Privacy Policy

LittleSteps is made by Tenton, of Str. Nazim Gafurri 13, 10000 Prishtina, Kosovo. We are the data controller for everything described here.

For any question about your data, or to exercise any of the rights below, write to support@golittlesteps.app. A person reads it, and we answer within a month.

• We do not sell your data, and we never will.
• There are no adverts in LittleSteps, and no advertising trackers of any kind.
• We do collect crash reports and a count of which screens get opened, because an app nobody can debug is an app that eventually loses somebody's memories. Neither carries a photo, a memory, or your child's name.
• Nothing you record is used to train a model or profile you.
• Nothing is public. A memory is visible to you and to the people you invite to that child, full stop.
• Deleting your account really deletes it, and you can do that yourself from the app.

Your account. Your name, and your email address and password if you create a full account — the password is stored only as a one-way hash, so nobody at our end can read it. We also keep your language, your time zone, your six-character share code, and your streak counts.

Your children. The name, birthday and gender you enter for each child, and their photo if you add one.

Your memories. Everything you record against a milestone or a day: the text you write, the photos you attach, the mood you pick, the date, and any measurements you log inside a milestone — weight, height, teeth, shoe size and similar. Measurements about your child are health-related data, and we treat them as the most sensitive thing in the app.

Your family. Who you have invited to each child's map, the relation you gave them, and whether they may edit or only read.

Your device. If you turn notifications on, we store a push token for that handset along with its platform, so a reminder can reach it. Turning notifications off, or signing out, removes it.

Technical records. Our servers keep ordinary request logs — IP address, time, and which endpoint was called — for security and debugging. We do not build a profile from them.

Diagnostics. When the app crashes, Firebase sends us a report of what it was doing at the moment it failed: the screen, the device model, the version of the operating system, and an identifier for that install of the app. Firebase also counts which screens are opened, so we can tell which parts of the app earn their place. Errors our own servers hit are recorded the same way, through Sentry. None of these records carries a memory, a photo, a measurement or your child's name, and none of them is used to advertise to you.

We never ask for your location or your contacts. Photo access works differently, and it is worth being exact about it: so the app can offer you the pictures you took around the day you are writing about, it reads your photo library by date, and reads which pictures you marked as favourites. That reading happens on your phone. Nothing leaves it except the pictures you actually choose to attach. If you save a recap card, the app writes that one image back into your library.

• To give you the service you asked for. Your account, your children's maps and your memories exist because you asked us to keep them. Without them there is no app.
• With your consent. Photographs and health-related measurements are kept on the basis of your consent, which you give by recording them and can withdraw at any time by deleting them. Push notifications are sent only while you leave the switch on.
• Because we have a legitimate interest. Keeping the service secure, stopping abuse, and fixing what breaks.
• Because the law requires it, where it does.

LittleSteps is used by adults to record their own children. Children do not hold accounts, and the app is not marketed to them. Everything about a child is entered by a parent or by somebody that parent invited.

Because of that, a child's data is never used for profiling, never used for advertising, never used for training, and never shared beyond the people you invite. When the child is old enough to ask for it, the account holder can hand the whole record over or delete it — the rights below apply to the child's data as much as to yours.

People you invite. Anybody you add to a child sees that child's memories. You choose them, and you can remove them.

The companies that run the service for us. Each one handles data on our instructions only, under a contract, and none of them may use it for anything of their own:

• Amazon Web Services — hosts the service and stores your photos.
• Expo — delivers the over-the-air updates that keep the app current.
• Apple and Google — carry push notifications the last step to your handset, if you turn them on.
• Google Firebase — receives crash reports and screen counts from the app, so we can fix what breaks.
• Sentry — records the errors our own servers hit, for the same reason.

That is the whole list. We do not sell your data and we do not pass it to advertisers or data brokers. If we are ever legally compelled to hand something over we will tell you, unless the law forbids us from doing so.

Your account, your children, every memory and every photo are held in private, access-controlled storage we run for that purpose. None of it sits anywhere a stranger can browse to, and nothing about your family can be reached from outside.

Two things leave that storage: a push notification has to pass through Apple's or Google's delivery network to reach your handset, and crash reports go to Firebase. Both are covered by the standard contractual clauses the European Commission approves for that purpose, and neither carries anything you have recorded.

Your memories stay until you remove them. That is the point of the app — a record you can still read in twenty years is no use if we quietly age it out.

• Delete a photo and it goes, along with the file behind it.
• Delete a memory and it goes the same way, with one exception: a memory filed under a milestone is permanent, because the milestone has no other way of being un-recorded. Deleting the child, or your account, still removes it, and so will asking us.
• Delete a child and their whole map goes with them.
• Delete your account and everything above goes, together with the account itself.
• Technical logs are kept for a short period for security, then discarded.
• Where the law requires us to keep a record for longer, we keep only that record and nothing else.

• Everything travels over an encrypted connection.
• Passwords are stored as one-way hashes, never as text anybody could read.
• Photos are never on a public address, and only the app you are signed in to can open them.
• Access to a child's map is checked on the server on every request, not hidden in the app.
• Only the people who need it can reach production data, and that access is logged.

No system is perfect. If a breach ever puts your data at risk we will tell you and the relevant authority as quickly as the law requires, and we will tell you plainly what happened.

You can, at any time:

• See what we hold — most of it is already visible in the app; ask us for the rest.
• Correct it — names, moods, measurements and the text of a memory are editable in the app until the chapter they sit in is finished. Two things are deliberately fixed: a child's birthday, because the whole map is measured from it, and a memory inside a completed chapter. Write to us for either and we will change it for you.
• Delete it — a child or your whole account, from the app, and free memories one by one. A memory filed under a milestone stays, as described above; ask us and we will remove that too.
• Get a copy — ask and we will send your data in a portable format.
• Withdraw consent — turn notifications off, or delete the photos and measurements you no longer want kept.
• Object or ask us to restrict processing — tell us and we will act on it.
• Complain — to us first, and to your national data protection authority if we have not put it right.

Write to support@golittlesteps.app and we will answer within a month. We do not charge for any of this.

The app uses no cookies at all. This website sets one session cookie, and it is used only to keep an administrator signed in to the admin area. There are no analytics cookies, no advertising cookies, and no third-party trackers on any page.

If this policy changes, the date at the top of the page changes with it, and anything that materially affects how your data is handled will be announced in the app or by email before it takes effect.

For anything at all about your data, write to support@golittlesteps.app. The rules for using the service itself are in the Terms & Conditions.