Tovvle is a private family organiser — chores, a shared “wallet” of IOUs, shopping, calendar, appointments and a family-only feed. This policy explains what we store, why, and the choices you have. We built Tovvle privacy-first: your family’s data is isolated to your family, health notes are encrypted, and there are no advertising or analytics trackers.
Who we are
Tovvle is operated by RebelWorks (Nellina & Thomas Verdianz), based in Vienna, Austria — the data controller under the EU GDPR. Contact for privacy questions: privacy@tovvle.com.
What we store
- Family & member profiles — a family name, member display names and roles (parent / teen / child). A parent creates the family; children are sub-profiles. Children never register themselves.
- Household activity — chores, the virtual wallet (IOUs only — no real money is ever held, moved or processed), shopping lists, calendar events.
- Appointments & health — a coarse category (medical / dental / vision / vet / other) and a date. Any free-text note is encrypted on your device before it is stored; we cannot read it on our servers.
- Family feed — posts and comments shared within your family only.
- Account — the parent’s email address (for sign-in) and authentication data.
What we do not do
- No third-party analytics or advertising SDKs. No ad tracking, no profiling.
- No precise location, no biometrics.
- No selling or sharing of your data with third parties for their own purposes.
- No payment processing or fund custody — the wallet is a record of IOUs settled in cash, outside the app.
Where your data lives, and family isolation
Data is stored with our processor Supabase in the EU (Frankfurt, eu-central-1). Every record is tagged to your family, and database row-level security ensures a signed-in member can only ever read or write their own family’s data — never another family’s. Health and feed data are further restricted (parent-or-self).
Children’s data
Tovvle is adult-first. A parent sets up the family and adds children as sub-profiles under verifiable parental consent. In Austria the digital-consent age is 14. Health/medical data and any social-feed participation require separate, explicit parental consent, recorded in the app, and can be withdrawn at any time. Children’s data is processed only to run the family’s shared organiser.
Legal bases (GDPR Art. 6 & 9)
- Performance of the service you asked for (running your family organiser).
- Explicit consent for special-category data (health) and for children’s data.
- Our legitimate interest in keeping the service secure and working.
Your rights
- Access, correct or export your data.
- Delete your account in-app — this cascades to and removes your children’s data.
- Withdraw consent for health or feed data at any time.
- Complain to your data-protection authority (in Austria, the Datenschutzbehörde).
To exercise any right, email privacy@tovvle.com.
Retention
We keep your data while your family uses Tovvle. When you delete your account, your family’s data (including children’s) is removed.
Changes
We’ll update this page if our practices change, and note the date above.