CHORES & CO SECURITY POLICY
Effective Date: 9 August 2026
Last Updated: 9 August 2026
Chores & Co ("Chores & Co", "we", "us", or "our") is committed to protecting the security, confidentiality, and integrity of information processed through our Services.
This Security Policy explains the general technical and organisational measures we use to protect our website, application, systems, and user information.
It applies to:
www.choresandco.com
and
app.choresandco.com
This Security Policy should be read together with our Privacy Policy, Cookie Policy, and Terms & Conditions.
________________________________________
1. OUR SECURITY APPROACH
Security is an important part of the design and operation of Chores & Co.
We follow a principle of data minimisation and security by design, meaning that we aim to reduce the amount of information collected and stored and protect the information that is necessary to provide the Services.
Our security measures are designed to protect information against:
• Unauthorised access;
• Unauthorised disclosure;
• Unauthorised alteration;
• Loss;
• Destruction;
• Misuse; and
• Other unlawful processing.
________________________________________
2. DATA MINIMISATION
Chores & Co is designed to collect and retain as little personally identifiable information as reasonably necessary.
The primary account information we collect is the user's email address.
We do not intentionally collect unnecessary information such as:
• Identity numbers;
• Passport numbers;
• Residential addresses;
• Telephone numbers; or
• Other unnecessary identifying information.
Reducing the amount of information we hold helps reduce the potential impact of a security incident.
________________________________________
3. ENCRYPTION
Numerical information entered into Chores & Co is encrypted.
We use encryption and other security controls where appropriate to protect information during storage and transmission.
Where encryption is used, access to the underlying information is restricted to authorised systems and processes necessary to operate the Services.
Encryption is one component of our overall security approach and does not replace access controls, authentication, monitoring, secure development, or other security measures.
________________________________________
4. DATABASE SECURITY
Chores & Co uses Supabase as part of its application and database infrastructure.
We use appropriate security controls to restrict access to application data.
Where applicable, database access controls such as Row Level Security (RLS) may be used to ensure that users and application processes can access only the information they are authorised to access.
Administrative and technical access to systems is restricted according to operational requirements.
We periodically review our security configuration and access controls as part of maintaining the Services.
________________________________________
5. ACCOUNT SECURITY
Access to Chores & Co accounts is protected using authentication mechanisms appropriate to the Services.
Users are responsible for maintaining the security of the email account and authentication credentials associated with their Chores & Co account.
Users should:
• Use a secure email account;
• Keep authentication information confidential;
• Avoid sharing account access unnecessarily;
• Notify us if they believe their account has been compromised; and
• Log out or secure their device when using a shared device.
Chores & Co will never intentionally request your password or payment credentials by email.
________________________________________
6. PAYMENT SECURITY
Chores & Co does not store payment card or banking credentials in our application database.
Payment processing is handled by PayFast, an independent payment service provider.
This means Chores & Co does not need to maintain users' underlying payment-card information within our own application infrastructure.
Payment information is submitted to PayFast for processing and is subject to PayFast's own security controls and applicable compliance requirements.
For payment-security information, please refer to PayFast:
PayFast Privacy Policy
________________________________________
7. THIRD-PARTY SERVICE PROVIDERS
Chores & Co relies on trusted third-party technology providers to operate parts of the Services.
These may include:
Supabase
Used for application and database infrastructure.
Firebase / Google
Used to support notifications and related application functionality.
PayFast
Used to process payments.
We select and configure third-party services with security and privacy considerations in mind.
Third-party providers may maintain their own security certifications, controls, policies, and infrastructure.
Chores & Co remains responsible for the security configuration and use of these services within our own application.
________________________________________
8. SECURE COMMUNICATIONS
Chores & Co uses secure communication technologies where appropriate to protect information transmitted between users and our Services.
Users should ensure that they access Chores & Co through official domains:
www.choresandco.com
app.choresandco.com
Users should be cautious of links, emails, or websites claiming to represent Chores & Co but using different domains.
________________________________________
9. ACCESS CONTROL
Access to systems and information is restricted according to legitimate operational requirements.
Where appropriate, we use:
• Authentication;
• Authorisation controls;
• Role-based access;
• Restricted administrative access;
• Database access controls; and
• Other technical measures.
Access permissions are intended to ensure that individuals and systems can access only the information necessary for their legitimate responsibilities.
________________________________________
10. SECURITY MONITORING
We take reasonable steps to monitor and maintain the security and availability of the Services.
This may include monitoring for:
• Unusual activity;
• Unauthorised access;
• System failures;
• Security vulnerabilities;
• Abuse; and
• Other events that could affect the security or availability of the Services.
Where a security issue is identified, we will take reasonable steps to investigate and address it.
________________________________________
11. SOFTWARE AND SECURITY UPDATES
We may periodically update the Services and supporting infrastructure to:
• Fix security vulnerabilities;
• Improve reliability;
• Improve performance;
• Introduce security enhancements; and
• Maintain compatibility with supported technologies.
Users should keep their browsers, operating systems, devices, and other software reasonably up to date.
________________________________________
12. EMPLOYEE AND ADMINISTRATIVE ACCESS
Where individuals require access to systems containing user information, access is limited to legitimate business and operational requirements.
We seek to ensure that individuals with access to confidential information understand their responsibilities regarding confidentiality and security.
Administrative access may be restricted using authentication and access-control mechanisms appropriate to the risk.
________________________________________
13. SECURITY INCIDENTS
If we identify or reasonably suspect a security incident, we will take reasonable steps to:
1. Identify and contain the incident;
2. Assess what systems and information may be affected;
3. Prevent further unauthorised access;
4. Investigate the cause;
5. Restore affected Services where appropriate;
6. Take steps to prevent recurrence; and
7. Notify affected persons or authorities where required by applicable law.
________________________________________
14. POPIA SECURITY COMPROMISE REQUIREMENTS
Chores & Co takes security compromises seriously and will comply with applicable requirements under the Protection of Personal Information Act 4 of 2013 (POPIA).
Where a security compromise involving personal information occurs, we will assess the incident and make notifications to the Information Regulator and affected data subjects where required by applicable law.
________________________________________
15. GDPR DATA BREACH REQUIREMENTS
Where the GDPR applies, Chores & Co will comply with applicable requirements relating to personal-data breaches.
Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will assess whether notification to the relevant supervisory authority is required.
Where applicable law requires affected individuals to be notified, we will provide appropriate notification.
________________________________________
16. RESPONSIBLE DISCLOSURE
We encourage security researchers and users to report suspected security vulnerabilities responsibly.
If you believe that you have discovered a security vulnerability affecting Chores & Co, please contact:
security@choresandco.com
Please provide:
• A description of the suspected vulnerability;
• The affected website, application, or feature;
• Steps required to reproduce the issue, where possible;
• The potential impact; and
• Any relevant technical information necessary for us to investigate.
Please do not:
• Access information belonging to other users;
• Modify or delete data;
• Perform destructive testing;
• Conduct denial-of-service attacks;
• Attempt to obtain payment information;
• Use social engineering against Chores & Co personnel; or
• Publicly disclose the vulnerability before we have had a reasonable opportunity to investigate and address it.
We appreciate responsible disclosure and will assess reported vulnerabilities in good faith.
________________________________________
17. SECURITY LIMITATIONS
Although we take reasonable security measures, no online service, computer system, database, or transmission over the internet can be guaranteed to be completely secure.
Accordingly, Chores & Co cannot guarantee that:
• The Services will never experience a security incident;
• Information will never be accessed unlawfully;
• The Services will always be available;
• Third-party services will never experience security incidents; or
• Information transmitted over the internet will always be completely secure.
We nevertheless continuously seek to maintain appropriate security measures relative to the nature and risks associated with the Services.
________________________________________
18. USER RESPONSIBILITIES
Security is a shared responsibility.
Users are responsible for:
• Protecting access to their email account;
• Protecting authentication credentials;
• Using secure devices;
• Keeping devices and software reasonably updated;
• Not sharing account credentials unnecessarily;
• Reporting suspected security incidents promptly; and
• Not attempting to compromise or misuse the Services.
________________________________________
19. SECURITY AND PRIVACY
Our security practices form part of our broader privacy framework.
For information about:
• What information we collect;
• Why we collect it;
• How we use it;
• How long we retain it;
• Your privacy rights; and
• How to request deletion or access;
please refer to the Chores & Co Privacy Policy.
________________________________________
20. CHANGES TO THIS SECURITY POLICY
We may update this Security Policy from time to time to reflect:
• Changes to our technology;
• Changes to our security practices;
• Changes to third-party service providers;
• Changes to our Services;
• New security risks; or
• Changes to applicable laws and regulations.
The latest version will be published on our website.
The "Last Updated" date at the beginning of this Security Policy indicates when it was most recently amended.
________________________________________
21. CONTACT US
For security-related questions or vulnerability reports:
Chores & Co
Security:
security@choresandco.com
Privacy:
privacy@choresandco.com
General support:
info@choresandco.com
Website:
www.choresandco.com
Application:
app.choresandco.com
________________________________________
Last Updated: 9 August 2026
