tinypose
Log inStart creating
Legal

Privacy Policy

Last updated: May 27, 2026

1. Introduction

tinypose (“we”, “our”, “us”) respects your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service at tinypose.co.

2. Information We Collect

Account Information

When you sign up via Google authentication, we receive your name, email address, and profile picture. We use this to create and manage your account.

Uploaded Photos

You upload photos of your newborn baby for portrait generation. These photos are stored in encrypted cloud storage (Supabase) and are used solely to generate your portraits.

Generated Portraits

AI-generated portraits are stored in your private gallery and accessible only to you via authenticated, time-limited links.

Payment Information

Payment processing is handled entirely by Creem. We do not store credit card numbers, bank details, or other payment credentials. Creem’s privacy policy governs payment data.

Usage Data

We collect anonymous analytics (via Vercel Analytics) such as page views and general usage patterns. This data is aggregated and not linked to individual users.

3. How We Use Your Information

  • To generate AI portraits from your uploaded photos.
  • To manage your account and provide customer support.
  • To process purchases and deliver your portraits.
  • To improve the Service through anonymous, aggregated analytics.
  • To send transactional emails (e.g., gallery ready notifications).

4. What We Do NOT Do

  • We never train AI models on your baby’s photos. Your images are processed once to generate portraits and are not used for model training or improvement.
  • We never sell your personal information to third parties.
  • We never share your photos with other users or publicly.
  • We never use your photos for marketing without explicit consent.

5. Data Storage & Security

  • Photos are encrypted at rest using AES-256 encryption in Supabase cloud storage.
  • All data is transmitted over HTTPS/TLS encrypted connections.
  • Access to your gallery is protected by authentication and time-limited signed URLs.
  • We use Supabase Row Level Security (RLS) to ensure users can only access their own data.

6. Data Retention & Deletion

  • Uploaded photos are deleted immediately after your portraits are generated. They are not retained on our servers.
  • Generated portraits are retained in your gallery for as long as your account is active.
  • Account data is retained until you request deletion. You may delete your account and all associated data at any time by contacting us.

7. Third-Party Services

We use the following third-party services:

  • Supabase — authentication, database, and file storage.
  • fal.ai — AI image generation. Photos are sent securely for processing and are not retained by fal.ai after generation.
  • Creem — payment processing.
  • Vercel — website hosting and anonymous analytics.

8. Your Rights (GDPR & CCPA)

You have the right to:

  • Access — request a copy of your personal data.
  • Rectification — request correction of inaccurate data.
  • Erasure— request deletion of your data (“right to be forgotten”).
  • Portability — request your data in a portable format.
  • Objection — object to certain processing of your data.
  • Withdraw consent — withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at contact@tinypose.co. We will respond within 30 days.

9. Cookies

tinypose uses essential cookies only for authentication and session management. We do not use advertising or tracking cookies. Vercel Analytics collects anonymous, aggregated data without cookies.

10. Children’s Privacy

tinypose is a service for parents and guardians to create portraits of their own children. Only parents or legal guardians may upload photos of minors. We do not knowingly collect information from children directly. If you believe a minor’s photos have been uploaded without proper consent, please contact us immediately.

11. International Data Transfers

Your data may be processed in data centers located in the EU and United States. We ensure appropriate safeguards are in place for any international data transfers in accordance with GDPR requirements.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page. Continued use of the Service after changes constitutes acceptance.

13. Contact

For privacy-related questions or data requests, contact us at contact@tinypose.co.