TiloziPrivacy policy
Tilozi is a visual routine app for children aged 3 to 10 and the grown-ups who look after them. The child uses the app; a parent sets it up and decides what is stored. This policy explains what we collect, why, who processes it for us, and how you can see or delete it. It also serves as our notice to parents under the US Children's Online Privacy Protection Act (COPPA).
The short version
- No advertising, no tracking, and no third-party analytics, in the app or on this site.
- We never sell information, and never share your child's information with anyone for their own purposes.
- Nothing about your child leaves your device until a parent gives consent by email.
- You can download a copy of everything, and delete a child or your whole account, from inside the app.
Who we are
Tilozi is made by Samar Pathania. Questions about privacy: privacy@tilozi.app. Anything else: support@tilozi.app.
Parental consent
Before any information about a child is stored on our servers, the parent who set up the family confirms consent by email, in two steps: we email a link to confirm, and about a day later a second email asks you to confirm again. Until both are confirmed, everything you set up stays only on your device. You can withdraw consent at any time in the app (Settings → Account); from then on nothing new about your child is stored on our servers.
What we collect, and why
| Information | Why |
|---|---|
| A grown-up's email address and display name | Signing in with a one-time code, consent emails, and showing family members who changed what. |
| A child's first name or nickname, birth year, avatar, and display preferences | Showing the right routines and pictures, in the way that suits your child. |
| Routines, steps, and the photos and voice recordings a grown-up adds | Showing your child their day, in pictures and your own voice. |
| Progress: routines started and finished, stickers, how your child said they feel, requests for help or a break | Progress reports for you, and any therapist or school you choose to share them with. |
| Family notes, the family calendar, chat messages, babysitter updates and care cards | Keeping the grown-ups around your child on the same page. |
| Feedback you send us | Answering you and improving the app. |
We do not collect location, contacts, advertising identifiers, or device fingerprints. Your child never types personal information into the app and never has an account. Reminders are scheduled on your device. A parent's optional PIN is stored only as a salted hash; nobody, including us, can read it back.
Who processes information for us
We use a small number of service providers, under agreements that let them use the information only to provide their service to us:
- Supabase — our database and sign-in.
- PowerSync — keeps your family's devices in sync.
- Cloudflare — stores photos and voice recordings, and hosts this website.
- Resend — sends sign-in, consent and family emails.
- Apple and Google — app distribution, and payments if you subscribe. They do not receive your child's information from us.
These providers may process information outside your country, including in the United States and South Korea. All traffic is encrypted in transit, and the copy of your family's data on each device is encrypted at rest.
Who in your family can see what
The parent who set up the family decides who joins and what each grown-up can see or change. Grown-ups can be limited to some children or given access that ends on a date. Therapists see progress but cannot change anything; relatives do not see feelings, notes or the consent record.
Seeing, downloading and deleting your information
- Download a copy: Settings → Your data → Take a copy builds a file of everything on your device, including photos and recordings.
- Delete a child: from the child's page. This removes their routines, history, photos and recordings.
- Delete your account: Settings → Delete my account. For the person who set up the family, this deletes the whole family and everything in it.
- You can also email privacy@tilozi.app to review, correct or delete your child's information, or to withdraw consent. We act on requests within 30 days.
How long we keep it
We keep your family's information while your account exists, and delete it when you delete the child or the account. Photos or recordings that were uploaded but never attached to anything are deleted automatically after 30 days.
Your rights
Depending on where you live (for example under COPPA in the US or the GDPR in the EU and UK), you may have the right to access, correct, delete or export your information, to withdraw consent, and to complain to your data protection authority. Contact us at privacy@tilozi.app and we will help.
This website
tilozi.app sets no cookies and runs no analytics or third-party scripts. Our host, Cloudflare, processes standard request information (such as IP addresses) to deliver and protect the site.
Changes
If we change how we handle children's information in a way that matters, we will tell parents by email and ask for consent again where the law requires it. The date at the top shows when this policy last changed.