Privacy Policy
Last updated: 21 October 2026
Tiny Threads is a shared family journal. Parents and the people they invite record meals, moments, milestones and notes about their children, and see them in one place.
This policy explains what we collect, why, where it goes, and how to get rid of it.
Who we are. Tiny Threads is operated by Christian Carter, an individual based in Virginia, United States. Questions, requests, or complaints: tiny.threads.application@gmail.com.
The short version
- We collect what you type in, the photos you upload, and the documents you add to the vault. Nothing else.
- We do not track you, and there is no advertising or analytics in this app.
- We do not sell or share your data, and no third party gets it for their own purposes.
- Photos and documents are stored privately and are only reachable through links that expire.
- We strip location data out of every photo before storing it.
- You can delete your account, and everything in it, from inside the app.
What we collect
Your account. Your name, email address, and a password. The password is never stored — only a bcrypt hash of it, which cannot be reversed.
Your family. A family name, the people you invite, and their role.
Each child's details. Their first name, their age or date of birth, and a profile picture if you add one.
What you record. Meals and their food groups, moments and milestones with your descriptions, notes and reminders, comments, and likes. This is the content of the app, and it is whatever you choose to write.
Photos. Pictures you attach to a moment or use as a profile picture.
Documents. If you subscribe to Premium, you can add paperwork to your family's document vault: medical records, school forms, custody or legal papers, insurance cards, IDs and the like. We store the file you add, the name and category you give it, which child it is for, who added it, and when. These can be sensitive, so add only what your family needs to share.
Purchases. If you subscribe to Premium, we store a record of that subscription: Apple's transaction ID, which plan it is, when it renews or ends, and whether it was refunded. We keep it so one subscription can unlock Premium for everyone in your family. We never see your payment details.
Preferences. Reminder settings and times.
Camera. The app uses the camera only when you choose to take a photo or scan a document. Scanning happens on your phone; only the finished PDF is uploaded.
We do not collect location, contacts, device identifiers for advertising, browsing behaviour, or usage analytics. There is no third-party SDK in the app collecting anything.
Photos: what we remove
Photos taken on a phone normally carry hidden metadata, including the GPS coordinates of where the picture was taken — which for family photos is usually your home.
Before storing any image, we re-encode it and discard all of that metadata. The stored file contains the picture and nothing else. We also resize it, which means the original full-resolution file never reaches our servers at all.
Documents: who can see them
The vault is shared with your family. Everyone in your family can open and save a copy of every document in it, whoever added it. That is the point of the vault: both parents have the same paperwork. Only the person who added a document can delete it. No one outside your family can see it.
Images added to the vault have their metadata, including location, removed in the same way as photos. PDFs are stored as you provide them, so a PDF made by another app may still carry details that app put inside it, such as an author name. Scans made with the app's own scanner contain only the scanned pages.
Once another member has saved a copy of a document to their own phone, deleting it from the vault cannot remove that copy.
Children's data
The people using Tiny Threads are parents and guardians. The app is not directed to children and children do not have accounts. Information about a child is entered by an adult who is responsible for them.
By adding a child, you confirm you have the authority to do so. If you are sharing a family with another parent or relative, they will see what you record.
We treat information about children as sensitive: it is never used for advertising, never sold, never used to train any model, and never disclosed to anyone outside the services listed below that are needed to run the app.
If you believe a child's information has been added to Tiny Threads by someone without the right to do so, contact tiny.threads.application@gmail.com and we will remove it.
Why we hold it
Only to run the app: to sign you in, to show your family's journal, to store and display your photos and documents, to send the reminders you switch on, and to keep the service working and secure.
We do not use your content for advertising, profiling, or training AI models.
The "AI Insights" screen is generated from your own entries — counts, patterns and averages calculated from the meals and moments in your account. Your data is not sent to any external AI service to produce it.
Who else touches it
Running the app means using a small number of infrastructure providers. They process data on our instructions only and may not use it for their own purposes.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, photo and document storage | United States (US East, Ohio) |
| Fly.io | Runs the application server | United States (US East, Virginia) |
| Apple | In-app purchases and subscriptions | Per Apple's own policy |
| Google (Gmail) | Sends password-reset emails | United States |
We never receive your payment details. Subscriptions are handled entirely by Apple. We receive Apple's signed record of your subscription (described under Purchases above), and Apple tells our server when it renews, ends or is refunded.
We do not use analytics, advertising networks, or crash-reporting services.
Reminders
Reminders are scheduled on your device by iOS. Their content stays on your phone and is not sent through our servers. Turning them off in the app, or in iOS Settings, stops them.
How long we keep it
Your content stays until you delete it or delete your account.
When you delete your account, we remove your profile, your entries, your photos, your documents and your preferences. Content in a family shared with other people is removed too, unless another member is still using that family — in which case the shared journal and the documents in the vault remain for them, as they have their own copy of that history.
Deletion is immediate and permanent. We cannot recover a deleted account.
Backups may hold residual copies for up to 30 days before being overwritten.
Your choices
Delete your account. Settings → Delete account. It asks for your password, then removes everything described above.
Delete individual entries. Any journal entry can be deleted from its menu. A document you added can be deleted from the vault.
Get a copy of your data. Email tiny.threads.application@gmail.com and we will send you your content in a machine-readable format.
Correct something. Most content is editable in the app. For anything else, contact us.
Withdraw someone's access. Remove a member from your family in Settings.
Depending on where you live, you may have additional rights — to object to processing, to restrict it, or to complain to your data protection authority. In the UK that is the ICO; in the EU, your national authority. We answer requests within 30 days and never charge for them.
Security
- Everything travels over HTTPS.
- Passwords are hashed with bcrypt, never stored or logged.
- Your session token is kept in the iOS Keychain, encrypted by the system.
- Vault passcode. If you set one, it is stored only as a one-way hash, like your password. Face ID, if you turn it on, is handled by your iPhone; we never receive any face data.
- Photos and documents live in a private store. They are not on the public internet: each view is granted through a signed link that expires after an hour.
- Sign-in attempts are rate-limited to slow down password guessing.
- Our servers do not log the content of your entries or your email address.
No system is perfectly secure, but we do not collect data we do not need, which is the most reliable protection there is.
Changes
If we change this policy we will update the date at the top, and tell you in the app before anything material takes effect.
Contact
tiny.threads.application@gmail.com
Christian Carter, Virginia, United States