Privacy Policy

1. Introduction

Tiny Roots (“Tiny Roots”, “we”, “us”, or “our”) provides a mobile application that helps parents and guardians build daily connection habits with their children through curated activities, an AI parenting companion, and a private memory journal (the “App”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

The App is built for parents and guardians, not children. A child never creates an account, logs in, or interacts with the App directly. Every account belongs to a parent or legal guardian (“you”, the “Parent User”), and any information about a child is entered and controlled by that Parent User. See Section 8, “Children’s Privacy,” for details.

By creating an account or using the App, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the App.

2. Information We Collect

a. Information you provide directly

• Parent account information: your phone number (used for OTP-based sign-in) and your name.
• Child profile information: your child's name, date of birth, gender, city, religion, grade, school board, content language preference, sibling status, interests, developmental goals you'd like to nurture, and any concerns or areas you'd like support with.
• Photos and memories: photos you capture within the App to build your child's memory timeline, along with any captions or context you add.
• Conversations: messages you send to the AI parenting companion, including any details you share about your child or parenting situation.
• Feedback: your reactions to curated activity cards (e.g. marking a card helpful or "not for us").
• Consent records: your explicit consent to this policy and our onboarding terms, recorded with a timestamp and version.

b. Information collected automatically

• Usage data: which features you use, how often you engage with cards or the companion, and general app-interaction patterns, used to personalize your experience.
• Device and log data: device type, operating system, app version, and basic diagnostic/crash information, used to keep the App reliable and secure.

c. Sensitive information about your child

Your child’s date of birth and religion are treated as sensitive fields. We encrypt these specific fields at rest using industry-standard symmetric encryption, in addition to the general security measures described in Section 6.

3. How We Use Your Information

• To create and secure your account, and verify your identity via one-time passcode (OTP).
• To personalize the daily activity cards, AI companion responses, and insights we show you, based on your child's age, interests, goals, and your prior interactions.
• To build and display your child's private memory timeline.
• To extract and remember helpful context from your conversations with the AI companion (for example, a preference or concern you've mentioned), so future guidance is more relevant — this happens automatically in the background.
• To send you service-related communications, such as OTP codes.
• To detect, prevent, and respond to fraud, abuse, or security incidents.
• To improve the App through aggregated, de-identified analysis of how features are used.

We do not sell your data, and we do not use it for third-party advertising. Tiny Roots does not run ads and does not share your family’s information with data brokers or advertising networks.

4. AI Processing and Third-Party Service Providers

We work with a small number of service providers who process information on our behalf, under contractual confidentiality and data-protection obligations. We do not permit these providers to use your data for their own independent purposes.

• AI language model provider (OpenAI): messages you send to the AI companion, and the contextual information needed to generate a relevant reply (such as your child's age or previously shared context), are sent to OpenAI's API to generate responses and to extract memory facts. OpenAI processes this data to provide the completion service; see OpenAI's own privacy policy for how they handle API data.
• SMS delivery provider (MSG91): your phone number is shared with our SMS provider solely to deliver OTP codes for sign-in.
• Cloud hosting infrastructure: your account data, child profiles, photos, and conversation history are stored on secured cloud servers that we operate and control.

We do not require a human reviewer to read your conversations as a matter of course. Automated processing (by us or our AI provider) may occur to generate responses, extract memory facts, and to detect content that indicates a safety concern (see Section 9).

5. How We Share Information

We share information only in the following circumstances:

• With the service providers described in Section 4, solely to operate the App.
• If required by law, regulation, legal process, or governmental request.
• To protect the rights, property, or safety of Tiny Roots, our users, or the public, including in situations that appear to involve a risk of harm to a child.
• In connection with a merger, acquisition, or sale of assets, in which case we will notify you before your information becomes subject to a different privacy policy.

We never sell your personal information or your child’s information.

6. Data Security

• All data in transit between the App and our servers is encrypted using HTTPS/TLS.
• Account sessions are authenticated using signed bearer tokens (JWT).
• Your child's date of birth and religion are encrypted at rest, as described in Section 2(c).
• Access to production data is restricted to authorized personnel who need it to operate and support the App.

No method of transmission or storage is 100% secure. We work to protect your information but cannot guarantee absolute security.

7. Data Retention and Deletion

We retain your account and child profile information for as long as your account is active, so that we can provide the App’s features.

You can permanently delete your account at any time from Profile → Delete Account within the App. Deleting your account removes your parent profile, your children’s profiles, your captured photos and memories, and your conversation history from our active systems. This action cannot be undone, and there is no recovery period once deletion is confirmed.

You can also request deletion by emailing us at friends@tinyroots.life. We will complete verified deletion requests within 30 days, except where we are required to retain limited information for legal, security, or fraud-prevention purposes.

8. Children's Privacy

Tiny Roots is designed to be used by parents and legal guardians. We do not knowingly collect personal information directly from children under 13 (or the relevant age of digital consent in your country). The App has no child-facing login, registration flow, or interface — every account is created and operated by an adult Parent User.

Information about a child (such as their name, date of birth, photos, or interests) is provided to us by the Parent User, who represents that they are that child’s parent or legal guardian and have the authority to share this information with us on the child’s behalf. If you are a parent or guardian and believe your child has provided us with personal information directly, please contact us at friends@tinyroots.life and we will investigate and delete such information promptly.

This section is intended to satisfy the notice requirements of the U.S. Children’s Online Privacy Protection Act (COPPA) as applicable, given that the App may be used by parents located in the United States, and analogous children’s-data protections under India’s Digital Personal Data Protection Act, 2023.

9. Safety Monitoring

Because parents sometimes discuss sensitive parenting situations with our AI companion, our systems include automated checks intended to flag conversations that may indicate a risk to a child’s safety or well-being. The AI companion is not a medical, psychological, or emergency service — for anything involving a possible medical, developmental, or mental-health concern, or an emergency, please contact a qualified professional or local emergency services directly.

10. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, export, or delete the personal information we hold about you and your child, and to withdraw consent for processing. You can exercise most of these rights directly within the App (editing your or your child’s profile, deleting memories, or deleting your account). For anything else, contact us at friends@tinyroots.life.

If you are located in India, these rights are provided consistent with the Digital Personal Data Protection Act, 2023. If you are located in the United States or elsewhere, we will honor applicable rights under your local law to the extent required.

11. International Data Transfers

Tiny Roots and its service providers may process and store information on servers located outside your country of residence, including in India and the United States. Where we transfer information internationally, we take steps to ensure it receives a comparable level of protection to that described in this policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the App or by other reasonable means before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at friends@tinyroots.life.