Privacy policy
How My Challenge takes care of your family's data. Updated on November 1, 2026.
In short
What we keep
And for how long. "Until deletion" means until the account or the family is deleted.
| Data | What it is | For how long |
|---|---|---|
| Adult account | Nickname, username, emoji avatar, language and theme. The password is never kept: only an encrypted digest that cannot be undone. | Until deletion |
| Adult's e-mail | Optional, confirmed by a code. Used for a new password and for the support notices. | Until deletion |
| Kid account | Nickname, username, password (encrypted digest) and emoji avatar. | Until deletion |
| App use | Chores, points, rewards, trades, collections and math games. | Until deletion |
| Security | The devices that have logged in to the account (an encrypted code) and the login attempts, to block anyone guessing passwords. | Up to 400 days |
| Network address (IP) | In the access logs, for security only (abuse, limits, investigating an incident). In the counters, only encrypted. | 7 days |
| Technical logs | Server errors and warnings, to fix problems. | 30 days |
| Free trial request | The e-mail and language of whoever asked. | Until the answer, at most 30 days |
| Support cases | The messages and, if you allow it, device information (version, browser, screen, language and theme). | 12 months after closing |
| Backups | Copies of all of the above, to restore the service after a failure. | 35 days |
What we do not keep
- Photos and videos
- Location
- Full name and date of birth
- Documents and phone number
- Device contacts
- Payment details
What we use it for
- Making the app work: logging in, checking chores, adding points, redeeming rewards.
- Protecting the accounts: blocking password guessing and ending suspicious sessions.
- Sending the e-mails you asked for: confirmation code, new password, invite and support answer notice.
- Answering support and fixing problems.
We never use the data for ads, behavior profiles or to train third-party systems. The legal basis is providing the service you use and, for the kids, the parent's consent.
Who we share it with
Only with the services that make the app work, each with the minimum:
- Amazon Web Services (AWS): keeps the data in São Paulo, Brazil, with a backup copy in the United States.
- Amazon SES: sends the e-mails. It gets the address and the e-mail's text.
- Cloudflare Turnstile: the human check, only in the forms without an account (free trial and support). It gets technical data from the browser, not your data.
We do not sell or rent data. We only hand it to an authority when the law requires it.
Cookies
- Session: keeps you logged in, for up to 180 days or until you log out.
- Known device: tells the security checks that this device has logged in to the account before.
- Preferences: the language and the theme stay in the browser itself.
There are no advertising or analytics cookies. That is why this page does not ask you to accept cookies.
Children
My Challenge is made for families. Kids only get in with an account created by a parent, who is the one consenting to the use of their data.
- A kid is registered by nickname, with no e-mail or contact information.
- There is no chat between kids: between related families, they only trade collection items, with the adults watching.
- The app shows no ads and does not lead to other sites.
- The parent sees everything the kid does and can delete the kid's account at any time.
Your rights
Under the Brazilian data protection law (LGPD), you can:
- See and correct your data: in My account, or by asking support.
- Get a copy of the family's data: through support.
- Delete your account or the whole family: see Account deletion.
- Know who we share it with and withdraw consent, by deleting the account.
We answer through support within 15 days. You can also complain to the Brazilian data protection authority (ANPD).