortest production-plan window that supports security and reliability, do not export them to a log drain, and disable unnecessary duplicate database audit-log storage. These records are not used for advertising or behavioral analytics.

The published copies of this policy and our other notices, and the Apparent website, are served by GitHub Pages. Like any web host it keeps its own visitor request logs (IP address, time, and page requested) for its operational window. The site sets no cookies, runs no analytics, and stores nothing you type; we do not receive those logs or use them for any purpose.

Deleted data may remain temporarily in restricted routine database backups until those backups rotate, and account-email delivery records remain under the email provider's limited operational or legally required retention. Backup and provider-log copies are not available in ordinary app operations and are not used to reverse an account deletion.

Your choices

• Use Sign in with Apple to share less (Apple can hide your real email). When an Apple-authenticated parent deletes an account, Apparent requests a fresh Apple authorization, sends its one-time code only to an authenticated server function, verifies that the Apple identity belongs to the signed-in account, and revokes Apple access before deletion. Apparent does not retain Apple authorization codes or tokens. If Apple cleanup fails, deletion pauses for an explicit Delete anyway choice and shows manual Apple Account removal instructions.
• Decline or disable notifications (the app still works; you'll see review requests when you open it).
• Choose whether to send optional feedback; the form warns against including sensitive family details.
• Delete your account and active-service data at any time, as above.

Changes to this policy

If we make material changes, we will update this page and the effective date above. For children's information the rule is stricter, and it is stated under Children's privacy: if what a child's device sends ever changes materially, we show you a new notice in the app and ask for your permission again before anything new is collected. Updating this page is not a substitute for that.

Contact

Provider: Bear Audio LLC 10089 Quarry Hill Place, Parker, CO 80134, United States Telephone: +1 303-506-2129 Questions or requests: privacy@apparentfamily.com