Privacy Policy
Last updated: May 2025
GDPR & COPPA Notice
TinyHeroes is a family app that stores children's data. A parent or legal guardian must register the account and give consent on behalf of any child under 16 (GDPR) or under 13 (COPPA). By using TinyHeroes you confirm that you are the parent or legal guardian of the children added to your family.
1. Introduction
Welcome to TinyHeroes. We are committed to protecting the privacy of your family. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal information. If you have any questions, please contact us at [email protected].
2. Data We Collect
Account
Email address and hashed password (or social login provider ID) used to authenticate you.
Children
First names and ages of children you add to your family. No last names, school information, or contact details are collected.
Good Deeds
Deed titles, descriptions, and point values you record for your children, together with any AI-generated images associated with them.
Authentication
Short-lived JWT tokens stored locally in your browser. Social login tokens are handled by the respective provider and never stored on our servers.
Family
Family name, member roles, and prize configuration you set up within the app.
3. How We Use Your Data
We use your data solely to provide the TinyHeroes service: authenticating your account, displaying your family's progress, computing weekly and monthly rankings, and generating AI-illustrated deed images. Image generation is powered by Hugging Face (FLUX.1-schnell model). The prompt sent to Hugging Face describes only the deed action — no child names, ages, or any other personal identifiers are included in the prompt.
4. Data Storage
Your data is stored on servers hosted in the European Union. We apply industry-standard security measures including encrypted connections (TLS), hashed passwords, and access controls. Uploaded deed images are stored on disk or in cloud object storage depending on the deployment configuration. We retain your data for as long as your account is active. See Section 6 for deletion options.
5. Third Parties
Hugging Face
Used for AI image generation. Only the deed description (no personal data) is sent. Subject to the Hugging Face Privacy Policy.
Google / Apple / Facebook
Optional social login providers. When used, your email address is shared with TinyHeroes by the provider. Their own privacy policies apply.
We do not sell, rent, or trade your personal data to any third party for marketing purposes. Data is shared only as described above, or where required by law.
6. Data Deletion
You can delete your family and all associated data at any time via Settings → Family Settings → Danger zone. This permanently removes your family, all children's records, deeds, and rankings. To delete your account entirely or request erasure of specific data, email [email protected]. We will process erasure requests within 30 days in accordance with GDPR Article 17.
7. Children's Privacy (GDPR & COPPA)
TinyHeroes is designed for families and is intended to be used by parents or guardians on behalf of their children. We do not knowingly allow children to create their own accounts. All accounts must be registered by an adult who provides verifiable parental consent before adding any child under the age of 13 (COPPA) or under 16 (GDPR Art. 8). Children's data — including names and deed records — is stored only for the purpose of providing the family ranking service and is never used for advertising or shared with third parties for commercial purposes. Parents and guardians may review, correct, or delete their children's data at any time via the app or by contacting [email protected].
Questions about your privacy?
Reach our privacy team at [email protected]. We aim to respond within 5 business days.