Privacy Policy

What stays on your device

Contraction timing, session history, display name and care contact are stored locally on your device.

We do not provide cloud history recovery. Reinstalling the app or restoring a purchase does not restore local history. If you enabled sharing, timing records uploaded to that Circle can remain on our servers until cloud deletion or the end of the retention period.

Service identity and purchases

When the production app starts, it creates or reuses a pseudonymous installation ID. That ID and a private credential are sent to our Supabase backend, and the same ID is used with RevenueCat to check your lifetime access. This happens whether or not you use Circle. The ID does not contain your name, email address or phone number.

Apple or Google processes the payment method. We do not receive card or bank details. RevenueCat receives the installation ID and purchase or entitlement history. Deleting a Circle or deleting the app does not erase the store purchase and does not by itself delete RevenueCat's purchase record.

What is uploaded, and only if you choose

If you turn on sharing, a space is created on our backend. Timing information is uploaded only for you and your invited partner, so the two of you see the same session.

Text updates and photos that you deliberately publish for family are uploaded and shown to people holding the viewer link.

Family viewers never receive contraction records. Partners can view and post but cannot operate the timer.

Photos

When you tap Add photos, the app opens the operating system’s selected-photo picker. Choosing a photo does not upload it, and LittleSoon does not add a separate photo-upload consent prompt or preference.

Only tapping Publish sends the selected photos to your Circle. The composer shows the audience before you publish.

The app compresses each photo, and the server decodes and re-encodes it before placing it in private storage. This removes metadata such as location and device details. Photos are served through short-lived links.

Before publication, an automated image model checks photos for explicit sexual content within our Supabase infrastructure. It can make mistakes; you can contact support about a rejected photo.

Where the backend is

The sharing backend runs on Supabase infrastructure in the European Union.

Supabase also processes the pseudonymous installation identity, anonymous Circle account, membership, security and delivery metadata needed to run the service.

Analytics and diagnostics

Product analytics and crash and error diagnostics run automatically only in production and beta builds of the mobile app, and both use PostHog (EU hosting). Older app releases send crash and error diagnostics to Sentry (EU hosting) instead. None of these services is initialized in development builds.

PostHog records lifecycle events and an allowlisted set of product events. Before sending a JavaScript error report, the app rebuilds it from an allowlist: a fixed error message, stack frames reduced to code locations and the app bundle’s file name, and allowlisted technical diagnostics. Analytics events and JavaScript error reports never include clinical values, free text, photos or viewer links. Native crash reports are built by PostHog’s iOS and Android SDKs and do not pass through that allowlist. They contain native stack frames, device details, the unfiltered native crash message and the app’s storage path on the device, which can include a random folder name that the operating system assigns to that installation. In older app releases, Sentry receives scrubbed errors and crash diagnostics. There is no session replay, touch capture or screen capture.

The Meta advertising SDK records limited installation and app activity to measure advertising. RevenueCat can send store-verified purchase events to Meta when permitted; on iOS, this currently requires authorized App Tracking Transparency (ATT) consent. These integrations may use pseudonymous or device identifiers and limited purchase data. Apple’s ATT permission controls cross-company tracking and access to IDFA. Declining tracking does not block the app or purchases. LittleSoon does not send contraction timing, clinical or other health data, photos, Circle content or names to Meta.

PostHog automatic location lookup from the network address is disabled for analytics events and JavaScript error reports, and our PostHog project is configured to discard the IP address of every event it receives. PostHog analytics uses the same pseudonymous installation ID used with RevenueCat. Crash and error diagnostics use a separate anonymous identifier instead of that installation ID and do not create a PostHog person profile. In older app releases, Sentry events are cleaned in the app and do not intentionally include the installation ID, contact details or request contents, and the LittleSoon Sentry project is configured to prevent storage of IP addresses. We still treat diagnostics as linked in store disclosures until a live event verifies the complete path.

The mobile app has no analytics or diagnostics switch. Events already received by PostHog or Sentry are not automatically erased by deleting a Circle or the app. Email support to ask about those records. Their exact retention settings must be confirmed before release and are not promised here.

This website carries no telemetry or analytics scripts. Its private pages (viewer, invite and deletion) also use no remote fonts.

Retention

A finished space becomes read-only for 30 days and is then deleted from the cloud.

An unfinished space is deleted after 90 days without owner or partner activity.

Visits from family viewers never extend retention.

When a Circle, post or account is deleted, database access is revoked immediately. Deletion of private storage objects and the anonymous authentication user is queued and retried in the background, so physical cleanup can finish later.

We keep minimal opaque tombstones, such as IDs, credential hashes and deletion times, to stop old devices or requests from recreating deleted data. Store purchase history, RevenueCat purchase records, Meta event records, security records and PostHog or Sentry events have separate retention. We do not state a provider retention period until its production setting is verified.

Stopping sharing

Stopping sharing immediately revokes API access for viewers.

Media links that were already issued expire within 60 seconds. Copies that somebody already downloaded cannot be recalled by us or by you: that is a limitation of any sharing, and it is worth knowing before you post.

Deletion

You can delete your cloud space and your local data separately. Deleting local data does not touch the cloud space, and deleting the cloud space does not erase your on-device history.

Use the deletion action in the app or the deletion form on this site with the deletion-only credential saved when sharing was enabled. A successful request revokes access immediately; queued storage and anonymous-auth cleanup can finish later.

Cloud deletion keeps the minimal anti-resurrection and security records described above. It does not erase local history, Apple or Google store purchase history, or automatically erase RevenueCat, Meta, PostHog or Sentry records.

You can email us to start a support request if the form is unavailable or you need help. Email is not an automatic deletion system or proof of identity, and you should never send a deletion credential or health details by email. If every credential is lost, we may have to wait for the Circle retention period. Proof of purchase alone cannot identify you or unlock private data.

Children

LittleSoon is intended for adults. It is not directed at children.

Your requests

Write to waadrarii@gmail.com to start an access, correction or deletion support request, or to ask about this policy and provider-held analytics, diagnostics or purchase records. We may need a safe verification step before acting. Never email a deletion credential or health details: we do not need them and do not want them.