Who we are
Pennykin helps a family keep a shared record of money it holds for a child or has promised to a child. Pennykin does not hold, move, invest or transfer money, and it does not connect to banks or cards.
This policy covers the Pennykin app for iPhone and iPad, the service behind it, this website, and messages you send to support. "We" means the operator named below.
To complete before publication: the operator's legal name, a monitored privacy email address, a mailing address and a telephone number. The children's privacy rules require them in this notice.
Information we collect
- Account information
- Your email address, which we use to send sign-in codes; the name you choose to show in the app; an account identifier; and whether you joined as a parent or guardian or as a kid 13 or older. We do not ask for a birth date.
- Family information
- The family you create or join, the parents and children in it, each person's role, and invitations: the invited email address and whether the invitation is waiting, accepted, declined or cancelled. We also record which parent manages each child's profile and data.
- Child profiles
- A child's first name or nickname and, if a parent picks one, a built-in animal avatar. A child profile does not need an email address. A child 13 or older can link their own sign-in email when a parent invites them. We never collect photos.
- Money records
- Amounts, dates, categories and optional descriptions of money in, money out and cash handed over; each child's balance; allowance schedules and the entries they add; records a child sends and the amount a parent confirms or changes; the reason a record was sent back; corrections and their history; whether an update was marked as read; and shortcuts saved for a child, each with a name, an amount and a category.
- On your device
- Your sign-in session, an encrypted copy of recent records, records waiting to be sent, app preferences and your parent PIN settings. If you turn on Face ID, Apple's system checks your face and tells the app only whether it matched. We never receive face data.
- Service and security information
- When your device connects to our service, our servers receive technical information such as your IP address, the time, the part of the service used and the result. Sign-in events are recorded for security while your account exists. The app also sends counts of which parts of the service worked, failed or were slow. These counts contain no names, email addresses, amounts, record text or device identifiers, and we store them only as totals per minute and per hour.
- Support messages
- Your email address and whatever you include when you write to us. Please don't send sign-in codes, PINs or a child's records.
We do not collect your location, contacts, photos, browsing history or advertising identifier.
How we use it
- Sign you in and keep your account and family connected.
- Show each child's balance and history to the people in the family who may see it.
- Add allowance on the schedule a parent sets, and handle confirmations, corrections, invitations and shortcuts.
- Check permissions, such as which parent manages a child's profile and data.
- Send sign-in codes and invitation emails.
- Keep the service secure and working, fix problems, and keep backups.
- Answer support and privacy requests.
We do not show ads, sell personal information, share it for targeted advertising, or use children's information to market to them. The app contains no advertising or third-party analytics code.
Children's privacy
Pennykin is used by families with children. A parent or guardian sets up the family and adds each child. Children under 13 cannot create their own account; they use Pennykin on a parent's device after a parent adds them. A child 13 or older can have their own sign-in and connect it to the family.
What we collect from children. A child can send a record of money they received or spent, with an amount, a category, an optional description and the date, and can mark updates as read. A child 13 or older with their own sign-in also gives us their email address and name. We use this only to keep the family's record and show it to the child and their parents. We do not show children ads, we do not ask them for more information than a record needs, and we do not share their information with anyone except the service providers above.
What a parent can do. A parent can see everything their child has sent, change amounts, and stop their child's use at any time by deleting the child's profile, which deletes all of its records (Delete [name]'s profile… on the child's profile). A parent can also email us to review or delete their child's information.
Before publication: a lawyer confirms how parents receive this notice and give verifiable consent before a child uses Pennykin, and the in-app wording that goes with it. Today a parent confirms they are the child's parent or legal guardian when adding the child.
Your choices
See and correct. You can see your information in the app. Parents can change any amount; the old amount stays in the record's history.
Delete your account. Open the account menu and choose Delete account…. The app shows what will be deleted and asks you to confirm once. If you created the family, the family and every child's records are deleted. If you are another parent, only your account is deleted and the family keeps its records. If you are a kid with your own sign-in, your profile and records are deleted.
Leave a family. A parent who did not create the family can leave it: account menu, Family members, Leave family…. They lose access to its children, and the family keeps its records.
Delete a child profile or a family. In Family members, open the child and choose Delete [name]'s profile…, or choose Delete family… if you created the family.
Ask us. If you can't use the app, email us to ask for a copy of your information or to delete it. We answer these requests wherever you live in the United States.
Before publication: set how we confirm who is asking, how quickly we answer, and how we handle a request about a family that several parents share.
How long we keep it
- Accounts, families and money records: as long as the account, child profile or family exists. When you delete them, they are removed from the live service right away, including your sign-in history.
- Backups: we make one encrypted backup a day and keep each for about 7 days, then it is deleted automatically. Information you delete stays in older backups until they expire, usually about 8 days later. If we ever restore a backup, we remove information deleted after that backup was made before the service reopens.
- Invitations: until they are accepted, declined, cancelled or expire, or the family is deleted.
- Server logs: kept in small files that are overwritten automatically as new entries arrive.
- Service monitoring: about 30 days. App diagnostic counts: up to 7 days by the minute and 30 days by the hour.
We keep children's information only while the family uses it for the record, and delete it as described above.
Before publication: choose how long support email is kept, confirm the restore procedure above, and have these periods reviewed as the written retention policy the children's privacy rules require.
Security
Connections are encrypted. The server checks every request against family roles before it reads or changes anything. The copy kept on your device is encrypted, and you can add a parent PIN and Face ID. Backups are encrypted and stored apart from the server, and the key that opens them is kept separately by the operator. Only the operator has administrative access to the service.
No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.
Before publication: write down the information security program the children's privacy rules require (who is responsible, a yearly risk review, safeguards and oversight of providers) and confirm each provider's controls.
This website
These pages have no sign-in, forms, ads, analytics, cookies or tracking scripts. They are hosted by Cloudflare, which receives what any website receives, such as your IP address and browser details, and handles it under its own privacy policy. We have not turned on Cloudflare's analytics for these pages.
Changes and contact
We will post changes here with a new date. If a change affects how we handle children's information, we will tell parents and ask for consent again where the law requires.
Contact to add before publication: the operator's name, privacy email address, mailing address and telephone number.
For help with the app, visit Pennykin Support.