The Piggy
Open the app
Privacy policy
The Piggy keeps as little about your family as it can. This page says what we keep, why, who can see it, how long we keep it, and how you can get a copy or delete it.
For kids: The Piggy knows your first name, your jobs and your money. It never shows you ads. Your mum, dad or carer can see your stuff. The people who run The Piggy only look if something needs fixing, and they have to write down why.
Who we are
The Piggy is run by Cummins Family Pty Ltd (ABN 66 164 374 172), an Australian company. In this policy "we" and "us" means Cummins Family Pty Ltd. You can email us any time at support@thepiggy.com.au, and a real person replies within 2 business days.
The privacy principles we follow
Small businesses like ours usually don't have to follow the Privacy Act 1988. We follow the Australian Privacy Principles anyway, by choice, and this policy is written to meet them. If a data breach ever happens, we'll handle it as if the Notifiable Data Breaches scheme applied to us (see Keeping it safe).
What we keep, and why
We only keep what The Piggy needs to count chores and pocket money and to keep your family's devices in sync.
About your kids
- Each child's first name and colour, their chores and what each one is worth, what they've earned and been paid, their goals, the rules you set, and the jobs and ideas they suggest.
- A name for each child's own device, such as "Ruby's iPad", which child it belongs to, the app version and when it was last used, so you can see and remove the devices you've set up.
- Kids don't have accounts. We never ask for a child's surname, birthday, photo, school or email address, and nothing about a child is kept outside your family's records.
About parents and carers
- Your email address and first name. You sign in with a code we email you, so there's no password. The others in your family see your first name, and the other parents and carers in it see your email address too.
- When you joined and last used The Piggy, and which families you're in.
- For each phone, tablet or computer you sign in on: a name for it (such as "iPhone"), the app version and when it was last used, so you can see your devices and sign one out.
- The parent PIN, which keeps kids out of the parent screens on a shared device. It's kept with your family's records.
- If someone invites you to their family by email, your email address, so the invite can reach you.
About your family
- The family name, whether it's set up and running, and any note you send us when asking to join (and our reply).
- Your family's records, and the last 20 earlier versions of them, so a mistake can be put right.
- Any change from a kid's device that The Piggy held back for a parent to check.
- While The Piggy isn't open to everyone, the email addresses we've said may sign up.
When you sign in
- To stop people guessing codes or flooding your inbox, we count the codes and wrong tries for each address. We keep that count under a scrambled form of your address (a keyed one way code), never the address itself, and keep the code only in scrambled form too.
- For each sign-in request: the device name and browser the asking device gave, and its rough location (city, region and country, from Cloudflare). The page the email's link opens shows you these before you tap Yes, so you can spot a request that isn't yours.
- To slow down attacks, we count tries from each network, for each family, and for each hour and day. A network is kept only as a scrambled code of a range of IP addresses, never the IP address itself.
Payments
- If you choose a plan, Stripe takes the payment. Stripe asks the paying parent for their email address and card, and Stripe keeps them. The Piggy never sees the full card number.
- Stripe keeps its record of your payments (the email address you gave it, the amounts and dates, and the card's type, last four digits and expiry date) in our Stripe account, where we can see it.
- We tell Stripe only your family's reference number. We keep Stripe's reference numbers for your family and its plan, which plan it is (monthly or yearly), its status and dates, and whether a discount applies, such as the friends and family code.
- If you type a code, we check it with Stripe. We never keep or log the code you typed.
- We note that your account has used its free month (reference numbers and dates only), so each account gets one.
Emails
- Our sign-in codes, invites and the app's other emails are sent by Cloudflare, which logs each email's address and subject (a sign-in code is in the subject).
- If you email us, we keep the conversation so we can help you. Your emails and our replies are kept in our support mailbox, which Google runs for us (see below).
Our own records of what we do
- A log of who did what and when, such as a family being approved or its records being opened, kept as reference numbers and reason codes only, never names, notes or records.
- Our service's error logs hold reference numbers, never names, email addresses or records.
On your devices
- The app keeps a copy of your family's records on each of your family's devices, so it works without the internet. It sets no cookies.
What we never do
- No ads, ever, for parents or kids.
- We never sell your family's data, and we never share it except with the companies that help us run The Piggy, below.
- The app loads nothing from other companies and has no analytics and no cookies, so there's no tracking in it. A child's device talks only to The Piggy.
- We don't use your family's records for marketing.
Who can see it
- Your family. The parents and carers in your family (up to 4) see all of your family's records. They also see each other's first names and email addresses. Each child sees their own screen, on their own device or on a shared one after tapping their name.
- Us, only to help. Your records are stored with Cloudflare and aren't end to end encrypted, so we can help when something goes wrong. Our support tool shows us family names, parents' first names and email addresses, devices and counts, but not your family's records. To open a family's records we have to type in why, and every look is recorded (who, when and which family). Even then the parent PIN stays hidden.
- The companies that help us run The Piggy, and only for that (below).
- Anyone the law makes us tell, such as a court with a legal order. We'd give only what the order requires.
Who helps us run The Piggy, and where your data goes
- Cloudflare, a United States company, hosts the app, this website and our service, stores your family's records and sends the app's emails. Cloudflare runs data centres around the world, so your data may be stored or handled outside Australia, including in the United States.
- Google, a United States company, runs our support mailbox (Google Workspace), where the emails you send us, our replies and any email we send you from it (such as a notice when something goes wrong) are kept. Google may keep them outside Australia, including in the United States.
- Stripe, also a United States company, takes payments. Stripe handles payment details in Australia and overseas, including the United States, and also uses them for its own purposes, such as stopping fraud, under its own privacy policy (stripe.com/privacy).
We give each of them only what they need to do their part.
How long we keep things
We delete things when The Piggy no longer needs them. These times come straight from the settings our service runs on.
| What | How long |
|---|---|
| Your family's records | While your family uses The Piggy. After the family is removed, 7 days, then deleted. |
| Earlier versions of your family's records | The last 20 saves, each replaced as new ones come in. A copy made when a backup is restored or a family starts over: 90 days. |
| A change held back for a parent to check | Until a parent decides, then 30 days. |
| A request to join that we decline | 30 days, then deleted. |
| Your account (your email address and first name) | Until you delete it, then 7 days, then deleted. |
| A kid's device | While it's set up. After you unlink it, its name and which child it was for stay with your family's records until the family is deleted. |
| A signed-in device | Until it's signed out, or not used for 180 days. Its record is deleted 30 days after that. |
| An invite | Open for 7 days. Deleted 30 days after it's used, declined, cancelled or runs out. |
| A sign-in code | Works once, for 10 minutes. The count of codes and tries for an address is deleted once 2 days pass with no code sent to it. |
| A sign-in request's device name, browser and rough location | 1 day. |
| A code for setting up a kid's device | 20 minutes at most. |
| Counts of tries from each network and for each family | 2 days at most. |
| Our log of who did what | 400 days. |
| Your family's plan, any free days we gave it, and a note of each email we sent about it | Deleted with your family. |
| The note that an account has used its free month | Kept, so each account gets only one. It holds reference numbers and dates, never a name or email address. |
| The messages Stripe sends us about a plan | Reference numbers and outcomes only, kept so we never act twice on one message. Deleted after 90 days. |
| Your full card number | Held only by Stripe, under Stripe's own policy. We never see it. |
| Stripe's record of your payments in our Stripe account | Kept after your family or account is deleted, for 5 years, because the law requires us to keep business records that long. |
| Cloudflare's log of the app's emails | As long as Cloudflare keeps its email logs. |
| Emails you send us, our replies and notices we email from our support mailbox | 2 years after the last message in the conversation, then deleted. |
| Our backups | Daily backups: 35 days. Monthly backups: about 13 months. |
| Cloudflare's own restore points for our database | Up to 30 days. |
| A family with no plan | Nothing is deleted when a plan stops. If there's no plan and no parent signs in for 24 months, we email the parent who set it up 30 and 7 days before, then remove the family and delete it as above. |
| An account that isn't in any family | Deleted after 12 months with no sign-in. |
| For the one family that moved from the first version of The Piggy: a standby copy of its records and a record of the move | Until the first version is switched off. Scrambled codes of the networks its old app used: 14 days. |
Getting a copy, fixing and deleting
See and fix
Your family's records are all in the app, and you can change them there. To see anything else we keep about you, or to fix something you can't change in the app, email us.
Get a copy
- A backup file: Admin, then Back up and restore. One file with your family's whole record, which The Piggy can restore.
- A readable copy: Admin, then Account, then Download a readable copy. A spreadsheet file (CSV) for each child, with their chores, payouts and goals, and one with your own details: your email address, first name, families and devices.
Delete your family
The parent who set up the family can remove it: Admin, then Family, then Remove this family. Every device stops syncing straight away. We keep the family for 7 days in case you change your mind (email us to bring it back), then delete it for good. Save a backup file first if you'd like to keep a copy.
Delete your account
Admin, then Account, then Delete my account. The app asks you to confirm, and to type a fresh code from your email. Then it signs you out everywhere, takes you out of every family you're in, and removes any family that only you run. If you set up a family that other parents are in, remove them (or the family) first.
For 7 days your account is only marked for deletion. If you change your mind, email support@thepiggy.com.au to stop it. After that we delete your account and email you to say it's done.
Deleting your account or your family doesn't delete the record of past payments in our Stripe account, which the law requires us to keep for 5 years (see How long we keep things).
Backups
Copies in our backups roll off by themselves: daily backups after 35 days and monthly ones after about 13 months. If we ever have to restore The Piggy from a backup, we delete again anything that had been deleted since that backup was taken.
Or just ask us
Email support@thepiggy.com.au for a copy, a fix or a deletion, and we'll do it for you, at no charge. We reply within 2 business days, check that the request comes from the email address on the account, and finish within 30 days.
Keeping it safe, and if something goes wrong
- Everything travels encrypted between your devices and The Piggy.
- There are no passwords to steal: you sign in with a code or link we email you, which works once and runs out quickly.
- The keys that keep a device signed in, and invite and sign-in links, are stored only in scrambled one way form.
- A family's records can be reached only from that family's own signed-in devices, and by us as described above.
- Only the people who run The Piggy can use our support tool, each with their own sign-in.
If we find that data about your family may have been accessed, lost or shown to the wrong person, we'll act straight away to stop it and limit the harm, and we'll work out within 30 days whether it could seriously harm anyone. If it could, we'll tell you and the Office of the Australian Information Commissioner (OAIC) as soon as we can, with what happened and what you can do. That's what the Notifiable Data Breaches scheme asks of the businesses it covers, and we hold ourselves to it.
This website
This website sets no cookies. Our home page counts visits with Cloudflare Web Analytics, which uses no cookies and doesn't follow you from site to site. The other pages on this website, and the app itself, have no analytics at all.
Questions and complaints
Email support@thepiggy.com.au first. A real person replies within 2 business days, and we aim to sort it out within 30 days. If you're not happy with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Changes to this policy
If we change this policy, we'll post the new version here with its date. If a change affects what we keep, why we keep it or who can see it, we'll email every parent and carer with an account at least 30 days before it takes effect.