Privacy at Penny Time
We take privacy seriously. We built Penny Time so your child can learn safely, without compromising their personal data.
Who we are
Penny Time by Employee Of The Month S.L. helps children aged 8-14 learn about money safely. We comply with GDPR and COPPA.
What data we collect
Only the basic information needed to run the app: parent's name, email, and date of birth, and child's nickname, age (years), and progress.
No photos, voice, or location data.
Why we collect it
To create accounts, manage progress, and help parents track learning. We never use data for ads or sell it.
Who can see it
Only parents. No third parties or ad networks.
How long we keep it
All data, including consent logs, is deleted when parents remove the account or after 12 months of inactivity.
Your rights
Parents can view, edit, or delete data anytime through the dashboard or by emailing [email protected]
For U.S. users under 13
We follow COPPA rules. Only a parent can create an account and add a child - a child cannot sign up on their own, and no data is collected until the parent sets up the child.
Privacy policy
1. Who We Are
This app is operated by Employee Of The Month S.L., based in Málaga, Spain ("we," "our," "us").
Contact: [email protected]
2. Data We Collect
| Category | Purpose | Examples |
|---|---|---|
| Parent data | Account management & consent | Name, email, date of birth, consent log |
| Child data | Learning progress tracking | Nickname, age (years), progress data |
| Technical logs | Security & fraud prevention | Device and usage logs (pseudonymised) |
No photos, voice, geolocation are collected.
3. Legal Basis for Processing
Legal bases (GDPR / UK GDPR Art. 6), by purpose:
- Your parent account (email, name, and sign-in) is processed to provide the service you signed up for: performance of a contract (Art. 6(1)(b)).
- Your child's core information (a nickname, an age we keep only as a birth year, and any preset avatar) is processed on the basis of our legitimate interest in providing the allowance and financial literacy features you set up for your child (Art. 6(1)(f)), weighed against your child's own interests, as required for children's data.
- Optional usage analytics runs only with your consent (Art. 6(1)(a)). It is off by default, and you can withdraw consent at any time in settings.
- Security, maintenance, and fraud prevention rely on our legitimate interest (Art. 6(1)(f)).
4. How We Use the Data
- Provide educational features and track progress
- Maintain parental dashboards
- Secure and monitor accounts
- Improve the app using pseudonymised usage data: activity events tied to an internal account identifier, never to a name, with amounts grouped into ranges and no free text. We report this data only in aggregate. It is off unless you turn it on, and we never share it with third parties or use it for advertising.
We do not use data for advertising, profiling, or resale.
5. Data Sharing and Storage
We use a secure, GDPR-compliant cloud provider based in the EU for authentication, database, and file storage.
Data remains within the EU and is protected under strict data protection standards.
No international transfers occur outside the EU.
6. Retention and Deletion
| Data Type | Retention | Deletion Method |
|---|---|---|
| Active accounts | Until parent deletes | Immediate removal |
| Inactive accounts | 12 months | Automatic purge |
| Consent logs | 12 months | Secure deletion |
All data is permanently deleted when accounts are removed or after 12 months of inactivity.
7. Parental Consent
- Only a parent can create an account and add a child. The parent signs in with their own Google, Apple, or email credentials, enters a nickname and an age for the child, and puts the child on a device using a one-time link the parent generates. A child cannot sign up, and no one except the parent who owns the account can add a child or start any data collection.
- For U.S. users under 13, parents confirm consent before data collection. We may use additional verification methods if required by COPPA.
- Parents may withdraw consent or delete data at any time.
8. Children's Privacy
We only collect what's necessary for learning activities.
No ads, social features, or external links appear inside the app.
9. Data Security
We apply strong safeguards:
- Encryption in transit and at rest (TLS/SSL)
- Role-based access control
- Pseudonymization of child records
- Secure backups and audits
10. Your Rights (EU / EEA)
Parents and guardians may:
- Access their data
- Request correction or deletion
- Withdraw consent at any time
- Request data portability
- Restrict processing for legitimate reasons
Contact [email protected] to exercise these rights.
11. Supervisory Authority
If you believe your data has been mishandled, contact:
Agencia Española de Protección de Datos (AEPD) - www.aepd.es
12. COPPA Compliance (Children under 13 in the U.S.)
We comply with the Children's Online Privacy Protection Act (COPPA).
We collect a child's information only inside the parent's account, and the parent is the one who enters it during setup. The parent controls the account and can review, correct, or delete the child's information at any time, or delete the account entirely.
We collect only basic, non-sensitive information and do not share it outside the app.
13. Policy Updates
We may update this policy to reflect new features or legal changes.
Parents will be notified by email before any significant change takes effect.
Latest revision: August 2, 2026