What we collect, why, who else sees it, how long we keep it, and what you can ask us to do about it. Children are dealt with separately and more strictly.
The HOP Collective Inc., a Delaware company at 318 Hollenbeck Place, Greenville, South Carolina 29607, United States, is the responsible party for the personal information described here.
Family Xchange (Pty) Ltd, registration number 2022/676747/07, of 53 Kleine Parys Estate 2, Carolina Road, Paarl, 7646, is our local representative in South Africa under a services agreement, and carries out marketing and commercial activities on our behalf. It is also the address at which legal documents may be served on us in South Africa. It acts on our instructions and does not use your information for its own purposes.
Information Officer: Bernard Lans — hello@familyxchange.com, +27 60 786 9759
Which laws we work to. We are a United States company and our first market is South Africa, so we apply both:
Where the two differ, we follow the stricter one.
POPIA requires us to tell you this plainly, so here it is as a table.
| What | Why we need it | Do you have to give it? |
|---|---|---|
| Account holder's name and email address | To create your account, sign you in, and contact you about the service | Yes — we cannot give you an account without it |
| Password | To secure your account. We store only a one-way hash, never the password itself | Yes |
| Family members' first name, last name, age and role (such as mother, child, grandparent) | To build your family's board, deal challenges that suit each person's age band, and track chores | Yes for each member you add — a member cannot play without it |
| A family member's mobile number | Only used where you ask us to send that person a notification | No — leave it blank and everything still works |
| A record of your consent: what you consented to, when, your IP address and your browser or device description | To prove we had your permission, as POPIA and COPPA require us to be able to | Yes — it is created automatically when you accept |
| Board game serial numbers | To unlock online sessions for your family | Only if you own a board game |
| Delivery name, address and telephone number | To ship something you bought from our shop, once the shop opens | Yes for a shop order; not needed otherwise |
| Order history | To run the shop, handle returns, and meet tax and accounting law | Yes for a shop order |
| Game and chore activity — which challenges were dealt, what was completed, stars and rewards recorded | To run the game, show progress, and improve the challenge deck | Created automatically as you play |
| Technical information — device type, operating system, app version, approximate location from your IP address, crash reports | To keep the service working, fix faults and prevent abuse | Collected automatically |
| Anything you write to us | To answer you | Only what you choose to send |
What we never collect. We do not ask any family member for an identity number, a passport number, a tax number, biometric information, health information, religious affiliation, or any other special personal information under POPIA section 26. If you type something like that into a free-text field, please do not.
Payment details never reach us. When you subscribe through the Apple App Store or Google Play, that store takes the payment and we never see your card.
Our shop is not open yet. When it opens, payment will be handled by a third-party payment provider on its own secure page, we will never see your card number, and the provider will be named here and on the checkout page before you are asked to pay for anything.
Under POPIA section 11 we rely on:
This section takes priority over anything else in this policy.
Children do not sign up. Only an adult of 18 or over can create an account. A child takes part as a member of that adult's family, added by that adult.
We get permission from the adult first. When you add a child, you confirm that you are that child's parent or legal guardian, or have their permission, and you consent on the child's behalf. We record that consent. For a child under 13, this is the verifiable parental consent COPPA requires, and we obtain it before we collect anything about the child.
We collect the least we can. A child's record holds a first name, a last name, an age, a role in the family, and a mobile number only if you enter one. We do not ask a child for an email address, a home address, a photograph, a voice recording, a precise location or a payment method, and we never require a child to hand over more than the game needs in order to play.
We do not advertise to children. No behavioural advertising, no advertising profiles, no third-party ad networks in the app, and no selling, renting or trading of any child's information to anyone, for any reason.
A parent is in control at all times. From the account area you can see everything we hold about a child in your family, correct it, stop us collecting more, and delete that child member. Deleting a child member deletes their personal information under clause 7. You never have to explain why, and it costs nothing.
If a child signs up anyway. If we learn that a child has created an account without a parent or guardian, we delete it and everything in it promptly. If you think that has happened, email the Information Officer.
We share personal information only with the people below, only as far as they need it, and only under a contract that binds them to protect it.
| Who | What they get | Why |
|---|---|---|
| Afrihost (South Africa) — hosting and email | Everything stored in the service; the email address a message is sent to | To run the servers and the database, and to send service email |
| Family Xchange (Pty) Ltd (South Africa) — our local representative | Only what it needs for marketing and commercial activities on our behalf | To represent us in South Africa, on our instructions only |
| A payment provider, once the shop opens | Your name, email and payment authorisation | To take payment for a shop order. The provider will be named here before the shop takes its first order |
| Apple and Google | Your subscription and payment relationship with them | They bill you for an in-app subscription |
| A delivery company, once the shop opens | Delivery name, address and telephone number | To deliver a board game you ordered. Named here before the shop takes its first order |
| Professional advisers, auditors, and a buyer if the business is ever sold | Only what is necessary | Legal, accounting, or continuity of the service |
| A court, regulator or law-enforcement body | Only what we are legally required to give | Where the law compels us |
We do not sell, rent or trade personal information. There is no exception to this, and it applies most strictly of all to children.
Our servers are in South Africa, with Afrihost. We are a United States company, so our staff and advisers in the United States can access information held on those servers, and Apple and Google operate outside South Africa.
POPIA section 72 allows a transfer out of South Africa where the recipient is bound by rules that give comparable protection, where you consent, or where the transfer is necessary to perform our contract with you. We rely on those grounds, and we put contractual protections in place with each provider.
If you would like to know which providers are outside South Africa and what protections apply, ask the Information Officer and we will tell you.
| What | How long |
|---|---|
| Your account and family members | While your account is open, then 90 days after you close it, then deleted or de-identified |
| A child member you delete | Deleted within 30 days |
| Consent records | five years after the consent ends, because we may have to prove we had it |
| Order, invoice and tax records | five years, as tax and accounting law requires |
| Game and chore activity | While your account is open; afterwards we keep only de-identified statistics that cannot be traced to a person |
| Support email | two years from the last message |
| Server and security logs | 12 months |
Traffic between your device and us is encrypted. Passwords are stored as one-way hashes and never in readable form. Database credentials are kept outside the web root. Access to live data is limited to the people who need it. We keep backups, and we test that they restore.
No system is perfectly secure. If a breach happens that creates a real risk to you, POPIA section 22 requires us to notify the Information Regulator and you, and we will — as soon as reasonably possible, telling you what happened, what it means for you, and what to do about it.
You can, at any time and free of charge:
To use any of these, email hello@familyxchange.com. We respond within 30 days. We may ask you to confirm who you are first, so that we do not hand a family's information to the wrong person.
The Information Regulator (South Africa) — you may complain directly, whether or not you have come to us first:
Information Regulator (South Africa) Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191 Telephone: 010 023 5200 · Toll-free: 0800 017 160 General enquiries: enquiries@inforegulator.org.za POPIA complaints are lodged through the Regulator's eServices portal at eservices.inforegulator.org.za/ — you register a profile there and submit the complaint on the portal. The PAIAComplaints address is for access-to- information complaints only, which are a different thing.
Checked against the Regulator's own website on 5 November 2026. Confirm again immediately before publication — these details have changed before.
The website uses cookies. What they are, which ones we use, and how to turn the optional ones off is in the separate Cookie Policy. The app does not use cookies, but it does store a login token on your device so you are not asked to sign in every time.
We do not make any decision about you by automated means alone that has a legal or similarly significant effect. Challenges are selected by age band and tier — that is content selection, not a decision about a person.
If we change this policy in a way that materially affects you — particularly anything in the children's section — we will tell you at least 30 days beforehand by email and in the app, and we will not apply the change to information already collected without a fresh consent where one is required.
Smaller changes are posted here with a new date. Every version carries its effective date and we keep the previous versions available.
Information Officer: Bernard Lans The HOP Collective Inc., 318 Hollenbeck Place, Greenville, South Carolina 29607, United States hello@familyxchange.com · +27 60 786 9759
In South Africa: Family Xchange (Pty) Ltd, registration number 2022/676747/07, 53 Kleine Parys Estate 2, Carolina Road, Paarl, 7646, South Africa Telephone: +27 60 786 9759