Download App

Privacy Policy

Last updated: 8 October 2026 · Version 2026-10-08

The short version

  • Without LittleClues Cloud, your diary stays on your phone. We can’t see it.
  • LittleClues Cloud is optional. If you turn it on, your diary is encrypted on your phone before it’s uploaded (end-to-end encryption). We store it in the EU, but we can’t read it.
  • To run Cloud and sharing, we do see some account and technical details, such as your name, your email address and who shares a diary with whom. Section 5 lists all of it.
  • We don’t sell your data, show ads or use your diary to train AI.
  • You can delete your account and your cloud data in the app at any time.

1. Who we are

LittleClues (“LittleClues”, “we”, “us”) is based in Lithuania and is the controller of the personal data described in this policy.

For privacy questions or requests, email [email protected].

This policy covers the LittleClues app, LittleClues Cloud, sharing with caregivers and our website, littleclues.app. Our Terms of Service and Cookie Policy apply alongside it.

2. Not medical advice

LittleClues is a diary. It is not a medical device and doesn’t give medical advice, diagnosis or treatment. Please read the medical disclaimer in our Terms of Service. In an emergency, call your local emergency number (112 in the EU).

3. Data that stays on your phone

Your diary lives on your phone: children’s names and colours, foods, products and ingredients, symptoms and how strong they were, notes, photos, safe foods, your own meals if you breastfeed, reminders and settings. Insights and PDF reports are calculated on your phone.

Without LittleClues Cloud, none of this is sent to us and we have no access to it. Reminders are scheduled on your phone. We don’t use push notifications.

If you export a backup, the app creates a file that is not encrypted and contains your whole diary, including photos. You decide where that file goes, so store it somewhere safe. PDF reports you share are not encrypted either.

Deleting the app deletes the diary on that phone. Deleting data in Settings → Backup, restore and delete data deletes the diary on that phone but not your cloud copy. To keep your diary, export a backup there or use Cloud.

4. Accounts

You need an account only for LittleClues Cloud and for sharing. You sign in with Apple or Google. We don’t use passwords.

When you sign in, we receive:

  • the ID that Apple or Google uses for you in our app,
  • your email address (with Apple, this can be a private relay address; with Google, only if Google has verified it),
  • your first name, if Apple or Google shares it. It becomes your display name, which you can change in the app. People you share a diary with see it.

With Sign in with Apple, we also keep an Apple token, encrypted, so that we can revoke our access at Apple when you delete your account.

For each phone you sign in on, we keep a random device ID, the platform (iOS or Android), the app version and when the phone last connected. A sign-in lasts up to 30 days without use and 180 days at most. After that, you sign in again.

5. LittleClues Cloud

LittleClues Cloud keeps a copy of your diary in the cloud, so it syncs between phones and can be shared. It is optional. Turning it on for your own diary is part of LittleClues Pro; joining a diary someone shares with you is free. Cloud and sharing are currently in Beta.

5.1 End-to-end encryption

Before anything leaves your phone, the app encrypts it with keys that only you and the people you share with have. Our server stores encrypted data that it can’t decrypt. We can’t read your diary, and we can’t give it to anyone in readable form.

When you turn on Cloud, you agree that we store your child’s encrypted diary in the EU. We record which version of this policy you agreed to, and when.

5.2 What our server can see

To store, sync and share your diary, our server sees:

  • your name and email address, as Apple or Google gave them to us, and the ID they use for you,
  • the internet (IP) address your phone connects from,
  • which phones and app versions you use, and when each phone last connected,
  • who shares a diary with whom, what each person may do, and when their access ends,
  • the email addresses you invite,
  • how many items are saved, how big they are and who saved them, but not what they say,
  • about when each change was made,
  • how many photos there are, and how big they are,
  • whether you have Pro, and when it ends or renews,
  • the problem reports you choose to send from the app, with any note you write (section 8),
  • which requests from your phones our server refused or couldn’t complete, and why, without your IP address,
  • which version of this policy you agreed to when you turned on Cloud, and when.

5.3 What our server can’t see

  • your child’s name and colour,
  • which foods, products and symptoms you log,
  • whether an entry is a meal or a symptom,
  • who ate something: you or your child,
  • how strong a reaction was, your notes and your photos,
  • which foods you marked as safe (only how many),
  • your insights.

This is about LittleClues Cloud. If you turn on usage analytics, session recordings show some of the screen too (section 8).

5.4 Your Recovery Key

When you turn on Cloud, the app creates a Recovery Key. It unlocks your diary on a new phone. We never receive it.

You can keep it in a password manager, on paper, or as the Recovery Kit PDF, which contains the key and your account email address. Where your phone supports it, the app can also save the key in your own iCloud Keychain or Google account (Block Store). Apple and Google store it end-to-end encrypted, and we can’t access it there.

If you lose all your phones and your Recovery Key, nobody can read your cloud copy, including us. You can then start over: this deletes the cloud copy and uploads your diary again from a phone that still has it.

6. Sharing a diary with caregivers

If you own a diary, you can invite people to it, such as a partner, a grandparent or a nanny, and choose what each person may do.

  • To invite someone, you give us their email address. We use it only to send the invite and to show you whom you invited.
  • People in a shared household see each other’s display names. You see each caregiver’s name and email address.
  • Nobody sees a diary until you confirm them in the app after they accept.
  • When someone’s access ends, their phone deletes the diary the next time it connects. We can’t delete copies on a phone that never connects again.
  • Entries a caregiver adds are part of your child’s diary. They stay after the caregiver leaves, labelled with the caregiver’s name, or “Former caregiver” if the caregiver deletes their account.

If you received an invite: we got your email address from the person who invited you. The invite email contains their name, a link, a code and the expiry date, and nothing about the child. If you don’t accept, the invite expires after 7 days, and we delete it 30 days later. You can ask us to delete it sooner.

Before you share: only share a child’s diary if you have the right to, for example as the child’s parent or with a parent’s permission.

7. Subscriptions

LittleClues Pro is sold through the Apple App Store and Google Play. They process your payment. We never see your card details.

We use RevenueCat to manage subscriptions. RevenueCat receives purchase details from the store (such as the product, transaction IDs, dates and status) and technical details (such as device type, operating system, app version and store country). It knows you by a random ID: your LittleClues account ID when you’re signed in, otherwise an anonymous ID. We don’t send RevenueCat your name or email address.

Our server asks RevenueCat whether your Pro is active and stores only the date it ends.

8. Crash reports, problem reports and usage analytics in the app

Crash reports and usage analytics are on unless you turn them off. You can turn either off when you set up the app, or at any time in Settings. If you turn them off while setting up the app, the app sends one last note saying which ones you turned off when you finish setting up, and then usage analytics stop. If you turn usage analytics off in Settings, they stop straight away. Crash reports stop from the next app launch.

  • Crash reports (Sentry). When the app crashes or hits an error, it sends technical details: the error, device model, operating system and app version, a log of the app’s recent steps (codes and random IDs only), a random account ID if you’re signed in (not your name or email), and a short replay of the screen in which all text and images are hidden. Colours and the layout of the screen stay visible. Before sending, the app removes email addresses, keys, tokens and invite codes. Sentry stores this data in the EU (Germany).
  • Usage analytics (Microsoft Clarity). The app sends how you move through it (screen names and taps) and a short list of named events, such as “paywall viewed”. It also labels each session with a few general facts: Free or Pro, whether Cloud is on and in which role, how many children (0, 1, 2 or 3+), whether crash reports are on, and whether cloud photo storage is nearly full. Session recordings hide text and images, but they still show colours, the layout of each screen and where you tap. Someone watching a recording could tell, for example, that a symptom was being logged and roughly how strong it was, but not which symptom, which food or the child’s name. Screens with your Recovery Key, invites, caregivers, Cloud settings and sign-out are never recorded.

Problem reports. If you tap Report a problem, the app sends us a technical report: app and phone versions, your settings, how sync is doing for each family, counts of entries, foods and photos, error codes, what you were doing and what happened (chosen from a list), and a log of the app’s recent steps. It never includes your diary, names, email addresses or keys. It’s linked to your account if you’re signed in, kept for 30 days, and also stored in Sentry in the EU. We use it only to fix the problem. The app sends a report only when you tap Send, whether crash reports are on or off.

You can add a short note (up to 300 characters). Please don’t include names, your child’s details or health information. The app removes email addresses and phone numbers before sending, and our server removes them again. The note is kept only on our server with the report for 30 days, and is never sent to Sentry.

None of these services receives the words or photos in your diary, and we don’t use them for advertising.

When the app starts, it asks our server for the current app version. This request contains no identifiers, but like any connection it reveals your IP address.

9. Our website

  • Cloudflare protects and delivers littleclues.app and our API. It processes every visitor’s IP address and request details, and tells us which country a visit comes from so that we show the right cookie banner.
  • Google Analytics and Microsoft Clarity measure how the website is used. In the EU, the EEA and the UK, they set cookies or record visits only after you accept. Until then, Google Analytics sends only cookieless, anonymous measurements and Clarity doesn’t run. Elsewhere, they run unless you opt out. Analytics never run on the invite, app-link and account deletion pages. Details are in our Cookie Policy.
  • Google reCAPTCHA protects our contact form and waitlist sign-up from spam. It loads on pages with these forms and sends Google your IP address and browser details.
  • Contact form: your name, email address and message are emailed to us. We don’t store them in a database. We keep the email as long as we need it to help you.
  • Waitlist: if you join a waitlist, we store your email address and platform, and email you when the app is available on your platform.

10. Emails we send

We send emails only as part of the service: invites, a note to a diary owner when someone accepts an invite, reminders before cloud data is deleted, replies to your messages, and the waitlist email you asked for. We don’t send marketing emails.

Our emails carry the LittleClues logo inside the email itself, so we don’t learn whether or when you open them. We send email through Google Workspace.

11. Why we may use your data (legal bases)

Under the EU General Data Protection Regulation (GDPR), we rely on:

  • Contract (Art. 6(1)(b)): to provide the app, accounts, Cloud, sharing and Pro, including service emails and subscription status.
  • Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)): to store your child’s encrypted diary in the cloud, because a food and symptom diary can contain health information. You give it when you turn on Cloud and withdraw it by turning off Cloud or deleting your account.
  • Consent (Art. 6(1)(a)): for analytics cookies on the website. You can withdraw it at any time.
  • Legitimate interests (Art. 6(1)(f)): crash reports and usage analytics in the app, to keep LittleClues working and understand how it’s used so we can improve it; security, spam protection, server logs, our record of refused or failed requests and backups, to keep LittleClues safe and working; problem reports and notes you choose to send, to fix the problem you reported; and sending an invite to someone you chose to invite. You can turn off crash reports and usage analytics in Settings, and object to the rest by emailing us.
  • Legal obligations (Art. 6(1)(c)): accounting records and answering lawful requests from authorities.

12. Who processes data for us

We use these service providers. They process data on our behalf under data processing agreements, except where they act under their own privacy policies, such as Apple and Google for sign-in and app store purchases.

  • Hetzner Online GmbH (Germany): servers and backups, in data centres in Germany and Finland.
  • Cloudflare, Inc.: network delivery and security for our website and API.
  • Google: Sign in with Google, Google Play, email (Google Workspace), Google Analytics, reCAPTCHA, and Block Store if you save your Recovery Key there.
  • Apple: Sign in with Apple, the App Store, and iCloud Keychain if you save your Recovery Key there.
  • RevenueCat, Inc.: subscription management.
  • Functional Software, Inc. (Sentry): crash reports and problem reports (without your note), stored in the EU.
  • Microsoft (Clarity): usage analytics in the app and on the website.

We don’t sell or rent personal data, and we don’t share it for advertising. We disclose data only when the law requires it. For Cloud diaries, we can only ever hand over encrypted data.

13. Data outside the EU

Our servers are in the EU. Some providers listed above, such as Cloudflare, Google, Microsoft, RevenueCat and Apple, may process data in the United States or other countries outside the EU. Where they do, the transfer is covered by an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or by the European Commission’s Standard Contractual Clauses.

14. How long we keep data

  • Your account: until you delete it.
  • The cloud copy of your diary: until you turn off Cloud or delete your account.
  • If your Pro ends: after a short grace period, syncing and sharing pause, and your phones keep everything. If Cloud stays paused, we delete the cloud copy. We email you 30 days and 7 days before, and the app shows the date.
  • A child you delete: caregivers lose access straight away. The child’s encrypted entries stay in your cloud copy until you turn off Cloud or delete your account.
  • Sign-ins on a phone: deleted 30 days after they expire.
  • Invites: valid for 7 days, then deleted 30 days after they were accepted or expired.
  • The record of your Cloud consent: until you delete your account.
  • Server logs with IP addresses: kept in rolling logs of limited size that are overwritten automatically.
  • Problem reports, their notes and our server’s record of refused or failed requests: 30 days. The request record holds the account and device IDs, the app version and the error, never IP addresses or content.
  • Backups: we make encrypted backups every night and keep them for up to 6 months. Deleted data can remain in a backup until that backup is overwritten. We use backups only to recover from a failure.
  • Contact and support emails: as long as we need them to help you.
  • Waitlist: until we have emailed you that the app is available on your platform, or until you ask us to remove you.
  • Crash reports and analytics: for the retention periods set by Sentry and Microsoft.

15. Deleting your data

  • Delete your account: in the app, go to Family → Back up & sync → Delete account. It happens at once and deletes your account, your cloud data and your sign-ins. You can also choose to delete everything on that phone. Entries you added to diaries other people own stay in those diaries, labelled “Former caregiver”. Without the app, follow the steps at littleclues.app/account-deletion or email us.
  • Deleting your account doesn’t cancel your subscription. Cancel it in your Apple or Google account settings.
  • Turn off Cloud: deletes the cloud copy. Your phone keeps your diary.
  • Uninstall the app: deletes the diary on that phone.
  • Ask us: email [email protected] from the address your account uses (with Sign in with Apple, the address Apple gave us works too). We delete your account and its data for you, the same as Delete account in the app, and confirm within one month. We can also delete an invite sent to your email address, or a problem report by its code (LC-…). We keep a short record that we did it: the date, the account ID or report code, and where the request came from, never your email address. Copies in backups go as described in section 14.

16. Your rights

Under the GDPR, you can ask us to:

  • give you a copy of your personal data,
  • correct it,
  • delete it,
  • restrict how we use it, or object to it,
  • give you the data you gave us in a common, machine-readable format (such as JSON), so you can take it to another service.

The copy of your data we send on request also holds the problem reports and notes you sent and our server’s record of your phones’ refused or failed requests (when, which kind of request, the answer and its request ID), both kept 30 days.

Where we rely on your consent, you can withdraw it at any time. This doesn’t affect what we did before.

Much of this works in the app. Settings → Backup, restore and delete data exports your whole diary as a file (JSON and photos). In Family → Back up & sync you can change your name, turn off Cloud and delete your account. For anything else, email [email protected] and we answer within one month. Because we can’t read Cloud diaries, a copy from our servers contains your account details and the information in section 5.2, sent as a JSON file; your diary itself comes from the app’s backup export.

You can also complain to a data protection authority. In Lithuania, this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). You can also contact the authority in the country where you live.

17. Children

LittleClues is for adults: parents and the people who help them care for a child. You must be 18 or older to use it. Children don’t use the app themselves.

The diary is about a child, so it contains information about that child. You enter it as the child’s parent or with a parent’s permission, and you decide whether to share it. We never knowingly collect personal data directly from children. If you think a child has given us personal data, contact us and we will delete it.

18. Security

We protect your data with:

  • end-to-end encryption of diary content and photos, with keys only on your phones,
  • encrypted connections (TLS) for all traffic,
  • invite links, invite codes and sign-in tokens stored only in hashed form,
  • server administration reachable only over a private network,
  • encrypted backups,
  • logs that never contain diary content, keys, tokens, invite codes or email addresses.

No system is completely secure. Protect your phone with a passcode, keep your Recovery Key safe, and take care with exported backups and PDF reports, because they aren’t encrypted.

19. Automated decisions

Insights are patterns calculated on your phone from your own log. We don’t make automated decisions about you that have legal or similarly significant effects, and we don’t profile you for advertising.

20. Changes to this policy

When we change this policy, we update the date and version at the top. If a change is significant, we will tell you in the app or by email before it takes effect. If it changes how we handle Cloud data, we will ask for your consent again where the law requires it.

21. Contact

LittleClues, Lithuania

Email: [email protected]