Privacy policy
Draft, under legal review
Version 0.2 of November 3, 2026
In short: what we keep
- Only what the sleep diary needs: sign-in (email or a Google / Apple account), your baby's date of birth, sleep entries, notes and settings. Your baby's name is optional.
- We do not collect location, contacts, photos or advertising identifiers. There are no ads in the app.
- On your phone, data is kept in an encrypted database; on our server — in the European Union (Finland), on an encrypted disk.
- Sleep entries are health data. We process them only with your consent, and you can withdraw it.
- You can delete your account in the app or by email — how to delete. Everything is erased within 30 days, including backups.
Who we are and how to reach us
Your data is processed by Marat Khabibullin (an individual, Kazakhstan), the data controller for Tinynap.
For any question about your data, write to support@tinynap.app. We reply within 2 business days.
What data we keep
- Sign-in data: your email address or the ID of your Google or Apple account. Apple may give us a hidden address instead of your real one.
- Baby profile: date of birth — needed to plan the schedule by age. A name — only if you add one.
- Diary: sleep and wake times, notes on entries.
- App settings and the region where your data is stored.
- Consents: which consents you gave or withdrew, and when.
- Subscription: whether you have one and until when. Card details never reach us — Apple and Google take the payment.
- Technical server logs: IP address, time and address of a request — to protect the service from attacks and investigate failures. Logs contain no diary entries, names or emails; they are kept for 30 days.
What we do not collect: location, contacts, photos and videos, advertising identifiers. The app has no ads and no ad SDKs. We do not sell data or share it for advertising.
Why we need this data
- To plan a daily schedule from your baby's age and sleep entries.
- To sync the diary between your devices and restore it on a new phone.
- To set up your subscription and check that it is active.
- To answer your emails and protect the service from attacks.
Your baby's sleep entries are health data. We process them only with your explicit consent, which you give on the “Before you start” screen in the app. You can withdraw consent at any time — write to us or delete your account. After that we stop processing this data on the server and erase it.
Where data is stored
- On your phone — in an encrypted database whose key is kept in the device's secure storage. The database is excluded from iCloud and Google backups, so the diary moves to a new phone only through your account.
- On our server — in the European Union (Finland), on an encrypted disk. The app talks to the server only over a secure connection (HTTPS).
- For users in Kazakhstan: for now data is stored on our server in the European Union (Finland). This is a cross-border transfer, and we do it only with your consent. Later we will add a server in Kazakhstan and keep Kazakhstan users' data there.
Who we share data with
Only with providers the app cannot work without, and only what their job needs:
- RevenueCat — subscription records: receives a pseudonymous user ID and purchase details from the store.
- Sentry — app and server error reports, without names, emails or diary entries.
- Apple and Google — account sign-in and subscription payments, under their own terms.
- Scaleway SAS (France, Transactional Email service, data in the EU) — sends sign-in codes by email.
There is no third-party analytics. We share data with anyone else only when the law directly requires it.
How long we keep data
For as long as you have an account. After you delete it, we erase all your data from the server within 30 days, including backups. Data on your phone is removed together with the app.
An entry you delete in the diary is first marked as deleted on the server, so the deletion reaches your other devices. It is erased for good together with the account.
Your rights
- Find out what data about you and your baby we keep, and get a copy in a portable format.
- Correct inaccurate data — most of it you can fix right in the app.
- Delete your account and all data — how to delete your account.
- Withdraw consent to the processing of health data and to the cross-border transfer.
- Complain to the data protection authority of your country.
To use any of these rights, write to support@tinynap.app from the address you sign in to Tinynap with. We reply within 2 business days and complete the request within 30 days.
Children's data
Tinynap is an app for parents. The account is created and managed by a parent or another legal guardian, who enters the baby's data and gives consents. The child does not use the app.
Changes to this policy
A new version is published on this page, with its number and date at the top. We will warn you in advance about significant changes.