Privacy policy
Last updated: October 3, 2026
This policy explains what information midom collects, what it uses it for, and the choices we make to protect children’s data in particular. It’s written to be read by a parent, not a lawyer.
midom is operated by Laura Garza, an individual with registered business activity (persona física con actividad empresarial), based in Monterrey, Nuevo León, Mexico. Our Data Protection Office handles any privacy matter at hola@midom.mx.
First: midom is not a bank
midom does not process, hold or transfer real money. Parents remain the actual holders of the money. Every balance you see in the app is a calculation over a history of entries (what came in minus what went out) — not an account with funds. We don’t ask for or store card details: subscription payments are processed by Apple or Google.
Children have no account
This is a design decision, not a detail:
- A child in midom has no email, no password, and no login of their own.
- Each child’s profile is a record managed by a parent from their own session.
- A PIN protects the way back into parent mode: a child can’t return to the management view on their own. Switching between children’s profiles is not PIN-gated. It’s a convenience gate, not a security barrier against a technical person — the real security is server-side, where every query is limited to your family’s data.
What we NEVER collect about a child
- No full legal name. Only the name or nickname you type.
- No email or phone number.
- No date of birth, exact or approximate. We don’t ask for or store any age data.
- No location. At no point in the product.
- No photo. The avatar is an illustration chosen from a list, not an uploaded image.
What we collect, and why
From parents (account holder)
| Data | Purpose | Basis |
|---|---|---|
| Email address | Create your account, sign in, reset password, important notices | Needed for the service |
| Password (hashed) | Authentication | Needed for the service |
| Family and children names (whatever you type) | Making the app work | Needed for the service |
| Device push token | Send you push notices (task completed, approval pending) | Needed for the feature; removed on sign-out |
From app usage
- Tasks, money and points entries, savings goals, rewards and redemptions that you and your kids record. This is the heart of the product: a history of what each child did, earned and spent.
- Subscription status (free plan or midom Familia), reported to us by Apple/Google through RevenueCat. We never see your payment method.
Who we share data with (processors)
We don’t sell data or share it with advertisers. We use providers that process data on our instructions so the service works:
| Provider | Purpose |
|---|---|
| Supabase | Database and authentication (where your account and history live) |
| Expo (EAS) | Building the app and delivering push notifications (together with Apple and Google); the text of a notification may include the name you entered for a child |
| Apple, Google | App distribution, subscription billing and sign-in if you choose to use your Apple or Google account |
| RevenueCat | Tells us whether your subscription is active |
| Sentry | App error and crash reports, with an internal family identifier (no names or emails) |
| Resend | Sending your account emails (sign-up confirmation and password recovery) and your family’s weekly recap, which includes the name you entered for each child and their week’s figures; receives your email address. You can stop the recap from the link in the email itself |
| Firebase Cloud Messaging (Google) | Delivery of push notifications on Android |
| Cloudflare | Hosting for this website and DNS |
| Google Workspace | Our email (hola@midom.mx) |
We may also disclose information if the law requires it, or to protect the safety of users.
How long we keep data
- While your account exists, we keep your family, tasks and history so the app works. The entry history isn’t “erased” piece by piece because the balance is calculated from it.
- If you’re the only adult and you delete your account, the family and its data are deleted too: they disappear from the app immediately and are purged from our backups within a maximum of 30 days. How to do it is on the Delete your account page.
- If there are other adults and you delete your account, your account, your access and the data used to keep that account active are deleted. The family continues with the other adults. What you recorded is kept without being tied to your account, and the historical consent record described under “Minors” may be kept. The deleted account data is also purged from our backups within a maximum of 30 days.
- If the family owner removes you, or you leave a family on your own, you lose access to it, but your account isn’t deleted; you can delete it yourself whenever you like.
- If you delete a child’s profile (not the whole account), we stop using that profile right away. We keep its information for up to 30 days — if it was a mistake, email us at hola@midom.mx within that window and we’ll restore it. After 30 days, we permanently delete the information tied to that profile, unless we have a specific legal obligation to keep some of it.
- Push tokens are removed on sign-out.
How we protect your data
We apply administrative, technical and physical safeguards to protect your information:
- Everything travels encrypted between the app and our servers (HTTPS/TLS), and data is stored encrypted at rest.
- Database access is restricted: every query is limited to your family’s data, even for us.
- Only staff who need it can access production systems.
No system is 100% foolproof. If a security breach were to significantly affect your personal data, we’ll notify you without delay — by email or in the app — explaining what happened and what you can do.
Your rights
You have the right to access your data, rectify it if inaccurate, cancel it when you believe it’s no longer needed, and object to its processing for specific purposes (ARCO rights, under Mexican law). You may also withdraw your consent at any time.
To exercise any of these rights, write to hola@midom.mx and include:
- Your name and a way to reach you.
- A copy of an official ID, so we can confirm it’s you.
- A clear description of the data and the right you want to exercise.
We’ll respond within 20 business days. As a parent, you may exercise these rights on behalf of your children. Many changes you can make yourself in the app, and you can delete everything from there.
If you’re not satisfied with our response, you may contact Mexico’s data protection authority.
Minors
midom is meant to be managed by an adult. Before creating a child’s profile, we ask you to explicitly confirm that you are their parent or legal guardian and that you authorize the collection of the information midom needs to work — we record when you gave that consent, which account gave it, and which version of this policy was in effect at the time.
A child doesn’t have an account and doesn’t give us contact information directly (full name, email, phone, location). They may generate information within the app while using Child Mode associated with your family account — for example, by completing a task, redeeming a reward, or setting their own savings goal — and we minimize it as described above. While a device is in Child Mode we also register its notification token, only for app alerts (for example, that a task was assigned) — never for advertising, and we never share it with third parties; it’s removed as soon as you sign out on that device.
As a parent or guardian, you can review your child’s profile information, ask us to delete it, or refuse to let us keep collecting new information about them (for example, by deactivating their profile) at any time. If you believe a minor gave us data directly without an adult’s involvement, contact us and we’ll delete it.
Changes
If we change this policy in a material way, we’ll give notice in the app or by email before it takes effect. The “last updated” date above always reflects the current version.
Questions?
Write to us at hola@midom.mx