Privacy Policy

TinyPlate is built by TinyPlate LLC. This policy explains what we collect, why, and what you can do about it. Plain English, no dark patterns.

What we collect

The app stores the minimum we need to help you plan safe meals for your child:

• Your email address, for sign-in (magic-link OTP via our auth provider, Supabase).
• Your child's first name, to personalize the app.
• Your child's birth date, to compute their age bucket so we can filter recipes for age-appropriate textures and safety rules.
• Known allergies: the allergens you tell us your child reacts to, so the app blocks matching recipes.
• Pantry items: what's on your kitchen shelves (you add these manually).
• Your feeding style and meal logs, to tailor suggestions.

We do not collect: photos of your child, location, contact list, ad identifiers, or tracking pixels. We use a privacy-focused analytics tool (PostHog) to understand how the app is used in aggregate. See "Who sees the data" below.

Who sees the data

• You. Everything you save is tied to your account.
• Us (TinyPlate LLC). Authorized engineers can read aggregated, anonymized data for product debugging. We will never read your specific child's allergies, meal logs, or identifiable information except to respond to a support request you've initiated.
• Our data processor: Supabase, Inc. (United States). Supabase stores the database and authenticates you. Their privacy practices are at supabase.com/privacy and their DPA at supabase.com/legal/dpa.
• PostHog, Inc. (United States). We use PostHog for privacy-focused product analytics: page views, feature usage, and anonymized session data to help us improve the app. PostHog does not receive your child's name, allergies, or meal data. Their privacy practices are at posthog.com/privacy.
• RevenueCat, Inc. (United States). RevenueCat processes subscription and purchase data on behalf of Apple's App Store. It receives your anonymous user ID and purchase status, not your name, email, or child's information. Their privacy practices are at revenuecat.com/privacy.
• Nobody else. No advertisers. No data brokers. We never sell or share your personal information. Your child's age and allergies stay in our database (hosted by Supabase) and are never sold or shared.

Children's data (COPPA-conscious)

TinyPlate is designed for parents and caregivers, not children. Children do not create accounts, upload content, or interact with the app directly. Information about your child is information you provide. You have the right to:

• See everything we store about your child (the entire Baby tab and any export we provide on request).
• Correct it at any time (edit from the Baby tab).
• Delete it at any time (in the app, tap the profile icon then Delete my account; all child records cascade-delete automatically).
• Export it (email contact@tinyplate.app; we'll send a JSON export within 7 days).

If you are under 13 years of age, do not use this app.

How we protect it

• All traffic between your app and Supabase uses TLS (HTTPS).
• Database rows are protected by Row-Level Security, so other users cannot read or modify your data even if they try.
• We never transmit your child's data to third-party AI services or analytics providers.
• Supabase stores data in the United States on AWS infrastructure.
• The current version uses passwordless email OTP, so no password is stored client-side.

Retention

Your data stays as long as your account exists. When you delete your account, every child / pantry / meal / allergy record cascade-deletes immediately. Deleted data may persist in Supabase backups for up to 30 days before full deletion.

Your rights

You can, at any time, email contact@tinyplate.app to:

• Request a full export of your data (JSON, delivered within 7 days).
• Request permanent deletion of your account and all associated data.
• Ask us to stop processing your data while we sort out a question.

If you're in the EU/UK: you have additional rights under GDPR (rectification, objection, etc.). Exercise them via the same email. Our legal basis for processing is your consent (signing up + acknowledging the disclaimer) and our legitimate interest in providing the service.

California privacy (CCPA/CPRA)

We do not sell or share your personal information, and we have not in the past 12 months. If you are a California resident, you have the right to know what personal information we collect, to access or delete it, to correct it, and not to be discriminated against for exercising these rights. Exercise any of them by emailing contact@tinyplate.app.

Changes to this policy

We'll update this page when material changes happen. The effective date above will change. If the changes materially affect your rights, we'll notify the email on your account.

Contact

Email contact@tinyplate.app. General questions also: admin@tinyplate.app. For data-protection or deletion requests, please include "Privacy Request" in your subject line so we can prioritize.