Privacy Policy

This Privacy Policy explains how André Ferreira, operating as an independent professional under the Tinyo brand ("Tinyo", "we", "us" or "our") processes personal data when you use Tinyo.

Tinyo is designed for parents and adult caregivers who want to organise and maintain personal records relating to children's health and wellbeing.

Because Tinyo can contain health information, some of the information processed by the service may constitute special category personal data, including health data, under applicable data protection law.

We take the protection of this information seriously.

This Privacy Policy should be read together with our Terms & Conditions. At account creation you also acknowledge Tinyo's Medical Disclaimer — a versioned acknowledgement that Tinyo is a personal record and does not provide medical advice.

The controller responsible for the processing described in this Privacy Policy is:

André Ferreira Operating as an independent professional under the Tinyo brand Portugal

Email: hello@tinyo.app

Tinyo has not appointed a Data Protection Officer at this time.

If you have a privacy question or want to exercise a data protection right, contact us at hello@tinyo.app.

Tinyo is intended for parents and other adult caregivers.

Tinyo is not intended for children to create or manage their own accounts.

The person using Tinyo remains responsible for ensuring that they have the appropriate authority to provide information about a child and to share that information with other caregivers.

Depending on how you use Tinyo, we may process the following categories of information.

Account information — This may include: email address; authentication information; account identifiers; account creation and update information; consent and declaration records; and information associated with your account settings.

Child profile information — This may include: child's name; date of birth; profile information; relevant personal details; blood type; allergies; health-related information; custom profile information; and other information you choose to record.

Health and medical information — This may include: medical events; symptoms; illnesses or health concerns; consultations; medications; medication doses and acknowledgements; vaccinations; growth records; measurements; notes; and other health information you choose to record.

Tinyo does not support medical document uploads at launch.

Collaboration information — Where you use collaboration features, we may process: invitations; collaborator account identifiers; collaboration roles; child-profile access permissions; and information necessary to manage access to shared child profiles.

Export information — When you use export functionality, Tinyo may process information necessary to generate your requested JSON or PDF export.

Technical and security information — We may process limited technical information necessary to operate and secure Tinyo, such as: authentication events; security-related information; service requests; error information; and information required to maintain service reliability.

Tinyo does not use third-party advertising or product-analytics SDKs that track your health information.

We do not use health information for advertising.

We primarily obtain information directly from you when you: create an account; create or edit a child profile; record a health event; record medication information; record growth or vaccination information; invite another caregiver; use export functionality; contact us; or otherwise use Tinyo.

We may also receive limited information from authentication providers when you use an authentication method such as Google or Apple.

We process personal data for purposes including:

Providing Tinyo — We use your information to: create and maintain your account; authenticate you; store and display your records; provide child profiles; provide timeline and health-record functionality; provide medication features; provide collaboration functionality; provide exports; and provide other features you request.

Maintaining security — We process information where necessary to: protect accounts; detect or prevent misuse; protect Tinyo and its users; maintain system security; and investigate technical or security incidents.

Managing legal documents and consent — We record your acceptance of applicable Terms and Privacy Policy versions and your Medical Disclaimer acknowledgement so that we can maintain evidence of which versions you accepted and when.

We also maintain a separate record of privacy declarations you make in Tinyo, such as health-data processing consent, child-authority declarations, owner sharing declarations, and recipient shared-profile access consent. These declaration versions are distinct from legal-document versions.

Providing support — If you contact us, we may process the information you provide in order to respond to your request and provide support.

Complying with legal obligations — We may process information where necessary to comply with applicable legal obligations.

Tinyo's processing may involve different legal bases depending on the purpose and type of data being processed.

Providing the Tinyo service, including account management and core functionality, is generally based on performance of the contract between you and Tinyo or steps taken at your request before creating an account.

Processing health information to provide Tinyo's health-record features requires your explicit consent through Tinyo's health-data processing consent. You may withdraw that consent in Settings; withdrawal removes health-data authorisation and schedules account deletion as described below.

Recording acceptance of Terms, this Privacy Policy, and the Medical Disclaimer acknowledgement, and recording privacy declarations, is based on our need to demonstrate compliance with legal obligations and to maintain evidence of your decisions.

Security, fraud prevention, and service reliability processing may be based on our legitimate interests in operating a secure service, balanced against your rights.

Where processing is based on consent, you may withdraw consent subject to the technical and legal consequences described in this Policy. Withdrawal does not affect the lawfulness of processing before withdrawal.

Tinyo is designed to allow adult caregivers to maintain records concerning children's health.

Health information may constitute special category personal data under applicable data protection law.

We process such information to provide the Tinyo service only where you have given explicit health-data processing consent, or where another applicable lawful basis applies.

Tinyo is intended for use by parents and adult caregivers rather than children themselves.

We do not intentionally design Tinyo for children to create accounts or submit their own health information directly.

You are responsible for ensuring that you have the appropriate authority to enter and manage information concerning a child.

Before creating a Tinyo account, you are required to review and accept: the Tinyo Terms & Conditions; this Privacy Policy; and the Tinyo Medical Disclaimer acknowledgement.

Tinyo records the relevant acceptance decisions and the versions of the documents accepted.

This allows us to determine which versions of these documents applied when you accepted them.

Separately, Tinyo may ask you to make explicit privacy declarations during use of the service. These include, for example: health-data processing consent; confirmation that you have authority to manage a child's information; owner sharing declarations when inviting collaborators; and recipient shared-profile access consent when accepting an invitation.

Privacy declarations are versioned independently from Terms and Privacy Policy versions. Tinyo records the declaration type, version, decision, and timestamp.

To use Tinyo's health-record features after account creation, you must grant explicit health-data processing consent.

When you grant health-data processing consent, Tinyo may process your child's health information to provide the health-record service.

When you withdraw health-data processing consent in Settings: health-data authorisation ends immediately — you can no longer use health-record features that require that consent; Tinyo schedules deletion of your account; and you are signed out of Tinyo.

Withdrawal does not create a dormant account with continued health-data processing.

If you restore your account during the account-deletion recovery period, health-data processing consent is not automatically restored. You must grant consent again explicitly before using health-record features.

Your health information is used to provide the core purpose of Tinyo: helping you maintain and organise personal records concerning a child's health.

We do not sell your health information.

We do not use your health information for targeted advertising.

We do not use your health information to build advertising profiles.

We do not use your health information for unrelated commercial purposes.

Tinyo is a personal record-keeping service, not a healthcare or diagnostic service.

If you use Tinyo's collaboration features, information associated with a child profile may be made available to other caregivers you authorise.

You control who you invite and what access is provided through the collaboration features available to you.

A collaborator may be able to view or manage information depending on the role assigned to them (for example Owner, Collaborator, or Viewer).

You should only invite people who are appropriately authorised to access the child's information.

If a caregiver is a collaborator on a child profile owned by another caregiver, deleting the collaborator's account does not necessarily delete the shared child profile.

The child profile may remain available to the owner and other authorised caregivers.

This is necessary for shared records to remain available to the people who continue to have authorised access to them.

You may request deletion of your Tinyo account using the account deletion functionality in Settings.

When you schedule account deletion: Tinyo schedules permanent deletion of your account and associated data; you are signed out; and you have a recovery period of seven (7) days to restore your account before permanent deletion proceeds.

If you restore your account during the recovery period, scheduled account deletion is cancelled.

Restoring your account does not automatically restore health-data processing consent if you had previously withdrawn it. You must grant consent again explicitly.

After the recovery period expires, Tinyo permanently deletes the account and associated Tinyo data owned by that account, including owned child profiles and their health records, in accordance with Tinyo's deletion procedures.

Identifiable consent and declaration history linked to your account is also permanently deleted at that point. A minimal non-relinkable accountability record may nevertheless be retained for a limited period as described under "Retention" below.

Account-level deletion may remove data earlier than any separate event-level retention period described below.

Some limited information may nevertheless be retained by infrastructure or service providers where they independently process information for security, legal, operational or other permitted purposes, or where retention is required by law. See "Retention" and "Service providers" below.

Archiving a child profile is different from deleting it. An archived child profile remains stored but is not part of ordinary active use in the same way as an active profile.

When the owner schedules deletion of a child profile: the child profile enters a scheduled-deletion state with a recovery period of seven (7) days before permanent deletion; the profile is not available for ordinary health-data access, reads, or writes through normal Tinyo features; the profile is excluded from normal export while scheduled for deletion; and only the owner may restore the profile during the recovery period.

Collaborators or viewers may see that a profile is scheduled for deletion where Tinyo presents that state, but they cannot restore it.

After the recovery period expires, Tinyo permanently deletes the child profile, its Collaboration Space, and associated health records through Tinyo's server-side purge process.

Archiving alone does not automatically trigger this scheduled-deletion purge mechanism.

When you delete an individual timeline event or event group in Tinyo, the record is removed from normal use of the service immediately.

Soft-deleted events and event groups are not available through ordinary Tinyo reads or exports. Related medication-dose acknowledgement records tied to soft-deleted events are likewise not available through ordinary user-facing access.

Tinyo retains such deleted records for a limited period before permanently purging them from Tinyo's active database. The currently configured retention period for user-deleted events and event groups is seven (7) calendar days from deletion. Eligible records are permanently removed through Tinyo's server-side purge process after that period.

This retention period is configured server-side and may be adjusted in the future. Changes apply to newly deleted records; records that already have a recorded deletion boundary retain the boundary that applied when they were deleted.

Account-level or child-profile deletion may remove records earlier than this event-level retention period where the broader lifecycle requires it.

Our retention approach depends on the type of data and lifecycle state:

Active account data — We retain your Tinyo personal data for as long as your account remains active and you continue to use the service.

Scheduled account deletion — When you schedule account deletion, your account and associated owned data remain recoverable for seven (7) days. After that period, eligible data is permanently deleted through Tinyo's account purge process.

Scheduled child-profile deletion — When a child profile is scheduled for deletion by its owner, it remains recoverable by the owner for seven (7) days. After that period, eligible child-profile data is permanently deleted through Tinyo's child purge process.

User-deleted events and event groups — As described above, user-deleted events and event groups are retained for the currently configured period (seven (7) calendar days at the time of this Policy) before permanent purge from Tinyo's active database.

Provider-controlled copies — Database and infrastructure providers may maintain their own backup, logging, or disaster-recovery copies for limited periods according to their service terms. Tinyo does not control the exact retention periods of every such copy, and complete eradication from all provider systems may not occur immediately.

Legal and operational retention — Some information may be retained where we are legally required or permitted to retain it.

Post-erasure accountability records — After permanent account deletion, Tinyo may retain a minimal non-relinkable accountability record for a limited period. This record is separate from your account and does not identify you, your child, or your email address within Tinyo's application database.

Such a record may include only the category of consent or acceptance (for example health-data processing consent or Privacy Policy acceptance), the applicable document version, whether consent was granted or withdrawn, and the original date of that event.

It cannot restore your account, cannot grant health-data processing access, and is not available through ordinary Tinyo use after your account is deleted. It is retained for the currently configured period of thirty-six (36) calendar months from the original event date and is then permanently deleted through Tinyo's server-side purge process.

This retention supports accountability obligations. It is not anonymous data, but it is designed not to be relinked to your erased account within Tinyo.

Tinyo's primary application infrastructure is configured in the European Union.

Our primary database infrastructure is hosted by Supabase in West EU (Ireland).

Tinyo's Vercel Functions are configured to execute in Dublin, Ireland.

However, the location of a primary database or application function does not mean that every processing activity performed by every service provider occurs exclusively within the European Economic Area.

Some service providers may process personal data outside the EEA in accordance with their own infrastructure, contractual arrangements and applicable data protection requirements.

Where personal data is transferred outside the EEA, Tinyo will rely on an applicable lawful transfer mechanism and appropriate safeguards where required by applicable law.

Tinyo relies on selected third-party service providers to operate the service.

These may include:

Supabase — Supabase provides infrastructure including database and authentication services. Tinyo's primary Supabase project is located in West EU (Ireland). Tinyo stores account, child-profile, health-record, collaboration, and consent data in Supabase.

Vercel — Vercel provides hosting and server-side application infrastructure. Tinyo's Vercel Functions are configured for Dublin, Ireland. Application requests may pass through Vercel when you use Tinyo.

Flinku — Tinyo uses Flinku to support invitation and deferred-install flows for collaboration invitations. Flinku may process invitation-related information such as invitation tokens and deep-link routing data necessary to deliver an invitation link. Flinku is not used to store your child's health records.

Google — Where you choose Google authentication, Google may process information necessary to authenticate your account. The use of Google authentication is subject to Google's own terms and privacy practices.

Apple — Where you choose Apple authentication, Apple may process information necessary to authenticate your account. The use of Apple authentication is subject to Apple's own terms and privacy practices.

Other providers may be introduced as Tinyo develops. We aim to use providers that provide appropriate security and data protection safeguards.

We take reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Tinyo's current security architecture includes measures such as: authenticated access controls; server-side authorisation; row-level security for stored data; separation of user and collaboration access; controlled API access; account deletion functionality; data export functionality; and minimisation of sensitive information in application logs.

No internet-based service can guarantee absolute security.

If we become aware of a personal-data security incident, we will assess and respond to it in accordance with applicable legal requirements.

Depending on your circumstances and the applicable legal basis, you may have rights including: the right to access your personal data; the right to request correction of inaccurate information; the right to request deletion of your personal data; the right to request restriction of processing; the right to object to certain processing; the right to data portability; the right to withdraw consent where processing is based on consent; and the right to lodge a complaint with a competent data protection supervisory authority.

You can exercise applicable rights by contacting: hello@tinyo.app

We may need to verify your identity before completing certain requests.

Some rights are subject to legal conditions and exceptions.

Tinyo provides functionality that allows users to export information associated with their account.

Depending on the features available, exports may include information such as: child profiles; medical timeline information; medication information; growth information; vaccination information; and other information associated with the account.

Export formats may include JSON and PDF depending on your plan and the features available to you.

Child profiles scheduled for deletion are excluded from normal export while in that state.

Export files may contain sensitive health information. You are responsible for protecting exported files after they leave Tinyo's controlled environment.

Tinyo may temporarily store information locally on your device, including information entered before an account is created.

This allows Tinyo to provide features such as local-first use and migration of information when an account is subsequently created.

Information stored locally may remain on your device until it is cleared by Tinyo, by your actions, or through deletion of local application data.

You should protect access to your device because information stored locally may be accessible to someone who gains access to your unlocked device.

Tinyo may use technologies necessary to provide authentication, security, session management and core application functionality.

We do not use health information for advertising purposes.

Tinyo does not use third-party advertising or product-analytics SDKs at launch.

Any non-essential analytics, advertising or tracking technologies introduced in the future will be addressed in an updated Privacy Policy and, where required, through appropriate consent mechanisms.

Tinyo does not sell personal data.

We do not sell children's health information.

We do not use children's health information for targeted advertising.

We do not provide health information to advertisers for advertising purposes.

Tinyo is intended to be available internationally.

Data protection laws differ between countries.

If you use Tinyo from outside the European Economic Area, additional laws may apply to the processing of your personal data depending on your location.

Where required, Tinyo will comply with applicable mandatory data protection and consumer protection requirements.

We may update this Privacy Policy when: Tinyo introduces new features; our processing activities change; our service providers change; legal requirements change; or we make improvements to our privacy practices.

When changes are material, we will provide appropriate notice and, where legally required, obtain renewed consent or acceptance through Tinyo's in-app legal-document acceptance flow.

The version of the Privacy Policy applicable to your account may be recorded when you accept it.

If you have questions about this Privacy Policy, your personal data or your data protection rights, contact:

André Ferreira Operating as an independent professional under the Tinyo brand Portugal

Email: hello@tinyo.app

If you believe that Tinyo has not handled your personal data appropriately, please contact us first at: hello@tinyo.app

You also have the right, where applicable, to lodge a complaint with the competent data protection supervisory authority.