Toddl Privacy Policy

Last updated: 2026-10-21

This policy is also available in Hebrew. If you are in Israel and the English and Hebrew versions differ, the Hebrew version prevails; everywhere else, the English version prevails.

Who we are

Toddl is operated by Noam Stolero, an individual ("we", "us"), who decides how the personal data described here is used (the controller). You can reach us at hello@toddl.family.

What data we collect

Account data

• Email address (from Apple/Google OAuth or direct sign-up)
• User identifier from the auth provider
• Display name / parent title (optional, user-provided)
• Avatar — a photo you upload, or an auto-generated initial on a colored disc

Family content you create

• Family name
• Children's names and optional birthdays
• Captured words: the word, meaning, context, capture mode, date, and any dialogue lines
• Favorites, first-word flags

Technical data

• Device type and OS version (when app crashes are reported)
• Location (only when you tag a memory with a place): the place name, and — if you choose "use my location" — the latitude/longitude. On iPhone and Android, your device sends those coordinates to its own geocoding service (Apple's or Google's) to suggest the place name; on the web, no geocoding service is used
• IP address (processed transiently by our hosting provider for connectivity)

Website waitlist

If Toddl is not yet available in your country, the toddl.family website offers a form to join a waiting list. If you submit it, we store your email address, the country derived from your connection, and the time you signed up. We use them only to tell you when Toddl becomes available in your country, and delete them when you ask or after we have notified you. Our email provider, Resend, delivers a notification of each signup to us; it contains your email address, the form's source, the country, your IP address and your browser's user agent. The notification is deleted together with the signup, when you ask or after we have notified you.

What we do NOT collect

• Advertising identifiers (IDFA/AAID)
• Third-party tracking cookies
• Contacts, photos, camera, or microphone (except features you actively invoke)
• Precise GPS location outside the feature you opt into

Why we collect it

• Account data — to authenticate you and link your content to your family
• Family content — this is the core product you create; stored so you can see it
• Technical data — to diagnose crashes (via Sentry) and ensure the service works

We do not sell, rent, or trade your data to anyone.

Giving us personal data is voluntary; no law requires it. We need your account data to create your account, and features that rely on other data (photos, voice, location, Google Drive backup, Toddl Plus) don't work without it.

Product analytics

We use PostHog, a product-analytics service, to understand how the app is used and to decide which features to switch on or off for you (feature flags). Analytics data is linked to your account's user identifier.

• Usage events — we send events describing what happened in the app, for example that a capture was saved or a feature was opened, along with non-identifying details such as which feature was involved and whether the action succeeded. Server-side events may also include the internal identifier of your family.
• App lifecycle events — when the app is opened, becomes active, or moves to the background. If an invite link launched the app, the access token in that link is redacted before the event is sent.
• Feature-flag evaluation — our servers ask PostHog which feature flags apply to your account.
• Account identifier and properties — your user identifier groups events from the same account, and we set a small set of non-identifying properties on your analytics profile, such as the app environment (development, preview or production), the running app version and build number, and home-screen widget usage. We do not send your email address, display name or profile photo.
• Device and network data — the analytics SDK attaches standard technical fields such as device type and operating system, and PostHog receives the IP address your device uses to reach it, which it may use to derive a coarse (country or city-level) location.

We never send the content you create — the words, meanings, photos or voice clips — to PostHog. Analytics is not used for advertising, is not shared with data brokers, and is not used to track you across other apps or websites. We do not record or replay your screen.

Processor: PostHog, hosted in the United States (us.i.posthog.com). PostHog processes analytics data under its own terms, including its retention settings.

Ad attribution on iOS

On iOS, Toddl uses Apple's privacy-preserving ad attribution (AdAttributionKit and SKAdNetwork). If you installed Toddl after seeing an ad, Apple may later tell that advertising network, with a delay and without identifying you or your device, that the install happened and how far the app was used, for example that a family was created or Toddl Plus was started. Apple sends this report, not Toddl. Toddl itself shares nothing with advertising networks, uses no advertising identifiers and does not track you across other apps or websites.

Subscriptions and billing

Toddl has a free plan and an optional paid plan, Toddl Plus. Purchases are made and paid through the Apple App Store or Google Play, so we never see your card or other payment details. We use RevenueCat, a subscription-management service, to validate purchases with the store and to keep your family's plan in sync. When you delete your account we also ask RevenueCat to delete your subscriber record, whether or not you ever bought Toddl Plus.

• What RevenueCat receives and holds: your Toddl user identifier (used as the RevenueCat app user ID), purchase history, store transaction identifiers and receipts, subscription state and dates, the country or storefront of the purchase, and technical data its SDK sends, such as device type, operating system, locale and currency. RevenueCat uses your IP address only to work out your country when the store does not supply it, and does not store it. We don't connect advertising identifiers to RevenueCat. RevenueCat processes this data on our behalf, under its data processing addendum, and stores it in the United States.
• What we store in our own database: for each Toddl Plus period that covers a family, a plan record (the family, the plan, the source of the plan such as a store purchase or a founding offer, the product, the store transaction reference, the buying account, the start and end dates, and whether it was refunded or revoked); a log of RevenueCat notification events we have processed, so that none is applied twice (each entry holds the event identifier, the event type and your user identifier); a record that your account has a RevenueCat customer; and, after account deletion, the erasure record described below.
• Subscription emails: when you buy Toddl Plus we email you a confirmation with the plan's renewal and cancellation terms. On a yearly plan we also email a reminder 15 to 45 days before each renewal, and on a monthly plan a reminder once a year. Our email provider, Resend, sends these to your account's email address and receives that address and the email's content. For each email we keep a record in our database: your user identifier, which email it is, the store transaction reference, the renewal it belongs to, the details shown in it (store, product, monthly or yearly, the price and currency when the store reports them, the purchase date, the trial-end or renewal date, and your app language and time zone), whether it was sent, the number of send attempts and the last error, Resend's message identifier, and the dates it was created and sent. The record does not hold your email address; we read it from your account when the email is sent. The record is deleted with your account.
• Free-plan usage and the Plus waitlist: to apply the free plan's monthly limits we keep, per family, a count of usage events (photos, videos, captures and art cards), each with the member who triggered it; that member's user identifier is cleared when their account is deleted, and the count stays with the family. If you tap to join the Toddl Plus waitlist when you reach a limit, we store a waitlist record (your account, your family and which limit you hit) and send a "pluswaitlistjoined" event with the limit and family identifier to PostHog.
• Founding offer and other free periods: a free period we grant to a family is stored as a plan record in our database, the same as a purchase, and is plain account data. It involves no payment details.
• Why: to confirm that a purchase is valid, to decide which features a family can use, and to handle renewals, refunds and expiry.
• Who gets Toddl Plus: a purchase covers the whole family. The plan record stays linked to the buying account. If the buyer leaves the family, the record is marked as detached from that family at that time and stays on file while that family exists.
• Deleting your account: we delete your account data first. Any plan records for purchases you made are marked revoked, so that a late store notification cannot restore the plan, and are kept in that form while the family they covered still exists; if you were that family's only member, the family and its plan records are deleted. The revoked record keeps the store and product, the store transaction reference (moved to a "deleted reference" field), the period dates, the family it covered and your former user identifier. The log of processed RevenueCat events, which holds the event identifier, event type and your former user identifier, is not deleted with your account. We then ask RevenueCat to delete the subscriber record for your user identifier. We keep a short erasure record (your former user identifier and the request and completion dates, and any error) while the deletion is pending and afterwards, and while billing is enabled we retry on a recurring schedule until RevenueCat confirms. Apple or Google keeps its own purchase record under its own terms, and deleting your Toddl account does not cancel a store subscription; cancel it in the store first.

How long we keep these records is set out under "Data retention".

In-app feedback

When you send feedback from the app (Settings → "Send feedback"):

• What we collect: the category you pick (idea, problem or other) and the text you write, together with your user identifier, your family identifier, the app version, your device platform (iOS, Android or web) and the app language.
• Why: to answer you and to improve Toddl (support and product feedback).
• Where it goes: we store it in our Cloudflare D1 database. We also send a notification to our support chat on Telegram, which delivers it to us. The notification holds the category, the first 300 characters of your message, your family identifier and the app version. Telegram does not receive your email address, your name or your user identifier.
• Retention: the stored feedback is kept until your account or your family is deleted, and is deleted with it. The notifications are kept in our Telegram support chat until we delete them; deleting your account does not delete them.

Push notifications

If you allow notifications, the app gets a push token for your device from Expo's push service and we store it with your account. When there is something to tell you, for example a family member added a word, shared a moment or commented, or a child's birthday or your weekly recap is due, our server sends the notification to Expo, which passes it to Apple Push Notification service (on iPhone) or Firebase Cloud Messaging (Google, on Android) to deliver it to your device.

• What a notification carries: your device's push token; the title and text you see, which can include a family member's family title or name, a child's or pet's name, and the word, milestone or start of the message it is about; routing data that tells the app what to open (the kind of notification, and internal identifiers of your family, the child or pet, and the word, moment, conversation or milestone it is about); for birthday and anniversary reminders, the child's or pet's name and age, and a child's gender; and, for some notifications, a link to a thumbnail of the photo or picture it is about.
• Why: to tell you about activity in your family and reminders you have not turned off.
• You can turn notifications off in your device's settings at any time.

Where data is stored

• Application database & auth: Cloudflare D1 (SQLite) with Better-Auth
• Media (photos and voice clips you attach to a memory): Cloudflare R2
• Crash reports: Sentry
• Push notifications: delivered through Expo, then Apple Push Notification service or Firebase Cloud Messaging
• Product analytics: PostHog (United States)
• Subscription and purchase data: RevenueCat, together with plan records in our Cloudflare D1 database
• Feedback you send from the app: Cloudflare D1, with a notification in our Telegram support chat

Each provider operates globally-distributed infrastructure. Data is encrypted in transit and at rest.

International transfers. Our service providers (Cloudflare, Sentry, PostHog, RevenueCat, Google Gemini, Expo, Resend and Telegram) store and process data for us outside the country where you live, mainly in the United States. Apple and Google deliver push notifications to your device through their own push services. Sign in with Google is provided by Google under your own Google account terms. If an admin turns on Google Drive backup, the family's memories, including other members' memories, are copied to that admin's Google Drive under the admin's Google account terms. By using Toddl you agree to these transfers.

Voice transcription (automated processing)

Toddl has two voice features and they handle audio differently:

• Voice capture (the "hold to record" flow that fills out a memory for you): the audio you record is sent to Google Gemini for automated processing. Gemini returns a transcription plus structured metadata (which child spoke, who else was present, the type of moment, the inferred date). We use this to pre-fill the capture screen so you can review and edit each field before saving. The app deletes the audio file from your device after processing. When a recording is queued to be processed in the background, it is held in our Cloudflare R2 storage until our server processes it, and is deleted once it has been processed or when you discard it; a queued recording still unprocessed after 7 days is deleted then. If the recording is saved as a moment, it is kept with that moment as its voice clip until you delete the clip or the moment. A recording processed straight away is passed to Gemini without being saved on our servers. The transcription text is shown in the app and the extracted fields (word, meaning, dialogue, place, date) are editable.
• Voice clips attached to a memory (the "+ Record clip" button next to a memory you're saving): these audio files are uploaded and stored in our media storage so you can play them back later. They are not sent to Gemini. The exception is audio you share into Toddl from another app: it is sent to Gemini to fill out the memory, and kept as the memory's voice clip if you save it.

Gemini also processes other content, as listed under "Third parties": photos and typed text you capture, milestones you type or say, the memories you turn into art cards, chats you import from WhatsApp, messages you send to Toddl on WhatsApp, and the stories of saved moments, from which we pick out a quote.

We do not use any voice recording to train Gemini's models — Google's standard processing terms apply.

You can avoid voice processing entirely by using the typed capture flow.

Google Drive backup (optional)

Toddl offers an optional backup of your family's memories to your own Google Drive, so your copy survives even if Toddl goes away. It is off by default and only an admin (parent) in the family can turn it on.

• What you grant: we request the Google drive.file scope, which lets Toddl access only the files it creates in your Drive — never the rest of your Drive.
• What gets backed up: your family's words, conversations, milestones, and the photos and voice clips attached to them, written as browsable folders plus a machine-readable manifest.json inside a "Toddl Backup" folder in the connecting admin's Drive.
• How it behaves: backup is append-only while connected — deleting a memory in Toddl does not remove the copy already in your Drive.
• Disconnecting: turning backup off revokes Toddl's access to your Drive and deletes our record of the connection; the files we already wrote remain in your Drive (they are yours) unless you choose to delete them: when you disconnect, Toddl asks whether to also delete the backup, and choosing "Disconnect and delete backup" removes the "Toddl Backup" folder from your Drive.
• Tokens: the Google authorization (refresh token) we store to perform backups is encrypted at rest and used only to write your backup.

Google user data

Toddl accesses Google user data only through what you grant. Sign in with Google uses the openid, email and profile scopes. The optional Drive backup uses the drive.file scope. Here is what we do with each type of Google data.

Google account email address and account ID

• Used for: creating your Toddl account, signing you in, and linking you to your family
• Stored: in our Cloudflare D1 database
• Shared: not shared or sold, and used for nothing else
• Retention: kept while your account exists
• Deletion: deleted when you delete your account (Settings → "Delete account")

Name and profile photo

• Used for: your name is shown to your family members as your display name (you can edit it); your profile photo URL is used as your avatar. If Google's photo is the generated default letter avatar, we discard it. We check this once at sign-in via Google's People API, using the sign-in access token
• Stored: in our Cloudflare D1 database
• Shared: shown to members of your family, and included in invitation emails you send (delivered via our email provider, Resend)
• Retention and deletion: kept while your account exists and deleted with your account

Sign-in tokens

• Used for: on the mobile apps, the tokens Google gives the app at sign-in are used only to verify your identity (and the one photo check above)
• Stored: not stored

Google Drive files Toddl creates (optional backup)

• Access: with the drive.file scope, Toddl can see and manage only the files and folders it created (the "Toddl Backup" folder, the backup files and manifest.json). It cannot see any other file in your Drive. Only an admin (parent) can turn backup on
• Used for: writing your family's backup, and reading those same files back if you restore a family from a backup
• Stored: in your own Google Drive, where Google stores them under your account. Our servers keep only the Drive IDs of the files and folders we created, plus backup progress bookkeeping; if you restore a family from a backup, the restored memories are copied back into Toddl and stored like any other memory
• Shared: not shared with anyone, and we do not read them for any other purpose
• Retention and deletion: the files are yours and stay in your Drive until you delete them, including after you disconnect backup or delete your Toddl account. Delete the "Toddl Backup" folder in Drive, or choose "Disconnect and delete backup" when you disconnect, to remove them

Google authorization for Drive backup

• What it is: the OAuth refresh token Google issues when you connect backup
• Stored: encrypted at rest in our database. During a restore, a separate encrypted copy of the authorization is kept only until the restore finishes or fails, or for at most 24 hours if you don't confirm it
• Used for: only to perform backups and restores
• Deletion: disconnecting backup in the app revokes the authorization with Google and deletes the stored token and our backup records. Deleting your Toddl account also deletes the stored token, so Toddl can no longer access your Drive. You can also remove Toddl from your Google account's third-party access page (see below)

How we use Google user data

• We do not use Google user data for advertising
• We do not sell Google user data
• We do not use Google user data to train AI or ML models
• We do not transfer Google user data to third parties except as needed to provide the features (our hosting provider Cloudflare stores it, and our email provider Resend delivers invitation emails that include your display name)
• Humans at Toddl do not read Google user data except with your consent, to investigate security or abuse, or to comply with law

Toddl's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Revoking Google access

• In the app, an admin opens the Family tab → "Google Drive backup" → "Disconnect", which revokes Toddl's Drive access
• Delete your account in Settings → "Delete account"
• At any time, remove Toddl's access at https://myaccount.google.com/permissions

Children's data (COPPA / GDPR-K)

Toddl is designed for adults (parents and guardians) recording memories of their own children. It is not directed at children under 13, and children must not use the app or have accounts. Information about a child, including photos and voice recordings of the child, is entered by the parent or guardian, who controls it and can delete it at any time. We do not knowingly collect personal information directly from a child. If you believe a child has given us information directly, contact us and we will delete it.

Your rights

• Access: ask by email for a copy of the personal data we hold about you. A parent or guardian can ask on behalf of their child. We answer in Hebrew, English or Arabic.
• Deletion: in-app via Settings → "Delete account". Your account, sign-in records and profile are permanently deleted. If you are your family's only member, the family, its children and all its memories are deleted too. If other members remain, the family and the memories you added stay with them: your memories are reassigned to another member, and you appear as a former family member without your name. Subscription records are handled as described under "Subscriptions and billing". There is no recovery.
• Correction: edit content directly in the app, or ask us by email to correct or delete data that is wrong, incomplete or out of date. If we change data at your request, we tell the providers we passed it to.
• Portability: JSON export of your family's content on request
• Withdrawal of consent: stop using the app and/or delete your account

If you live outside Israel, you also have the rights that the data-protection law of your country gives you, for example Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act 1988 or Mexico's LFPDPPP. To use them, email us at hello@toddl.family; you can also delete your account yourself in the app (Settings → "Delete account"). Where your law lets you complain to a data-protection authority, you can do so.

We give these rights to every user, wherever they live. We do not sell or share personal information, as the California Consumer Privacy Act defines those terms.

Data retention

• Active accounts: as long as you use the service
• Deleted accounts: your account, sign-in records and profile, and, if you were your family's only member, the family and its content, are permanently removed from our live database when you delete your account; if other members remain, the memories you added stay with the family, as described under "Your rights". Backup copies are purged within 30 days. The exception is subscription data: a revoked plan record (store and product, store transaction reference, period dates, the family it covered and former user identifier) while that family exists, the billing event log entries (event identifier, event type and former user identifier) and an erasure record are kept as described under "Subscriptions and billing", and RevenueCat holds its subscriber record until it confirms deletion.
• Subscription plan records: kept while the family exists.
• Billing records after account deletion: billing event log entries are deleted 13 months after they are processed, revoked plan records 24 months after the end of the period they covered, and erasure records 30 days after RevenueCat confirms the deletion.
• Subscription email records: deleted 24 months after the email was sent or finally failed, or earlier with your account.
• In-app feedback: kept until your account or your family is deleted; the notifications in our Telegram support chat are kept until we delete them.
• Website waitlist: kept until we notify you about launch in your country or you ask us to delete it.
• Crash reports: 30 days (Sentry free tier default)

Third parties

Security

• Application-layer authorization restricts data access to members of your own family
• All traffic is TLS (HTTPS) encrypted
• Authentication is handled via Apple and Google OAuth providers; we do not store passwords
• We follow Apple's App Transport Security requirements

Changes

We will post any changes to this policy here and, if material, notify you in the app before they take effect.

Contact

• Email: hello@toddl.family

Regulatory addresses

Toddl is not offered in the European Union, the European Economic Area, the United Kingdom or Switzerland, on the App Store or on Google Play. If we make it available there, we will appoint the representatives the GDPR (Article 27), the UK GDPR and the Swiss Federal Act on Data Protection require and update this section.