Privacy Policy

Who is responsible

Karma (karma.workshopai.lt) is a family chores-and-points app. The controller — the one responsible for your data — is Augustinas Keturakis. For anything about your data, write to keturakis.augustinas@gmail.com.

What we store

• Parent account. Name, email address and Google account ID, taken from your Google account when you sign in with Google (we ask only for “openid email profile”). If another parent invited you: the email address they typed. Some older accounts sign in with a password instead — we keep only a salted hash of it, never the password.
• Children’s profiles. A parent creates each one. We store a name (a first name or nickname is enough), a password hash if the parent set one, and — only if given — the child’s Google email address and account ID.
• What the family enters. Chores, prizes, the points history (what was earned or spent, when, and who entered it), wishes children write down, the family name, language and the family’s sign-in code.
• Technical. The cookies listed below, and the web server’s log: IP address, time, page requested and browser name.

We do not ask for surnames, birth dates, addresses, phone numbers, photos or location. There are no analytics or advertising trackers.

Why, and on what legal basis

• To provide the service you asked for: sign you in, keep the family’s lists and points, and show them to that family’s members (GDPR Art. 6(1)(b), contract).
• To keep the service secure and working: logs and limiting sign-in attempts (Art. 6(1)(f), legitimate interest).

We do not sell data, send marketing, build profiles or make automated decisions about anyone.

Children

Karma is for families, not for children on their own. Only a parent creates a family and the children’s profiles in it; by doing so you confirm you are that child’s parent or legal guardian.

A child’s profile holds as little as possible: a name, points and what the child writes down. Only that child and the parents of the family can see it — not other families, not the public.

A parent can view, download and delete a child’s data at any time (the “Your data” section on the parent screen). A child who wants something changed or deleted should ask a parent; a parent can also write to us.

In Lithuania a child can consent to online services alone only from age 14. That is why under-14s do not sign up themselves: everything runs under a parent’s account.

Who sees it, and who we share it with

• Only the members of a family see that family’s data. Other families cannot.
• Hosting: the data is kept on a server in Helsinki, Finland (inside the EU), provided by Hetzner Online GmbH.
• Google: when you press “Sign in with Google”, Google tells us your name, email and account ID. Google’s own privacy policy covers your Google account; we send Google nothing about your family.
• Authorities, only where the law requires it.

Cookies

Karma sets only the cookies it needs to work. There are no tracking or advertising cookies, so there is no consent banner.

• karma_session — keeps you signed in. 6 months, or until you sign out.
• karma_accounts — lets one device switch between accounts (for example a child with two homes). Up to 4 sign-in keys; 6 months; an account is removed when you sign out of it.
• karma_oauth — only while you sign in with Google. 10 minutes.
• NEXT_LOCALE — remembers the language of the page you opened last. Removed when you close the browser.

How long we keep it

• As long as the family account exists. When a parent deletes a child or the whole family, the data is removed from the live database immediately.
• Server backups, when taken, are overwritten within about 6 months.
• Web server logs: about 2 weeks.
• Sign-in sessions last 6 months, and stop working at once when the person is deleted.

Your rights

You can ask to see your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. The main ones you can do yourself in the “Your data” section of the parent screen: download the family’s data (JSON), delete a child, delete the whole family, or leave a family you are a parent in.

For anything else write to keturakis.augustinas@gmail.com; we answer within one month. You may also complain to a data protection authority — in Lithuania the State Data Protection Inspectorate (VDAI): vdai.lrv.lt, ada@ada.lt — or the authority in your own country.

Security

Connections use HTTPS. Passwords are stored only as salted scrypt hashes. Sign-in cookies are signed and HTTP-only. Access to the server is limited to those who run Karma. No system is perfectly secure; if a breach puts you at risk we will tell you and the authority, as the law requires.

Changes

When this policy changes, the date at the top is updated; for changes that matter we will let you know.