Fondwise ("we", "us", "the Service") is a family finance and chores app: parents create an account, set up their children's profiles, and the whole family uses the app together — parents on their own devices, children on shared or paired devices using a PIN.
Children never create their own account, never provide an email address, and never enter personal information directly. Every piece of information about a child in Fondwise — their name, an optional birth year, their avatar, their PIN — is entered by the parent during account setup, on the parent's own account. Children access the app afterward using a short numeric PIN chosen by the parent; no separate registration, no personal contact information, no account of their own. This is a deliberate design choice, not an afterthought: it keeps children out of the data-collection relationship entirely — the relationship is between us and the parent, on the child's behalf.
We do not use third-party analytics or advertising trackers in the app.
Each family's data lives in its own isolated database file, physically separate from every other family's data — not a shared database with a "family ID" column. This is a deliberate architecture choice to make cross-family data leaks structurally harder, not just access-controlled.
Current limitation, disclosed honestly: at this stage, per-family databases are not yet encrypted at rest on our servers (encryption-at-rest is planned — see our development roadmap). Data is protected by server access controls and hashed credentials, but if you require encryption-at-rest as a hard requirement today, please contact us before relying on the Service for sensitive use.
Subscription payments are processed by Stripe. We never receive or store your full card number — Stripe handles that under its own privacy policy and PCI-compliant infrastructure. We do store the minimum billing state needed to know whether your family's subscription is active (e.g. plan status, trial end date).
You can export a complete copy of your family's data at any time from Parent Mode → Settings (a downloadable archive of every record associated with your account), and you can permanently erase your family's data at any time using the same screen. Erasure is irreversible and removes all children's profiles, activity history, and balances associated with your account. If you'd rather we do it for you, or you're unable to access the app, contact us at the address below and we will process the request.
We retain your family's data for as long as your account is active, plus a limited backup retention window for disaster-recovery purposes. Erasing your data via Settings removes it from active use immediately; backups are pruned on a rolling schedule and are not indefinite.
Fondwise is designed for use by parents, on behalf of their children — not for direct use or account creation by children under 13 (or the relevant age of digital consent in your jurisdiction). We do not knowingly collect personal information directly from a child; all such information is provided by, and remains under the control of, the parent account holder, who may review, correct, or delete it at any time as described above.
If we make material changes to this policy, we will update the "last updated" date above and, where required, notify account holders by email.
Questions about this policy or a data request: [CONTACT EMAIL — fill in before publishing].