Privacy Policy
Last updated: March 25, 2026
In Plain Language
- We never collect personal data from children — no email, no location, no photos.
- Child profiles only store a nickname, age group, and a chosen avatar.
- No ads, no tracking cookies, no behavioral profiling.
- Parents control everything — view, download, or delete all data anytime from the dashboard.
- We use essential cookies only (for login sessions).
- Payments are processed by Razorpay — we never see your full card number.
- Deletion requests are fulfilled within 30 days.
Introduction
Tinyed (“we”, “us”, “our”) operates tinyed.com (the “Service”), an interactive activity book platform for children ages 3–6. This Privacy Policy explains how we collect, use, and protect information about parents (“you”) and children.
We are committed to complying with all applicable children's privacy laws including the U.S. Children's Online Privacy Protection Act (COPPA 2025), the EU General Data Protection Regulation (GDPR), the UK Age Appropriate Design Code (UK Children's Code), Brazil's Lei Geral de Proteção de Dados (LGPD), and India's Digital Personal Data Protection Act (DPDP Act 2023).
Data We Collect
Parent Account Data
- Email address (for authentication and account recovery)
- Hashed password (we never store plaintext passwords)
- Subscription status and payment metadata (processed by Razorpay)
- Referral code (if you share Tinyed with friends)
- Consent timestamp and verification method
Child Profile Data (Minimal by Design)
We collect the absolute minimum data needed to provide the Service:
- Nickname (chosen by parent — we recommend a first name only)
- Age group (enum: “3-4” or “5-6”, not exact age or birthdate)
- Avatar (selected from predefined illustrations — no photos uploaded)
- Activity progress (stars earned, activities completed, difficulty level)
- Creative content (drawings and sticker scenes saved by the child)
Data We Do NOT Collect from Children
- Email address
- Full name or last name
- Location or GPS data
- Photos, videos, or audio recordings
- Device identifiers or advertising IDs
- Browsing history or behavioral profiles
- Contact lists or social connections
How We Use Data
- Authenticate parents and manage accounts
- Display age-appropriate activity difficulty for children
- Track learning progress (visible to parents in the dashboard)
- Generate printable PDF activity worksheets
- Process subscription payments via Razorpay
- Send account-related emails to parents (password reset, subscription receipts)
- Improve the Service using anonymized, aggregated analytics
Cookies and Local Storage
We use essential cookies only. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
| Cookie/Storage | Purpose | Duration |
|---|---|---|
| supabase-auth-token | Authentication session | 7 days |
| localStorage: progress | Offline progress queue | Until sync |
| localStorage: pwa_install | PWA install prompt state | 30 days |
| localStorage: cookie_notice | Cookie notice dismissed | 1 year |
Third-Party Sub-processors
We use a limited set of third-party services to operate Tinyed. Each has been reviewed for children's privacy compliance. See our Sub-processors page for full details.
| Service | Purpose | Child Data Access |
|---|---|---|
| Supabase | Database & authentication | Nickname, age group, progress only |
| Razorpay | Payment processing | None (parent-only) |
| Vercel | Hosting & CDN | No child PII in server logs |
| PostHog | Anonymized product analytics | Aggregated only, zero identifiers |
Data Retention Schedule
| Data Category | Retention Period | After Deletion |
|---|---|---|
| Parent account | Until account deletion | Purged within 30 days |
| Child profile data | Until parent deletes child | Cascade-deleted within 30 days |
| Activity progress | Until child/account deletion | Cascade-deleted within 30 days |
| Creative content | Until child/account deletion | Permanently deleted from storage |
| Payment records | 7 years (legal requirement) | Archived, then purged |
| Analytics events | 12 months rolling | Auto-purged monthly |
| Server logs | 30 days | Auto-purged |
| Auth session tokens | 7 days | Automatically expired |
Parental Rights (COPPA)
As a parent or legal guardian, you have the right to:
- Review all data we hold about your child via the parent dashboard
- Delete your child's data at any time (Dashboard → Children → Delete Profile)
- Withdraw consent for data collection at any time
- Refuse further data collection while still accessing free features
- Request a complete copy of your child's data in machine-readable format
We will fulfill deletion requests within 30 days. All child data is cascade-deleted when a child profile is removed.
European Union Residents (GDPR)
If you are located in the EU/EEA, you have additional rights under GDPR:
- Right of access — request a copy of your personal data
- Right to rectification — correct inaccurate data
- Right to erasure — request deletion of your data
- Right to data portability — receive data in a structured format
- Right to object — object to processing based on legitimate interest
- Right to restrict processing — limit how we use your data
Legal basis for processing: Consent (parental consent for children's data), Contract (providing the Service), and Legitimate Interest (security and fraud prevention).
Data transfers outside the EU are governed by Standard Contractual Clauses (SCCs) with our sub-processors. Contact us to request copies.
United Kingdom (UK Children's Code)
Tinyed complies with the UK Age Appropriate Design Code:
- Best interests of the child are the primary consideration in all design decisions
- Default settings are set to maximum privacy (no tracking, no sharing, screen time limit of 30 minutes)
- Data minimization — we collect only what is strictly necessary
- No detrimental use — child data is never used for profiling, marketing, or behavioral targeting
- Transparency — this policy is written in plain language
- Nudge techniques — we do not use dark patterns to encourage children to provide data
- Connected toys/devices — not applicable (web-only service)
- Screen time — default 30-minute limit with break prompts at 20 minutes
Brazil (LGPD)
Under Brazil's LGPD, processing of children's personal data requires specific consent from a parent or legal guardian. Tinyed obtains verifiable parental consent before creating any child profile. Brazilian users have the right to access, correct, anonymize, block, or delete personal data. Contact us at the address below to exercise these rights.
India (DPDP Act 2023)
Under India's Digital Personal Data Protection Act 2023, Tinyed acts as a “Data Fiduciary.” We obtain verifiable consent from parents before processing any child's personal data. We do not undertake tracking, behavioral monitoring, or targeted advertising directed at children, as prohibited by Section 9 of the DPDP Act. Indian users have the right to access, correct, and request deletion of their personal data.
Security
We protect your data with:
- TLS 1.3 encryption for all data in transit
- AES-256 encryption for data at rest (Supabase)
- Row-Level Security (RLS) ensuring parents can only access their own family's data
- Content Security Policy (CSP) with per-request nonces
- CSRF protection on all state-changing API endpoints
- Rate limiting on authentication and PDF generation endpoints
- No child data stored in browser cookies or localStorage
Changes to This Policy
We may update this policy to reflect changes in our practices or applicable law. We will notify parents via email of any material changes at least 30 days before they take effect. The “Last updated” date at the top indicates the most recent revision.
Contact Us
For privacy questions, data requests, or to exercise your rights:
- Email: privacy@tinyed.com
- Subject: “Privacy Request — [Your Request]”
For COPPA-specific inquiries, parents may contact us to review, delete, or refuse further collection of their child's information. We respond to all requests within 30 days.