Privacy Policy

Version 1.0 Effective: October 16, 2026 Last Updated: November 9, 2026

The Short Version for Tired Parents

We do not sell your personal data. There is zero advertising and zero third-party commercial tracking in Tiny Sprout.
You are the consenting adult. Tiny Sprout is an activity tracking tool built for parents and caregivers. Children do not create accounts and cannot use the app directly.
Multi-tenant isolation: Only people you explicitly invite to your household can see your baby's logs.
Honest infrastructure: Your data is hosted on Cloudflare Workers and stored in Cloudflare D1 databases. Transactional invitation emails are sent via Cloudflare Email Service.
You own your data: You can export a full JSON backup of everything on the server with one tap, or permanently delete your account at any time.

1. Who We Are

Tiny Sprout (“we”, “our”, or “us”) is a baby activity tracking application available on the web and mobile platforms at sprout.robbie.digital. The service is operated by Robbie Cook, based in New Zealand. If you have any privacy questions, concerns, or requests regarding your personal data, you can contact us directly at privacy@robbie.digital.

2. Children’s Privacy and the Role of the Adult Account Holder

Tiny Sprout is designed exclusively as an organizational utility for parents, legal guardians, and authorized family caregivers (such as grandparents or nannies) to record daily infant care activities.

The account holder is the consenting adult: All accounts on Tiny Sprout must be registered by an adult aged 18 or older. Minors are not permitted to register.
Not directed to children: The application is not marketed to or directed at children under the age of 13 (or under 16 in the EEA/UK), and children do not directly interact with or enter information into Tiny Sprout.
Parental consent for infant records: Information about babies (names, birth dates, growth milestones, and care logs) is submitted entirely at the direction and with the express consent of the child's parent or legal guardian.

3. What We Collect and Why (Grounded in Our Code)

We collect only the minimum information necessary to authenticate you, synchronize data across your household, and keep your care logs safe. Every piece of data stored in Tiny Sprout corresponds to an explicit database column in our schema:

Category	Specific Fields Stored	Purpose & Code Usage
Account Details	Display name, email address, salted & hashed password, profile image (optional).	Authenticating you, securing access via Better Auth, identifying family members in shared households, and managing invites. Plaintext passwords are never stored or logged.
Session & Security Data	Session token and expiration timestamp. We do not store your IP address or device/browser (User-Agent) details with your session.	Stored in the `session` table to keep you securely signed in (30-day rolling session). Expired sessions are deleted automatically every day. To stop brute-force attempts, sign-in and sign-up requests are counted per IP address for a few minutes; those counters are deleted within a day.
Baby Profile	Name/nickname, date of birth (`YYYY-MM-DD`), sex (Female, Male, Other, or null), avatar tint color, optional photo data URL.	Stored in the `baby` table to calculate age, personalize timelines, and render avatars across household devices.
Activity & Care Logs	Event type, start time (epoch ms), duration/end time, notes, structured data payload (amounts, ounces/mL, formula brand, nursing side durations, diaper wet/dirty consistency, growth measurements, routines), deduplication key, and author user ID.	Stored in the `entry` table to render the merged chronological activity feed, compute trends and counts, and maintain an accurate log of your baby's daily rhythm.
Household & Sharing	Household name, member user IDs, assigned roles (`owner`, `editor`, `viewer`), join timestamps.	Stored in `household` and `household_member` tables to enforce strict tenancy: no member can access a baby or entry without a valid household membership.
Invitations	Invitee email address, SHA-256 token hash (the raw token is sent only in the invite link and email, never stored raw in the database), expiration timestamp (7 days), inviter user ID.	Stored in the `invitation` table to allow family members to invite partners or caregivers securely.
Household Preferences	Family-wide preference key-value pairs (e.g. `showFeedReminder`).	Stored in `household_pref` so that household-wide decisions (such as showing the home feed reminder) stay synchronized across all members.
Bug Reports (Voluntary)	Freeform report text and a small diagnostic summary (screen, window size, app build version, recent app error messages). Reports are stored anonymously: we do not record who sent one, your device or browser details, or your IP address.	Stored in `bug_report` only when you voluntarily tap “Report a bug” to help us diagnose and fix client glitches.

4. Lawful Basis for Processing

Under the GDPR, New Zealand Privacy Act 2020, and similar international standards, we process your information based on:

Contractual Necessity: To provide you with the account, multi-device synchronization, and activity logging services you request.
Parental Consent: Your explicit consent in entering your child's milestones, diaper logs, and feeding notes.
Legitimate Interests: Protecting the security and integrity of the service through rate limiting (edge and D1 limits), automated intrusion defence, and fraud prevention.

No data sales or advertising: We do not sell, rent, monetize, or broker your personal information or your child’s data to third parties. We do not use your data for advertising, marketing profiling, or behavioral targeting.

5. Third-Party Service Providers (Data Processors)

We keep our infrastructure minimal. We do not integrate third-party ad networks, tracking pixels, or commercial telemetry SDKs. The only external processors involved in running Tiny Sprout are:

Cloudflare, Inc. (United States & Global Edge): Provides edge computing (Cloudflare Workers), database hosting (Cloudflare D1 SQLite database), and native transactional email (Cloudflare Email Service for sending household invitation emails). Cloudflare complies with standard data protection terms and security certifications.

Verified in code: Tiny Sprout does not use Resend, Google Analytics, Firebase, Sentry, or any social media SDKs. If Cloudflare Web Analytics is enabled at the edge, it is non-identifying, privacy-preserving performance telemetry that uses no cookies and stores no personal data.

6. Cookies and Local Storage

Cookies

Tiny Sprout uses a single first-party session cookie (managed by Better Auth, named sprout_session or better-auth.session_token). This cookie is strictly necessary for service operation: it is set with HttpOnly (inaccessible to malicious scripts), SameSite=Lax (protecting against cross-site request forgery), and Secure (only transmitted over HTTPS in production). We do not set any advertising, tracking, or cross-site cookies.

Local Storage (`localStorage`)

The web app uses your browser’s localStorage to store preferences and a small cache of your recent data. The exact keys used in code are:

sprout.theme: Stores your visual theme preference ('light' or 'dark').
sprout.cache.v1: A local copy of your household babies, recent entries, and preferences, kept so the app can show your last-known data while it loads. Cleared immediately when you sign out or delete your account.
sprout.queue.v1: Entries whose save failed because of a dropped connection, kept so the app can retry them.
sprout.returning: A simple flag ('1') so the login screen defaults to “Sign in” instead of “Create account” on devices you have used before.
sprout.tiles.v1: Stores your custom drag-and-drop order for quick-log action buttons.
sprout.collapse.v1: Remembers whether collapsible sections on entry sheets are open or closed.
sprout.bell.seen: Tracks the latest “What’s New” changelog version you have viewed so we do not show repetitive alerts.
sprout.a2hs.dismissed: Remembers if you dismissed the iOS Safari “Add to Home Screen” prompt.

7. Data Retention & Concrete Deletion Path

We believe you should have complete control over how long your family’s data exists. Here is exactly how retention and deletion work in our code (worker/account.ts):

How Account Deletion Works in the Code: You can trigger permanent account deletion at any time from Account → Delete account (which requires typing your current password). When initiated:

Sole-member households: If you are the only member of a household, that household is deleted entirely from the database. Cloudflare D1 foreign key cascades (ON DELETE CASCADE) immediately and permanently delete every baby, care entry, invitation, and preference associated with that household.
Shared households (co-parenting & families): Because a child's care log belongs to the whole family care team, a shared household is not destroyed when one parent departs. Your membership is removed, and if you were the sole owner, ownership is automatically transferred to the oldest remaining member. Any entries, invitations, or household records you created are re-assigned to an anonymous tombstone user (usr_deleted, labelled “Former member” with dummy email deleted-user@invalid), completely removing your name, email, and identity.
Bug reports: Bug reports are already stored without any link to you, so there is nothing to disconnect.
Credentials & Sessions: Your password hash, credentials, and active session tokens are wiped from D1.
Device cache: The cached data in your browser’s localStorage is wiped.

Individual entries & baby profiles: You can delete any individual care entry at any time (hard delete). Household owners can archive baby profiles (soft deletion recorded with an archived_at timestamp). Invitation links expire automatically after 7 days.

Automatic cleanup: Every day Tiny Sprout deletes expired sign-in sessions, expired password-reset links, and the short-lived per-IP counters used to block brute-force sign-in attempts. Our hosting provider (Cloudflare) is configured not to keep a per-request log of your visits.

8. Your Rights and How to Exercise Them

Regardless of your geographic location, we respect your fundamental data rights:

Right of Access & Portability: You can export a complete machine-readable backup of all your babies, entries, households, and settings directly from the app at any time (tap Account → Export Data Backup (JSON)).
Right of Rectification: You and any editor in your household can edit or correct logged entries, baby profiles, and preferences directly in the app.
Right to Erasure (Deletion): You can delete individual log entries or delete your entire account as detailed above.
Right to Withdraw Consent: You can leave a household, remove members, or delete your account at any time.

If you need assistance with an access, export, or deletion request, please email privacy@robbie.digital. We respond to all verified requests promptly.

9. Data Security

We implement rigorous technical safeguards grounded directly in the application architecture:

Strict Tenant Isolation: Every database query in worker/tenancy.ts strictly verifies that the authenticated user belongs to the target household before exposing any baby or entry. Nothing is reachable by ID alone.
Encryption in Transit: All communications require modern TLS 1.3/HTTPS encryption with HTTP Strict Transport Security (HSTS) pinned.
Origin & CSRF Protection: Every state-changing API request verifies first-party origin headers, preventing cross-site attacks.
Modern Security Headers: Pinned Content Security Policy (CSP), X-Content-Type-Options: nosniff, X-Frame-Options: DENY (preventing clickjacking), and strict Cross-Origin-Opener policies.
Brute-Force Rate Limiting: Multi-tiered rate limiters at both the Cloudflare network edge and inside the D1 database protect sign-in, account creation, and invitation guessing.

10. International Data Transfers

Tiny Sprout is operated from New Zealand and hosted on Cloudflare's global infrastructure. Your information may be processed and stored on Cloudflare servers distributed internationally. By using Tiny Sprout, you acknowledge that your information will be transferred to and processed in these facilities under Cloudflare’s enterprise-grade security standards.

11. Changes to this Privacy Policy

If we update this Privacy Policy, we will post the revised version at this URL with an updated “Last Updated” date and record the revision in our version changelog. If changes are material, we will provide additional notice through the application.