Privacy Policy

Last updated: August 15, 2026

Tiny Treasures holds something sacred: a family’s voices, kept for a child to open one day. It is a private capsule operated by parents and invited adult family members. We use family data only to provide, protect, and support the service. We do not sell it, use it for advertising, or build advertising profiles.

Tiny Treasures is operated by LocalSquare LLC. For anything in this policy, including a request about your own data, write to privacy@tinytreasuresapp.com.

No transcription or voice biometrics, ever

We do not transcribe recordings, identify speakers, create voiceprints, infer emotion, scan for keywords, or otherwise analyze what is said. Audio is stored and played back as audio, copied byte for byte. The same holds for the short videos a family can attach to a message: we do not run facial recognition, we do not identify anyone in them, and we do not analyze their content. There are no advertising or third-party analytics SDKs in our apps. There is no model to leak, no transcript to breach.

Your recordings stay on your phone unless you ask us to keep a copy

Tiny Treasures is free for one parent recording for one child, and that has not changed. What is new is that you can choose to have that capsule backed up to your own private account, also free, so that it does not live on one phone alone. Backup is a choice you make, never a default and never a condition of using the app.

If you do not make an account, nothing you record leaves your phone. Your recordings, videos, photos, and notes live only there, and in your normal device backup, under your control. The only thing either app can send us without an account is the small set of anonymous usage events described below, which never includes anything you record or write. Recordings are stored with system data protection, encrypted whenever your phone is locked.

If you were already recording before backup existed, we do not upload any of it because you signed in, because you installed an update, or because you opened the app. We ask you once, about that capsule specifically, and if you say no we do not ask again. If you change your mind later, the offer is waiting in Settings.

Backing up is not sharing. A capsule you back up stays visible to exactly the people it was visible to before: you, and any family members you have invited. It invites no one, it changes nothing about who can see or hear any message, and a message you chose to keep private stays private. As everywhere else in Tiny Treasures, nothing is transcribed and no voice or face is ever analyzed. Your own copies stay on your phone after a backup,and you can still export your recordings to a single audio file at any time, with no account and no network. Your recordings always belong to you.

What we collect when your family syncs

Account information: sign-in provider identifiers, email address, chosen display name, relationship label, and linked sign-in methods.
Capsule information: the child’s first name, birthdate, pronoun, family membership, invitations, and message dates and settings.
Content you choose to keep: voice recordings, written messages, photos, short videos attached to a message (with a still image made from the video so it can be shown in a list), and recordings of the child’s voice called Treasures.
Optional service information: a family-line phone number, texts or voicemails sent to that line, notification tokens, reminder choices, and purchase or subscription status where a store purchase is available. A parent may also save a name alongside a number for a family member who does not use the app, so a grandparent’s call arrives with their name on it rather than a bare number. That name and number may be typed in, or brought over from the parent’s phone contacts by picking one person; the app never reads the rest of the address book.
Safety information: the report reason and optional details a family member submits, plus identifiers needed to investigate the reported message or contributor. A report does not create a copy of the private message, recording, or photo.
Anonymous usage events: a random install identifier and a small set of coarse events, for example “the app was opened” or “a message was sealed.” These never include your name, the child’s name, your recordings or photos, or the words of any message, and they are never sold or shared. On both iPhone and Android this is off until you turn it on. Until you do, nothing is recorded, nothing is stored on the phone waiting to be sent, and nothing is sent. You can turn it on, or back off again, in Settings at any time; turning it off also discards anything collected but not yet sent.
A few counts our own servers keep: for example that an invitation link was opened, or that joining failed because the invitation had expired. These are not the app setting above and no switch turns them off, because they are our servers counting their own work rather than anything about you. Each one carries a fresh random number that links to nothing else, and never your name, the child’s name, your account, the invitation link itself, or which family it belonged to.

How we use it

We use this information to sign you in, sync an invited family’s capsule, store and play the content you choose, send requested notifications, provide support, prevent abuse, and respond to safety reports. Service providers such as our hosting, database, media-storage, sign-in, notification, and app-store partners process data only as needed to provide those functions. Purchases are processed by Apple or Google; we use RevenueCat to validate them. When you sign in, we also give RevenueCat your email address and your name, where your sign-in provider gives them to us, so that a purchase record belongs to a person rather than to an anonymous code. We never send it your child’s name, your recordings, or anything in your capsule.

Service providers and where data is processed

We use a small number of providers, each for one job:

Vercel hosts the website and the API.
Neon provides the database that stores account, capsule, and message records.
Cloudflare R2 stores media: recordings, photos, and videos. Access is by short-lived signed links.
Apple provides Sign in with Apple, App Store purchases, and push notifications on iPhone.
Google provides Google Sign-In and Google Play purchases.
RevenueCat validates purchases, as described above.
Twilio carries the optional family phone line: the calls, voicemails, and texts sent to a family’s number. A family that never turns the line on never touches Twilio.
Paddle is the merchant of record for a gift bought on this website, and handles the payment. We never see your card details.
Google Analytics runs on this website only, to count visits. It is not in the iPhone or Android app, and it never receives anything from your capsule.
Microsoft Clarity runs only on the public marketing and legal pages of this website, where it creates heatmaps and session replays that help us understand how those pages are used. It never loads on sign-in, invitation, gift-code, gift-claim, purchase thank-you, or family contributor pages. It is not in either app and never receives anything from a capsule. Text entered in form fields is masked.

These providers act on our instructions and only to perform the function listed. We do not sell family data, and none of it is used for advertising or to build advertising profiles.

International transfers

Tiny Treasures is operated from the United States, and the providers above process and store data in the United States and, for some of them, in other countries where they run infrastructure. If you use Tiny Treasures from outside the United States, your information is transferred to the United States and handled under this policy. Write to privacy@tinytreasuresapp.com if you would like to know more about how a particular transfer is handled.

Family visibility

The author chooses whether each message is shared with the invited family now or kept private for the child. An author may change that visibility later. A non-author cannot read or play a private message, and this is enforced on our servers, not by the app politely looking away. Messages that arrive through the family phone line start private; the capsule owner may review that line message and choose whether to share it. Treasures of the child’s own voice are shared with the invited family, by design, so a grandparent can hear their grandchild say a first word. Removing a contributor deletes their messages unread. There is no public feed and no sharing with strangers.

The family phone line

If your family uses the phone line, so a grandparent can call or text a keepsake straight into the capsule, we store the phone numbers your family registers and use them for one thing: recognizing that caller and placing what they leave into the right capsule. Calls from numbers your family hasn’t registered are politely declined and nothing is kept. We never transcribe a voicemail.

A parent can also save a name with one of those numbers, so the people who only ever call or text, a grandparent without the app, still show up in the family by name. If you do that, you are giving us a name and a number for someone who is not a user here and has not seen this policy, so we hold it narrowly. Their name is shown to your family, the same way any family member’s name is, so that what they leave arrives from a person rather than from a stranger’s phone number, and so the child knows who it was from when the capsule opens one day. Their phone number is not: it stays visible only to you, the parent who added it. We never use either for marketing, and the number is used only to recognize that person when they call or text. If they ask to be taken out, or you simply change your mind, removing them in the app deletes their name, their number, and anything they sent, including the recordings themselves, from Tiny Treasures. One honest limit: the call itself passed through our phone carrier the way every phone call does, and the carrier keeps its own copy of call recordings under its own terms, which our deletion does not reach. You can also write to us and we will remove them for you.

If you buy a gift on our website

You do not need an account to buy a gift, so this is the one part of Tiny Treasures where we hold information about someone who never signed up.

The checkout asks for your name and email, and optionally the recipient’s name and email and a short note you write to them. We keep those with the gift record so we can send you the code and a receipt, send the recipient their gift if you gave us their address, print the card if you would rather hand it over yourself, and answer you later if you write to us about the purchase. The note is shown to the recipient, because that is its entire purpose. We do not use any of it for advertising and we do not sell it.

If you reached us by clicking an advert, your browser remembers which advert it was, and that tag travels with your purchase so we can tell which one paid for itself. It is a short code naming the advert, not you. We keep it on our own servers, we do not send it to any advertising company, and we do not use it to build a profile of you or to follow you around the internet. We deliberately chose this over the usual advertising trackers, which would have meant handing your details to someone else.

The payment itself is handled by Paddle, who are the seller of record for website purchases. Your card details go to Paddle and never to us: we never see or store a card number. Paddle processes your name, email, and billing country to take the payment and handle tax, under their own privacy policy.

If you leave the recipient’s email blank, we never learn who the gift is for until they open it. Write to hello@tinytreasuresapp.com and we will delete a gift record and the note on it, subject to the transaction records Paddle and we have to keep for tax.

Children

Tiny Treasures is designed for adults who are parents, guardians, or invited adult family members; the child is the subject of the capsule, not its operator. We collect a child’s information only as the family provides it. The one exception is the moment the app exists for: when the family decides the time has come, a parent can hand the child their key, and the child can open the capsule and listen to what was left for them. A child’s session is for listening; it cannot record messages, invite anyone, or make purchases. If you believe a child has used the service directly in any other way, or information was added without appropriate authority, contact us so we can investigate and delete it.

Storage and security

Synced content is transferred over encrypted connections and stored using access-controlled database and object-storage services. Media access uses short-lived signed links. Access is limited to the account and invited capsule membership rules enforced by our server. No online system can be guaranteed perfectly secure, so keep your own export of anything irreplaceable.

Your choices

Choose a message’s family visibility and change it later.
Export your recordings to one audio file, anytime, offline, where export is offered.
Turn anonymous usage events on or off in the app’s settings. On both iPhone and Android they are off to begin with, so there is nothing to turn off unless you switched them on.
Decline permissions (microphone, photos, notifications) and still use the app; features that need that permission simply stay quiet.
Report a shared message or another contributor from inside the Android app, or email safety@tinytreasuresapp.com.
Delete recordings you made, a contributor you invited, or your whole account, in the app or through our account-deletion page.

Your privacy rights

Whatever law applies where you live, we handle these requests for everyone rather than only where we are obliged to:

Access. Ask what we hold about you and get a copy.
Correction. Fix anything wrong. A display name, relationship label, or child’s details can be edited in the app directly.
Deletion. Delete a recording, a contributor you invited, or your whole account. See below for exactly what deleting an account removes.
Portability. Take your recordings with you as one audio file, from inside the app, free, offline, and with no account. You do not need to ask us for this one, and you do not need our permission or our continued existence to use it.
Objection. Object to a particular use of your information.
Withdrawing consent. Turn off anonymous usage sharing in Settings, decline any permission, or stop backing a capsule up. Withdrawing consent is as easy as giving it, and it never costs you access to what you have already recorded.

How to make a request: email privacy@tinytreasuresapp.com from the address on your account, and say what you want done. If we cannot tell that the request comes from the account holder we will ask you to confirm before we act, because acting on an unverified request about a family’s private recordings is its own harm. You can also delete your account yourself, without writing to anyone, from the account-deletion page. We do not charge for any of this and we will not treat you differently for asking.

How long we keep things

Recordings, videos, photos, notes, and Treasures: kept until you delete them or delete your account. We do not expire a family’s content, because the whole promise is that it is still there years later.
Account and capsule records: kept while the account exists, and removed when it is deleted.
Family-line voicemails, texts, and photos: kept with the rest of the capsule’s content, on the same terms.
Gift purchase records: kept while needed for the purchase and for the transaction records we and Paddle have to keep for tax.
Anonymous usage events: these carry no name and no account identifier, and today we do not delete them on a schedule. We are not going to state a period here that we do not yet enforce.

Account deletion and retention

Deleting a member account removes that person’s identity, messages, photos, and media from active systems. A Treasure of the child’s own voice may remain with the family without the departing member’s attribution. Deleting an owner account removes every capsule that account owns, including its child profile and all family content in it. Limited de-identified purchase, fraud-prevention, legal, and safety-report records may be retained where reasonably necessary. Residual encrypted backup copies may remain temporarily until they are overwritten under provider retention schedules. See Delete Your Account for details.

Contact and changes

Questions or privacy requests can be sent to privacy@tinytreasuresapp.com. If this policy changes, we will update the date above and request renewed acceptance when a material change requires it.