Tinytend

Privacy Policy

This policy explains what personal data Tinytend uses, why, who receives it, how long we keep it and how you can control it. It starts with the short version and the part specific to Tinytend, followed by the rules that apply to all our apps and the information required in particular countries.

Last updated: November 5, 2026

The short version

ODBS LLC is responsible for your personal data in Tinytend. You can reach us at info@odbs.tech.
Your baby’s records are health data: Tinytend stores and syncs them only with the explicit consent you give in the app, and shows them only to your household’s members, according to their role.
Records and photos are stored on servers in Frankfurt, Germany. Tinytend has no advertising and no analytics or tracking tools, and we never sell your data.
Timer notifications and Live Activities can show your child’s name on the phones of your household’s members.
You can download a copy of your data, withdraw your consent and delete your account in Settings.
We use your data to provide Tinytend and the features you choose, to keep it secure and working, and to meet our legal obligations.
We do not sell your personal data, do not use it for targeted advertising and do not share it with data brokers.
Health information is used only to provide the features you use, with your consent. It is never sold or used for advertising.
You can access, correct, export and delete your data and withdraw your consent. See section 9 for how.

This summary helps you find your way; the full policy below is what applies.

1. Who we are

Tinytend is made by ODBS LLC (“ODBS”, “we”, “us”), a limited liability company organised in Wyoming, United States, at 30 N Gould St, Ste N, Sheridan, WY 82801, United States. ODBS LLC is the controller responsible for the processing described in this policy, unless this policy says otherwise.

This policy covers the Tinytend app, its online services, its website and our support. It does not cover services run by others that you use with Tinytend, such as app stores, sign-in providers or payment providers; their own privacy policies apply to them.

For any question about privacy or to exercise your rights, write to info@odbs.tech. Please include “Tinytend” in your message.

Read the terms of use

2. How Tinytend uses your data

What Tinytend is and where data is kept

Tinytend is a baby log that a household shares. Parents and the people they invite record feeds, sleep, diapers, health notes, growth and milestones, and see the same timeline on their own phones. Tinytend has no advertising, no analytics or tracking tools, and we never sell your data.

Your household’s log is kept on our server and on the phones of its members, so that it works offline and stays in sync. Each phone keeps its copy in the app’s protected storage, which Tinytend’s widgets, Live Activities and Apple Watch app also use. The doctor summary is created on your phone.

Your account

You can start as a guest. To use Tinytend on another device you can sign in with Apple, with Google where the app offers it, or with a one-time code sent to your email address; there are no passwords. We store an account identifier, the email address and name your sign-in provider shares with us (if any), your language, your time zone and your consent choices.

We also store the app installations you use (platform and app version), the recovery key that lets a guest come back after a reinstall in a form that cannot be read back, and, with Apple, a token so we can revoke Tinytend’s access when you delete your account. Each consent you give or withdraw is recorded with its time, your language, the app version and a shortened IP address.

To protect the service we use device checks provided by Apple and rate limits, and we keep technical logs (such as IP address and request time) for security.

Your baby’s records (health data)

The records you and your household enter are about your child and include health information: feeds, sleep, diapers, pumping, temperature, medication, symptoms, vaccines, growth measurements (weight, length, head circumference), milestones, activities and notes. The child profile holds your child’s name, date of birth, the due date if your baby was born early, and optional sex.

Entries can include details such as amounts, foods, allergens and reactions, diaper colour and rash, the names and doses of medication as you write them, symptoms and their severity, and vaccine lot numbers, as well as who logged or changed each entry and when.

Under the GDPR and Türkiye’s KVKK this is special category (health) data. We process it only with the explicit consent you give in the app before the first child or record is added; the consent text is published at https://tinytend.odbs.tech/en/health-data. We use the records only to store them, sync them between your household’s devices and show them to your household.

Children’s names and the notes on entries are additionally encrypted in our database and its backups. The household name, which the app creates from your child’s name, and the other details of entries are protected by our general security measures but not by this additional encryption.

Children’s data

Tinytend is used by adults (18 or older) to keep records about their children; children do not use the app and we do not knowingly collect data from children. The data about a child is entered by a parent or by a caregiver the parent invited. Photos of the day are added by the household’s owner and parents, who decide which photos of the child to share with the household. Parents can exercise the child’s data protection rights on the child’s behalf, and the child can later ask us to delete data about them.

Your household

Everything logged in a household is visible to its members according to their role (owner, parent, caregiver or viewer). Each entry shows who logged it. Members see each other’s display name. When someone leaves or is removed, the entries they made stay with the household. Invites are links or QR codes; anyone who has a valid invite can join with the role it carries, so share invites only with people you trust.

Owner and parents see the children, every entry, photos of the day, the members and the household’s history of changes (who added, changed or removed what).
Caregivers see the children and every entry, but not photos of the day or the history.
Viewers see the children, every entry and photos of the day, but not the history.

An invite is valid for 72 hours and can be used once. When a member deletes their account, their entries and photos stay with the household and are shown as added by a former member. The camera is used only to scan the QR code of an invite; nothing is recorded or uploaded.

Photo of the day

With Tinytend Pro, your household can keep one photo per child per day (“photo of the day”); adding a new photo for the same day replaces the previous one. Photos are shown on the Today screen and in a day-by-day list of memories.

You choose a photo with the system photo picker: the app receives only the photo you pick and cannot see the rest of your photo library, so it does not ask for photo library permission. Before uploading, the app re-encodes the image and removes its metadata (EXIF), including GPS location and camera or device details. Our server decodes and re-encodes the image again without metadata and stores resized versions (thumbnails). We never store where a photo was taken.

Only current household members with a family role see the photos: the owner, parents and viewers. The owner and parents can add or replace a photo; a photo can be deleted by the member who added it or by the household owner. Members with the caregiver role cannot see or add photos. Someone who leaves or is removed from the household loses access at once; photo links already loaded on their phone expire within about an hour.

Photos are stored encrypted at rest (AES-256) in Tinytend’s private Amazon S3 storage on Amazon Web Services servers in Frankfurt, Germany (eu-central-1); Amazon Web Services stores them only on our behalf. The app on your household’s devices loads them through signed links that expire after about an hour. We use photos only to store them and show them to your household: they are never used for advertising, analytics, profiling, face recognition or AI training, and they are not shared with third parties.

Photos are kept by the household, not by the account that added them. If the member who added a photo leaves the household, the photo stays with the household; if they delete their account, it also stays and is no longer linked to them.

Notifications, Live Activities and the Apple Watch

The app registers for silent Apple push notifications so that new entries reach your other devices; the push token is stored with your device. We store it together with your language, time zone and app version. Silent notifications contain no records.

When a member starts a nursing, nap or pumping timer, the phones of the other members can show a Live Activity and a notification with the child’s name and what was started. The member who started a timer can get a reminder with the child’s name if the timer is still running after a while, and members can see a notice when someone takes over. These notifications are delivered through Apple Push Notification service.

Widgets, Live Activities and the Apple Watch app can show your child’s name and recent entries on your lock screen and on your watch. If you start a trial, the app schedules a reminder on your phone two days before it ends.

Doctor summary

The doctor summary is created on your phone from your household’s entries for the period you choose. It is not sent to us; you decide whether to share it, and with whom, through your phone’s share sheet.

Purchases, crash reports and support

Tinytend Pro is an auto-renewing subscription sold by Apple. Apple processes the payment; we never see your card details. RevenueCat receives the purchase receipt and your account identifier so that we can confirm which household has Pro.

If the app or our server fails, an error report is sent to Sentry (EU region). Reports from the app contain technical details such as the device model, the OS version and the place in the code that failed; they are not linked to your account and do not contain your baby’s records. Reports from our server are linked to your account identifier and do not contain your baby’s records. Sentry also receives performance measurements from a sample of requests.

If you send feedback from the app (Settings → About → Send feedback), we keep your message, its category, the email address you give for a reply (optional), and the app version, platform and language. If you write to us, we use your message and email address to answer.

Members of our team can see account, household, subscription and feedback details in our support console when this is needed to help you or to protect the service. The console gives no access to your children’s profiles or records.

Service providers and where data is processed

Your account, your household’s records and its photos are stored on Amazon Web Services servers in Frankfurt, Germany (eu-central-1). We use these processors under data processing agreements:

Amazon Web Services: our server, database, backups and photo storage, Frankfurt, Germany (EU).
Cloudflare: network delivery and protection of the app’s server and this website, on its global network.
RevenueCat: subscription status, United States.
Sentry: crash reports and performance measurements, EU region (Germany).
Resend: sending sign-in codes and codes to confirm a new email address, United States.
Apple: Sign in with Apple, push notifications, App Attest and purchases; Google: only if you sign in with Google.

Some of these providers may process limited data, such as your account identifier, email address or technical request data, in the United States or other countries.

How long Tinytend keeps data

Account data: while your account exists. Deleting your account takes effect at once.
Guest accounts: a guest account that is not used for 180 days (400 days if it has a recovery key) is deleted automatically.
Household data (children, entries and photos): while the household exists, also after the member who added it leaves or deletes their account.
Deleted entries: their content is removed from our servers 30 days after deletion.
Households: a household that is deleted because its owner deleted their account without a parent to take it over is erased with its children, entries, photos and history 30 days after the deletion; a household whose only member deletes their account is erased at once.
Photos of the day: a replaced or deleted photo is removed from storage shortly afterwards, and an uploaded photo that was never set as a day’s photo is deleted automatically within about 24 hours. When a household is erased, its photos are erased with its other data.
Data exports: the archive is deleted from our servers after 7 days.
Backups: encrypted, deleted after 180 days.
Feedback: 365 days, or until you delete your account.
Push tokens: removed 30 days after they stop working or after 270 days without use.
Records of the emails we send you, such as sign-in codes: 90 days.
Server logs: overwritten on a rolling basis as new logs are written.
Crash reports: kept by Sentry for a limited period, then deleted.
After you delete your account: a record of the consents you gave and withdrew, without your IP address or device identifiers, as proof of consent; purchase records; and the records of our team’s access to accounts (12 months for views, 24 months for changes).

Your choices in Tinytend

Copy of your data: Settings → Download my data. The ZIP file contains your account, the households you belong to with their children and every entry, the image files of the photos you added and the household’s list of photos (which child and day, and who added each); photos added by other members are not copied into your archive and remain available in the app to the household’s owner, parents and viewers.
Health data consent: Settings → Health-data consent → Withdraw consent. Tinytend then stops taking new entries from you at once, and your phone no longer receives the household’s children and records; what your household already logged stays with the household until it is deleted.
Correcting or deleting entries: in the app, according to your role. Changing and deleting entries needs an active Tinytend Pro subscription in the household; you can also write to info@odbs.tech.
Members and invites: in the Family tab, according to your role.
Camera and notifications: in your iPhone’s settings.
Deleting your account: Settings → Delete account. If you own a household, it passes to a parent or is deleted as described above.

Legal bases for Tinytend

Your baby’s records and other health data: your explicit consent (GDPR Article 9(2)(a); KVKK Article 6), given on its own screen in the app and withdrawn in Settings.
Your account, household, invites, sync, notifications, export and subscription, and photos of the day: to provide the app and the features you chose to use (contract). We do not process photos of the day as health data.
Device checks, rate limits, technical logs, crash reports, feedback and our team’s support console: our legitimate interests in keeping the service secure and working and in improving it.
Consent and purchase records: our legal obligations.

3. Our legal bases

Where the law requires a legal basis for processing personal data, such as the EU and UK General Data Protection Regulation (GDPR), Türkiye’s Personal Data Protection Law (KVKK) or Brazil’s LGPD, we rely on the following bases, as described for each use in the part of this policy specific to Tinytend:

Contract: to provide Tinytend, your account and the features and purchases you ask for.
Consent: where we ask for it, for example for optional analytics or for sending content to a third-party AI service. You can withdraw your consent at any time in the app or by writing to us; this does not affect processing that took place before.
Legitimate interests: to keep the service secure, prevent fraud and abuse, fix errors and answer your requests, where these interests are not overridden by your rights. You can object to this processing.
Legal obligation: to keep records required by law, such as tax and purchase records, and to answer lawful requests from authorities.

Health information is special-category or sensitive data. We process it only with your explicit consent, which you can withdraw at any time, in which case we stop processing it for the features that depend on it.

Some data is needed to provide Tinytend; without it, the app or a feature cannot work. Where data is optional, the app tells you or lets you choose.

5. Health information

Health information you record or allow Tinytend to read is used only to provide the features you use, such as your records, charts, reminders and reports. We do not sell it, do not use it for advertising or marketing, and do not share it with third parties other than the service providers needed to run those features, or as you direct, or as the law requires. We do not use it for insurance, credit, employment or similar decisions about you.

6. International transfers

ODBS is based in the United States, and our service providers process data in the countries stated for Tinytend. When personal data is transferred from one country to another, we use the safeguards the law requires, such as adequacy decisions, the EU-US Data Privacy Framework where a provider is certified, the European Commission’s standard contractual clauses and their UK and Swiss equivalents, and the mechanisms provided by other laws, such as the KVKK and the LGPD.

You can ask us for more information about the safeguards for a particular transfer by writing to info@odbs.tech.

7. How long we keep data

We keep personal data only for as long as it is needed for the purposes described in this policy. The part specific to Tinytend lists the main periods. In general:

Your account and your content are kept until you delete them or your account, unless a shorter period is stated.
When you delete your account, we delete its data or remove everything in it that identifies you, except for data we must keep to meet legal obligations, to resolve disputes or to protect against fraud and abuse, which we keep only as long as needed for that purpose.
Backups are overwritten on their normal schedule, and deleted data disappears from them when that cycle ends.
Purchase and tax records are kept for the period the law requires.
Data that no longer identifies anyone may be kept for statistics.

8. How we protect data

We use technical and organisational measures appropriate to the risk to protect personal data, such as encryption in transit, encrypted storage where our providers offer it, access controls, limiting access to people and providers who need it, and monitoring for misuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the authorities as the law requires.

9. Your rights and choices

Depending on where you live, you have some or all of the following rights. We respect them for everyone where we reasonably can:

to know whether we process your personal data and to get a copy of it;
to have inaccurate data corrected and incomplete data completed;
to have your data deleted;
to receive the data you gave us in a portable format and to have it transmitted to another provider where technically feasible;
to restrict or object to processing, including processing based on our legitimate interests and direct marketing;
to withdraw your consent at any time, without affecting processing that took place before;
not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you;
to appeal our answer to your request, where your law provides for it, and to complain to a data protection authority.

Many of these choices are available directly in the app, as described for Tinytend, such as exporting or deleting your data and turning optional features off. You can also write to info@odbs.tech from the e-mail address you use with Tinytend, or tell us how to identify your account. We may need to verify your identity before we act, answer within the time the law sets (usually one month, or 30 days in Türkiye, extendable where the law allows) and do not charge a fee unless a request is manifestly unfounded or excessive. You may use an authorised agent where your law allows it; we may ask for proof of the authorisation. We will not treat you differently for exercising your rights.

10. Children

Tinytend is for people aged 18 or older and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe that a minor has given us personal data, write to info@odbs.tech and we will delete it.

11. This website

This website has no user accounts. It stores one cookie, NEXT_LOCALE, to remember the language you choose; it is necessary for the site to work as you asked and contains no identifier.

The site is delivered and protected by Cloudflare, which processes technical request data, such as your IP address and browser information, to deliver the site and to protect it from attacks.

We may use Cloudflare Web Analytics, which counts visits without cookies, without fingerprinting and without tracking you across sites, to understand how the website is used.

We do not use advertising or tracking cookies on this website.

Links to send us an e-mail open your own e-mail app; nothing is sent until you send it.

Because we do not track you across websites, the website and the app do not change their behaviour in response to browser Do Not Track signals; where the law requires it, we honour Global Privacy Control signals as a request not to sell or share personal data, which we do not do in any case.

12. Changes to this policy

We update this policy when Tinytend, our providers or the law change. The date at the top shows the latest version, and we keep earlier versions available on request. If a change materially affects how we use your data, we will tell you in advance, for example in the app or by e-mail, and where the law requires it we will ask for your consent again.

13. Additional information for the European Economic Area, the United Kingdom and Switzerland

ODBS LLC is the controller. Our legal bases for each use are described in section 3 and in the part specific to Tinytend. You have the rights under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection described in section 9.

You can lodge a complaint with the data protection authority of the country where you live or work or where an alleged infringement took place, for example the Information Commissioner’s Office in the United Kingdom or the Federal Data Protection and Information Commissioner in Switzerland. We would appreciate the chance to address your concern first at info@odbs.tech.

14. Additional information for the United States

Depending on the state where you live, such as California, Colorado, Connecticut, Virginia or Texas, you may have the rights described in section 9, including the rights to know, access, correct, delete and port your personal data, to opt out of its sale, of targeted advertising and of profiling, and to limit the use of sensitive personal data. To exercise them, write to info@odbs.tech. If we decline your request, you can appeal by replying to our answer with the subject “Appeal”; if your appeal is denied, you can contact your state attorney general.

We do not sell personal data or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not use sensitive personal data, such as health information, for purposes other than providing the service you asked for and the other purposes the law permits. We do not use personal data to train large language models.

Categories of personal data we collect, their sources, purposes, the categories of recipients and retention periods are described in the part specific to Tinytend and in section 4 and section 7. California residents may also ask which personal information, if any, we disclosed to third parties for their direct marketing purposes; we do not make such disclosures.

If you live in Washington, Nevada or another state with a consumer health data law, those laws give you additional rights over consumer health data, including the rights to confirm and access the data we collect, to withdraw consent and to have it deleted. We collect and share consumer health data only as described in this policy and with your consent, and never sell it.

15. Information notice for Türkiye (KVKK)

This section is our information notice under Article 10 of Türkiye’s Personal Data Protection Law No. 6698 (KVKK). The data controller is ODBS LLC. The personal data processed, the purposes and the legal reasons are described in the part specific to Tinytend and in section 3; we collect personal data electronically through the app, its server, the website and our support, on the legal grounds in Articles 5 and 6 of the KVKK, such as the performance of a contract, our legitimate interests, legal obligations and, where required, your explicit consent.

Personal data is transferred to our service providers and, where necessary, to authorities, for the purposes described in this policy, including to service providers abroad on the grounds and with the safeguards provided in Article 9 of the KVKK.

Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed, to request information about it, to learn the purpose of the processing and whether it is used accordingly, to know the third parties in Türkiye or abroad to whom it is transferred, to request its correction or deletion and the notification of these actions to those third parties, to object to a result against you arising from its analysis exclusively by automated systems, and to claim compensation for damage arising from unlawful processing. You can send your request to info@odbs.tech from the e-mail address registered with us, or in the other ways set out in the Communiqué on the Principles and Procedures for Requests to the Data Controller. We answer without charge within 30 days at the latest. You may also complain to the Personal Data Protection Board.

16. Additional information for Brazil (LGPD)

If you are in Brazil, you have the rights in Article 18 of the General Personal Data Protection Law (LGPD), including confirmation of processing, access, correction, making unnecessary or excessive data unidentifiable, blocking it or deleting it, portability, information about the public and private entities with which we share data, information about the possibility of refusing consent and its consequences, and withdrawal of consent. To exercise them or for any question about the processing of your data, write to info@odbs.tech. You may also petition the National Data Protection Authority (ANPD).

17. Additional information for other countries

Canada, including Québec: you have rights of access and correction and, in Québec, rights relating to portability and to automated decisions. Questions and requests about privacy can be sent to info@odbs.tech, and you may complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d’accès à l’information.
Japan: we handle personal information under the Act on the Protection of Personal Information. Our service providers abroad are listed for Tinytend; you can ask us at info@odbs.tech about the measures they take and the personal information protection systems of their countries, and request disclosure, correction, suspension of use or deletion.
South Korea: you can request access, correction, deletion or suspension of processing at info@odbs.tech. The personal data transferred abroad, the recipients, their countries, the purposes and the retention periods are described for Tinytend; you can refuse such transfers by not using the features that require them or by deleting your account.
India: you can request access, correction, completion, updating and erasure of your personal data, nominate another person to exercise your rights, and raise a grievance with us at info@odbs.tech; if it is not resolved, you may complain to the Data Protection Board of India.
Australia: we handle personal information in line with the Australian Privacy Principles. You may complain to us at info@odbs.tech and, if you are not satisfied with our answer, to the Office of the Australian Information Commissioner.
Everywhere else: you have the rights that the law of your country gives you, and you can exercise them by writing to info@odbs.tech.

18. Contact

ODBS LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. E-mail: info@odbs.tech. Please include “Tinytend” in your message.