Privacy Policy

1. Introduction

TinyMiles ("we," "our," or "us") is a baby tracking app built for twins and premature babies, with support for shared access across multiple caregivers. This Privacy Policy explains what personal information we collect, how we use it, and your rights regarding that information.

By using TinyMiles, you agree to the practices described in this policy.

2. Who We Are and Who Uses This App

TinyMiles is used by adult caregivers (parents, guardians, and designated caregivers) of infants and young children. We do not permit children under 18 to create accounts. The app collects data about minors (babies) on behalf of their caregivers, as described below.

3. Data We Collect

Account and Caregiver Data

• Email address (used for authentication)
• Display name (e.g., "Mom," "Dad," "Grandma") — shown to other caregivers on the same account
• Caregiver relationship (e.g., Parent, Grandparent, Other) — used to label shared baby views
• Encrypted password (handled by Supabase Auth — we never see your plaintext password)
• Subscription status (Basic or Premium) — used to enforce feature access and caregiver limits; see Section 5

Baby Profile Data

• Baby's name, date of birth, gestational age at birth, gender
• Skin tone and color theme (used only for in-app display personalization)

Tracking Logs

• Sleep logs: start/end times, duration, notes
• Feed logs: type (breast, bottle, formula), amount, time, notes
• Diaper logs: type (wet, dirty, mixed), time, notes
• Milestone logs: milestone name, date achieved, notes
• Food/solids logs: food introduced, date, reaction notes

What We Do NOT Collect

• Location data
• Device identifiers or advertising IDs
• Biometric data
• Payment card numbers or other financial account details — TinyMiles offers optional Premium subscriptions, but all payment is handled directly by Apple's App Store; we never receive or store your card details. See Section 5 for the limited subscription metadata we do receive.
• Cookies or tracking pixels

4. How We Use Your Data

We use the data you provide solely to:

• Operate the TinyMiles app and provide its features to you
• Display your babies' tracking history and statistics within the app
• Allow multiple caregivers on the same account to view shared data in real time
• Generate in-app reports and summaries for your own use
• Send transactional emails (e.g., email confirmation for account creation) — no marketing emails without your separate opt-in

We do not sell your data, share it with advertisers, or use it to train AI or machine learning models.

5. Data Processors and Third-Party Services

We use a small number of service providers to operate the App. Each acts as a data processor on our behalf, only for the purposes described below — none of them may use your data for their own purposes, and we do not sell or share your data with them for advertising.

Supabase (backend and database)

TinyMiles uses Supabase (Supabase, Inc.) as our backend and database infrastructure. All data is stored on Supabase-managed servers, encrypted at rest and in transit (TLS). Supabase does not use your data for its own purposes. Learn more at supabase.com/privacy.

Your data is stored in the United States (Supabase's default AWS region).

Resend (transactional email)

TinyMiles uses Resend to send account-related emails — password resets and account-creation confirmations. Resend processes your email address solely to deliver these messages; it is not used for marketing or shared with any other party. Learn more at resend.com/legal/privacy-policy.

RevenueCat and Apple (subscription management)

If you choose to purchase TinyMiles Premium, subscription purchases are made through Apple's App Store and billed directly by Apple — we never receive or store your payment card details. We use RevenueCat to manage and verify subscription status (e.g., whether your account is Basic or Premium) across devices. RevenueCat receives a device/app-generated user ID and purchase/subscription event data (product purchased, renewal dates, entitlement status) — it does not receive your name, email, or any baby/tracking data. Learn more at revenuecat.com/privacy.

See Section 5 of our Terms of Service for full subscription pricing, billing, and cancellation terms.

6. Data About Minors (COPPA Disclosure)

TinyMiles stores tracking data about minors (babies) on behalf of their adult caregivers. We comply with the Children's Online Privacy Protection Act (COPPA):

• We do not collect data directly from children. All accounts are created and managed by adults (caregivers aged 18+).
• Baby profile data is entered by adult caregivers and used solely to provide the app's tracking features.
• We do not display, share, or sell any data about minors to third parties.
• We do not use data about minors for advertising purposes.

If you believe a minor has created an account without parental consent, contact us at support@tinymilesapp.com and we will promptly delete the account.

7. Data Retention

• Active accounts: Your data is retained for as long as your account is active.
• Account deletion: All associated data is permanently deleted within 30 days. Some data may remain in backups for up to 90 days.
• Inactive accounts: Accounts with no login activity for 3 years may be deleted with prior email notice.

8. Your Rights and Choices

You have the right to access, correct, delete, or export your data at any time. To submit a request, email support@tinymilesapp.com. We will respond within 30 days.

9. GDPR (European Users)

If you are located in the EEA or UK, you have additional rights under GDPR including the right to access, rectification, erasure, data portability, and the right to object to processing. Legal basis: contract performance and legitimate interests.

To exercise any GDPR right, contact: support@tinymilesapp.com

10. CCPA (California Users)

California residents have the right to know what data we collect, delete their data, and opt out of sale. We do not sell personal information. To submit a CCPA request: support@tinymilesapp.com

11. Security

• TLS encryption for all data in transit
• Supabase Row Level Security (RLS) — each user can only access their own data
• Encrypted passwords — we never store plaintext passwords
• No third-party analytics or advertising SDKs (Resend and RevenueCat, described in Section 5, are used only for email delivery and subscription management, not analytics or advertising)

In the event of a data breach, we will notify affected users within 72 hours of discovery.

12. Third-Party Services

TinyMiles does not use any third-party analytics or advertising services. Our only third-party service providers are Supabase, Resend, and RevenueCat, described in Section 5 — none of them are used for analytics, advertising, or tracking.

Future additions (this policy will be updated before any of these are added): crash reporting (e.g., Sentry), analytics (e.g., Mixpanel), and push notifications (require separate consent).

13. Changes to This Policy

If we make material changes, we will notify you via in-app notification and/or email at least 14 days before changes take effect.

14. Contact Us

---

This Privacy Policy is intended to comply with COPPA, GDPR, CCPA, and Apple App Store requirements.