My Values — Privacy Notice
App: My Values · Publisher: Purposeful Security Pty Ltd · ABN 36 677 972 039 · Contact: hello@pursec.com.au
Effective 3 July 2026 · Last updated 1 August 2026 · Version 1.6. This notice supplements the Purposeful Security Privacy Policy and should be read with it. The multi-adult family provisions in this notice apply once family sharing is enabled for your family.
1. Who this is for
My Values is used by a parent or guardian ("you"), who holds an account. The app helps you set tasks, track how your children are going against those tasks, and manage a simple virtual pocket-money model (spend / save / give). Children do not have their own accounts.
A family can include more than one adult. The adult who creates the family is its owner. Owners can invite other parents or caregivers using a one-time invite code, decide which adult manages each child's records, and manage family settings. Each adult signs in with their own account and accepts these terms for themselves — we record each adult's consent separately.
When an owner adds a child or invites another adult, the owner confirms they are the child's parent or guardian (or have that person's authority) and consent to us handling that information as described here. Each adult is responsible for their own use of the app.
Lawful basis. We collect and handle this information on the basis of consent (of the parent or guardian) and to provide the service you have asked for. You may withdraw your consent at any time by deleting your account (see Section 7).
2. What we collect
About you (the account-holder)
- your email address and password — used to sign in. Passwords are handled by our authentication provider and stored only in hashed form, never by us in plain text. You may instead sign in with Google/Apple, in which case Google/Apple confirms your email address to us; we do not receive your password;
- your family name or label, contact email, and preferences (reminder day and time, currency, and your country/region, which we use to show the right local support helplines and partner organisations);
- a record of your consent.
Family invitations
When an owner invites another adult, the app creates a one-time invite code, which the owner shares directly — for example in person, over their own messaging app, or as a QR code the other adult scans. We do not ask for, collect, or store any contact information about the person being invited. The owner may add a short nickname (such as "Nani" or "Sam") to label the invitation in their own pending list; this label is visible only to the family's owners and is deleted with the invitation. Invitations expire after 14 days, can be used only once, and can be withdrawn by the owner at any time. We store the invite code only in hashed form, so it cannot be read back even by us.
About your child (entered by you)
- the child's name — a first name or nickname is sufficient;
- the month and year of birth — we deliberately do not collect the day of birth, only month and year, used to show age-appropriate tasks;
- task and attribute performance — how tasks are going over time;
- a virtual pocket-money ledger — spend / save / give amounts, rewards, and any notes you add. These are in-app numbers only and do not represent real money; the app does not process payments or hold funds.
When you use the Advisor (optional AI feature)
- The Advisor lets you ask questions about parenting, child wellbeing, values, and co-parenting. We collect the question you type and the AI-generated answer and store the conversation.
- Before your question leaves our database, we automatically remove your, your family's, and your children's names. The de-identified question is then sent to our AI providers (see Section 4) to generate an answer.
- If you give feedback on an answer (a thumbs up/down and an optional reason), we store that feedback.
- Advisor conversations are reviewed by Purposeful Security staff to monitor quality and safety and to improve the service.
- Your Advisor questions and answers are visible only to you. Other adults in your family cannot read them. Any usage limit on the Advisor is shared across the family.
The Advisor is optional — the rest of the app works without it.
When you send feedback
If you use the in-app "Send feedback" option, we collect the category and the note you write, together with the screen, platform, and app language at the time, so we can act on it. Please don't include sensitive personal details in free-text feedback.
Automatically
Basic technical information needed to run the app (for example, authentication session data and push-notification tokens if you enable reminders).
What we do not collect
We do not collect:
- photographs of your child (avatars are generated graphics);
- audio recordings of your child's voice;
- your or your child's precise location;
- the device advertising identifier (IDFA on iOS, AAID on Android) — we have disabled the SDK access to it;
- third-party analytics, advertising, or crash-reporting telemetry. The app contains no analytics, advertising, or crash-reporting SDKs.
Biometric unlock, if you enable it, is handled entirely on your device by the platform (iOS Keychain / Face ID; Android BiometricPrompt). We never receive your biometric data.
3. How we use it
We use this information only to:
- provide the app's features (tasks, performance tracking, virtual pocket-money model);
- answer your Advisor questions and show you relevant local support contacts;
- send the reminders you ask for;
- secure your account and prevent misuse;
- review Advisor conversations and act on the feedback you send, to keep the service safe and improve it; and
- maintain and improve the app using aggregated, de-identified information.
We do not sell your or your child's information, and we do not use it for advertising or profiling beyond the app's own features.
Sharing within your family. Adults in the same family can see the family's shared records: each child's values, tasks, assessments, rewards, and virtual pocket-money history. Each child's records are written by one designated adult; other adults can view but not change them. Your Advisor conversations are not shared (see Section 2).
AI and automated decision-making
The Advisor uses artificial intelligence to generate answers. The Advisor is informational only — it does not make decisions about you or your children, and its outputs do not have legal or similarly significant effects on you. A human at Purposeful Security reviews Advisor conversations as described above. The Advisor is not a substitute for professional advice on parenting, child welfare, or mental health.
4. Who we share it with
We use a small number of service providers to run the app:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and storage | Australia (Sydney) |
| Resend | Delivers account emails (sign-up confirmation, password reset) | United States |
| Sign-in (if you choose Google sign-in) | United States | |
| Apple | Sign-in (if you choose Apple sign-in) | United States |
| Anthropic | Generates Advisor answers (de-identified question only) | United States |
| OpenAI | Routes Advisor questions to the right content (de-identified question only) | United States |
We send the AI providers (Anthropic, OpenAI) only your de-identified question — your, your family's, and your children's names are removed first. These providers process data on our behalf under their terms. Resend receives only your email address and the message being delivered (such as a one-time verification code) and keeps short-term delivery logs; it never receives your family's or children's records. We do not otherwise disclose your or your child's information except where required by law.
5. Overseas disclosure
Your and your child's information is stored by Supabase on infrastructure located in Australia. Some limited information is disclosed overseas: if you use the Advisor, your de-identified question is processed by our AI providers (Anthropic and OpenAI) in the United States; account emails are delivered by Resend in the United States; and if you choose Google or Apple sign-in, that sign-in is handled in the United States. Where we disclose information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.
6. How long we keep it
- Your children's task history and virtual pocket-money entries are retained for 12 weeks, then automatically removed.
- Account and family information is kept while your account is active.
- Pending family invitations (including any nickname label the owner typed) are kept until accepted, withdrawn, or for 14 days, whichever comes first. They contain no contact details of the invited person.
- Advisor conversations and the feedback you send are kept while your account is active for quality and safety review. They are deleted on deletion of your account or retained for a maximum of 12 months.
- When you delete your account, or on request, we delete your and your child's personal information within 30 days, except where we must retain limited records to meet a legal obligation.
See our Data Retention and Disposal Policy for detail.
7. Your choices and rights
- Access and correction: you can view and edit your family's information in the app, or contact us at hello@pursec.com.au.
- Delete a child's profile: you can delete an individual child's profile from within the app. Associated tasks and pocket-money entries are deleted at the same time.
- Delete your account ("right to be forgotten"): you can delete your account at any time from within the app (Settings → Delete account). What deletion removes depends on your role in the family:
- If you are the only adult in your family, deleting your account permanently deletes the whole family — every child's records and history, and your login — within 30 days.
- If your family has other adults, deleting your account removes your login and your personal data (including your Advisor questions and feedback) and removes you from the family. The family's shared records — the children's values, history and rewards — remain with the family, and any children you managed pass to the remaining owner(s) to manage.
- If you are the family's only owner and other adults remain, we first ask you to remove them or make another adult a co-owner, so a family is never deleted out from under its members.
- Notifications: you can turn reminders off at any time in the app or your device settings.
- Withdraw consent: because we rely on consent to handle your child's information, you can withdraw your consent by deleting your account. Where you are the only adult, this deletes your child's information; where other adults remain, their consent continues to cover the family's shared records. Withdrawing consent will not affect anything we have already lawfully done with the information.
8. Children's privacy
My Values is designed to be operated by parents and guardians. We collect the minimum information about children needed for the app to work — that is:
- a first name or nickname;
- month and year of birth (never the day);
- in-app task and virtual pocket-money records.
We commit to the following with respect to children's information:
- we do not market to children;
- we do not profile children for behavioural advertising;
- we do not use children's information for any purpose other than providing the service you have asked for;
- we do not share children's information with third parties except the sub-processors listed in Section 4, who act on our behalf (adults you invite into your own family are not third parties — see Section 3);
- we do not knowingly allow children to create their own accounts or to provide information to us directly.
Once the Australian Children's Online Privacy Code is in force (expected by 10 December 2026), we will update this section to reflect any further specific commitments required of us.
9. Security
We protect your information with encryption in transit and at rest, access controls, and the security practices described in our master Privacy Policy. As a security company, protecting this data is central to how we work.
Data breach notification
If a data breach occurs that is likely to result in serious harm to you or your child, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
10. Changes to this notice, complaints and contact
Changes
If we make a material change to this notice (for example, a new category of information, a new sub-processor, or a change to overseas disclosure), we will notify you in the app and by email at least 14 days before the change takes effect. Minor wording changes are reflected by updating the Last updated date at the top of this notice.
Complaints and contact
Questions or complaints: hello@pursec.com.au. We will acknowledge your complaint within 5 business days and aim to substantively respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.