Privacy policy

This policy applies to:

• The public website (home, about, resources, gallery, FAQ, and similar pages)
• The logged-in app at /app and related routes
• Account registration, login, and password recovery flows
• Optional features such as child profiles, activity logs, journal entries, and photo uploads
• Public activity share links that do not require a login

It does not govern third-party websites we link to (such as Plunket, Healthline, or KidsHealth). Those sites have their own privacy practices.

Information you provide directly

• Account details: email address, password (stored in hashed form by our authentication provider), and optional display name
• Profile preferences: region, simple mode, milestone visibility, selected child, and similar in-app settings
• Child profiles you choose to add: name, date of birth or expected due date, pregnancy flag, optional notes, and optional avatar
• Activity and programme use: saved activities, completion logs, milestone notes, routine checklists, and dismissed Today suggestions
• Journal content: text notes, optional titles, links to activities, and optional photos you upload
• Communications: messages you send us for support or programme feedback

Information collected automatically

• Basic technical data: device type, browser, approximate access times, and pages or screens viewed
• Security and reliability logs: IP address, error reports, and authentication events where needed to protect accounts
• Install and session data for the progressive web app (PWA), such as whether the app was added to a home screen

We do not require you to add child profiles or journal entries. You can use much ofTiny Steps with minimal personal information.

Tiny Steps requires a whānau account to use the app. When you sign in, your settings, optional child profiles, journal entries, saved activities, and activity history are stored in your programme account on our servers so you can access them across devices.

We do not offer a separate offline-only or browser-only mode for family data. If you sign out or delete your account, synced programme data is handled as described in the account deletion section below.

We use personal information to:

• Provide and maintain Tiny Steps (accounts, sync, and core app features)
• Personalise daily ideas and age-match activities to children you add
• Remember your preferences, saved activities, and programme progress
• Store journal entries and optional family photos you choose to upload
• Operate public share links for individual activities (without your profile data)
• Publish and administer programme content (activities, articles, packs) for editors
• Respond to support requests and protect the security of the service
• Understand aggregate usage patterns to improve the programme — not to profile children for promotional purposes

We do not sell your family data. Tiny Steps is not funded by advertising targeted at children or caregivers.

We do not:

• Sell, rent, or trade personal information to data brokers or marketers
• Use child profiles for third-party advertising or behavioural profiling
• Require you to upload photos of children to use the service
• Publish your private journal or child details on public pages without your action (such as choosing to share an activity link)

We handle personal information in line with the Privacy Act 2020 (New Zealand) and related guidance from the Office of the Privacy Commissioner. Depending on the activity, we rely on one or more of the following:

• Your consent — for example, when you create an account, add a child profile, or upload a photo
• Performance of the service — to operate features you ask us to provide
• Legitimate programme interests — to keep the service secure, reliable, and improving, balanced against your privacy rights
• Legal obligations — where we must retain or disclose information under New Zealand law

We process personal information to operate Tiny Steps, keep accounts secure, and meet our obligations under the Privacy Act 2020 (New Zealand).

You and your whānau account. Information you save to an account is accessible when you sign in. Keep your login details private.

Programme editors and administrators. Authorised Trust staff and volunteers with editor or admin roles can manage published programme content (activities, articles, packs, and public pages). They do not routinely browse private family journals. Access to user support data occurs only when needed to resolve a request, maintain security, or address a safety concern.

Service providers. Infrastructure partners (such as cloud hosting and database services) process data on our behalf under contractual safeguards. We use reputable providers with security and confidentiality obligations.

Share links. When you share an activity card URL, recipients see the activity content only — not your account, journal, or child profiles.

We may disclose information if required by law, court order, or to protect the rights, safety, or security of users, children, or the public.

Journal and activity photos are optional. If you upload an image, it is stored in our secure content storage and linked to your account. You should only upload photos you have the right to share — for example, images of your own children or where all relevant caregivers have agreed.

Deleting a journal entry or your account should remove associated photos from active programme storage, subject to short backup retention described below.

Do not upload images containing other people's personal details (such as visible address labels, medical documents, or school enrolment forms) unless you intend to store them privately and understand the risks.

Account and programme data is stored in secure cloud infrastructure operated by our service providers. Data may be processed in New Zealand and/or other countries where those providers maintain facilities, always under contractual protections.

We use technical and organisational measures appropriate to a family-facing charity app, including encrypted connections (HTTPS), access controls, row-level security on user data, and role separation for editors. No online service can guarantee absolute security; please use a strong, unique password and sign out on shared devices.

We retain personal information only as long as needed for the purposes in this policy:

• Active accounts: profile, children, journal, and logs are kept while your account remains open
• Deleted content: when you delete journal notes or child profiles in-app, they are removed from active use
• Closed accounts: when you request deletion, we will delete or anonymise personal data within a reasonable period, except where retention is required by law or for dispute resolution
• Backups and logs: encrypted backups and security logs may persist for a limited period before automatic deletion

Encrypted backups and security logs may persist for a limited period before automatic deletion.

Tiny Steps is designed for adults caring for children. We do not knowingly collect personal information directly from children under 16 without appropriate adult involvement. Child profiles are created and managed by caregivers.

If you believe a child has provided us personal information without caregiver consent, contact us and we will take appropriate steps to delete it.

Please be thoughtful about what you record in notes and photos — children have privacy interests too, even when they are young.

Tiny Steps uses essential cookies and limited browser storage to keep you signed in, remember preferences, and support PWA installation. We do not use third-party advertising cookies.

Your browser may allow you to block cookies; doing so may prevent login or sync from working correctly.

Depending on applicable law (including the Privacy Act 2020), you may have the right to:

• Access personal information we hold about you
• Request correction of inaccurate information
• Delete child profiles, journal entries, and photos you added
• Delete your account and associated personal data via Settings or by contacting the Trust
• Withdraw consent where processing is consent-based (which may limit features)
• Complain to the Office of the Privacy Commissioner (New Zealand)

To exercise these rights, use in-app controls where available or contact the Trust. We may need to verify your identity before fulfilling certain requests.

You may delete your Tiny Steps account and associated personal data in Settings or by contacting the Trust. Before deleting, save any journal memories you wish to keep elsewhere.

Deletion is intended to remove personal profiles, children, journal entries, and linked photos from active programme systems. Anonymised or aggregated statistics that cannot identify you may be retained for programme reporting.

If you subscribe to a newsletter or programme updates, we will use your email address to send those messages. You can unsubscribe at any time using the link in the email or by contacting us.

We do not send behavioural advertising based on child profiles or journal content.

Tiny Steps is built for whānau in Aotearoa New Zealand. If you access the service from overseas, your information may be transferred to and processed in New Zealand and other countries where our providers operate. By using the service, you acknowledge those transfers for programme purposes.

We may update this policy as Tiny Steps grows — for example, when new features ship or when legal advice requires clearer wording. We will post the updated version on this page and adjust the “Last updated” date.

Significant changes may also be highlighted in-app or by email where appropriate. Continued use after an update means you accept the revised policy, unless otherwise required by law.

Please also read our Terms of use, which describe acceptable use, educational disclaimers, and liability limits for Tiny Steps.

For privacy questions, access requests, or concerns about how we handle family information, contact Vector Group Charitable Trust via vectorgroup.org.nz.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner (New Zealand).