Privacy Policy

1. Who processes the data

Data controller: Sole trader (IP) Volodin S. V., tax ID (INN) 666307848501.

For any data question, write to sv@1147.org.

2. What data we collect

• Account data: name, email address, password (stored only as a bcrypt hash — we never know the password itself), interface language, email verification flag.
• Group content created by members: group names and descriptions, member names within a group, roles, coin balances, chat messages, tasks (title, description, deadlines, statuses), the task event log, coin awards, penalties and spending with comments, reward templates, the group budget.
• Payment data: amount, group, status and date of a payment. Card details are entered on Robokassa's side — we never receive or store them.
• Devices and sessions: a device identifier generated by the app, a device label (e.g. “Chrome on Android”), sign-in sessions.
• Push notification tokens: Firebase Cloud Messaging (Google), RuStore Push (VK), Huawei Push Kit, and browser Web Push subscriptions (subscription URL, encryption keys, browser user agent).
• Server logs: IP address, request time and URL, browser or app user agent.

We show no ads, use no third-party analytics, never sell data and build no advertising profiles. The website sets a single cookie — your language; the app keeps its sign-in tokens on your device.

3. Why we process data

• to create and maintain your account, sign you in and reset your password;
• to run groups: tasks, coins, chat, the event feed, invitations;
• to send push notifications and service emails (email confirmation, password reset, group invitation, account deletion);
• to accept payments and extend groups;
• to keep the service secure, investigate errors and abuse, and answer your requests;
• to comply with the law.

Legal grounds: performance of our agreement with you (the terms of use), your consent and legal obligations (including Russian Federal Law No. 152-FZ “On Personal Data”).

4. Children

BonusBank is made for families: children use it under the supervision of their parents or legal guardians. Usually an adult creates a group and adds the child (entering a name and email) or invites them with a link or QR code.

By adding a child, the adult confirms they are the child's parent or legal guardian and consents to processing the child's data to the extent needed for the group to work. We ask children for nothing beyond a name and email and show them no ads.

A parent can remove a child from a group at any time and can ask us to delete the child's account by writing to sv@1147.org. Minimum age for signing up on one's own: [уточнить].

5. Where and how data is stored

Data is stored in a database on the service's server. The server is located in Russia.

Traffic between the apps and the server is encrypted with HTTPS. Passwords are stored only as hashes, and server access is restricted.

6. Who we share data with

Only with services BonusBank cannot work without, and only what they need:

• Robokassa — payment processing: payment amount, number and description; you enter card details on Robokassa's side.
• Google Firebase Cloud Messaging — push notifications in the Google Play, Xiaomi and Samsung Android versions and on iOS: device token and notification text.
• RuStore (VK) — push notifications in the RuStore version: device token and notification text.
• Huawei Push Kit — push notifications in the AppGallery version: device token and notification text.
• Browser Web Push services (Google, Mozilla, Apple, Microsoft) — notifications in the web app: encrypted notification text.
• Selectel — sending email (SMTP): your email address and the email text.

A push notification's text may include the group name, the author's name and the beginning of a message or a task title. Servers of Google, Huawei and browser vendors may be located outside Russia — by turning on push notifications you agree to this cross-border transfer. We also disclose data to authorities when the law requires it.

7. How long we keep data

• Your account and group content — for as long as the account exists.
• When you delete your account, personal data is deleted immediately (see section 8). Messages and coin records in groups that still have other members remain without your name — shown as “Deleted user”.
• Payment records — as long as accounting and tax law requires (at least 5 years).
• Server logs — no longer than [уточнить: period] days.
• Database backups — no longer than [уточнить: period] days, then overwritten.
• Push tokens and subscriptions are deleted when you sign out, turn notifications off, or the provider reports the token as invalid.

8. Your rights and account deletion

You can ask what data we hold, correct it (name, email and password can be changed in the app's profile), withdraw consent and delete your account.

Delete your account in the app: Profile → “Delete account” → confirm with your password. Or email sv@1147.org from your account's address — we will delete it within 30 days. What exactly is deleted: Account deletion.

If you believe we violate your rights, you can complain to Roskomnadzor (the Russian data protection authority) or go to court.

9. Changes to this policy

We may update this policy. The current version is always on this page; we will warn you about material changes in the app or by email.

10. Contacts

Email: sv@1147.org. Controller: Sole trader (IP) Volodin S. V., tax ID (INN) 666307848501.

See also the Terms of Use.