Little Binder Privacy Policy

1. Information we handle

Account information includes names, email addresses, account identifiers, sign-in and recovery information, family roles, preferences, and records of choices and consent. Passwords are stored as hashes. If you add a passkey, we store its public credential and related security records, not your fingerprint, face data, or device PIN. Your credential provider handles any synchronization of the private credential. Two-step sign-in uses a protected authenticator secret and hashed recovery codes.

Family information includes child display names, optional birthdays or birth years, optional portraits and name pronunciation, creation images, recordings, titles, transcripts, dates, organization, and editing choices. A birthday supports age-appropriate presentation and family search; invited viewers do not receive it, and it is not sent to AI or used for advertising. Portraits may be visible to the family and authorized viewers whose sharing includes that child. Portraits are not used for facial recognition or AI analysis.

Sharing information includes invitation recipients and relationships, access permissions, shared albums and creations, view receipts, reactions, written replies, and voice replies. Gift information includes purchaser and recipient details, delivery messages, claim status, and payment records. Support information includes messages, feedback, reply choices, and optional technical details. Forms identify the information they request.

Operational information includes limited request and security logs, IP addresses, device and installation identifiers, app and platform versions, language, notification tokens and delivery records, and service-use information needed for reliability and account features. For example, we record launch totals and dismissed reminders, not a child's screen history or session duration for those counters. Optional adult-provided location or Home answers are used for the stated feature or message purpose, not added to child profiles or used for child-based advertising. We do not request device location.

2. Why we use it

We use information to provide and secure the family archive, authenticate people, apply permissions, synchronize content, fulfill chosen sharing and printing, operate requested AI features, process payments and gifts, deliver permitted messages, provide support, and manage exports and deletion. We also use necessary records to investigate misuse, comply with law, and establish or defend legal claims where permitted. We do not use ad networks, data brokers, or cross-app advertising trackers.

3. Children and adult authority

Adults hold accounts and manage children's profiles. Children may create images and recordings through family features, so information can come from a child as well as from an adult. A parent, guardian, or other person with lawful authority must authorize the child's participation and the information provided. Account acceptance and an app PIN are not substitutes for legally required parental consent.

A parent or guardian may ask to review or correct their child's information, stop further collection or use, withdraw applicable consent, or request deletion by contacting privacy@littlebinder.com. We may verify identity and authority before acting. Some features cannot operate without the information necessary to provide them. We do not require children to provide more personal information than reasonably necessary for their participation. Contact us if you believe a child's information was collected without required authorization.

4. Family managers, viewers, and copies

Family managers control access within their permissions. Invitations use recipient details supplied by an authorized adult. Sharing begins only after acceptance and is limited to current permissions. Shared creations can identify all their child creators, including co-creators. Album and automatic sharing follow the family's chosen settings. We store viewing and response information so the family can see the interaction.

Viewers can use available printing features, including PDF saving where supported, but do not receive the family's full archive export. Removing or pausing access stops further authorized service access; it cannot recall screenshots, prints, downloaded exports, or other copies already made outside the service. Offline devices may retain previously available copies until they reconnect and process updated permissions or deletion instructions.

Closing one person's account does not automatically erase another family's independent record of a creation, reply, or interaction. Depending on the relationship and applicable rights, a family may retain an attributed contribution in its archive after the contributor leaves. Contact us about a specific deletion or authority dispute. We review it rather than treating an account role as permission to disregard another person's legal rights.

5. AI assistance and search

Family AI assistance and voice-note transcription are separate choices that start off. They process the images, recordings, or words needed for the selected feature on systems we operate in the United States. We do not use third-party AI services. Your children’s artwork, voice notes, and other family content are not sent to AI companies or used to train AI models. Saved titles and transcripts remain with their creations until removed. Temporary processing inputs are removed after processing.

Ordinary search can run on the device. Family AI search can additionally process search words and relevant saved titles and transcripts on our servers. Related search starts on for new viewer accounts and can be turned off. It includes only currently shared content from families that have authorized that AI use. Existing off or indeterminate legacy choices remain off unless changed. Turning family AI off stops new AI processing of that family's content, including viewer related search; unfinished results are discarded, while accepted results remain until removed.

Speaking a search is a separate choice. Recognition runs on the device where supported or sends a temporary recording to our servers, with names the speaker is already authorized to use to improve recognition. The temporary recording and search processing data are not retained after processing or used for training. A viewer's speech choice does not authorize AI processing of unshared content. We keep preference and consent records, not a history of search queries or a separate content search index.

6. Service providers and payment

Providers help us host and protect the service, deliver email and notifications, process payments, and respond to support. They receive information needed for those functions and are subject to applicable contractual and legal restrictions. Our infrastructure includes DigitalOcean hosting; automated email uses Resend. Expo, Apple, and Google handle tokens and notification payloads for push delivery. Account and invitation emails may include the information needed for their purpose; push messages avoid sensitive creation and child details.

Stripe handles payment details under its own privacy policy. We do not receive or store full payment-card or bank-account credentials. We retain necessary transaction, entitlement, receipt, gift, accounting, and fraud-prevention records. A gift does not give its purchaser access to the recipient's family content or enroll the recipient in marketing. Third-party credential providers and device services also handle information under their own policies when you choose to use them.

7. Messages, website storage, and feedback

Optional promotional email requires an adult's separate choice and includes an unsubscribe mechanism. Promotional push and in-app ideas have separate controls. We record choices and do not use child-derived data or device location for campaign targeting. Account, billing, security, legal, and requested sharing messages are separate from marketing and may continue when needed and permitted. Device permissions still control push. We do not track opens or clicks in private transactional messages or optional update emails.

We count requests to our public social links by day and link. These totals do not store IP addresses, cookies, account details, or browsing histories.

The website and app use necessary local storage and similar technology for sign-in, security, language, preferences, and remembered sign-in methods. Device storage may also hold offline creations and unsent work. Removing an app, clearing its data, or losing a device can lose unsent work. Copies on your device are not server backups until synchronization finishes.

Feedback is optional. We use its message, category, account reference, submission time, and reply choice for support and service improvement. Optional technical details can be previewed before sending and do not attach raw logs, creations, recordings, names, or file paths. Authorized staff access is restricted and audited. Sending feedback does not grant staff access to the family archive. Feedback is not used for advertising or AI training.

8. Security, support, and legal disclosures

We use access controls, private storage, encrypted network transport, restricted staff access, and other safeguards appropriate to the service. Uploaded creation images have embedded location metadata removed before saved images are shared; useful non-location metadata may remain. No storage or transmission system can guarantee absolute security or availability.

Routine staff support access to creations requires an adult's logged, time-limited permission. Separately, we may access, preserve, or disclose information when reasonably necessary and legally permitted to comply with legal process, investigate misuse, enforce our Terms, protect against a security threat, or protect a person from serious harm. Such access is restricted to authorized personnel for the relevant purpose. We report apparent child sexual exploitation as US law requires, including required reports to the National Center for Missing & Exploited Children.

9. Retention and deletion

We retain account and family information while needed to provide the archive and its chosen features, subject to deletion requests, account status, lawful preservation, and any properly notified service termination. We do not retain children's information for unrelated future uses. Ordinary subscription cancellation does not itself request deletion. A fully refunded family retains access for 90 days; after that period we may remove its stored content. We do not promise removal of every copy on the day that access ends.

Confirmed account-deletion requests normally have a 14-day cancellation period; signing in during that period cancels the request. Sessions are revoked on confirmation. After that period, eligible active account and family data are removed. Shared-family administration or a lawful hold may require additional handling. App-managed copies on other devices are cleared when those devices reconnect and process the deletion. Copies independently saved outside Little Binder remain under their holders' control.

Ordinary encrypted backup copies expire within 35 days after active deletion and are not available for routine access or user restoration. A record subject to a lawful preservation requirement may be segregated and retained for that requirement. We may retain only the information reasonably necessary and legally permitted for accounting, security, fraud prevention, required suppression, or legal claims, and remove it when that purpose ends. These exceptions do not authorize indefinite retention of an entire family archive. A minimal deletion receipt records completion.

Specific operational limits include: raw security IP addresses, up to 30 days; feedback messages, up to 90 days; attached feedback technical details, up to 14 days; export-request and download history, up to 35 days; and unsent sharing delivery records, up to 35 days. Gift-delivery details leave the active queue within 30 days after purchase, and unpaid checkout details within two days. Identifying records may be retained longer only where a specific lawful exception applies. Backup expiration is separate from active-record deletion.

Notification preferences, authorized delivery collections, optional Home answers, launch counters, and saved feature results follow their account or family purpose and deletion rules. Delivery collections do not preserve erased creations. Account closure removes usable credentials and account-linked feedback. Requests involving another family's contributions are reviewed as described above. You can ask us about the retention applicable to a particular record.

10. Your choices and privacy requests

Available account controls let authorized adults correct information, change sharing and optional processing choices, export family information, and request deletion. Account deletion is also available at littlebinder.com/delete-account.html. Contact privacy@littlebinder.com for access, correction, deletion, withdrawal of consent, or other rights available under the law that applies to you. We may request proportionate verification and explain any lawful limitation on a request. Withdrawing consent does not invalidate processing already lawfully completed.

Where applicable law requires a legal basis, we use the basis appropriate to the purpose, such as providing the requested service, consent for optional processing, compliance with legal obligations, or legitimate operational and security interests where permitted. Children's information and sensitive uses require the authority applicable to them. You may contact the relevant privacy regulator if you are not satisfied with our response.

11. Location and business transfers

Little Binder is based in Puerto Rico, United States. Our servers and encrypted backups are in the United States. AI processing runs on the device or on systems we operate in the United States. Separate service providers for payments, email, and notifications may process the information needed for those services in other countries. Applicable safeguards and transfer requirements still apply. Foreign courts and authorities may have lawful access to information held in their jurisdiction. Canadian residents may contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information du Québec. Our privacy contact also serves as our privacy officer contact.

If Little Binder is involved in a merger, acquisition, financing, reorganization, or transfer of the service, necessary information may be disclosed or transferred under confidentiality and data-protection safeguards, subject to applicable law. A successor must honor the applicable privacy commitments. This does not authorize selling family information for advertising or unrelated purposes, or using a business transfer to bypass required notice or consent.

12. Updates and contact

We publish the revision date and give appropriate advance notice of material changes. We obtain new consent where required before a changed use begins. A revised policy does not silently expand the purposes authorized for information collected under an earlier commitment.

Little Binder LLC, 1654 Calle Tulipan, Ste 100, San Juan, PR 00927-6242, United States. Privacy officer and requests: privacy@littlebinder.com. Support: support@littlebinder.com. Telephone: +1 787-699-3505.

Privacy on our free activity pages

Our free activity pages and downloads do not ask for names, ages, email addresses, addresses, pictures or recordings. They do not use cookies, browser storage, analytics, advertising, social widgets or third-party embeds. Local page controls open help and printing options without sending activity choices anywhere. Our servers process the network information needed to deliver the pages. We do not keep visitor access logs for activity pages or their downloads. The separate family app has its own sign-in, parent consent and privacy controls.