Privacy Policy

Effective Date: March 24, 2026 | Last Updated: July 15, 2026

At Tiny Tastes Tracker ("we", "us", "our"), we take your privacy and your child's privacy extremely seriously. Because our application ("App") is designed to track child feeding, sleep, medication, and allergy data, we have built this Privacy Policy to transparently explain what data we collect, how we use it, and how we protect it.

1. Information We Collect

We collect information both directly from you and automatically when you use our App.

Information You Provide Directly

Account Information: When you create an account, we collect your email address, password (securely hashed), and display name via Google Firebase Authentication.
Child Profile Data: You may voluntarily provide identifiers for your child, including their name, date of birth, and profile photos.
Health & Wellness Logs: The core function of the App requires you to input feeding logs, sleep logs, diaper logs, medication administrations, symptom tracking, known allergies, and user-generated notes.
Billing Information: In-app purchases and subscriptions are processed securely through Apple and RevenueCat. We do not collect or store your raw credit card information.

Information Collected Automatically

Device & Usage Data: We use Firebase Analytics to collect aggregated, non-personally identifiable information such as device type, OS version, crash logs, and feature usage statistics to improve the app.

Cloud Storage, Important Disclosure

Your child's tracking data, including feeding logs, sleep records, diaper logs, growth measurements, and medication logs, is stored in Google Firebase Firestore, Google's cloud database infrastructure. This is required to enable sync across your devices and the Village (family sharing) feature. This data is not stored solely on your device. Firebase Firestore data may be stored and processed in the United States. By using the App, you acknowledge that your data may be transferred to and processed in the US under Google's applicable data protection terms.

2. Special Note on Children's Data (COPPA Compliance)

Tiny Tastes Tracker is designed for use by parents and adult caregivers, NOT by children. We do not knowingly collect personal information directly from children under the age of 13. All data regarding minors is entered into the App by the parent or authorized legal guardian. By using the App to track your child's data, you consent to our collection and storage of this data for the purpose of providing the App's services to you.

3. How We Use Artificial Intelligence (AI)

Tiny Tastes Tracker utilizes the Google Gemini API to power features such as "Sage" chat, recipe generation, allergy conflict checks, and sleep predictions.

Data Transmission: When you invoke an AI feature, relevant subsets of your child's logged data (e.g., recent meals, age, and sleep logs) are securely transmitted to the Google Gemini API to generate a personalized response.
AI Training: We do not use your personal data or your child's health data to train our own proprietary AI models. Per Google's current API policies, data submitted via the API is not used to train Google's foundation models. Please refer to Google AI Terms for the most current information.

4. How We Share Your Data

We do not sell your personal data or your child's data to third-party data brokers or advertisers. We only share data with service providers essential to operating the App:

Google Firebase (Auth + Firestore): Used for secure user authentication, cloud database storage of your tracking data, and cloud functions.
Google Gemini API: Used to securely process intelligent health-adjacent recommendations and queries when you invoke an AI feature.
Apple & RevenueCat: Used strictly for subscription processing and entitlement validation.
OpenFoodFacts: When you scan a food barcode, the barcode number is sent to the Open Food Facts API to retrieve nutritional information. No personally identifiable information is transmitted.
Cloudflare Workers: All AI requests are routed through our Cloudflare Workers proxy for security, rate limiting, and request validation. Cloudflare processes request metadata (IP address, headers) and the AI request payload in transit. Cloudflare does not retain request bodies beyond the processing window.
USDA FoodData Central: When you look up food nutrition information, queries are sent to the USDA FoodData Central API (via our server-side proxy) to retrieve nutritional data. No personally identifiable information is transmitted, only food search terms.
GitHub (Feedback): When you submit feedback through the app, a sanitized, hashed summary (no raw user ID) and your feedback text are posted to a private GitHub repository for triage. If you attach a screenshot, a domain-restricted link is included. GitHub acts as a data processor for feedback only.
Village / Family Sharing: If you invite other users (e.g., a co-parent, nanny, or grandparent) to your "Village", they will have read and/or write access to your child's profile and logging data based on their permission tier. Village members must accept the Terms of Service before accessing any data. You may revoke Village access at any time in Settings.

5. Data Retention & Deletion

We retain your data for as long as your account is active. You have the right to request full deletion of your account and all associated child data at any time.

Account Deletion: You can delete your account directly inside the App by navigating to Settings > Account > Delete Account. This action will permanently erase your user record, child profiles, and all associated log data from our active Firebase databases.

5a. Data Retention Schedule

We retain different categories of data for different periods:

Data Category	Retention Period	Rationale
Active account data (profiles, logs, recipes)	Duration of account	Core service functionality
Consent records (COPPA, ToS, AI consent)	3 years after account deletion	Legal compliance / proof of consent
Feedback screenshots	90 days after submission	Triage and resolution
Firebase Analytics	Per Google's default retention (14 months)	App improvement
Crashlytics crash logs	Per Google's default retention (90 days)	Stability monitoring
AI request/response data	Not retained by us; Google's API retention per their terms	Stateless proxy

Upon account deletion, all active data is permanently removed (except consent records, which are retained for the legal hold period above). See §5 for how to request deletion.

6. Your Privacy Rights (GDPR & CCPA)

GDPR Lawful Basis for Processing

For users in the European Union or United Kingdom, we process your personal data under the following lawful bases:

Account information (email, name): Contract performance, Art. 6(1)(b)
Child health logs (feeding, sleep, medication, allergies): Explicit consent, Art. 9(2)(a) for special category health data
Analytics (crash logs, feature usage): Legitimate interests, Art. 6(1)(f)
AI feature data transmission: Explicit consent, obtained via in-app consent flow before first use

You may withdraw consent at any time by deleting your account or contacting us at [email protected]. Data Controller: Tiny Tastes Tracker (operated by Maritza Gallaga). For EU/UK data subject requests, contact: [email protected].

Rights Available to All Users

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data (Right to be Forgotten / CCPA Right to Delete).
Export your data in a portable format (Settings > Export Data).
For California residents: the right to know what personal information is collected and to opt out of any sale (we do not sell data).

7. Medical Disclaimer

The tracking tools and AI-generated insights provided by Tiny Tastes Tracker are for informational and convenience purposes only. We are not a healthcare provider, and the App is not a medical device. We do not provide medical diagnoses or treatment plans. Your data is not monitored by medical professionals.

8. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at: Email: [email protected]