Your family data is not our punchline.

Account and household information

We store the parent email address and account identifiers, household name, children's first names or nicknames, optional voice-reference choices, characters, routines, schedules, time zone, widget settings, checkmark history, and paired-device records. Restricted display sessions and technical session information keep devices connected to the correct household. Children do not need email addresses or passwords.

We use this information to show routines, synchronize progress, play selected prerecorded reminders, personalize characters and displays, protect accounts, and provide support. We do not sell family data. The public Android release has no advertising. Please avoid entering passwords, payment details, or other sensitive information in routine, widget, and feedback text.

Legal bases for UK users

We rely on our contract with the parent to provide parent account access and household subscription services. We rely on our legitimate interests in providing a parent-managed family routine service to use child profiles, routines, checkmark history and paired-display records. We also rely on our legitimate interests in securing the service and preventing misuse to use the limited account and technical information needed for those purposes. We rely on consent for optional launch emails and optional analytics and advertising on our public marketing homepage. You can unsubscribe from those emails or change your cookie choice at any time.

Optional weather

Weather forecasts currently cover supported U.S. locations only. Local forecasts outside the United States are not supported. You can use Cheeky without adding weather.

Weather is optional and configured by a parent. You can choose any supported forecast city or ZIP, including ZIP+4; it does not have to be where you live or currently are. We send the chosen forecast place to OpenStreetMap's Nominatim service and forecast coordinates to the U.S. National Weather Service. We store the chosen place and its returned latitude and longitude with the household weather setting. Those coordinates can identify a finer forecast place than a city center. We do not request your device's GPS location or use the choice to determine your family's whereabouts. Please enter a city or postal code, not a home address.

Messages and feedback

A child can optionally choose a preset completion message for the household's parent view. There is no free-text chat, recording upload, or messaging outside the household. We keep message identifiers and delivery and dismissal times with routine history to prevent duplicate sends. The inbox shows undismissed messages from the last 30 days; dismissing a message hides it rather than erasing that history.

When you send feedback, we receive your message, category, optional rating, app version and platform, together with your account and household identifiers. We use it to respond, diagnose problems and improve the product. Please do not include passwords or sensitive family information in feedback or screenshots.

Subscriptions

Apple handles App Store payments and Google handles Google Play payments; we do not receive your payment-card details. We store purchase references, subscription status and the account and household association to verify access, restore purchases, and prevent one purchase being reassigned to another household. Cancelling payment does not delete household information. Deleting a Cheeky account does not cancel a store subscription. Cancel renewal in the store used for your purchase.

On Android, Google Play Billing processes subscription transactions and sends technical diagnostics to Google when the parent app connects to Google Play. These diagnostics include billing results, app version information and a billing-session identifier, and help Google improve billing reliability and investigate errors. This is separate from advertising. Cheeky receives purchase references, subscription status and expiry to verify household access, but does not receive your payment-card details.

Android release and earlier ad tests

The public Android release uses a household subscription and has no advertising or ongoing ad-supported Free tier. It does not include Google Mobile Ads or Google's advertising-consent SDK, request ads, or collect an advertising ID. Subscription choices and purchases stay in Parent Mode; paired child displays have no ads, upgrade prompts or purchase controls. We do not ask for a birthday in this subscription-only release.

Earlier private Android test builds included Google AdMob banners on parent screens and optional rewarded ads for routine access. That test functionality is excluded from the public subscription-only release. The following advertising information applies to those earlier test builds, including ads labelled Test Ad.

AdMob processes network information, including an IP address that can indicate approximate location, ad interactions and diagnostic information. Its SDK can also process device or app identifiers. Our Android configuration removes advertising-ID permissions, requests non-personalized ads and applies child-directed treatment and a G-rated ad-content limit to every ad request. These restrictions do not mean that Google collects no data. We do not send children's names, routines or checkmark history as ad targeting information.

When you choose a routine reward, an opaque verification identifier links Google's completion callback to the requested household reward. We retain the verified transaction reference and reward result to prevent duplicate grants. This is separate from subscription payments. Where Google requires privacy choices, the app provides them before requesting ads and makes required privacy options available. Learn about Google's processing in its privacy policy and information for apps that use Google services.

Services that help us operate

We require third parties that process personal information for Cheeky Checkmarks to protect it in a manner consistent with this privacy policy and applicable law.

Supabase provides authentication, database storage and synchronization. Cloudflare provides web delivery, protected audio delivery and abuse protection. Resend delivers account messages. These services process information needed to operate and secure their services, including request and network information. Resend also processes email-delivery activity, including source and destination information, for its own service operations, security and improvement. Weather searches and forecasts use the services described above.

If you choose Google or Apple sign-in, that provider verifies your identity and shares an account identifier and email address with Supabase. Google may also share basic profile details. Apple can supply a private relay email. Cheeky does not receive your Google or Apple password or request access to your contacts or files.

Where information is processed

Our household database is hosted in the United States. The services listed in this notice may process information in other countries, including outside your country of residence. Using Cheeky from Canada, the United Kingdom, Australia or New Zealand does not mean your information is stored in that country.

For personal information they process on our behalf, Supabase, Cloudflare and Resend provide contractual safeguards for transfers from the United Kingdom through their standard data processing agreements. These include the UK Addendum to the Standard Contractual Clauses where applicable. These safeguards relate to their processing for Cheeky; their own uses of information are described in their privacy notices.

HeyCatch processes consented homepage analytics on our behalf under its Data Processing Addendum, which applies automatically to SDK customers. For applicable UK international transfers, that agreement incorporates the Standard Contractual Clauses with the UK Addendum.

Optional launch emails

Parents and guardians can separately ask for a launch email. We use EmailOctopus to collect your email address, selected phone platform and consent, confirm your address, and send the launch notification. Choosing Both means one launch email for each platform. Signing up does not create a Cheeky account or require a payment, and this form does not ask for information about your children.

EmailOctopus processes signup, confirmation, delivery and unsubscribe records on our behalf. We keep the information needed to manage your request and respect your email choices. You can unsubscribe from launch emails or contact sendhelp@cheekycheckmarks.com to ask us to remove your signup information. We may retain a limited record of an unsubscribe so we do not send you further launch emails.

The signup form uses Google reCAPTCHA to reduce automated submissions. Google processes browser and network information and uses a necessary cookie for this protection. See Google's Privacy Policy and Terms of Service.

Earlier access requests

Our earlier access-request form asked for an adult's first name, email address, a short description of their routine, and confirmation that they are an adult with an Android device. Requests go to our inbox for review and a reply; they do not create an account or add you to a marketing list. Do not include children's names or sensitive information.

Cloudflare Turnstile screens automated submissions using browser and device signals. Temporary rate limits use hashed network and email identifiers to reduce spam. The request service does not keep a separate request database or log your message. Contact us to request removal of an access request from our inbox.

Parent control and deletion

A parent or guardian manages the household, can edit its information, disconnect paired displays, and request deletion inside the app or through our account-deletion page. We verify requests to protect household information. Contact us to request a copy of your information or help correcting it.

Account deletion removes the applicable account and household data, including routine and message history, through our deletion process. Limited purchase references remain to enforce the original purchase association and prevent fraudulent reassignment. Encrypted deletion suppression records may remain for up to seven days to prevent deleted households being accidentally restored. Backup copies expire through the applicable backup retention cycle; they are not live app records.

Disconnecting a display blocks new server access. An offline copy can only be cleared when that device reconnects. Parents should also remove the app or clear its local data before giving a device to someone else.

Your privacy rights

Depending on the law that applies to you, you may have rights to access, correct or delete your personal information, receive a portable copy, or restrict or object to certain uses. Where we rely on your consent, you can withdraw it. These rights have legal limits; withdrawing consent does not affect earlier lawful processing.

To make a request or raise a privacy concern, email privacy@cheekycheckmarks.com. We verify requests to protect your household's information. You can also complain to your local privacy regulator, including the Office of the Privacy Commissioner of Canada, the UK Information Commissioner's Office, the Office of the Australian Information Commissioner, or New Zealand's Office of the Privacy Commissioner.

Children and parent-managed use

A parent or guardian creates and manages the household. Children use restricted, parent-paired displays. A Personal Display shows only its assigned child's checklist, not sibling lists or parent controls. We do not ask children to create accounts, record their voices, upload photos or videos, or share contacts. Prerecorded voice playback does not record your family.

For children: your parent can see your checklist progress and any preset completion message you choose to send. Your Personal Display shows your own checklist. A shared Family Display lets people in your household see the checklists shown on that screen.

Optional website advertising cookies

On our public marketing homepage, we use the Meta Pixel only after you accept advertising cookies. Meta receives information about your page visit, including the page address, browser and device information, network information such as your IP address, and advertising cookie identifiers. This helps us measure visits from Facebook and Instagram ads. Meta may use this information under its Privacy Policy.

Rejecting optional cookies does not affect access to the website or app. Use Cookie choices on the homepage to change or withdraw your choice. We remember your choice on this browser for up to 180 days and respect Global Privacy Control by keeping this tracking off. The Pixel is not installed in the family app, account pages or child displays. We do not send names, email addresses, routines or household data through this Pixel, and do not use advanced matching or server-side Conversions API.

Optional homepage analytics

HeyCatch loads only on our public homepage after you accept optional cookies in the new notice or enable HeyCatch in Cookie settings. The first notice offers equally accessible Accept optional cookies and Reject optional cookies buttons; accepting allows both Meta advertising and HeyCatch analytics. Cookie settings lets you allow either purpose separately. Browsing, demo access and store links work without optional tracking. A previous acceptance of Meta advertising cookies does not enable HeyCatch. You can allow either provider, both or neither. Rejecting either does not affect access to the website or app.

We send HeyCatch a consented homepage-visit event and, when clicked, a demo-link event or an Apple/Google store-button event. These events include their times, the fixed homepage address, a limited source category such as YouTube, temporary session/device identifiers and SDK version information. We remove raw URL queries, fragments, referrers, page text and arbitrary click details from these event payloads. Like other internet services, HeyCatch also receives network and browser information, including an IP address and browser request headers. HeyCatch uses OpenRouter and other AI providers to analyze the data and produce summaries. Providers process this information in the US and other countries. HeyCatch says it collects end-user analytics while our subscription is active and keeps it for two months after the subscription ends, unless we request earlier deletion. See HeyCatch's privacy notice.

HeyCatch is not installed on the demo, parent, account, family, display or policy screens, or in our native apps. We do not send names, email addresses, child profiles, routines, household data or purchase records, and do not link these visits to a Cheeky account. A store-button click is not a subscription or trial. This measurement covers consenting homepage loads and clicks, not all visitors or unique people.

Our separate Meta and HeyCatch choices are saved in this browser for up to 180 days. HeyCatch identifiers are held in memory for the current page load; its SDK can also save a capture-preference flag in local storage. We do not enable HeyCatch identifier cookies, automatic click/form capture, session recording or identity matching. We filter out automatic page/rage-click events and send only the three events described above. Global Privacy Control keeps both optional providers off. Use Cookie choices on the homepage to withdraw either choice. Turning HeyCatch off saves rejection, clears its known local storage and reloads the page to remove its code and timers; this does not erase data already received by a provider. Contact privacy@cheekycheckmarks.com for a privacy request.

Contact and changes

Cheeky Checkmarks is operated by Keith Buckley, an individual based in the United States. Keith Buckley is responsible for the personal information described in this notice.

For privacy questions or requests, email privacy@cheekycheckmarks.com. For help with the app, visit our support page. We will date material updates here and notify affected users when appropriate. Last updated October 21, 2026.