Privacy Notice · Tiny Whabbit

This Privacy Notice explains how Tiny Whabbit ("we", "us", "our") collects, uses, and protects personal data when you use the Tiny Whabbit app and website (the "Service"). The Service is operated by Omowunmi Kolawole, trading as Tiny Whabbit, who acts as the data controller for the personal data described below.

1. What personal data we collect

We collect the following categories of personal data:

Profile information you provide: your parent name, your child's name, your child's age range, your chosen language track, and your goal for using the Service.
Email address: if you choose to subscribe to updates or support contributions.
Usage and progress data: which moments you've completed, your streaks, and your in-app preferences (for example whether reminders are on).
Device and technical data: IP address, browser type, device identifiers, and timestamps, collected automatically when you use the Service.
Support correspondence: any messages you send us.

Payment-card details are not collected by us. Payments are processed by Paddle (see "Sharing" below), which collects and handles payment data under its own privacy notice.

2. Why we use your data and our legal basis

To provide the Service (account, personalisation, progress tracking, reminders) — legal basis: performance of a contract with you.
To process support contributions and (future) paid features — legal basis: performance of a contract, implemented through our Merchant of Record, Paddle.
To send optional updates and tips — legal basis: your consent (you can withdraw it at any time).
To keep the Service secure and prevent abuse — legal basis: our legitimate interest in protecting users and the Service.
To improve the Service through aggregated, mostly anonymised analytics — legal basis: our legitimate interest.
To meet legal obligations (e.g. responding to lawful requests, tax records held via our Merchant of Record) — legal basis: legal obligation.

3. Who we share data with

We do not sell your personal data. We share it only with the following categories of recipients, under appropriate contractual safeguards:

Service providers / sub-processors: hosting, database, and infrastructure providers (Lovable Cloud / Supabase), analytics, and customer-support tooling.
Merchant of Record (Paddle): when you make a support contribution or purchase, Paddle processes the payment as Merchant of Record. Paddle handles billing, tax compliance, invoicing, refunds, and customer-service inquiries about your order. See Paddle's Privacy Notice.
Email delivery providers for sending optional updates and account-related emails.
Professional advisers (legal, accounting) where reasonably necessary.
Authorities and regulators where required by law, legal process, or to protect rights, property, or safety.

4. International transfers

Some of our service providers are located outside your country of residence, including the United Kingdom, the European Economic Area, and the United States. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

5. How long we keep your data

We keep personal data only for as long as we need it for the purposes set out above:

Account and profile data: kept while your account is active and for up to 12 months after you stop using the Service, then deleted or anonymised.
Email subscription data: kept until you unsubscribe, then deleted from active mailing systems.
Payment and transaction records: kept by Paddle and us for up to 7 years to meet tax and accounting obligations.
Support correspondence: kept for up to 24 months after the matter is resolved.

6. Your rights

Depending on where you live, you may have rights in relation to your personal data, including the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased ("right to be forgotten");
restrict or object to certain processing;
receive your data in a portable format;
withdraw consent (where processing is based on consent);
lodge a complaint with your local data-protection authority (in the UK, the Information Commissioner's Office).

We aim to respond to verified rights requests within one month. To exercise any of these rights, contact us using the details in Section 9.

7. Security

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit (HTTPS), encrypted storage, access controls, and the principle of least privilege for our team and service providers. No system is perfectly secure, but we work hard to reduce risk.

8. Cookies and similar technologies

Tiny Whabbit uses a small number of essential cookies and local storage entries to keep you signed in, remember your preferences, and operate the Service. We may also use limited analytics to understand how the Service is used in aggregate. We do not use advertising cookies. Where consent is required for non-essential cookies, we will ask for it.

9. Contact

If you have any questions about this Privacy Notice or how your personal data is handled, please contact Omowunmi Kolawole through the Tiny Whabbit support channels listed in the app, or via the Profile page.

10. Changes to this notice

We may update this Privacy Notice from time to time. If changes are material, we will notify you in-app or by email where appropriate. The "Last updated" date at the top of this page reflects the most recent revision.