Privacy Policy

§ 01The short version

This policy applies to Banked. for iPhone and iPad and is published by Rayyan Anwar.

§ 02Who this covers

Family mode

A parent or guardian pairs their device with a child's device. The parent sets rules; the child's device measures activity, applies Screen Time restrictions, and shows the minute balance. A Pro family can add a second parent, who joins the same family roster and can see and manage the children already in it.

The app stores the first names typed during setup and the child's device name so each screen can identify the right person and device. It does not ask for an email address, telephone number, birthday, or postal address.

Solo mode

Solo mode is for one person managing their own device. It requires no pairing, creates no family CloudKit record, exposes data to no parent or second person, and keeps its rules, activity, proofs, and minute ledger on that device. App Store purchases still go through Apple, as described in § 10.

§ 03What stays on each device

Banked. and its Screen Time extensions share an Apple App Group container on the device. Depending on the mode and features used, it can contain:

• The daily minute ledger: earned, spent, granted, carried over, and remaining minutes.
• Today's step count and flights climbed from Health.
• Counts for push-ups, squats, jumping jacks, and high knees.
• Results for made-bed and touch-grass proofs, but not the photographs themselves.
• Phone-down block details, including the selected or completed minutes and whether a live block was broken.
• Memory and math progress. Only those two game sources have daily earning caps.
• Task descriptions, requests, parent decisions, and direct minute adjustments.
• Earning rates, blackout windows, carry-over settings, and other family or solo rules.
• Opaque Screen Time app, category, and website tokens, plus summary counts.
• A salted digest of the parent's PIN, never the PIN digits.
• The latest location point, only when location sharing is available and switched on.
• Subscription entitlement and setup status.
• In family mode, the fact and date of parental consent, keyed to that child's pairing token.

Local data is covered by the device passcode and Apple's file protection. Deleting the app removes its local data and its Screen Time restrictions. Family-mode copies in CloudKit must also be deleted as described in § 12.

§ 04What syncs in family mode

This section does not apply to solo mode. In family mode, Banked. uses Apple's CloudKit public database to exchange a small set of family records between a child's device and each authorized parent device. The records are identified by a random pairing token generated in the app, not by an account or contact detail.

Apple processes these records under Apple's Privacy Policy. We operate no separate sync server or duplicate family database.

§ 05Health and activity data

With permission, Banked. reads exactly two Health quantities for the current day:

• Step count.
• Flights climbed.

The app requests read access only. Its bundle declares a Health write usage description, but its authorization request contains no write types and the app never writes to Health. It does not read mindful minutes, Apple Exercise Time, heart rate, sleep, weight, cycle data, clinical records, or any other Health category.

In solo mode, the two daily totals stay on the device. In family mode, they form part of the daily ledger synced to the authorized parent devices through CloudKit. They are not used for advertising, sold, or sent to any developer-operated server.

Health permission can be revoked in the Health app under Profile › Apps & Services. Revoking it stops new Health activity from being counted; other earning methods remain available.

§ 06Location sharing

Family mode can optionally share a child's location with their authorized parent devices. It is off by default, requires iOS permission on the child's device, and can be switched off or revoked there at any time. Solo mode does not share a location with another person.

• The app stores one most-recent point: latitude, longitude, accuracy, and timestamp.
• There is no route or location history. Each new point replaces the previous point.
• Updates are based on significant movement rather than continuous tracking.
• The latest point is visible to every authorized parent in that family.
• Location sharing is unavailable when Apple's App Store storefront reports India.

A family rule can require location sharing before new minutes are earned. The child still controls the system permission, already-earned minutes are not removed, and the rest of the app continues to work. Switching sharing off or revoking permission clears the stored point.

§ 07Screen Time data and app tokens

Banked. uses Apple's Family Controls, Managed Settings, and Device Activity frameworks. When someone chooses apps, categories, or websites to manage, iOS gives the app opaque tokens rather than readable app or website names.

• We cannot read which specific apps, categories, or websites the tokens represent.
• We cannot see content, searches, messages, or actions inside another app.
• A token is meaningful only to Apple's framework on the device that created it.
• Parent dashboards therefore receive summary counts, not a readable app list.
• Apple's sealed activity-report extension renders usage information without handing the underlying report to us.

§ 08Camera, pose detection, photos and AR

Camera access supports four separate features. Each runs on the device. The live camera feed, photographs, body-pose observations, and AR room map are not uploaded to us or put into CloudKit.

1. Pairing QR codes

Live frames are scanned for a Banked. pairing or parent-invite code. The decoded token is used to pair; the frames are discarded. A code can be typed instead.

2. On-device pose detection

For push-ups, squats, jumping jacks, and high knees, Apple's Vision framework derives temporary body-joint positions from live frames and counts completed repetitions. No recording, frame, face template, or body model is retained. The repetition count and resulting minutes are what survive in the ledger.

3. Made-bed and touch-grass proof

The app captures a before-and-after image for made-bed proof or one image for touch-grass proof, judges it on the device, and discards it. Only the proof result, count, and resulting minutes survive. Banked. does not request Photo Library access, does not save these images to the camera roll, and never uploads them.

4. Phone-down surface detection

Phone-down uses ARKit world tracking and horizontal-plane detection to identify a flat nearby surface before a block begins. During that setup, ARKit processes camera frames, device motion, anchors, and a temporary map of detected surfaces. Once the block starts, the camera and AR session stop and motion sensing watches whether the device remains down. The frames, anchors, and room map are discarded and never saved or synced. The app records only the block's minutes and whether it was broken.

The microphone is not used for any of these features. Camera access can be revoked in iOS Settings; camera-based earning features will then be unavailable.

§ 09What we never collect

Outside the limited processing described above, Banked. does not collect:

• Email addresses, telephone numbers, birthdays, or postal addresses.
• Contacts, messages, calendars, or the contents of the Photo Library.
• Health data beyond the two daily totals in § 05.
• A location route or history; only the optional latest point in § 06.
• Browsing history, search history, or text entered inside another app.
• Microphone audio, voice recordings, face recognition data, or identity templates.
• Advertising identifiers or a profile for advertising.
• Third-party analytics, attribution, session-replay, or crash-reporting SDK data.

We do not sell personal information or share it for cross-context behavioral advertising. App data goes only where a feature requires: local device storage, the family CloudKit records in paired mode, and Apple's purchase or notification systems. Camera and AR inputs described in § 08 remain on the device.

§ 10Subscriptions and notifications

Subscriptions

Apple handles every App Store purchase. We never receive or store a card number, billing address, or Apple Account password. The app receives verified entitlement information such as the product, status, purchase date, renewal state, and expiry date so it can unlock the purchased features. Apple may provide aggregate App Store sales reports that do not identify individual buyers.

Push notifications

Parent devices register with Apple Push Notification service (APNs) so CloudKit can silently wake the app when a family request changes. Apple issues an APNs device token; the app receives it for registration but does not save it in a family record or send it to a server of ours. After syncing, the app may create a local notification describing the request. Notification permission can be changed in iOS Settings at any time.

§ 11Children's privacy and consent

In family mode, a parent or guardian initiates setup and sees a plain-language data notice before a child can be paired. When the parent agrees, the app stores the fact and date of consent on the parent device, keyed to that child's random pairing token. It records no signature or contact information. Each new child gets a separate consent record, and deleting that child removes it.

A child creates no Banked. account and has no public profile. Their family record can include the name entered by the parent, device name, the two Health totals, earning and proof results, minute ledger, task notes, Screen Time status, and an optional latest location. Camera photographs and live frames are processed as described in § 08 and are never uploaded or retained.

The parent can review this information, withdraw permissions, unpair a device, or delete the child's stored family data. For help with a child's data, contact the named person in § 17.

§ 12Keeping and deleting data

• Solo data remains on the device until solo mode is left or the app is deleted.
• Family device data remains while the app is installed, subject to daily ledger rollover.
• Family CloudKit records can remain after unpairing so the child can be paired again with the same rules. The child device deletes the CloudKit record it created when it next receives the release. Permanently deleting the released child from the parent dashboard requests deletion of the parent-created record and removes the local consent record.
• Location is replaced by the next point and deleted when sharing is switched off or becomes unavailable.
• Camera frames, proof photographs, pose observations, and AR maps are discarded after the relevant on-device check or session.
• Phone-down state is kept while a block runs. Completed minutes enter the current daily ledger; a broken block earns zero.
• Retired earning fields for reading, practice, chores, exercise, and mindful minutes may still exist in ledgers written by older versions. Current versions do not offer, read, or add to those sources. Daily rollover clears their old values, and deleting the data removes the fields with the rest of the ledger.
• Legacy session data is removed when a current version performs its migration. Current versions create no session history.
• Support email is kept only as long as needed to answer and document the request.

To erase family data completely, release the child, let the child device reconnect once so it can erase the record it owns, permanently delete that child from the parent dashboard, and delete the app from the devices. CloudKit can reject one device's attempt to delete a record created by the other; if the other device cannot reconnect, contact us for deletion help; do not include the full pairing token in the first email. To erase solo data, leave solo mode and delete the app. Subscription cancellation is a separate App Store action.

§ 13Security

iOS file protection and the device passcode protect local data. Apple encrypts data in transit to and from CloudKit. Parent PIN digits are never stored; only a salted SHA-256 digest is kept and synced.

We run no server of our own, so there is no separate database of ours to breach. Your data does sit in our CloudKit container, which Apple hosts and secures. The practical protections are the device passcode, Apple Account security, and secrecy of pairing tokens: anyone holding that token can read the record it keys.

Use passcodes on every paired device, enable two-factor authentication for Apple Accounts, and do not send pairing codes through channels you do not trust.

§ 14Service providers and this website

The app relies on Apple for HealthKit, Screen Time and Family Controls, on-device Vision and ARKit processing, CloudKit sync, APNs notifications, App Store distribution, and payments. There are no advertising, analytics, attribution, or third-party crash-reporting SDKs in the app.

These legal pages are hosted by Railway. Visiting them sends ordinary connection information, such as an IP address, browser details, requested path, and timestamp, to Railway and the web server for delivery and security logging. The site sets no analytics or advertising cookies and loads no third-party fonts or trackers. Railway describes its handling in its Privacy Policy. Website request logs do not contain the family records held in CloudKit.

§ 15Your privacy rights

Depending on where you live and whether a law applies, you may have rights to know, access, correct, export, or delete personal data; withdraw consent; restrict or object to processing; and complain to a regulator. Relevant laws can include the California Consumer Privacy Act as amended by the CPRA, the EU or UK GDPR, and India's Digital Personal Data Protection Act, 2023. We do not sell personal information, so there is no sale to opt out of.

The fastest route is in the app: open Settings › Your data to see what is collected, where it goes, how long it is kept, and the controls that erase it. You can also revoke Health, Camera, Location, Screen Time, and Notification permissions in iOS Settings.

For access, deletion, correction, consent, or complaint requests, contact Rayyan Anwar at rayyan.zahid.anwar@gmail.com. We may need enough information to match a request to a pairing token without collecting a new identity record. We reply within 30 days.

§ 16Changes to this policy

The version and revision date at the top change whenever this policy changes. If a change materially affects how personal data is handled, we will provide notice in the app before it takes effect when reasonably possible.

§ 17Data-protection contact

Rayyan Anwar is the data-protection contact for Banked.. Send privacy questions, complaints, consent withdrawals, and data requests to rayyan.zahid.anwar@gmail.com. We reply within 30 days.

The rules for using the app are in the Terms of Service, and day-to-day help is on the Support page.