Small Hours
Privacy Policy
Small Hours Baby Sleep Tracker ("Small Hours", "the app", "we", "us") is made by Hyung-shik Jung, an independent developer in the Republic of Korea. This policy explains what data the app uses, why, and what you can do about it.
1. Data we collect
- Baby and care data. The baby's name, birth date or due date, and, if you enter them, sex, weeks born early, gestational age, allergies, conditions, and the names of the baby's doctor and clinic. Also the care you log: sleep, feeds, nursing, pumping, diapers, growth, health notes (medicine, temperature, vaccines, symptoms, doctor visits and visit questions), moods, milestones, activities, running timers, reminders, and notes.
- Stories, photos, and attachments. Photo stories and their captions, the text you place on a story, the baby's profile photo, photos and PDFs you add to an entry, and the small preview images the app makes from them.
- Account information. If you use email and password, we keep your email address, and Supabase Auth stores a protected one-way form of your password rather than the password itself. When you sign in with Apple or Google, we receive a user ID and the email address that the provider shares. With Sign in with Apple, you can hide your email address. The app does not ask Apple for your name. Google also shares the name and profile picture on your Google account; our sign-in service keeps them with your account, and the app does not use them.
- Sharing information. For a shared baby: which accounts care for it, who owns it, when each caregiver joined, the names caregivers give each other, invite codes, and which caregiver added each record and story.
- Consent records. When you agree to these terms, we keep which version you agreed to, when, and the app version.
- Purchase and paywall information. Subscription offers are shown through Superwall, and Apple handles purchases. Superwall receives device and app information (for example device model, OS version, language, and app version), a device identifier that Apple gives to apps from the same developer, paywall and purchase events, and your subscription status. After you sign in, Superwall also receives your account's user ID, so a subscription follows your account to another phone. We never receive your payment details.
We do not collect your precise location, contacts, or advertising identifier.
2. Where your data is kept
Your care records, stories, photos, attachments, and reminders are kept on your iPhone. The app's widgets read them there. If you take a photo with the in-app camera for a story or an entry, a copy is also saved to your Photos library, if you allow it.
When you sign in, your account and consent records go to our server.
A baby that you do not share stays on your iPhone. The first time you open Invite caregiver for a baby, the app tells you what sharing uploads and waits until you tap Share and get a code. Then it uploads that baby's profile and all of its records to our server, including records made before you shared it. Later changes follow. When you join a baby with an invite code, the records on your phone are replaced by the shared ones, and what you log after that is uploaded too. This includes:
- the baby's profile and profile photo;
- care entries and running timers;
- photo stories, their captions, and the story images; and
- photos and PDFs added to entries, with their preview images.
The app then downloads the same data to the phone of every caregiver of that baby. A change made without a connection waits on the phone and goes up later. Reminders and display settings stay on each phone.
3. How we use your data
- To run the app: record care, show summaries and charts, send the reminders you set, and show widgets.
- To sync a shared baby between the caregivers you choose.
- To sign you in and keep your account secure.
- To offer and manage subscriptions.
- To fix problems and improve the app.
- To answer you when you contact us.
We do not use your baby's data for advertising. We do not use it to train AI models, and we do not share it for research.
4. Data sharing and disclosure
We do not sell or rent your personal information. We share data only with the service providers that run the app for us, and only as needed:
- Supabase, Inc.: hosts sign-in, our database, and the private file storage for shared stories, photos, and attachments.
- Apple: Sign in with Apple, App Store purchases, and TestFlight.
- Google: Google Sign-In, if you choose it.
- Superwall, Inc.: shows paywalls, reports subscription status, and measures how paywalls and purchases perform.
We may also disclose data if the law requires it, or to protect the rights and safety of our users.
5. Sharing a baby with caregivers
A caregiver can make an invite code for a shared baby. Anyone who signs in with a valid code joins that baby. Share codes only with people you trust.
- Every caregiver of a baby can see and change its profile, care history, running timers, stories, photos, and attachments.
- A caregiver can delete the records and stories they added. The baby's owner can delete any record or story of that baby, including ones other caregivers added. The server records who added each one, and it refuses a deletion from anybody else. Records and stories added before we recorded this have no recorded author. Only the baby's owner can delete them.
- Caregivers see each other's names. Until somebody sets a name, a caregiver's name can be the email address they signed in with.
- The owner can remove a caregiver, and a caregiver can leave. This stops their access to our server. It cannot remove copies that are already on their phone.
6. Data retention and deletion
Data on your iPhone stays there until you delete it, erase it when you delete your account, replace it by joining another baby, or delete the app.
Server data stays while your account is active. When you delete a record or a story, it is marked as deleted so that the deletion reaches every caregiver's phone. The marked record and its files stay on our server until the baby is deleted.
You can delete your account in the app: open Settings and choose Delete account. You sign in again first, with Apple, Google, or your password, to show that it is you. Then:
- Your access ends at once, and every phone signed in to your account is signed out. If you signed in with Apple, we ask Apple to revoke the app's access to your Apple ID. If you signed in with Google, the app asks Google to remove its access.
- For each baby you own, access ends at once for you and for every other caregiver. The other caregivers keep their own accounts and any other babies they care for.
- For a baby somebody else owns, you stop being one of its caregivers. That baby and its records stay with its owner.
- For 30 days, we keep your account and your babies' data on our server in a locked state, in case you deleted it by mistake. Nobody can use it during this time, other caregivers included. Only you can restore it: sign in again with the same account (Apple, Google, or email and password) within those 30 days. The app shows the exact date and time when this ends. Knowing an email address alone never restores an account. Restoring gives you back your babies and their records, and the other caregivers get their access back as it was.
- When the 30 days end, we permanently delete your account, your sign-in identities, your consent records, your babies, their records, stories, photos, and attachments from our database and file storage. The deletion job runs every hour, so this normally happens within an hour of that time. As proof of consent, we keep only which versions of the consent, our terms, and this policy you accepted, and on which day. That record does not contain your name, email address, account, or anything else that identifies you.
Copies in our service providers' backups and logs are removed on those systems' own schedules, which can be later than this. Copies already on other caregivers' phones stay there, because we cannot reach them.
7. Data security
Records on your iPhone are protected by iOS data protection. Data sent to our server is encrypted in transit. On the server, access rules make sure that each person sees only their own account and the babies they care for, and shared files are kept in private storage. No system is completely secure, but we work to protect your data.
8. Your rights and choices
Under the Korean Personal Information Protection Act, the EU and UK GDPR, and other laws that apply to you, you can ask to:
- see the personal data we hold about you;
- correct it;
- delete it;
- limit or stop how we use it, or object to a use;
- receive a copy in a common format; and
- withdraw your consent at any time.
In the app, you can remove a caregiver, stop sharing a baby, and delete your account (Settings, then Delete account). To use any other right, email support@small-hours.app.
9. International data transfers
Our service providers may process data outside your country, including in the United States. When data leaves the Republic of Korea, the EEA, or the UK, we rely on the safeguards the law requires, such as standard contractual clauses.
10. Children's privacy
Small Hours is for parents and caregivers. It is not for children to use. We do not knowingly collect personal data from children under 14, or under the age of digital consent where they live. An adult enters any information about a baby. If we learn that a child has given us personal data, we delete it.
11. Consent to share consumption data with Apple
If you buy a subscription in the app and agree to it, and Apple asks us about a refund request, we may send Apple your subscription status and usage totals. This helps Apple decide the refund. We never send your baby's entries.
12. Third-party links
The app can link to other websites and services, such as Apple's subscription settings. Their own privacy policies apply to them, and we are not responsible for them.
13. Data protection authority
If you think we have handled your data wrongly, please contact us first. You can also complain to the Personal Information Protection Commission of Korea (pipc.go.kr). If you live in the EEA or the UK, you can complain to your local data protection authority.
14. Changes to this policy
We may change this policy. We will post the new version here and change the effective date. If a change is important, we will also tell you in the app. If you continue to use the app after a change, the new policy applies.
15. Contact us
Hyung-shik Jung (Small Hours), Republic of Korea
Email: support@small-hours.app