Privacy Policy

Version 2.5 · Effective 20 October 2026

We know you're a busy parent. So we've written this in plain English, with a short summary at the top of each section. The short version: Tunytot exists to make your toddler's day a little easier. We collect the minimum needed to make a personalised song, and we protect your child's information like it's our own.

1. Who we are

In plain English: Tunytot is operated by TUNYTOT LTD, a company registered in England and Wales (company number 17374044).

Tunytot is operated by TUNYTOT LTD ('we', 'us', 'our'), company number 17374044, registered office at 20 River Close, Ruislip, HA4 7UY. For anything to do with your data, email tunytot.app@gmail.com. We'll always respond within five working days.

For users in the UK and EEA, we process your personal data in line with the UK GDPR and the Data Protection Act 2018. For users in the United States, we comply with COPPA. We do not knowingly collect personal data directly from children under 13.

2. Who this is for

In plain English: This service is for parents and guardians, not for children.

Tunytot is built for adults aged 18 and over. By creating an account, you confirm that: you're at least 18; you're the parent or legal guardian of any child you create songs for; and you're happy for us to process the information described in this policy.

Children must not register or use the Service independently. If we discover that a child under 13 has created an account without verified parental consent, we'll delete that account and all associated data immediately.

3. What we collect

3.1 Your account details

In plain English: Just your email and a display name so you can log in and keep your songs saved.

When you sign up via Clerk (our authentication provider), we collect your email address and a display name. We don't ask for a phone number, date of birth, or payment details.

3.2 Your child's details

In plain English: A first name or nickname, an age range, a routine, and whatever interests you choose to share. Nothing more.

To make a personalised song, you give us your child's first name or nickname (never their full name), their approximate age range, their routine, and their interests, things like dinosaurs, trucks, or space. If you are not signed in, we do not create a child profile and we do not store the name in the dedicated child-name field until you create an account and claim the song. Before that claim, the name can still appear in the temporary song title, lyrics, sung lyrics and audio, because those are needed to make and play the song.

Legal note: Child names never appear in URLs. We use opaque, randomised identifiers throughout. Once a song is claimed, child names are stored in your private account and are never visible to other users or listed publicly by us.

3.3 Song content

In plain English: Your child's name appears in the lyrics and title of their personalised song, and can be heard in the audio. This is the whole point of the service, but it means we need to be transparent about where that data goes.

Before lyrics are written, a safety check on the parent's inputs runs through the Lovable AI Gateway using Google's Gemini model. If the check raises a safety concern, we do not generate the song.

Lyrics are written by Google Gemini 2.5 Flash. A personalised song may include your child's first name or nickname, their routine and interests in the title, displayed lyrics and sung lyrics. The finished lyrics are then sent to Google Lyria to make the music. This means your child's first name or nickname can be processed by Google as part of lyric and audio generation.

A name typed for a pronunciation preview goes to Google's text-to-speech to be read back; it is not stored.

Cover images are made with Google's image model, gemini-3.1-flash-image. Cover prompts use only fixed theme keys, fixed descriptive phrases and music style. They do not include your child's name, age or any free-text interests you typed. Google processes this data on our behalf under its applicable data-processing terms.

3.4 How you use the app

In plain English: We use PostHog for anonymised product analytics. No child names or interests are ever shared with PostHog.

We use PostHog (EU region) to collect anonymised usage data, which features you use, session duration, and device type. PostHog autocapture is restricted to an explicit opt-in allowlist only, child names, interests, lyrics, and all free-text inputs are excluded from capture at the configuration level. No child names, ages, or interests are passed to PostHog. PostHog operates under a data processing agreement with appropriate GDPR safeguards.

3.5 Anonymous sessions

In plain English: You can try making a song, up to 3 plays, before you sign up. Your song waits for you when you create an account.

If you use the Service before signing up, we store a temporary token in your browser to track your anonymous session. When you create an account, your anonymous songs are securely transferred via our claim process, and the temporary token is deleted.

3.5a Retention of anonymous creations

In plain English: If you make a song without signing up, the song waits 14 days for you to claim it. If you never play it and never sign up, it is removed on the 48-hour schedule, normally by 72 hours. Audio files are stored privately and only opened with short-lived, signed links, they are not crawlable or shareable as public URLs.

Anonymous tunies are subject to two automatic retention windows. A daily cleanup removes the song record, audio file and cover file when the relevant window has passed:

14-day claim window. Any anonymous song not claimed into a registered account within 14 days of creation is deleted, including the record, lyrics, title, audio file, cover file and metadata. Because cleanup runs daily, deletion normally happens by 15 days. Share links stop working at that point.
48-hour orphan sweep. Anonymous songs that have not been played at all are deleted after 48 hours, even before the 14-day window expires. Because cleanup runs daily, deletion normally happens within 72 hours. This minimises retention of personal data, including a child's first name in lyrics, title, sung lyrics and audio, for drop-offs that never reached playback.

Audio and cover files live in private storage. We never serve the underlying objects publicly: the player loads audio through a one-hour signed URL minted server-side at the moment of playback. The share page is also marked noindex so it does not appear in search engines. During an anonymous session, the child's first name you entered is not stored as a child profile or in the dedicated child-name field, but it can appear in the song's title, lyrics, sung lyrics and audio. The retention windows above exist to keep that exposure narrow when a parent never returns.

3.5b Your agreement record

In plain English: When you agree before your first song, we keep a note of what you agreed to and when. It has nothing about your child in it.

When you agree to our Terms and this Privacy Policy before your first song, we record which policy versions you accepted, when, and which app version you were using. This record holds no details about your child. It is linked to your account once you sign in. If you delete your account, we replace your account ID in the record with a one-way code and keep it for 3 years (see Section 8). That makes it pseudonymised rather than anonymous. If you agree before signing in and never create an account, the record is deleted after 14 days. We use it only to show that you agreed.

3.6 Communications

In plain English: We only contact you if you've asked us to. You can turn this off any time.

If you opt in to routine notifications, we store that preference and act on it. A notification may include your child's first name and routine so it makes sense on your lock screen. We don't send marketing emails without your explicit consent.

4. How we use your information

In plain English: We use your data to make your songs, keep your library working, and make the app better. Not for advertising. Not for profiling. Just to make Tunytot work for you.

Making your songs (contract performance):

Checking the parent's inputs for safety before generation
Writing lyrics, making audio and cover art, and saving personalised Tunies
Maintaining your library and account across sessions
Transferring anonymous songs on signup

Improving Tunytot (legitimate interests):

Analysing anonymised usage data to improve song quality and app design
Identifying and fixing technical issues

Staying legal (legal obligation):

Keeping records required by law
Responding to lawful requests from authorities

With your permission (consent):

Sending routine reminders and song-ready notifications, which may include your child's first name and routine in the message
Sending email updates, withdraw consent any time

Legal note: We never use child names or interests for advertising, profiling, or any purpose beyond creating your songs and running the service you requested.

5. Children's data: how we protect it

In plain English: This section matters most.

Child data is only accessible to the parent or guardian account that created it
Child names are never visible to other users or shown publicly
Child names never appear in shareable URLs, we use randomised share tokens
Songs you publish publicly are stripped of child-identifying information before display
We enforce these restrictions at the database level using Row-Level Security, a technical lock, not just a policy
We don't build profiles of children, sell child data, or use it commercially

Legal note: COPPA (US users): Before your first song, the app asks you, as the parent or guardian, to agree to the limited data collection described here for children under 13, and we keep a record of that agreement (see Section 3.5b). You can withdraw your consent and ask us to delete your data at any time by emailing tunytot.app@gmail.com.

6. Who we share your data with

In plain English: We don't sell your data. We share it only with the services that make Tunytot work.

Clerk: authentication
Handles your login. Processes your email and session tokens under a GDPR data processing agreement. Some authentication metadata may be stored outside the EEA under Standard Contractual Clauses.

Lovable & Supabase: database, storage and hosting
Stores your songs, children's profiles, and library. Our contract and data processing agreement for this are with Lovable (GPT Engineer AB), which runs the service on Supabase as its subprocessor. Tuny audio is held in a private storage bucket served only via short-lived signed URLs. Data is stored in the EU (Ireland).

Lovable: safety checks and payment routing
Lovable AI Gateway routes safety-check requests to Google's Gemini model on our behalf. The parent's inputs are sent for that safety check before lyrics are written. Our requests to Stripe are routed through Lovable's Stripe integration, and Lovable also receives its own copy of subscription events, such as a subscription starting or ending, which include your email address. Lovable never receives full payment card numbers.

Google: lyrics, safety checks, music and cover images
Google Gemini 2.5 Flash writes lyrics from the parent's inputs, including the child's first name or nickname, routine and interests where relevant. A safety check on the parent's inputs also runs through the Lovable AI Gateway using Google's Gemini model. Google Lyria makes the song audio from the finished lyrics, which may include the child's first name or nickname. Google's image model, gemini-3.1-flash-image, makes cover images from fixed theme keys, fixed descriptive phrases and music style only. It does not receive the child's name, age or parent free text for covers. Google processes this data on our behalf under its applicable data-processing terms.

Onelink (Link, LLC) and Stripe: web payments
Premium bought on the web is sold by Onelink (Link, LLC), Stripe's merchant-of-record service, with Stripe processing the payment. They receive only the data needed to take payment (email, name on card, billing country, postcode and card details entered directly into their own form). We never see or store full card numbers. Onelink handles this information under its own privacy policy.

Apple and RevenueCat: iOS purchases
Premium bought in our iOS app is sold and billed by Apple. RevenueCat keeps track of those purchases for us. Our iOS app sends RevenueCat only our account identifier for you plus the Apple purchase records, never your name or email.

OneSignal: push notifications
Delivers routine reminders and "your song is ready" alerts if you opt in. Receives a pseudonymous device push token and the notification payload. That payload may include your child's first name and the routine (e.g. "Mia's bedtime song is ready ✨") so the notification is meaningful on your lock screen. OneSignal is hosted in the US and is used only to deliver notifications to your device.

PostHog: analytics
Collects anonymised usage data. Autocapture is restricted to an opt-in allowlist, no child names, ages, or interests are captured. PostHog operates under a data processing agreement and stores data in the EU.

Cloudflare: edge delivery and DDoS protection
Serves the website and acts as a CDN/edge layer. Processes connection metadata (IP, user agent) for security and abuse prevention.

Legal requirements and business changes
We may share information if required by law or court order. If Tunytot is ever acquired, we'll notify you at least 30 days before any transfer of personal data.

7. Cookies and tracking

In plain English: We use essential cookies and PostHog analytics. No advertising or behavioural tracking.

We use essential cookies and browser storage to keep you logged in and remember your anonymous session. We also use PostHog for anonymised product analytics. PostHog autocapture is restricted to an explicit opt-in allowlist, form fields, child names, and free-text inputs are excluded. We don't use any advertising, behavioural, or third-party tracking cookies.

8. How long we keep your data

In plain English: Your data stays as long as your account is active. Delete your account and we delete your data within 30 days.

We keep your account data for as long as your account is open. If you delete your account, all personal data, including your child's name, interests, and songs, will be deleted or anonymised within 30 days. Backups are purged within 90 days. You can delete a specific child profile at any time; we'll complete this within 30 days and confirm in writing.

Anonymous songs (created before sign-up) are retained on a much shorter clock: 14 days from creation, or 48 hours if never played. See Section 3.5a.

The one exception is the record of your agreement (Section 3.5b). When you delete your account we replace your account ID in it with a one-way code, so it is no longer shown against your account. It is pseudonymised, not anonymous, and we keep the rest of the record for 3 years as evidence that consent was given.

Legal note: UK GDPR right to erasure: Soft-delete is implemented throughout the Service. We confirm completion in writing for every erasure request.

9. Your rights

In plain English: You're in control of your data and your child's data. Just email us.

Under UK GDPR you have the right to: access the data we hold; correct inaccurate data; request deletion; restrict processing; receive your data in a portable format; object to legitimate-interest processing; and withdraw consent at any time. Email tunytot.app@gmail.com. We'll respond within one month. You can also complain to the ICO at ico.org.uk.

10. Security

We protect your data using HTTPS/TLS for all data in transit; database Row-Level Security so users can only access their own records; opaque UUIDs and share tokens; rate limiting on anonymous sessions; input validation on server functions; HMAC signature verification on webhook endpoints; safety checks on parent inputs; and content moderation on all generated and user-edited lyrics before audio is rendered. If we become aware of a breach, we'll notify you and the relevant authority within 72 hours.

11. International transfers

Our database and storage are hosted in the EU (Ireland) by Lovable, using Supabase as its subprocessor. Clerk may store authentication data outside the EEA, they use Standard Contractual Clauses as the transfer mechanism. Google may process lyric, safety-check, translation, music and cover-image data internationally under its applicable data-processing terms. PostHog stores analytics data in the EU. Link, LLC (Onelink) and Stripe, which handle web payments, are based in the US. RevenueCat, which records purchases made in our iOS app, and OneSignal, which delivers push notifications, are also based in the US. Where personal data is transferred outside the UK or EEA, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms where required.

12. Changes to this policy

We'll tell you about any material changes, by email and on our website, at least 14 days before they take effect. For changes affecting how we use children's data, we'll ask for fresh consent first.

13. Get in touch

Questions? We actually read our inbox.

tunytot.app@gmail.com · www.tunytot.com