Privacy Policy

Small Hours Baby Sleep Tracker · Effective date: 28 September 2026

Small Hours Baby Sleep Tracker ("Small Hours", "the app", "we", "us") is made by Hyung-shik Jung, an independent developer in the Republic of Korea. This policy covers the people who use the app. It also covers the people who buy a gift of Premium on small-hours.app, and the people who get the gift emails. It explains what data we use, why, and what you can do about it.

1. Data we collect

Baby and care data. The baby's name, birth date or due date, and, if you enter them, sex, weeks born early, gestational age, allergies, conditions, and the names of the baby's doctor and clinic. Also the care you log: sleep, feeds, nursing, pumping, diapers, growth, health notes (medicine, temperature, vaccines, symptoms, doctor visits and visit questions), moods, milestones, activities, running timers, reminders, and notes.
Stories, photos, and attachments. Photo stories and their captions, the text you place on a story, the baby's profile photo, photos and PDFs you add to an entry, and the small preview images the app makes from them.
Account information. If you use email and password, we keep your email address, and Supabase Auth stores a protected one-way form of your password rather than the password itself. When you sign in with Apple or Google, we receive a user ID and the email address that the provider shares. With Sign in with Apple, you can hide your email address. The app does not ask Apple for your name. Google also shares the name and profile picture on your Google account; our sign-in service keeps them with your account, and the app does not use them.
Sharing information. For a shared baby: which accounts care for it, who owns it, when each caregiver joined, the names caregivers give each other, invite codes, and which caregiver added each record and story.
Consent records. When you agree to these terms, we keep which version you agreed to, when, and the app version.
Purchase and paywall information. Subscription offers are shown through Superwall, and Apple handles purchases. Superwall receives device and app information (for example device model, OS version, language, and app version), a device identifier that Apple gives to apps from the same developer, paywall and purchase events, and your subscription status. After you sign in, Superwall also receives your account's user ID, so a subscription follows your account to another phone. We never receive your payment details.
Premium records. When you are signed in, our server keeps a record of your Premium, because backup, sync and sharing work only with Premium. Superwall sends our server an event for each step of a purchase: the plan, when it started and when it ends, a free trial, a renewal, a failed renewal and its grace period, a cancellation, a refund. Each event also holds the price, the currency and the country of the purchase, Apple's transaction numbers, whether the plan came through Family Sharing, and which screen in the app showed the offer. When you sign in or open the app, and from time to time to check that a plan is still current, our server can also ask Superwall about the purchases on your account. We keep your plan, its state and its end date with your account, and we keep each event as it arrived. We do not receive your Apple ID or your payment details.
Gift purchases. You can buy Premium as a gift on small-hours.app. Gifts are sold through Link, the merchant of record of Stripe, which takes the payment and sends the receipt. Your card statement shows LINK.COM and our name. Your card details go only to Stripe, the payment processor. We keep the buyer's name and email address, the amount and the currency, Stripe's IDs for the checkout and the payment, and whether it was paid, refunded or disputed, with the dates. For the gift, we keep the names of the sender and the recipient, the message, the card design, and the delivery date. If the gift goes by email, we also keep the recipient's email address. We use it only to send the gift and, if nobody opens it, a reminder after 7 days and again after 30 days. We use the buyer's email address for accounting and for the gift emails to the buyer. The buyer gets the gift by email only when it is for the buyer. For a gift given by hand, the buyer gets the link on small-hours.app. The buyer also gets a note when somebody opens a gift for another person. When somebody opens the gift, we record which account opened it. If nothing else keeps that account's Premium, we email its sign-in address 14 days before the gift year ends. Our email service, Resend, sends all gift emails. When somebody looks up, opens or pays for a gift, we keep a hashed form of their network (IP) address to limit repeated tries. We keep each verified payment event from Stripe, with the names, email addresses, phone numbers and postal addresses taken out. We keep the order and the payment events for as long as tax law requires us to keep business records. We keep them also after an account is deleted, but we no longer connect them to that account. We keep the recipient's email address and the gift message until shortly after the gift is opened or can no longer be opened, for example after a refund. We keep the hashed network addresses for 30 days.

We do not collect your precise location, contacts, or advertising identifier.

2. Where your data is kept

Your care records, stories, photos, attachments, and reminders are kept on your iPhone. The app's widgets read them there. If you take a photo with the in-app camera for a story or an entry, a copy is also saved to your Photos library, if you allow it.

When you sign in, your account and consent records go to our server. Your Premium records are kept there too.

Gift orders and gifts are kept on our server. This includes the data of gift buyers and gift recipients who do not use the app. Stripe keeps the payment details.

A baby stays on your iPhone until you back it up or share it. Both need Premium and an account.

Backup. In the baby's profile, when you tap Back up to your account, the app uploads that baby's profile and all of its records to our server, under your account. After that, the changes you make go up too, so the backup stays up to date. Nobody else can see a backed-up baby until you invite a caregiver. On another phone, sign in and tap Restore from your account. The app then downloads the baby, and the records on that phone are replaced by the ones in your account.

Sharing. The first time you open Invite caregiver for a baby, the app tells you what sharing uploads and waits until you tap Share and get a code. Then it uploads that baby's profile and all of its records to our server, including records made before you shared it. Later changes follow. When you join a baby with an invite code, the records on your phone are replaced by the shared ones, and what you log after that is uploaded too. This includes:

the baby's profile and profile photo;
care entries and running timers;
photo stories, their captions, and the story images; and
photos and PDFs added to entries, with their preview images.

This list is the same for a backup and for a shared baby. The app then downloads the same data to the phone of every caregiver of that baby. A change made without a connection waits on the phone and goes up later. If Premium ends, backup and sync pause. Nothing is deleted: the records stay on each phone and on our server, and changes go up again when Premium is back. Reminders and display settings stay on each phone.

3. How we use your data

To run the app: record care, show summaries and charts, send the reminders you set, and show widgets.
To back up a baby to your account and restore it on another phone.
To sync a shared baby between the caregivers you choose.
To sign you in and keep your account secure.
To offer and manage subscriptions, and to check whether you or your family has Premium.
To take orders for gifts of Premium, send them, and open them, and to keep the records that tax law needs.
To fix problems and improve the app.
To answer you when you contact us.

We do not use your baby's data for advertising. We do not use it to train AI models, and we do not share it for research.

4. Data sharing and disclosure

We do not sell or rent your personal information. We share data only with the service providers that run the app for us, and only as needed:

Supabase, Inc.: hosts sign-in, our database (with backups and Premium records), and the private file storage for the stories, photos, and attachments of backed-up and shared babies.
Apple: Sign in with Apple, App Store purchases, and TestFlight.
Google: Google Sign-In, if you choose it.
Superwall, Inc.: shows paywalls, reports your subscription status to the app and to our server, and measures how paywalls and purchases perform.
Link: the merchant of record of Stripe. It sells gifts on small-hours.app, takes the payment and sends the receipt.
Stripe: the payment processor for gifts. It keeps the card details.
Resend: sends the gift emails.

We may also disclose data if the law requires it, or to protect the rights and safety of our users.

5. Sharing a baby with caregivers

A caregiver can make an invite code for a shared baby. Anyone who signs in with a valid code joins that baby. Share codes only with people you trust.

Every caregiver of a baby can see and change its profile, care history, running timers, stories, photos, and attachments.
A caregiver can delete the records and stories they added. The baby's owner can delete any record or story of that baby, including ones other caregivers added. The server records who added each one, and it refuses a deletion from anybody else. Records and stories added before we recorded this have no recorded author. Only the baby's owner can delete them.
One Premium covers the family: a baby has Premium when any of its caregivers has it. The other caregivers do not see your purchases. They can see only whether the family has Premium, and until when.
Caregivers see each other's names. Until somebody sets a name, a caregiver's name can be the email address they signed in with.
The owner can remove a caregiver, and a caregiver can leave. This stops their access to our server. It cannot remove copies that are already on their phone.

6. Data retention and deletion

Data on your iPhone stays there until you delete it, erase it when you delete your account, replace it by joining another baby, or delete the app.

Server data stays while your account is active. A backed-up or shared baby stays on our server also when Premium ends, and when you delete the app. To remove a baby you own from our server, delete your account, or email us. When you delete a record or a story, it is marked as deleted so that the deletion reaches every caregiver's phone. The marked record and its files stay on our server until the baby is deleted.

We keep your Premium records while your account is active. Some purchase events reach our server with no current account. If you buy before you sign in, the events for that purchase name Superwall's anonymous ID for your phone. This includes later renewals, cancellations, and refunds. If you delete your account and do not cancel the subscription, each renewal event after the deletion names the ID of your former account. We keep purchase events that arrive with no current account with the ID they name, as the record of the purchase, with no set end. Such an event can hold the product, the price, the currency, the country of the App Store, and Apple's transaction IDs. It does not hold your name or your email address.

For gifts, we keep each order and each payment event for as long as tax law requires us to keep business records. We keep a recipient's email address and the gift message until shortly after the gift is opened or can no longer be opened. We keep hashed network addresses for 30 days.

You can delete your account in the app: open Settings and choose Delete account. You sign in again first, with Apple, Google, or your password, to show that it is you. Then:

Deleting your account does not cancel a subscription. Apple continues to bill until you cancel it in your Apple ID's subscription settings. The app shows a Manage subscription button for this.
Your access ends at once, and every phone signed in to your account is signed out. If you signed in with Apple, we ask Apple to revoke the app's access to your Apple ID. If you signed in with Google, the app asks Google to remove its access.
For each baby you own, access ends at once for you and for every other caregiver. The other caregivers keep their own accounts and any other babies they care for.
For a baby somebody else owns, you stop being one of its caregivers. That baby and its records stay with its owner.
For 30 days, we keep your account and your babies' data on our server in a locked state, in case you deleted it by mistake. Nobody can use it during this time, other caregivers included. Only you can restore it: sign in again with the same account (Apple, Google, or email and password) within those 30 days. The app shows the exact date and time when this ends. Knowing an email address alone never restores an account. Restoring gives you back your babies and their records, and the other caregivers get their access back as it was.
When the 30 days end, we permanently delete your account, your sign-in identities, your consent records, your Premium records and the purchase events stored with your account, your babies, their records, stories, photos, and attachments from our database and file storage. Purchase events that arrived with no current account stay, as we describe above. The deletion job runs every hour, so this normally happens within an hour of that time. As proof of consent, we keep only which versions of the consent, our terms, and this policy you accepted, and on which day. That record does not contain your name, email address, account, or anything else that identifies you.

Copies in our service providers' backups and logs are removed on those systems' own schedules, which can be later than this. Copies already on other caregivers' phones stay there, because we cannot reach them.

7. Data security

Records on your iPhone are protected by iOS data protection. Data sent to our server is encrypted in transit. On the server, access rules make sure that each person sees only their own account and the babies they care for, and the files of backed-up and shared babies are kept in private storage. Premium records are in a part of the database that the app cannot read. Through the app, you can read only your own Premium status and whether your family has Premium. No system is completely secure, but we work to protect your data.

8. Your rights and choices

Under the Korean Personal Information Protection Act, the EU and UK GDPR, and other laws that apply to you, you can ask to:

see the personal data we hold about you;
correct it;
delete it;
limit or stop how we use it, or object to a use;
receive a copy in a common format; and
withdraw your consent at any time.

In the app, you can remove a caregiver, leave a baby that somebody else shares with you, and delete your account (Settings, then Delete account). To use any other right, email support@small-hours.app.

9. International data transfers

Our service providers may process data outside your country, including in the United States. When data leaves the Republic of Korea, the EEA, or the UK, we rely on the safeguards the law requires, such as standard contractual clauses.

10. Children's privacy

Small Hours is for parents and caregivers. It is not for children to use. We do not knowingly collect personal data from children under 14, or under the age of digital consent where they live. An adult enters any information about a baby. If we learn that a child has given us personal data, we delete it.

11. Consent to share consumption data with Apple

If you buy a subscription in the app and agree to it, and Apple asks us about a refund request, we may send Apple your subscription status and usage totals. This helps Apple decide the refund. We never send your baby's entries.

12. Third-party links

The app can link to other websites and services, such as Apple's subscription settings. Their own privacy policies apply to them, and we are not responsible for them.

13. Data protection authority

If you think we have handled your data wrongly, please contact us first. You can also complain to the Personal Information Protection Commission of Korea (pipc.go.kr). If you live in the EEA or the UK, you can complain to your local data protection authority.

14. Changes to this policy

We may change this policy. We will post the new version here and change the effective date. If a change is important, we will also tell you in the app. If you continue to use the app after a change, the new policy applies.

15. Contact us

Hyung-shik Jung (Small Hours), Republic of Korea
Email: support@small-hours.app