Privacy Policy

Who we are

Sjokos is in a pilot phase and is provided by Jonah Wiecek, a private individual in Norway, who is the data controller for the personal data described here. You can reach us at jonahwiecek@gmail.com. Before commercial launch, a company will be established and take over as controller – this policy will be updated, and you will be notified of the change.

Pilot period

The service is currently being tested with a small number of families and professionals who have agreed to take part. For children using the service in the pilot, consent from a parent or guardian is required before the child signs in.

• The service is free during the pilot, and we process no payment information.
• You can withdraw from the pilot at any time – we then delete your account and data.
• When the pilot ends, we delete pilot data unless you actively choose to keep your account.

What data we process

We only collect what the service needs to work:

• Adult accounts: name, email address and password (stored encrypted).
• Child profiles: a first name or nickname and a username created by the adult. Children never register an email or phone number.
• Content you create: daily plans, goals, tasks, rewards and Sjoko history.
• A notification ID for the app (push token), if you use the mobile app and have accepted notifications.
• Technical information necessary for operations and security, such as sign-in events.
• Payment information: none during the pilot. When payment is introduced, it will be handled by a payment provider (planned: Stripe) – we will never store card numbers ourselves.

Children's personal data

We collect as little as possible about children. Child profiles are created and controlled by adults, and children cannot be contacted by third parties through the service. We show no ads, and we never use children's data for profiling or marketing.

Purposes and legal basis

We process data to deliver the service you have an agreement for (GDPR art. 6(1)(b)), to meet legal obligations such as bookkeeping (art. 6(1)(c)), and to secure and improve the service based on our legitimate interest in stable and safe operations (art. 6(1)(f)).

Storage and security

The database is hosted by Neon in Frankfurt (EU). The service itself runs on Vercel. Passwords are stored encrypted, access is restricted, and all traffic uses encrypted connections.

Sharing of data

We never sell personal data. We only share with processors necessary to deliver the service – currently Vercel (hosting) and Neon (database), plus Expo for delivering push notifications to the mobile app. These are bound by data processing agreements. Beyond that, we only share data where required by law.

How long we keep data

Data is kept while the account is active. When an account is closed, data is deleted or anonymized within a reasonable time, unless legally required retention (such as accounting records) requires otherwise.

Your rights

You can at any time:

• request access to the data we hold about you and your children
• request correction or deletion
• request a copy of your data (data portability)
• object to processing based on legitimate interest
• complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe we process data unlawfully

Changes to this policy

If we make material changes to how we process personal data, we will notify you in the service or by email before the changes take effect.