Privacy policy

The short version

• No public profiles, advertising, third-party analytics SDKs, or cross-app tracking.
• We do not sell family information.
• Each family can create one new moment per Monday-to-Sunday week without a paid membership. Membership makes moment creation unlimited and lets the family owner create invitations.
• The first-moment screen offers privacy details and requires your explicit agreement before sharing data, without a separate AI setup wizard or feature toggles. Settings > Privacy explains data use and links to this policy. An earlier decline or withdrawal stays in effect unless you explicitly agree again.
• Your first typed or voice moment is saved before child suggestions are requested. With permission, its saved transcript is sent to OpenAI to suggest children. You can edit names, icons, and optional birthdays before confirming profiles and links to that same moment. Confirming with no children is valid.
• Apple first transcribes each voice memory on your iPhone. With permission and a connection, the current app sends the original recording and limited first-name spelling hints to OpenAI GPT-Transcribe through Cloudflare AI Gateway. It preserves the returned wording, and your recording stays safe if that request fails.
• The combined permission also covers chosen text and limited family details for organization and chapters. A moment-organization request may use existing shared-family tag labels as vocabulary hints, without their associated stories or people. Automatic family chapters require the family owner’s permission. The saved entry remains your chosen words, and you can review or correct every result.
• Your recordings, transcriptions, and family information are not used to train AI models. Little Moments does not train models with journal data or opt in to provider training.
• Photos are filtered by date on-device. Only photos you explicitly choose are copied to the private journal, and photos are never sent to AI.
• Invited family members are full co-editors and can access shared journal content.
• You can delete content or delete your Little Moments account in the app.

Information we collect

Account and family access

We store a private account identifier and the name and email supplied by your sign-in account, along with your family journal name, membership role, and invitation records. Invitation secrets are shown once; only a cryptographic hash is stored after creation.

Subscription and entitlement

When the family owner starts or restores a subscription, Apple provides signed purchase information. We store the product and plan, original and current transaction identifiers, purchase and expiration dates, renewal and revocation status, the purchasing Little Moments account, and a random app-account token tied to the in-app family journal. We use this to determine whether the owner and active invited members can create unlimited moments and whether the owner can create invitations. We do not receive or store the Apple Account password, full payment-card number, or bank details.

The subscription covers the owner’s invited Little Moments family through our own entitlement system. Apple Family Sharing is not enabled for these products, so we do not use or receive an Apple family-group roster.

We may issue a time-bounded complimentary entitlement for App Review or support testing. We store its family, type, start and expiration dates, revocation date if any, reason, and an operator label for auditability. A complimentary entitlement is not recorded as an Apple purchase, does not charge an Apple Account, and does not renew.

Child profiles

A profile can include first, middle, and last name; pronouns; aliases; optional birth date; optional life-end date; avatar symbol; optional profile photo; and each family member’s personal birthday-card preference. Unknown birthdays stay unknown: we do not derive a birth date from an age. First-moment onboarding asks for no memorial or life-end details.

Journal content

We store the moments you save and chapters created for your family, including transcripts, original audio when saved, titles, stories, dates, tags, milestone suggestions and decisions, linked profiles, recap sources, edit revisions, and selected recap photos.

App operation

We store sync state, automatic-chapter scheduling records, the configurable family timezone, and—if you enable notifications—a random installation identifier, Apple Push Notification service token and environment, device timezone, and notification preference. Protected local caches may include recordings waiting to sync and downloaded journal media.

First-moment setup also stores progress, proposed child details and quoted evidence, source hashes, model and attempt status, and confirmation receipts containing the confirmed profiles and links. These records help recover progress and prevent duplicate suggestions or profile creation; their retention is explained below.

Website and service requests

This website does not use analytics, advertising cookies, or a contact form. Cloudflare necessarily processes request information such as IP address, browser or device information, timestamps, requested URLs, and security or diagnostic events to deliver and protect the website and app service. Website fonts are served with the site. No third-party font service receives your request.

How we use information

We use information only to provide, secure, maintain, and improve the features you request. That includes authenticating accounts, sharing one journal among invited members, tracking the family’s weekly free-moment allowance or unlimited subscription access, transcribing recordings locally, carrying out permitted AI requests, organizing and syncing memories, preparing family chapters, delivering the push notifications you enable, providing support, preventing abuse, and meeting legal obligations.

Little Moments does not use family journal content for advertising or cross-app tracking.

On-device transcription and OpenAI data sharing

Your permission

The first-moment screen makes privacy details available before your explicit agreement. The combined permission covers saved moment text for child suggestions, original recordings for enhanced transcription, and moment text with limited family details for organization and chapters. This policy identifies the providers and their processing. Permission requires an explicit agreement action. Opening or dismissing the screen, paying for membership, or installing an update grants nothing. There is no separate AI setup wizard or set of feature toggles.

The combined action records enhanced transcription and organization/highlights together, while retaining separate, versioned records for enforcement and older apps. We store each signed-in family member’s choice, disclosure version, and decision dates. Existing declines and withdrawals remain effective unless you explicitly agree again; an older grant is not silently upgraded to cover child suggestions. Settings > Privacy explains data use and links to this policy. It offers an explicit agreement action when required permission is not current; it does not offer a withdrawal control. Previously recorded declines and withdrawals, including decisions made through older apps, continue to prevent sharing that requires that permission. Those decisions do not erase previously processed requests or saved journal content.

Children suggested from your first moment

Your first typed or voice moment is durably saved through the existing capture flow. Once it has synced and any pending transcription has finished, the child-suggestion request sends only its exact saved transcript to OpenAI, with no recording, photo, rewritten story, or added profile catalog. Personal details you said or typed are naturally part of those words. This use requires your explicit agreement to the current disclosure, and the service checks your permission and family access again before sending the request.

Suggestions are only a starting point. You can edit names, select icons, add or remove children, supply or clear optional birthdays, and choose which children to link to the moment. A suggested birthday must come from an explicit full date for that child, never from an age or partial date. Unknown birthdays produce no age labels or birthday schedules. Onboarding asks for no memorial details.

Confirming saves the reviewed profiles and selected links to the same moment together, preserving its words, audio, date, and other existing content. It does not create another moment or use another moment allowance. You can confirm with zero children or enter details manually if suggestions are unavailable. Confirmation itself does not call AI or require AI permission. Saved receipts allow an unchanged retry after a lost response to return the same result without creating duplicate profiles.

Voice transcription

Apple first transcribes voice recordings on the iPhone. Saved child first names and aliases, plus familiar first names of active family members, can be used locally as spelling hints. The original recording and Apple transcript are protected locally before optional online work begins, and the untouched Apple transcript remains available for review.

Only after you allow Enhanced transcription, and when a connection is available, the current app sends the original recording to OpenAI GPT-Transcribe through Cloudflare AI Gateway. A limited spelling catalog can contain child first names and configured aliases and familiar first names of active family members. The service makes one speech-recognition request and preserves its returned wording and original model result. It does not combine other recognizers, remove spoken repetitions, or ask a text model to rewrite the transcript. It does not invent word-confidence scores, phrase timing, or highlighted uncertainty spans. Full-recording playback and manual correction remain available. This processing is separate from the AI organizer described below.

Beyond what you say in the recording, the OpenAI transcription request does not add the Apple transcript, selected child IDs, photos, email addresses, account IDs, family roles, invitations, family members’ full names, profile surname fields, exact birth dates, life-end dates, or saved stories. If online transcription is empty or fails, the original audio and available Apple transcript remain protected on the iPhone for retry. If you decline, Apple’s on-device transcript remains available and you can type or correct the saved wording yourself.

Older app versions retain their previous Cloudflare Workers AI speech-recognition flow, using Whisper and, where supported, Deepgram-backed Nova. Those versions can compare the Apple result and use actual recognition confidence and timing for optional phrase review.

Organizing a new moment

If you allow AI organization and highlights, our service can use the selected transcript, capture time, timezone, any child selected in the capture flow, and family profiles to prepare minimized context. The organizer request can include the transcript; child first names, configured pronouns and aliases; temporary request references; derived age or broad life stage at the event; how the event relates to a child’s lifetime; and a bounded catalog of active family members’ familiar first names as spelling context. The signed-in adult’s familiar name can also help resolve grounded first-person wording. A catalog name is never evidence that someone participated, and a full child name is used only when needed to distinguish profiles.

After you review and allow organizer disclosure version 3 or later, a moment-organization request may also include a bounded, deduplicated list of tag-label strings already used in the shared family journal. Each label is sent by itself: no story, child, author, date, usage count, memory ID, or other identifier is attached to it. The labels are vocabulary hints, not evidence. They help the service reuse a fitting existing label and avoid near-duplicates without preventing a genuinely useful new tag. A version-2 choice continues to authorize only the previously disclosed request and does not authorize sending this tag vocabulary. First-child suggestions require the new version-4 disclosure; older grants are not upgraded automatically.

The organizer request does not add recordings, photos, raw birth or life-end dates, stable profile IDs, account IDs, email addresses, roles, invitations, family members’ full names, or the family name. Existing tag labels are not accompanied by the moments or people they came from, their dates or counts, or any stable identifier. The organizer may suggest a title, date interpretation, tags, linked child, and possible milestone. The saved journal entry itself remains your selected transcript, and you can correct every result. A milestone is never confirmed automatically.

Creating chapters and highlights

With the same AI organization and highlights permission, a chapter or highlight request can include the chosen period, a bounded set of selected eligible moment titles, transcript excerpts, dates, milestone labels, temporary references, and the first names and configured pronouns of children linked to those sources. The supplied transcripts are also the only style reference, helping the draft subtly reflect recurring family diction, rhythm, perspective, humor, emotional register, and level of detail. Little Moments does not create or retain a separate voice profile, analyze recordings for style, or add unrelated older memories solely to learn a voice. When the excerpts are sparse or mixed, the draft is instructed to stay clear and neutral. The request does not include recordings, photos, stable IDs, raw profile dates, avatars, aliases, or photo metadata. You can instead dictate a replacement story locally without an AI rewrite.

You can review, include, exclude, or reorder the proposed source moments. When you request a rewrite from those sources, the AI receives only the confirmed source moments and must cite each one. The draft is instructed to stay grounded in those sources, preserve quoted wording, and never let style override facts, configured pronouns, or uncertainty. Source text is treated as journal content rather than instructions to the AI.

When you explicitly choose “Update with latest moments,” the AI service also receives the current saved chapter’s title and body alongside the selected eligible moments so it can preserve your family’s edits. Unsaved typing is not sent by that request. The proposal is temporary: the existing saved chapter remains in place until you review the proposal and choose Save. Opening a saved chapter, editing its words or photos, or canceling does not itself request AI processing.

Automatic chapters

Chapters are a core automatic feature under the family owner’s existing AI organization and highlights permission. There are no separate weekly, monthly, or yearly schedule opt-ins, and a subscription is not required. The owner’s permission allows eligible shared moment text to be used for the whole-family draft. Automatic AI chapter work does not run when the owner’s required permission is absent, declined, or revoked. Other members can see the resulting shared draft; their own AI permission separately controls AI actions they initiate.

A whole-family weekly chapter starts after two eligible parent moments and refreshes as the week grows while it remains unedited. Once a family member saves their own edits, automatic replacement stops for that chapter. Monthly drafts are prepared on the 4th at 9:00 a.m. for the prior month, and yearly drafts on January 1 at 9:00 a.m. for the prior year, using the family timezone that the owner can configure. These drafts are created only after the period ends and only when no chapter exists for that exact whole-family period. Saved family edits and chapter photos are preserved. You can explicitly request an updated draft as described above and review it before choosing Save to replace the chapter.

If you do not allow AI

You can still type and save a moment in your own words. Declining enhanced transcription keeps speech processing on the iPhone. Declining the organizer saves a typed or transcribed moment without AI organization. You can also edit an existing highlight or dictate replacement prose for local transcription without an AI rewrite. Features whose purpose is to create an AI suggestion remain unavailable unless that specific permission is allowed.

Provider use

OpenAI provides current enhanced transcription and text AI tasks through Cloudflare AI Gateway: first-child suggestions, moment organization, tag and milestone checks, chapter drafts, and optional selection among legacy transcription candidates when enabled. It receives permitted original audio and bounded spelling hints for transcription and minimized text and context for text tasks. Photos are never sent to OpenAI. The gateway uses our project-scoped OpenAI key. We disable gateway caching and request/response payload logging, disable stored OpenAI response objects for text requests, and do not maintain a conversation history or opt in to training with journal data.

Your recordings, transcriptions, and family information are not used to train AI models. OpenAI excludes API content from model training unless its customer explicitly opts in; Little Moments does not opt in to training with journal data. This commitment is separate from provider retention. Response storage being disabled does not remove OpenAI’s separate abuse-monitoring logs, which may contain prompts and responses and normally remain for up to 30 days. OpenAI permits longer retention when required by law or reasonably necessary to protect its services or others from harm. Eligible organizations or projects can obtain approved Zero Data Retention or Modified Abuse Monitoring controls; we do not assume this account has either approval. Provider prompt caching may also retain encrypted key/value tensors on GPU-local storage for up to 24 hours. Cloudflare’s Unified Billing Zero Data Retention mode does not apply to requests using our own OpenAI key. These inference controls are separate from the moments and highlights you choose to save in your private journal. See Cloudflare’s credential and retention controls and OpenAI’s data controls.

Audio transcription uses OpenAI’s separate audio-transcription endpoint, rather than its text Responses endpoint. OpenAI currently lists no abuse-monitoring or application-state retention for that audio endpoint in its data controls. This endpoint-specific policy is separate from account approval for Zero Data Retention and from operational or billing metadata; it is not a blanket guarantee of zero provider retention.

Cloudflare Workers AI continues to provide Whisper and Deepgram-backed Nova speech recognition for older app versions. Cloudflare states that customer content is not used to train models or improve its own or third-party services without explicit consent. We do not promise a fixed legacy inference-retention interval that the provider has not publicly guaranteed.

Audio, photos, and notifications

Audio

Temporary recordings remain on the device during capture and transcription. Original voice audio is uploaded to the private journal only when you save a recorded memory. A recap dictation recording is deleted after local transcription and is not saved as audio.

Apple Photos

Photo dates and thumbnails are read on-device only after you open the period photo browser and grant access. The app does not inspect Favorites, People & Pets, captions, or locations to identify children. For each photo you choose, the iPhone creates a new, orientation-corrected, size-limited JPEG without the source filename, library identifier, creation date, location, camera details, EXIF data, Live Photo motion or audio, or album and People metadata. Only that copy is uploaded. Removing it from Little Moments does not delete the original in Apple Photos.

Push notifications

If you enable notifications, Apple receives the device token and payload needed to deliver them. Automatic-highlight alerts use generic text without names, story text, or photos. In app versions that support new-moment alerts, a notification can include the contributor’s name and the moment’s title, along with internal identifiers used to open the correct moment in the correct account and family.

When a new moment includes a photo, its notification can show a photo preview. The payload includes a temporary, restricted download credential; the notification extension retrieves the photo from our private storage after the service checks the recipient’s current access. This does not make the photo public. Notification previews may be visible on the Lock Screen according to your iOS settings. You can control new-moment and automatic-highlight alerts separately in Little Moments Settings, or change notification permissions and previews in iOS Settings.

Who can receive information

Your invited family

Active invited members are full journal co-editors, not view-only guests. They can view, add, edit, and delete shared child profiles, moments, recordings, photos, milestones, and highlights. Removing a member ends future service access but cannot erase copies they previously downloaded, exported, or shared.

Service providers

We use providers only to run the service: Google and Apple for native sign-in; Cloudflare Workers, D1, R2, Workers AI, and AI Gateway for application delivery, private storage, legacy speech recognition, and routing permitted AI inference; OpenAI for permitted current audio transcription and text AI tasks; and Apple for App Store distribution, subscription processing, PhotoKit permissions, and push notifications. Website fonts are served with the site. These providers process information under their own terms and privacy commitments.

Legal and safety reasons

We may disclose information if reasonably necessary to comply with law, protect a person’s safety, investigate abuse, secure the service, or protect our rights. If the service is involved in a merger, acquisition, financing, or sale, information may transfer subject to this policy and applicable law. We do not sell personal information.

Retention, security, and deletion

We keep account and journal information while the relevant account, family journal, or content exists and as needed to operate, secure, and comply with legal obligations. Operational and security records may remain for a limited period appropriate to those purposes. We do not promise that every encrypted backup or provider log disappears at the exact moment you press Delete.

First-moment proposal receipts retain proposed child details and quoted evidence for the family journal’s lifetime to prevent duplicate processing. Confirmation receipts retain confirmed profile details and links until the family or confirming account is deleted. These are separate copies: deleting the source moment or a child profile does not erase the setup receipts.

When journal content is deleted, access is removed from the app and associated private media is queued for deletion. The service retries temporary storage failures. An owner who deletes their account deletes the shared family journal for every member; a non-owner deletes only their own account and family access, and the shared journal remains.

Account deletion removes the Little Moments account, its Google or Apple provider link, and its active sessions. It does not delete the person’s external Google Account or Apple Account. If Sign in with Apple was used, Little Moments also asks Apple to revoke its authorization. Signing in again creates a new, empty Little Moments account.

Deleting Little Moments or a Little Moments account does not cancel an Apple subscription. The family owner must manage or cancel it in Apple Account subscription settings. A membership ending does not itself delete already-saved journal content, remove existing members, or revoke an invitation that was already issued.

We use access controls, private cloud storage, transport encryption, signed authentication, protected local caches, and scoped family queries. No security measure is perfect, and we cannot guarantee absolute security.

See the exact in-app steps on Delete your account.

Your choices and rights

You can review and correct profile and journal content, edit or delete moments and highlights, read data-use details and this policy from Settings > Privacy, change personal birthday-card and notification preferences, manage Apple permissions in iOS Settings, remove selected photos, leave or manage a family as permitted by your role, and delete your account in the app. The family owner can configure the family timezone.

The family owner can view membership status, restore purchases, or open Apple’s subscription-management settings from Little Moments. Every family can create one new moment per Monday-to-Sunday week without paid access. An active membership is required to generate a new family invitation; existing members and already-issued invitations remain available after membership ends.

Depending on where you live, you may have rights to request access, correction, deletion, or restriction of personal information. Email support@helloreadysetgo.com. We may need to verify the request before acting. We will not discriminate against you for exercising applicable privacy rights.

See Privacy choices for a feature-by-feature guide.

Children’s information

Little Moments is intended for adult family members and is not directed to children under 13 as users. Adults who create profiles or invite family members are responsible for having appropriate authority and consent to add, store, and share information about a child. Do not give a child account credentials or invite someone you do not trust with the full journal.

Changes and contact

We may update this policy as the product or law changes. We will update the effective date here and provide additional notice when required.

Questions or privacy requests can be sent to support@helloreadysetgo.com.

Little Moments is provided by Hello Ready Set Go in San Francisco, California, United States.