Privacy Policy

Information We Collect

• Account information, such as email address, sign-in details, support requests, and contact preferences, and your name if you sign in with Apple or Google and choose to share it.
• Family profile information, such as child name, birthday, family name, relationship labels, invitations, and family circle roles.
• Family memories, such as photos, videos, thumbnails, voice notes, written notes, firsts, prompts, reactions, letters, saved moments, and export files.
• Your account backup, such as how your photos are sorted, your answers and picks, readings of your family's faces, Firsts, letters, words, voice notes, and settings. It is encrypted.
• Media metadata, such as creation time, dimensions, media type, local library identifiers, and location metadata when available from saved media.
• Purchase and billing records, such as plan, billing owner, product identifiers, redemption codes, Stripe customer or subscription IDs, store purchase metadata, and refund status.
• Website form details, such as gift giver and recipient contact details, gift notes, delivery dates, partner inquiries, and checkout form entries.
• Notification details, such as your device's push token and time zone, if notifications are allowed or you share your photos with the other parent.
• Technical information, such as device permissions, app version, operating system, logs, error reports, and basic website request data.

Signing In

You can sign in with a code sent to your email, with Sign in with Apple, or, in our Android app once it is available, with Google. We never receive your Apple Account or Google Account password.

• Sign in with Apple shares the email address you choose, which can be a private address that Apple's Hide My Email forwards to you, and, the first time you sign in, your name if you allow it. We use the email to sign you in and to send account messages such as sign-in and deletion codes and a note once your account is deleted, and the name only to suggest a name for your family space. When you delete your account, we ask Apple to revoke Our Little World's access to your Apple Account.
• Sign in with Google shares your name, email address and profile picture. We use them only to sign you in and set up your account.

Apple's and Google's own privacy policies apply to your accounts with them.

How We Use Information

We use information to authenticate users, create and manage family spaces, store selected memories, organize timelines, run prompts and letters, manage invitations, process purchases and gift codes, provide support, prevent abuse, maintain security, comply with law, and improve the service.

Product Analytics

The app sends usage data so we can see which features are used and fix problems: for example, that a parent opened Tonight, recorded a voice note, or shared a moment. Usage data never includes your photos, videos, words, voice notes, names, birthdays, locations, or face data. When you are signed in, it is linked to your account and family. It is not used for advertising, and we do not sell it or share it with other companies. PostHog processes it for us as our analytics provider. Crash reports go the same way, with the kind of error and where in the app it happened, and stop when usage data is off.

Usage data is on by default. You can turn it off at any time in the app under You, Share usage data. Where the law requires it, such as in the EU and UK, the app asks before sending any. We also record purchases, renewals, cancellations, refunds, and account deletions as events, without content, to understand how the Family plan is used.

On this website, analytics is off unless you allow it. When allowed, events contain coarse actions and campaign labels only. They do not contain child names, birthdays, captions, notes, letters, prompt answers, photos, media identifiers, precise locations, contacts, checkout session IDs, or gift and redemption codes. You can deny website analytics, change your choice, or revoke consent at any time. Revoking clears the anonymous analytics identifier and campaign attribution stored by this browser and stops future analytics delivery.

If you allow website analytics, App Store links on public marketing pages may include a fixed channel label, such as website, Instagram, TikTok or email. Apple uses these campaign links to report aggregated downloads and purchases. We do not add personal identifiers, form entries, private links or arbitrary campaign text. Changing or revoking analytics consent removes these labels from future website links. Apple's own reporting privacy thresholds apply.

Local Business Referrals

If you choose to save a local business referral, we record that business with your signed-in family. This is optional and does not change your subscription. Authorized partnership operators can see aggregate referral counts and current subscription totals. Businesses do not receive your family's identity, contact details, memories, or individual billing records.

With website analytics permission, we also count partner-page visits and App Store clicks using a business identifier and a placement category. Those counts contain no account, family, device, or visitor identifier. Partner App Store links can carry an approved business campaign label for Apple's aggregate reports. The private referral and partnership-management screens do not send website or advertising analytics.

iPhone Ad Measurement

Two things help us tell which of our ads reach parents. First, Apple's own install attribution (SKAdNetwork): if you install the app after tapping one of our ads on Meta or TikTok, Apple tells that network an install happened. It carries no identifier and nothing about you or your family, and it needs no permission.

Second, an optional choice. During setup the app asks once whether you'd help measure our ads; if you say Continue, Apple shows its own tracking prompt. Only if you allow both do Meta and TikTok receive app-open events and their SDKs' device, network and technical diagnostic information, including advertising and vendor identifiers and IP address, to measure our ads and attribute activity on their services. We do not send your family's photos, words, names, birthdays, face data, account or family identifiers, photo activity, or the product-analytics event stream. Automatic screen, purchase and enhanced-content collection is disabled. Website consent and the other parent's choice do not enable it.

Turn the choice off any time in Settings, Privacy and your data, or in iPhone Settings under Privacy & Security, Tracking. Turning it off stops new measurement; events already transmitted or in flight cannot be recalled, and previously consented events held by an SDK may be retried if you later enable measurement again. See Meta's privacy policy and TikTok's privacy policy.

Optional Website Advertising Measurement

Separately from product analytics, you may allow Meta (Facebook and Instagram) and TikTok to measure visits to public marketing pages, and Meta to measure clicks to the App Store. These providers receive basic browser and network information, including IP address, and may match it with activity on their services for ad measurement and attribution. TikTok measurement runs only once its pixel and a separate measurement origin are configured.

Advertising measurement is off until you explicitly allow it. A sandboxed frame keeps provider scripts away from the parent page and its form entries. We send only a broad public page category and event name, never names, email addresses, family content, invitation codes, full page URLs, URL queries or fragments. It does not run on invitations, family moments, checkout returns, account or policy pages. You can stop future measurement here at any time. This does not erase events already received by a provider or remove cookies held on that provider's own domain.

See Meta's privacy policy and TikTok's privacy policy. This website choice does not enable advertising tracking in the iPhone app.

Photo Library Access and Discovery

With the access you grant, the app reads your photo library on your device to find photos and videos of your child. Organizing, including face, smile, and laughter recognition, runs on your device. Your photo library is not uploaded. The only photos and videos that leave your phone are ones a parent shares and ones that go to the other parent. Words and voice notes a parent adds to a photo go to the other parent too, unless you turn this off in Settings. Family members see a parent's words only on a moment shared with them, or on a photo where a family member has started a conversation, from that point on. A voice note goes with its words, which your iPhone writes out using Apple's speech recognition on the device. A First you keep or turn down (which First, its day, and its photo) is shared with your family, so both parents see the same Firsts. Letters, and your own words about a First, are private to you. They are backed up to your account, encrypted. A shared photo is sent as a resized copy without its location or other embedded photo metadata.

So that both parents' phones recognize your child and each other, the app sends face prints of the faces a parent or the app confirmed as your child or a parent. A face print is a numerical description of a face, not the photo. A “not this child” answer is shared only for a photo both parents have, as that photo and where the face is in it, never as a face print. The other phone reads that face itself. Face data is encrypted, shared only between the two parents' phones, and stored in your family's private space with a key our server issues, so it is not end-to-end encrypted. Invited family members never get it. It is not used for advertising or sold. Erase everything removes it. Leaving the family or deleting your account also removes the faces the other parent confirmed as you. Versions of the app before 1.1.6 also sent the face print with a “not this child” answer and kept look-alike prints in the backup. We have deleted those from our servers and delete any an older version still sends. The same private space also holds each parent's Growing up picks and the cover they choose for each space, so both phones show the same world. These point to photos shared with the other parent and add no photo, date, or place.

Your account backup also holds the app's readings of your photos, encrypted. It keeps face prints only of faces you confirmed, or the app matched, as your child or a parent. For every other face it keeps only where the face is in the photo. Only your account can restore the backup. It is never shared with the other parent or invited family members. Erase everything, leaving the family, or deleting your account removes it. Recovery depends on what reached that backup; check the new-iPhone recovery guidance before replacing or erasing a phone.

Face data is used only to sort your own photos. You agree to it when you connect Photos, for yourself and as the parent or guardian of your children. The Face Data Policy explains consent, how long we keep face data, when we delete it, and your rights.

The app may name and order albums using Apple's language model on your iPhone, from text about the album. No photos and nothing about them leave your phone for this.

You can change Photos, Camera, or Microphone permissions in your device settings. If future discovery features require materially different processing, we will update this policy.

What Family Members See

Family members you invite see your children's photos that the parents' phones share and the moments you share with them. They never see face data, where a photo was taken, or the rest of your photo library. Depending on the level you give them, they can leave a heart, write, or record a voice note on any photo they can see, and everyone in the family who can see that photo sees it too. A parent's own notes on a photo from before that stay with the parents.

The first time you invite family, the parents get to look through what family members will see. Family members see your children's photos once both parents have looked, or 24 hours after the first family invitation, whichever comes first. A parent on their own opens it once they have looked.

Before a photo goes to family, your iPhone checks whether it might be private, such as bath time, swimming or a diaper change, using Apple's image recognition on the device. Photos it flags are kept from family until a parent chooses to show them. The check runs only on your iPhone, and for a video it looks only at its cover picture. We store only that a photo was held back. It can miss photos, so look at what family can see. Photos in your Apple Photos Hidden album, and photos you remove from Photos or stop sharing with the app, are also kept from family.

Either parent can hide any photo from family, or delete it from Our Little World. Deleting removes the app's copy for everyone, from shared moments, and the face prints learned from it, on our servers and at our video provider. It also deletes the words, voice notes and hearts anyone left on it. It never deletes anything from Apple Photos.

You can be a parent in one family and an invited family member in other families. Each family is separate. What you add in a family is seen only by that family, and your own family's photos and face data never go to the families you visit. Leaving a family removes it from your phone.

Notifications

Notifications start quietly when you sign up or join, without a prompt. iOS delivers them to Notification Center without a sound or banner until you choose otherwise in the app or in iOS Settings. When notifications are allowed, we store your device's push token and time zone so we can send them. A notification can show a shared photo, or one of the other parent's new photos. Notifications about a shared moment say who shared it, replied or left a heart, and can name the children in it. A new share goes to everyone it was shared with, including invited family members. A reply or heart goes to the parents and to family members who wrote on that moment. When the other parent adds photos, the notification names your child. Invited family members don't get that one. If you are in more than one family, a notification names the family it is about.

The app also makes some notifications on your iPhone, such as “Is this [your child]?”, which can show your child's name and a crop of a face on the Lock Screen. These are made on your phone and never sent to our servers.

If you share your photos with the other parent, we also store your device's push token and time zone with notifications off. We use them to wake the app in the background twice a day, in your afternoon and evening, to send your new photos of your children. These wakes show nothing on your phone. Turning off photo sharing removes the token unless notifications are on.

Child and Family Information

Our Little World is for adults creating a record about their family. It is not intended for children to create accounts. Parents, guardians, and caregivers decide what information about a child or family to add to the private archive.

Payments

Apple processes in-app subscriptions bought through the App Store. When website checkout is enabled, Stripe processes website subscriptions and gift purchases. Payment providers may collect card, billing, tax, fraud-prevention, and transaction information under their own policies. Our Little World does not store full payment card numbers.

Media Storage and Processing

When you share a moment, we store a resized copy of the photo, or the video, in your family archive, with any words or voice note you chose to include. Letters, and your notes on Firsts, are private to you unless you share them. They are backed up to your account, encrypted. Our Little World is not a backup of your photo library. Your photos stay in Apple Photos.

Video processing may include upload, encoding, storage, streaming, and delivery through media infrastructure providers. In addition to our other service providers, we may use Cloudflare for video streaming, media storage, and content delivery.

How Information Is Shared

• With invited users in your family space, based on their role and the memories you share.
• With service providers that help run authentication, hosting, database, storage, payments, app distribution, email, support, analytics, and security.
• With payment platforms and app stores as needed to process purchases, renewals, refunds, chargebacks, and entitlement checks.
• When required by law, legal process, safety, security, fraud prevention, or to protect our rights or users.
• In connection with a merger, financing, acquisition, reorganization, or sale of business assets, subject to reasonable confidentiality protections.

What We Do Not Do

• We do not sell personal information.
• We do not run a public social feed, likes, followers, or ad-ranking algorithm.
• We do not store full payment card numbers.
• We do not intend for children to create accounts.
• We do not use face data for advertising or sell it, and we do not use it to recognize anyone for anyone outside your family.

Security

We use reasonable technical and organizational measures designed to protect your information, including private storage and access controls for family archive data. No method of transmission or storage is completely secure.

Retention

We keep information for as long as needed to provide the service, comply with legal and tax obligations, resolve disputes, prevent abuse, maintain backups, and enforce agreements. Deleted content may persist for a limited time in backups or logs.

Your account backup is kept while your account exists. It is deleted with your account, when you choose Erase everything, or when you leave the family it belongs to.

Your Choices and Requests

You can manage device permissions in iOS Settings, choose whom to invite, review shared family circle access, and contact support for help with access, correction, export, deletion, billing owner changes, or account removal.

Depending on where you live, you may have additional privacy rights, including access, correction, deletion, portability, appeal, or opt-out rights. We will honor applicable rights requests as required by law.

Send requests to the support address below. We may need to confirm it is you before we act. We answer within 45 days. If we decline, you can appeal by replying to our answer, and we respond to an appeal within 45 days. We never charge you or treat you differently for making a request.

International Use

If you use the service outside the United States, your information may be processed in the United States and other places where we or our service providers operate.

Changes

We may update this policy as the app, website, providers, or legal requirements change. The latest version will be posted on this page.

Contact

For privacy, account, billing, gift, or deletion requests, email support@ourlittleworld.me.