Privacy Notice

Last updated: {{DATE}}

Pearls of Wisdom Developments Pty Ltd, an Australian company trading as Two Buckets ("we", "us"), is the data controller for personal information collected through this app and website. This notice explains what we collect, why, and your rights.

1. Information we collect - Account data: email, password (hashed), family name, family description, avatar, children's first names and ages you choose to add. - Usage data: activities you save, rate, and mark as tried; ratings and optional comments you leave. - Media you upload: photos and videos you add to your private Memories, plus optional captions and tags. If you tick "Share with the community" when uploading, the media is submitted for our review before other families can see it. - Device and technical data: app version, operating system, push notification token (if you enable reminders), IP address, crash logs. - Transaction data: the subscription plan, status and billing period for your account. Card details are collected and held by Paddle, never by us.

2. How we use it - Deliver the daily activity and personalise your experience. - Create and manage your account and subscription. - Send the 8am reminder if you opt in. - Moderate community-shared media before it appears to other users. - Diagnose crashes and improve the app. - Comply with legal, tax and accounting obligations.

Our legal bases are performance of our contract with you, your consent (for optional features such as push reminders and community sharing), our legitimate interests in running and improving the service, and compliance with law.

3. Children Two Buckets is used by parents and carers, not directly by children. Children's names and ages you enter are treated as sensitive family data, stored privately to your account, and never used for advertising or shared with third parties.

4. Who we share data with We do not sell your personal information. We share it with: - Paddle.com Market Ltd, our reseller and Merchant of Record, which processes payments, issues invoices and handles tax. Paddle receives your name, email, billing address and payment details and acts as an independent controller for that data ([Paddle's privacy policy](https://www.paddle.com/legal/privacy)). - Infrastructure and hosting providers that store the app's data and media, under confidentiality obligations. - Analytics and crash reporting providers, to keep the app working. - Other Two Buckets families — only for media you explicitly opted in to share and that we approved. - Authorities, where required by law.

Some of these providers are located outside Australia, including in the European Union and the United States. We take reasonable steps to ensure your information is protected to a comparable standard.

5. How long we keep it We keep account data for as long as your account is open, and for up to 12 months afterwards. Transaction records are kept for 7 years to meet Australian tax law. Deleted media is removed from live systems immediately and from backups within 30 days.

6. Security Data is encrypted in transit and at rest. Access is restricted to the people who need it to run the service.

7. Your rights You can, at any time: - Access, correct, export or delete your account from Account settings. - Withdraw a community-shared memory (deletes it from public view). - Turn off push notifications. - Withdraw consent where we rely on it. - Complain to the Office of the Australian Information Commissioner (oaic.gov.au), or your local supervisory authority if you are in the EU or UK.

8. Contact Pearls of Wisdom Developments Pty Ltd — privacy@twobuckets.co