TinyDepositsTinyDeposits privacy notice
Version 2 · draft · 7 October 2026
Draft for Gaurav's approval and a lawyer's check. Not yet published. Anything marked [legal check] needs a lawyer's view or a fact confirmed before this goes live. Everything else describes what the app's code does today (origin/main, 5 October 2026).
In one minute
- TinyDeposits is for parents. Children don't have accounts and don't sign in. You tell us about your child; we use it to plan ten minutes a day together.
- What we hold: your email and name, your children's profiles (first name, age, school year, curriculum, likes, an optional photo), your plans and how sessions went, your family calendar and to-dos, summaries of school emails you forward, and simple usage records.
- Why: to run the app for your family. We ask for your consent, and you can withdraw it at any time.
- Who helps us run it: Vercel (hosting), Supabase (database, sign-in and file storage), Cloudflare (domain and email forwarding), Resend (sending emails) and Anthropic (the built-in intelligence). Some of them are outside the UAE.
- Anonymous suggestions: the how-did-it-go ratings of activities are counted together with other families' ratings to suggest "Families like yours also enjoyed". No names, no places, and an activity is only suggested once at least 10 families have rated it. You can switch this off in Settings.
- We never sell your data, show ads or use your children's information for marketing.
- How long: school-email text we couldn't read is deleted after 30 days, school-inbox items after 180 days, and forwarded raw emails straight after reading. Everything else stays until you delete it or ask us to.
- Your rights: see, correct, download or delete your data, and withdraw consent. Email admin@tinydeposits.com.
1. Who we are
TinyDeposits (tinydeposits.com) is a personal project run by Gaurav Nanda in Dubai, United Arab Emirates. It is not a company. Gaurav decides how your data is used and is responsible for it.
Contact: admin@tinydeposits.com
[legal check] Confirm that an individual running a free, invite-only pilot can act as the data controller under the UAE PDPL, and whether a registered entity, a named data protection officer or any registration is needed now or before a wider launch.
TinyDeposits is currently a free, invite-only pilot. New sign-ups are switched off; only people Gaurav approves (or a parent invites into their family) can sign in.
2. Children and parental consent
- TinyDeposits is used by parents and carers, not by children. There are no child accounts and children never sign in.
- Everything we hold about a child is entered by a parent (or comes from school emails and reports the parent chooses to share).
- Most children it's designed for are under 13. That's why we ask the parent who adds a child to confirm that they are the child's parent or legal guardian and that they consent to us handling the child's information as described here.
- A second parent can join a family with an invite code. Both parents then see and edit the same family information, including the children's profiles.
- You can remove a child's profile at any time (Family → Children → Edit → Remove child), or ask us to delete everything (see section 8).
[legal check] The UAE Child Digital Safety Law (Federal Decree-Law No. 26 of 2025) is reported to require verifiable parental consent for under-13s' data, with compliance due by January 2027. Confirm (a) whether it applies to a parent-facing app that holds children's data but isn't used by children, and (b) whether a checkbox at sign-in by an invited, email-verified parent is enough, or whether a stronger check is needed.
3. What we collect, where it comes from, and why
| What | Where it comes from | Why we use it |
|---|---|---|
| Your account: email address, the name you give, which family you belong to and your role (owner or parent), and an optional different email for calendar invitations | You, when you request access, sign in or join a family | To let you sign in, keep your family's data together, and send you sign-in codes and calendar invitations |
| Access requests: email, name and the short note you write | You, on the "Request access" form | So Gaurav can decide who joins the pilot. Gaurav gets an email about each request |
| Your family: the family name you choose, invite codes (valid for 7 days), your private school-email address and your private calendar-feed link | Created by the app when you set it up | To run the calendar and school emails |
| Children's profiles: first name, age, school year, country, curriculum, favourite things, what they love and aren't keen on, sports, preferred session length and time, reward ideas, and an optional photo (made small, about 480 pixels, before it is saved) | You | To personalise plans, games and worksheets, and to show which child is which |
| Plans and progress: survey answers, chosen focus skills, plans, which activities you did, how long they took, the three-tap feedback after each session, your notes, saved worksheets and activities | You, as you use the app | To plan the next two weeks for each child and make them fit better over time |
| School reports and curriculum overviews you upload or paste | You | Read once by the built-in intelligence to suggest levels, focus skills and this term's topics. The file itself is not stored. We keep only the short summary, levels and topics the app shows you |
| Calendar and to-dos: events, holidays and to-dos, including which child they're for | You, or a forwarded school email you approve | To show your family calendar, the private calendar feed and calendar invitations |
| Forwarded school emails: sender, subject, the date, the summary, the dates and to-dos picked out, and any attachments (PDF, Word, pictures) | Emails you forward to your private TinyDeposits address | To turn school emails into calendar items and to-dos for you to approve. School emails may mention other children, teachers or parents; we only use them to produce your family's summary |
| Printable PDFs (fridge charts and worksheets) | Created when you download them | So you can find and print them again under Downloads |
| Calendar invitations sent: which item, which parent it went to and the address used, and a copy of what was sent (title, date, notes, child's first name) | Created when you tap "Send to calendar" | So changes and deletions in TinyDeposits can update or cancel the invitation in your calendar |
| Activity links you share: the activity text (name, steps and tips, with any child's name removed), a random link code, which parent made the link, and when it expires. No child, family or email details | Created when you tap "Share this activity" | So the person you send it to can read the activity, and so you can stop the link. Anyone with the link can read the activity until it expires or you stop it |
| Friends' circles: the circle's name and join link, which families are in it, and for each family its weekly target and the deposits it made this week (as totals across its children, with no names) | You, when you create or join a circle and as you tap "We did it" | To show a circle's group total only ("Group update: 20 of 30 deposits done"). Families in a circle never see each other's numbers, names, children or location. Leave or delete a circle at any time, and your numbers are removed |
| Feedback you send: what you write, the type, the area and the screen you were on | You, using "Send feedback" | To improve the app. See section 5 for how it's anonymised |
| Usage records: which screens and features are used, activity names, ratings and session times, a random ID for the child (not their name), how long the app was open, your browser type, and how much built-in intelligence each family used and what it cost | Created by the app as you use it | To understand what's useful, keep costs under control, and set daily and monthly allowances. Gaurav sees counts and activity names, not children's names or school-email content |
| Anonymous suggestions: your ratings of Heartwork activities (not names, family or place) are counted with those of other families | Worked out from the usage records above | To suggest activities other families enjoyed, only when at least 10 different families have rated them. No built-in intelligence is used. Switch it off under Settings → Anonymous suggestions and your ratings are left out from then on |
We don't collect your phone number, address, payment details or location. The app doesn't use the camera or microphone, except when you choose a photo or file to upload.
Sign in with Google is built into the app but switched off unless Gaurav turns it on. If it is on and you use it, Google shares your email address and basic profile with Supabase. [legal check] Confirm whether Google sign-in is switched on for the pilot; if not, this paragraph can be shortened.
Legal basis: your consent. We ask each parent to agree to this notice before using the app, and you can withdraw consent at any time (section 9). [legal check] Confirm consent is the right basis under the PDPL for each purpose above, in particular for usage records and for holding information about third parties that appears in forwarded school emails.
4. The built-in intelligence
In the app we call it "the built-in intelligence". It is provided by Anthropic (Anthropic PBC, United States) through its API.
What we send to it, and only when you use a feature that needs it:
- Plans, activities, games and worksheets: your child's age, school year, curriculum and country, their likes and favourite things, your request, and how past sessions went. We don't send your child's name for these.
- School reports and curriculum overviews: the text, pictures or PDF pages you add.
- Forwarded school emails: the email text and attachments, plus your children's first names, ages, school years and curricula, so it can tell which child an event is for.
What comes back is shown to you and saved in your family's data. Anything you type into a request box is sent as written, so please don't include anything you don't want shared.
Some generic worksheets (made without your own request or theme) are saved in a shared library and reused for other children of the same age, curriculum and skill, to save cost. These contain no names or personal details.
The built-in intelligence makes suggestions only. It doesn't make decisions about you or your child that have legal or similar effects.
[legal check] Confirm Anthropic's current commercial terms for API data: how long Anthropic keeps inputs and outputs, and that it does not use them to train its models. Quote the exact terms (with a link) here rather than paraphrasing.
5. Who processes your data
We use these service providers to run TinyDeposits. They process data on our behalf, under their own terms.
| Provider | What it does for us | What it handles |
|---|---|---|
| Vercel (Vercel Inc., USA) | Hosts the website and the server code. On our welcome page only (not inside the app), counts visits with Vercel Web Analytics, which uses no cookies | Everything passing between your browser and our server, and server logs. For the welcome page: the page visited, where the visit came from, and the type of browser, device and country, without identifying you |
| Supabase (Supabase Inc.) | Database, sign-in and file storage | All the data in section 3, the optional child photos, printable PDFs and forwarded emails waiting to be read |
| Cloudflare (Cloudflare Inc., USA) | Domain, receiving emails sent to your private TinyDeposits address, and passing admin@tinydeposits.com mail on to Gaurav | Forwarded school emails in transit |
| Resend (USA) | Sends emails: sign-in codes, "you're in" emails, access-request alerts to Gaurav, and calendar invitations | Recipient addresses and the email content, including event titles and children's first names in calendar invitations |
| Anthropic (Anthropic PBC, USA) | The built-in intelligence | See section 4 |
| GitHub (GitHub Inc., USA, owned by Microsoft) | Stores TinyDeposits' code and task list. Feedback you send is copied there as a task | Feedback text only, after email addresses, phone numbers and your children's first names have been removed automatically, with an anonymous family code (for example F-3a9c1d). The repository is private |
| Google (Gmail) | Gaurav's inbox for admin@tinydeposits.com and access-request alerts | Messages you send us, and access-request details |
Your browser also loads fonts from Google Fonts and code libraries from jsDelivr and cdnjs (Cloudflare). These services see your IP address and browser type, as with any website, but none of your family's data.
The TinyDeposits code is written and maintained with help from AI coding agents (provided by Anthropic). These agents work on the code and task list in GitHub; they don't have access to the database, and feedback reaches them only in the anonymised form described above.
We don't sell your data, share it with advertisers, show ads, or use children's information in marketing. We would only disclose data if the law required it.
[legal check] Put a written data processing agreement (or confirm the provider's standard one applies) in place with each provider above, and list them by legal entity name.
6. Where your data is stored
Our database and server code run in the European Union (Ireland). Some providers process data in the United States, and Cloudflare works worldwide. So your data, including children's data, is transferred outside the UAE.
- Supabase: West EU (Ireland).
- Vercel: West EU (Ireland) for the server code.
- Anthropic, Resend, GitHub: United States. [legal check] Confirm each provider's processing location.
[legal check] Cross-border transfer: the PDPL limits transfers of personal data outside the UAE to countries with adequate protection, or with appropriate safeguards or consent. Confirm what's needed for transfers to the European Union (Ireland) and the United States, and whether the consent wording should mention transfers explicitly (it does in this draft).
7. How long we keep it
What the code does automatically today (a clean-up runs every night):
| Data | How long |
|---|---|
| A forwarded email's raw file (with attachments) | Deleted straight after it has been read. Any left behind (for example after an error) are removed by the nightly clean-up once they're a day old |
| Text of a forwarded email that couldn't be read yet (for example, the daily allowance was used up) | Deleted after 30 days |
| School-inbox items (sender, subject, summary, picked-out dates and to-dos) | Deleted after 180 days. Anything you saved to your calendar stays there until you delete it |
| School reports and curriculum files you upload | Not stored. Only the summary, levels and topics are kept with your child's profile |
| Activity share links | Stop working after 30 days, or straight away when you stop them. They are deleted if you delete your account (an expired link's text isn't deleted automatically yet) |
| Family invite codes | Expire after 7 days (the expired code isn't deleted automatically) |
Everything else (your account, children's profiles and photos, plans, calendar, to-dos, PDFs, records of calendar invitations, feedback and usage records) is kept until you delete it or ask us to delete it. There is no automatic time limit yet.
[legal check] The PDPL expects data to be kept no longer than needed. Decide on retention periods for usage records, records of calendar invitations, feedback, declined access requests and accounts left unused, and add them to the nightly clean-up. Also confirm how long Supabase and Vercel keep backups and logs after deletion.
8. Deleting your data
You can do this yourself in the app:
- Delete events, to-dos, saved worksheets, activities and printable PDFs.
- Remove a child's photo (edit the child, then "Remove photo") or the whole child profile (Family → Children → Edit → Remove child).
- Download a backup of your family's data (Family → Settings → Backup).
- Leave a friends' circle (Home → Friends' circles → Leave), which removes your family's numbers from it straight away, or delete a circle you made, which removes it for everyone.
- Reset your private calendar-feed link or school-email address (Family → Settings), so the old one stops working.
To delete everything (your account, your family, your children's profiles and everything linked to them), email admin@tinydeposits.com from the email you sign in with. We'll confirm when it's done. [legal check] Set and state a response time (for example, within 30 days).
Or delete everything yourself in the app: Family → Settings → Delete my data (type DELETE to confirm). If another parent shares your family, only you leave, and they keep the family's data. If you're the last parent, the whole family is deleted: children, plans, worksheets, saved PDFs, calendar, school emails and attachments, your place in any friends' circles (a circle with no families left is deleted), and your account.
Some things can't be pulled back once sent: calendar invitations already in your calendar stay there until you delete them in your calendar app (we delete only what's in TinyDeposits and our providers' systems, so we don't send cancellations when you delete your data or remove a child), and feedback already copied to GitHub stays there in its anonymised form unless you ask us to remove it.
Removing a child deletes everything linked to that child: their plans, preferences and saved PDFs. You choose whether their calendar items are deleted from TinyDeposits or kept without being linked to them.
9. Your rights
Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "PDPL"), you have the right to:
- be told what we hold and how we use it (this notice);
- get a copy of your data, and receive it in a format you can reuse (the in-app backup does most of this; email us for the rest);
- correct anything that's wrong (most of it you can edit in the app);
- have your data deleted;
- restrict or object to how we use it;
- object to decisions made only by automated processing (we don't make any; see section 4);
- withdraw your consent at any time.
How to withdraw consent: use Delete my data (Family → Settings), or email admin@tinydeposits.com. Withdrawing consent means we stop using your data and delete it, and you won't be able to use TinyDeposits. It doesn't affect what we did before you withdrew.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the UAE Data Office.
[legal check] Confirm the list of rights against the PDPL text and its executive regulations (reported as still pending), the time limit for answering requests, and the UAE Data Office complaint route. If families outside the UAE join (for example in India), check which other laws apply before inviting them; India's DPDP Act requires verifiable parental consent for anyone under 18.
10. How we keep it safe
- Each family can only see its own data. This is enforced in the database itself (row-level security), not just in the app.
- Forwarded emails and printable PDFs are kept in private storage. Forwarded emails can only be read by our server.
- Sign-in uses a one-time 6-digit code sent to your email; there are no passwords to steal.
- Only Gaurav can open the admin page, and it shows usage counts, not children's details or school-email content.
- Daily limits on the built-in intelligence, forwarded emails and calendar invitations protect against misuse.
Please keep these private, because anyone who has them can use them:
- Your private calendar-feed link. Anyone with the link can see your family calendar, including children's first names on events. You can reset it in Family → Settings.
- Your private school-email address. Anyone who knows it can send emails into your school inbox. You can reset it in Family → Settings.
TinyDeposits also keeps a copy of your family's data in your browser so the app opens quickly. It stays on that device after you sign out, so use a device you trust.
No method is completely secure. If we learn of a breach that affects your data, we'll tell you and, where the law requires it, the UAE Data Office. [legal check] Confirm breach-notification duties and timings under the PDPL.
11. Cookies and similar storage
We don't use advertising or tracking cookies, and there are no third-party analytics tools. The app uses your browser's storage to keep you signed in and to keep a copy of your family's data for speed. If you open a shared activity link before signing in, the app remembers the link code in your browser until you use or dismiss it. Our own usage records are described in section 3.
12. Changes to this notice
If we change this notice in a way that matters, we'll tell you in the app and ask for your consent again. Each version has a number and a date at the top.
13. Contact
Gaurav Nanda, TinyDeposits, Dubai, UAE
admin@tinydeposits.com
© 2026 TinyDeposits. All rights reserved. · Terms of Use · Back to TinyDeposits