Tiger Daddy Privacy Policy

Information we collect

From parents, we collect the Apple sign-in account identifier and email address (which may be an Apple relay address), consent choices and records, device notification tokens, and a one-way code (hash) of the App Store transaction identifier for Tiger Daddy. Parents provide the child's nickname, tasks and schedules, review decisions and return reasons, daily time allowances and limits, family timezone, and survey answers. We also keep parental privacy requests and replies, and hashes and security status for parent-issued protection-change codes.

When a parent contacts support in the app, we collect the request type, message and parent account ID. We keep replies, request and message identifiers, retry keys, status, assignment, timestamps, read status and handling records to manage the conversation. If you choose to include device details, we also collect your app version, build number, OS version and device model. These details are optional and shown before you send them.

The support form does not attach your child's account details, tasks, photos, screen time records or device logs. Attachments are not supported. Free-text messages may still contain personal information you enter. Please do not include your child's information, passwords or payment details.

Routines store the settings parents choose, including titles, steps, completion requirements, versions, estimated minutes, review and reward settings, repeat schedules, time zones, pauses and exception dates. We collect step progress, completion reports, preset help requests and responses, read and resume states, and server event times from the connected child's device. We also keep parent review and direct-completion records and reasons, self-check permission and withdrawal records, completion roles, and links to earned-time records. These routine records are used only to provide routines, connect children with parental help, show family history and keep rewards accurate. We do not use these new records for additional analytics purposes or send them to external AI services. Routine help has no free-text chat or voice recording, and we do not collect actual step durations, location, school names or medical information as routine fields. Please avoid sensitive personal details in editable text.

From a connected child's device, after parental consent, we collect an account identifier, task suggestions and completion reports, camera photos (which may show a face), screen time session start and end times and minutes, Screen Time approval and setup times, protection status, and counts of selected apps, categories and web domains. We receive counts only, not the names or identifiers of those selections. We collect notification tokens from the child's device to send service notifications. We also collect a hash of the Tiger Daddy App Store transaction identifier to compare parent and child accounts and match App Store consent withdrawals. Requests also send IP addresses and device or browser information (user agent).

We collect information through your entries, camera uploads, app actions and device requests. Photos have location and other photo metadata removed before upload. Age signals are checked on the device and are not stored on our server. A nickname or free-text task may still contain personal information you enter.

On the parent device, after the adult age check, we collect an installation identifier, app version, App Store transaction environment and verification status, and hashes used to recognize repeat installations and authorize access to installation records. For parent-install attribution, Apple AdServices receives a short-lived token and returns attribution status, campaign, ad group and keyword identifiers, and click or impression type. We store those results, not the AdServices token or raw response. The child role does not request AdServices attribution or register a parent installation.

Subscriptions and purchases

Apple processes subscription payments. We do not receive your payment card details. We store verified subscription purchase information linked to your family, including product identifiers, subscription periods, renewal status and refund or revocation status. We use this information to provide and restore subscription access and measure subscriptions and trial conversion. Transaction identifiers are stored as hashes. Our service does not use this information for third-party advertising or tracking.

How we use information

We use information to connect family devices, review tasks, calculate earned time, balances and limits, show family history, send service notifications, recover accounts, answer privacy requests, handle support requests and feedback, secure the service, and handle age and consent requirements. We measure setup progress, family use, task suggestions, tasks returned for changes, review times and survey trends within our service. Parent-install attribution helps us measure how parents find the app.

These routine records are used only to provide routines, connect children with parental help, show family history and keep rewards accurate. We do not use these new records for additional analytics purposes or send them to external AI services.

Before consent, the child's device signs in without a name or email address. Sign-in and invite-code checks send an account identifier, IP address, user agent and attempt times. We use these only for authentication and abuse prevention under COPPA's support-for-internal-operations exception. Without consent, the child's device cannot connect or send task suggestions, reports, photos or screen time sessions. We do not use these pre-consent identifiers to contact a child, build a profile or advertise. Access controls restrict them to authentication and security processing; we do not supply them to advertising or analytics providers.

Support and feedback

We use support information to investigate problems, answer questions and consider feedback. Replies to in-app requests appear in My requests. We do not automatically forward those requests to email or send email replies to them. Submitting feedback is not a promise that we will add a feature or resolve an issue by a particular date.

In the app, only the parent who submitted a request can view its conversation, including when another parent belongs to the same family. Authorized human support staff can access it to handle the request. Supabase provides the authentication, database and server functions used for this process.

We do not send support messages or device details to AI services, Slack or Linear. Slack receives aggregate queue counts and waiting-time measures, without customer or ticket identifiers or message content. Product work in Linear uses reproduction steps with personal information removed. If we find sensitive information entered by mistake, our support operator restricts access and removes it from the active support records.

Email support

If you cannot sign in or use in-app support, you can email tigerdaddy@studiolinus.app. We receive your sender address, message, any attachments you send and email technical information to handle and reply to your request. Email is handled separately from in-app conversations. Please do not include your child's information, passwords or payment details.

Cloudflare Email Routing forwards incoming email to our Google Gmail mailbox. We use Cloudflare Email Sending to send replies and keep sent copies in Gmail. These providers process email on our behalf and may process it outside your country. We have not confirmed the specific storage countries or regions for this email route. See Google's Privacy Policy, Google's data retention information and Cloudflare's Privacy Policy for their processing and retention practices.

We permanently delete each support email and its attachments from the mailboxes and other copies we control, including sent mail and trash, within 90 days after that message is received or sent, or 30 days after the request is closed, whichever comes first. Reopening a request or making another copy does not extend an existing message's deadline. A new message has its own receipt or sending date. A previous closure date does not apply to a new message received after that closure. We do not quote earlier message content or resend earlier attachments in our replies.

Provider logs, queues, backups and any previously stored message previews may remain under the providers' retention and deletion processes; their deletion is not confirmed by deleting our mailbox copies. Copies in your own mailbox are under your control. To request deletion, email tigerdaddy@studiolinus.app or use Privacy requests in the app. Email privacy requests keep their first receipt date when transferred for privacy handling.

Sharing and service providers

Our service providers process information to operate Tiger Daddy: Supabase provides authentication, databases, private photo storage, server functions, consent-request processing and in-app support; Resend receives the recipient address, notice and consent link to send parental consent and confirmation emails, with open and click tracking disabled; Apple provides Sign in with Apple, on-device age signals, App Store consent-withdrawal notifications, parent-install attribution and push notifications. Cloudflare hosts this static website and processes page and script access information. These providers fall into these categories: infrastructure and hosting; email delivery; and authentication, App Store and notification services. We do not share child information with third-party advertising or analytics services.

We do not send child photos, task details or nicknames to Resend in these emails. Under its current policy, Resend stores email and log data in the United States for 30 days and states that remaining customer data is deleted within 90 days after our Resend account is terminated. Resend separately processes service usage data, including communication source and destination information and activity logs, as an independent controller for service operation, security and improvement. These 30-day and 90-day periods may not apply to that usage data, which Resend retains under its own policies. Deletion from Tiger Daddy does not immediately delete copies held by Resend. See Resend's Data Processing Addendum, Resend's Privacy Policy and Resend's Security page.

Apple APNs receives notification tokens, notification types, random notification identifiers and generic display instructions to send service notifications. Task details are fetched separately from our server and may appear in device notification previews.

Who can see your child's information

Only the parent account that gave consent can view the child's photos, reports and records through the parent app. The child's connected device shows their own tasks, routines and time. Parents can view routines only for the child for whom they gave consent. Service providers process the information needed for their functions, and operator access is restricted to service operation and support. Children cannot publicly publish information through Tiger Daddy.

Parental consent and age

The parent role requires the adult age check. We require parental consent for the child role before family connection and collection beyond the sign-in and security processing above. We use the email address Apple shared at sign-in to send the full direct notice and a consent link. Read the notice, open the link, check the box and press Give consent. Opening the link alone does not give consent. A link expires 48 hours after the email is sent; a new request cancels the previous link.

We schedule a confirmation email to be sent about 24 hours after consent, with the notice and withdrawal instructions. If delivery fails, we pause new task suggestions, photos, reports and screen time sessions from the child's device until delivery succeeds. If the confirmation has not been delivered within 7 days of its scheduled sending time, consent ends and child-profile deletion follows. We also process App Store consent withdrawals.

Before an existing child profile starts using routines, we send the parent an updated direct notice through the consent email process and obtain updated consent for the new routine records. Opening a notice, continuing to use the app or not replying does not give this consent. Parents who do not give updated consent can continue using existing task and screen time features under their earlier valid consent; new routine collection stays off. New child profiles receive the routine notice as part of their initial parental consent process. Self-check is a separate parent setting, not a substitute for child-data consent.

Your rights as a parent

You can review your child's records and change their nickname, tasks and time settings in the parent app. To request access, correction, deletion or a copy of information, or refuse further use or collection, use the app's privacy-request feature or email tigerdaddy@studiolinus.app. We verify that the request belongs to the consenting parent account before disclosing child information.

You can also request access, correction, deletion or a copy of your own account and support information through Privacy requests or our contact email. You do not need a connected family to make a request about your own information. We verify your identity before disclosing personal information. If a privacy request arrives through general support or email, we preserve its first receipt date when transferring it for privacy handling; asking you to use a different form does not restart the response period.

To withdraw consent, delete the child's profile in the app or email us. This deletes the child's profile, task, routine and time records, disconnects the device and stops further collection; queued photo-file deletion follows. The retention section explains records kept to process requests or manage the family account. To delete the family account, use account deletion in the app or contact us. We do not require a child to provide more personal information than is reasonably necessary to take part in an activity. Refusing collection needed for connected tasks and time means the child cannot use those features.

We respond to privacy requests within 45 days; if we need up to 45 more days, we tell you why. You can appeal a refusal through the same request feature or email. We respond to appeals within 60 days and, if we deny an appeal, provide the relevant state attorney general's contact information and complaint procedure.

Turning off self-check changes how a routine is reviewed; it does not withdraw your child-data consent.

Photos

Photos are privately stored for task and routine-step review. Confirming, returning for changes or cancelling the submission makes its photo unavailable. Unreviewed photos become unavailable 72 hours after the app reserves an upload slot. The reservation occurs before the photo is sent. Unused upload reservations expire after 1 hour. File deletion follows and is retried if needed; it can take longer than the access limit.

How long we keep information

We keep information for the purposes and periods below. Scheduled cleanup can take place after a period has elapsed. Deleting a child or family, or withdrawing child consent, removes the relevant records sooner, except the processing records described below.

• Family and child records: nicknames, tasks, schedules, decisions, routines, versions, step progress, preset help, review and self-check records, reward links, time settings, protection summaries, sessions and balances support connected tasks and time management. Time history supports family review; status history, return reasons, surveys and setup records support service measures. We keep these while the family uses the app. Families inactive for 12 months are deleted. After a child has been inactive for 12 months, we ask the parent in the app whether to keep the records; no response within 30 days means child deletion. Choosing to keep them starts another 12-month period. Automatic token refreshes and background requests do not extend activity. The latest family and child activity records support this cleanup; retention-question records end with child deletion.
• Protection-change code hashes and attempt or lock status authorize changes to selected apps. Each child has one current record, replaced on a new code and removed with the child or family. The current protection summary replaces the previous summary.
• Photos and upload reservations follow the review, 72-hour and unused-reservation rules above. File paths and family identifiers in the deletion queue remain only to finish deletion, until storage confirms removal, including after family deletion.
• Notification tokens support service notifications. Child tokens are immediately cleared from our active database on reconnection, unlinking, child deletion or account deletion. Parent-device tokens remain until replaced, cleared after APNs invalidation, or account deletion. Clearing a stored token does not erase a notification already delivered. Notification jobs and their internal recipient, task, state and timing records are removed 7 days after completion, with a 7-day limit from creation for pending jobs. The parent notification inbox shows available task and screen time records from the last 7 days and stores each parent's read status until the underlying notification record is deleted. It does not create a separate copy of child message content. Support replies in the service category follow the support request's retention period.
• App Store transaction-identifier hashes support parent/child account comparison and consent-withdrawal matching; we do not send or store the raw transaction identifier for these checks. We keep one current parent hash until replacement, parent sign-in account deletion or family deletion, including while no child is connected. These hashes are identifiers, not anonymous data. We keep up to three child hashes while connected, to check repeated values and account-change limits and match withdrawals for App Store accounts previously used to download Tiger Daddy. Reconnection replaces these records; unlinking, withdrawal, child, family or sign-in account deletion removes them. App Store withdrawal markers last 30 days from receipt to handle delayed, duplicate or pre-connection withdrawals. We do not retain the original signed withdrawal payload.
• Unconnected pre-consent sign-in accounts and invite-attempt records are cleaned up after 24 hours for sign-in and abuse prevention. Invite records are removed 24 hours after expiry. Connected account identifiers remain for the connection until unlinking or deletion.
• Database authentication audit records, including recorded IP addresses, are cleaned up after 30 days for security. Authentication-session IP addresses and user agents remain until session end or account deletion. This 30-day database rule does not set the retention period for external hosting or service-provider logs. Hosting and database providers retain technical logs under their own retention policies. We do not export these logs or keep separate copies. See Supabase Privacy Policy, Supabase logging documentation and Cloudflare Privacy Policy.
• Unconsented request records, including the request email address, are deleted 7 days after the request. The email address and Apple sign-in identity remain in the sign-in account until account deletion. Consent evidence, notice version, times and confirmation status remain to manage consent and withdrawals until the relevant child, family or parent sign-in account is deleted.
• Family privacy requests and replies, including any child identifiers or personal information entered in them, remain after child deletion to handle requests, response deadlines and appeals, until family or parent sign-in account deletion.
• In-app support requests: we keep the request, messages, optional device details, read status and handling records for up to 90 days after the original submission or 30 days after closure, whichever comes first. Adding messages or reopening a request does not extend the original limit. At the limit, access ends; daily cleanup then removes the records from the active database. Deleting your parent sign-in account removes them sooner. Deleting only a family while keeping your parent account does not remove your support requests; the same support limits still apply.
• Privacy cases for parents without a connected family: we keep a separate record of the request type, first receipt date, deadline, status, handling and notification times, and case identifiers for up to 180 days after first receipt or 30 days after we finish handling your request, whichever comes first. Parent account deletion removes it sooner. This record does not copy the general support message or device details. Links to privacy cases are removed when the case is deleted and may be removed earlier after the support conversation is deleted. This does not delete the independent privacy case. Family privacy cases follow the separate family privacy retention rule. General support messages keep their own shorter retention limit.
• Deletion-completion hashes are retained for 8 days to prevent deleted data from being restored to the service.
• Account-deletion jobs temporarily keep parent and family identifiers and encrypted Apple authorization codes or refresh tokens to finish deletion and revoke Apple sign-in access. After you request account deletion, we retry disconnecting Sign in with Apple for up to 30 days from job creation. Disconnection may remain incomplete. You can stop using Sign in with Apple for Tiger Daddy in your Apple Account settings at any time. See Apple's instructions for stopping Sign in with Apple for an app or developer. The stored Apple token and identifier are cleared when access is revoked or when the job requires reauthentication, including when retries reach the 30-day limit. Parent and family identifiers are cleared at job completion. Completed jobs are removed after 7 days; unfinished file-deletion work remains until storage removal is confirmed.
• Parent-install identifiers, app version, transaction environment, installation hashes and attribution results measure installation and family setup. Records linked to a family remain for its account life and are removed on family deletion; installations never linked to a family are removed after 12 months. Child setup milestones end with child deletion. Family-level first milestones and survey answers may remain after an individual child is deleted, until family deletion. Cohort membership also remains until family deletion. After family deletion, only weekly aggregate counts without family or child identifiers remain for service measures.

Routine settings, versions, progress, preset help, review and self-check records, and reward links follow the family and child retention periods above, only as needed for family history and accurate rewards. Unused versions are deleted after references are cleared. Deleting a child or family, or withdrawing child consent, also removes the related routine records and prevents further collection. Pending changes on a device are cleared when it receives the deletion or withdrawal status; a device that is offline may retain local copies until it reconnects. Our server rejects their later upload. Photo checks follow the photo access and deletion periods above; check results may remain after the photo is deleted. Background generation, notifications and token refreshes do not count as user activity for retention.

Deletion from our active database does not immediately erase provider backups or technical logs. Providers retain those under their own policies. Our recovery process requires expired or removed support data to be removed again before service resumes. Any recovery checkpoint we keep contains limited identifiers and status and timing records, not messages or device details, and is replaced and removed before the earliest retention limit of the records it contains.

Security

Authenticated accounts, family permissions and private photo storage restrict access to information. Pre-consent identifiers are limited to authentication and security processing.

This website

This site uses no cookies or analytics and has no text-entry forms. Cloudflare processes page requests, including IP addresses and browser information, to host the site. When parental consent becomes available, a script on the parental consent page will send the verification value from your link, the version of the consent notice and your checkbox choice directly to Supabase. The verification value is in the part of the link after the # sign, so it is not sent to Cloudflare when the page first loads. Supabase will also receive your IP address and browser information with that request. The consent script will not use cookies or browser storage.

We do not track visitors across third-party websites and do not allow third parties to collect information here for tracking across websites. We do not change this site's processing in response to a browser's Do Not Track signal because we do not perform that tracking.

Changes to this policy

We post updates here with their effective date and version. For material changes to child-data collection, use or sharing, we notify parents at their consent contact email and obtain fresh parental consent before applying the changed practices. You can review the current policy here and request changes to your information through the app or our contact email.