What Tiny Beacon collects, and what you control.

Version 1.3.2  ·  Effective date: 25 June 2026  ·  Last updated: 12 November 2026

This notice is also available in Bahasa Melayu.

Tiny Beacon is a family-safety app for parents and legal guardians. This policy explains what the public app receives, what it does not receive, and what changes when you choose a safeguard.

• Sensitive safeguards start unticked.
• Nothing is collected until you confirm your choices.
• Emergency help stays available.
• Your child can see which categories are shared.
• A parent or legal guardian can turn off any safeguard at any time.

An adult parent or guardian creates and runs each Tiny Beacon account. We do not knowingly collect personal information directly from a child. The parent enters and manages any information about a child, with their consent, as section 5 describes.

1. What we collect

The public app receives only the family, location, app-use, alert, consent and device information described below. Some categories depend on the phone and the app edition. Each entry explains why the category exists, who can see it, and how you can change the choice.

1.1 Parent account and identity

• Parent name and email address (to create the account and sign in)
• Account and user identifiers
• Parent date of birth (used once as an adult age check, to confirm the account holder is an adult)
• Sign-in identity from Apple or Google (OAuth), only if you choose that way to sign in
• Profile photo for parent and child, only if you add one
• Your device’s encryption public key and an optional device label, so paired devices can exchange data securely
• Push notification tokens, to deliver alerts to your own devices
• Parent phone number, if you add one
• Email addresses and roles of any co-guardians you invite to help care for your child
• Community alert details, only if you choose to post a missing-child alert: the child’s name, age, description, an optional photo, last-seen location and an emergency contact number. Signed-in Tiny Beacon parent accounts can see these.

1.2 Child profile (added by the parent)

The parent enters and manages these details in the parent dashboard. We never collect them from the child directly.

• Child’s first and last name
• Child’s date of birth
• Child’s phone number, if you add one, so you can call or message your child from the app

1.3 Location and safe zones

Location sharing is a family choice, not a hidden setting. It is off by defaultand turns on only with a parent’s or legal guardian’s explicit consent. This safeguard is available in every edition and version of the app.

• While sharing is on, the child’s device shares its location with the linked parent or family account continuously, including in the background and when the app is closed. This keeps safe-zone alerts and emergency context working.
• While sharing is on, the child’s device shows a persistent notification, so it is always clear that location is being shared.
• Location is used only for family-safety features: live location, safe-zone (geofence) alerts and emergency context. It is never used for advertising or cross-app profiling. We never sell it or share it with third parties. Our backend providers (Supabase, PostHog, Sentry, Expo) act only as processors on our behalf.
• A parent or legal guardian can turn sharing off or delete location data at any time. Turning sharing off stops new location collection. Withdrawing consent stops collection immediately. The privacy controls in the app explain what happens to data already kept.

1.4 App time and screen-time limits

Screen-time controls use the phone’s own tools. If you set screen-time limits, the app uses the device’s built-in Screen Time / Family Controls to enforce them. The limit and block-screen (“shield”) events needed for this are processed on the device.

On Android, app-use details are an optional category. The app collects them only after a parent or legal guardian gives explicit consent and Android Usage Access (PACKAGE_USAGE_STATS) is switched on. Since 28 July 2026 the app has collected this “app-use awareness” through Android Usage Access:

• the package and app name, and the app’s category
• how long each app was open
• screen opens
• daily totals

This gives you screen-time insights and lets you set and enforce limits for each app. It is kept within the family’s retention window of 7 to 365 days (default 180 days). It is deleted when the parent or legal guardian withdraws consent, and the choice in the app shows what withdrawing does.

On iPhone, app use across other apps is not collected. On iOS, screen-time limits rely only on Apple’s built-in Screen Time / Family Controls.

1.5 Pairing and consent records

• A hash of the device-pairing code (we store the hash, not the code itself)
• Parental consent records: what you agreed to, and when
• Your retention settings

1.6 Diagnostics and analytics

• Product analytics (PostHog)is used only to improve the app, and is kept separate from family safety records. It is anonymous and unlinked: events are not linked to an account, parent or child identity. It holds product-interaction events and app and build details, and no child-entered content. Automatic lifecycle events are off and session replay is not used. These events are not used for advertising or cross-app profiling. You can change the analytics choice in Privacy & data controls.
• Crash and performance diagnostics (Sentry), with personal identifiers minimised and parent context shortened before it is sent.

The tiny-beacon.com website has its own analytics, Plausible and Google Analytics, described in section 8.

1.7 Device wellbeing status (phone status)

After a parent or legal guardian gives consent and switches on this safeguard, the app shares:

• a coarse battery band
• whether the device is charging
• the connection type: Wi-Fi, mobile data, offline or other
• the last time our server heard from the device (the last-seen time)

It does not share the exact battery percentage, IMEI, Wi-Fi network name (SSID), mobile carrier or a history of the device. We keep only the latest status, not a history.

An ongoing offline alert keeps the last-seen time recorded by our server (last_seen_at). When the device checks in again, the alert can be marked resolved, keeping last_seen_atand its resolved status. Offline and resolved alerts expire after 30 days, or sooner if the child’s retention window (7 to 365 days, default 180) is shorter. These alerts cannot be pinned as evidence. Trimming old data does not end consent (section 7).

1.8 Social-app safety check-ins (Android, optional, from app version 1.8.0)

From Android app version 1.8.0, a parent or legal guardian can choose to switch on social-app safety check-ins. They are off by default and need their own separate choice. They start only after the child grants notification access on their phone, and the child can see that they are on.

• The app reads the text of new incoming WhatsApp notifications on the child’s phone. It checks that text on the phone for narrowly defined signs of serious risk, such as threats or extortion, requests for sexual images, pressure to keep secrets from parents, or attempts to arrange a private meeting.
• It does not read SMS apps, chats that do not show notifications, or messages that contain only media. It will not catch every unkind or harmful message. Full chat histories are never synced or made available to browse.
• When something may need care, the parent receives the category and a short excerpt of no more than 64 characters. Links, email addresses, phone numbers, handles and invite codes are removed on the phone before the excerpt is sent. Excerpts are kept within the child’s retention window of 7 to 365 days (default 180).
• A managing parent can pin an alert as evidence (section 7). Switching the safeguard off deletes its alerts, pinned and unpinned.
• Conversation context (optional, currently switched off).We may switch this on later. If we do, and a parent or legal guardian gives this extra, separate consent, an alert can include one end-to-end encrypted snapshot. This happens for a serious alert, or for two related warning signs in the same chat within 15 minutes. The snapshot holds the chat title and up to 20 recent notification messages from that 15-minute window. Only the parent’s and child’s devices can read it, and every opening is logged. It is kept for at most 30 days and is never sent to an AI service.

1.9 Website sign-up (optional)

This sign-up is for adults (parents or guardians aged 18 or over) and asks nothing about your child. If a child has signed up, email us and we will delete it.

If you ask on tiny-beacon.com for one email when message alerts are ready on Android, we first send one confirmation email. If you do not confirm, we do not add you to the list. Resend keeps its copy of that confirmation email for up to 30 days.

After you confirm, we store your email address, the page language, when you asked and when you confirmed, the notice version, and that you signed up on tiny-beacon.com. Resend, Inc. stores them in the United States on our behalf, only to send the one notice.

We delete them within 30 days after sending the notice, or within 30 days if we stop working on the feature, and in any case by 31 December 2027.

If you withdraw consent or ask us to delete your sign-up, we stop using it as soon as we receive your email and delete it within 21 days. Requests to see or correct it are answered within 21 days. Email [email protected]. The notice email will carry an unsubscribe link.

2. What we do not collect

The public app does not receive any of the following. Android app-use details are in section 1.4. Separate supervised editions are covered in section 9.

• Screenshots or any screen content in the public store app (supervised editions may add this; see section 9)
• App use across other apps on iPhone (Android collects per-app use only after a parent or legal guardian gives consent and Android Usage Access is switched on; see section 1.4)
• SMS, or full chat or message content (the optional Android social-app safety check-ins keep only a short excerpt, see section 1.8; for supervised editions, see section 9)
• Call logs
• Web browsing or search history
• Advertising identifiers (IDFA or AAID); we do no cross-app profiling
• Contact lists
• Biometric data
• Audio or video recordings

3. How we use it

We use each category only for the family choice it belongs to. We do not sell family data or use children’s information for advertising.

• Account access: to create accounts, sign users in and pair devices
• Core service:to let a parent set up and manage a child’s profile and the family’s paired devices
• Safety features: to share live location within your family, send safe-zone arrival and leaving alerts, provide emergency context, send emergency and amber alerts, and enforce any screen-time limits you set
• Alerts and notices:to deliver notifications to the parent’s own devices
• App improvement: unlinked product analytics and crash diagnostics, to keep the app working and improve it

We do not sell or rent personal information. We do not share it with advertisers or data brokers. We do notuse children’s personal information for behavioural advertising or to build advertising profiles.

4. Encryption and security

• All data is encrypted in transit using TLS 1.2 or higher.
• Personal data is encrypted at rest with AES-256.
• Device encryption keys are created on the device. They are kept in the phone’s protected, device-only storage (iOS Keychain or Android Keystore-backed storage) and left out of cloud backups. The private key never leaves the device.
• When you sign out, the local data key is wiped. The device’s private key stays on that device, so evidence saved earlier can still be opened, unless the app is removed or reset.
• End-to-end encryption covers stored screen check-in images and sealed message snapshots. Location, app use, phone status, alerts, short excerpts, and content while an AI service checks it, are encrypted in transit and at rest, but not end to end.
• Row Level Security (RLS) on every database table: a parent can access only their own family’s data.
• Role-based access keeps parent and child accounts separate.

5. Children’s privacy and parental consent

A parent or legal guardian creates the child profile and chooses each safeguard. Nothing is collected until they confirm their choices. Phone status is suggested and can be unticked. In supervised editions, screen check-ins may be suggested for children under 13.

The child can see which categories are shared. The parent or legal guardian can review or withdraw a choice at any time. A child can raise a concern or ask a grown-up for help. The parent or legal guardian controls consent and any pause in location sharing.

• Parental consent before collection. Only the account holder adds information about a child. The account holder is an adult who controls the account and confirms they are 18 or over through our date-of-birth age check. Consent is recorded in the app before any child information is collected, and we keep a record of what was agreed to and when.
• Parental review and deletion.A parent or legal guardian can review the information held about their child, delete it, and refuse its further collection or use. They can do this at any time, from the app’s settings.
• Data minimisation.We collect only what is reasonably necessary for the service. We do not make a child’s participation depend on disclosing more than is reasonably necessary.
• No targeted advertising to children.We do not use children’s personal information for behavioural advertising.
• Limited retention. The parent or legal guardian chooses a rolling window of 7 to 365 days (default 180) for each child. In supervised editions, captures flagged as a threat are kept only while needed and deleted automatically when they expire (see section 7).

If you believe a child has given us personal information without parental consent, contact us at [email protected] and we will delete it.

6. Your rights under Malaysia’s Personal Data Protection Act 2010 (PDPA)

You can review, correct, export or delete your account and family information. You can also withdraw a safeguard from the app. Section 7 explains what stops and what is removed.

• Review the data held in your account in the parent dashboard
• Correct account and child profile details at any time
• Withdraw consent and stop further processing
• Delete your data or your whole account, which permanently removes all linked data
• Ask for a copy of your data by emailing [email protected]

7. Data retention and deletion

The parent or legal guardian chooses a rolling retention window for each child: 7 to 365 days, with 180 days as the default. Nothing is kept indefinitely by default.

The rolling window trims older data. It does not end consent. Consent ends only when a parent or legal guardian explicitly withdraws it.

Existing families. The new 180-day default applies only after the parent or legal guardian confirms it in the app. Until then, the window already chosen for that child stays as it is.

7.1 Delete your account and data

• In the app:open Settings → Privacy & data controls and choose “Request Account/Data Deletion”. This permanently removes all parent and child data linked to the account from our systems.
• Without the app (web): email [email protected] from your account email address and ask us to delete your account. We verify the request and delete the data within 30 days.

7.2 Turning off a safeguard or withdrawing consent

• Withdrawing consent stops further collection immediately.
• Turning off a single safeguard deletes the data that safeguard collected.
• Turning off every data-collecting safeguard deletes all of that child’s data from those safeguards.
• Emergency records are the exception. Records of emergency alerts and safe-word triggers are kept when you turn off an individual safeguard, so a later settings change does not erase a past safety event. They are removed with everything else on a full withdrawal or account deletion.

7.3 How long data is kept

• Per-child retention: the parent or legal guardian chooses a rolling window of 7 to 365 days, 180 days by default, for each child. Unpinned safety history is deleted automatically once it falls outside that window. Conversation-context snapshots (section 1.8) are kept for at most 30 days. Scheduled clean-up removes data when its retention period ends.
• Pinned evidence: a parent can pin specific safety items as evidence, to keep them beyond the rolling window. Pinned items stay until the parent unpins or deletes them. Once unpinned, an item goes back under the rolling window, and is deleted if it is already older than the window.
• Pinning never overrides a withdrawal or a deletion. Pinned items are still deleted when the related safeguard is withdrawn, or when the child profile or account is deleted. The child can see which categories have pinned items.
• Device wellbeing alerts: offline and resolved connection alerts keep the last-seen time recorded by our server (last_seen_at) and their status. They expire after 30 days, or sooner if the child’s retention window (7 to 365 days, default 180) is shorter. Offline and device-status alerts cannot be pinned. The latest device status is a single current record, not a history.

8. Third-party services

These providers help deliver sign-in, storage, notifications, product analytics, diagnostics and the website. Each entry names the service’s role and the kind of information it receives.

Supabase Backend, database and authentication

Stores account and profile data and sign-in (auth) tokens. Protected by RLS policies and data isolation, and encrypted at rest.

Apple and Google Sign-in, notifications and maps

If you choose to sign in with Apple or Google, we receive a basic identity token. Apple Push Notification service (iPhone) and Google Firebase Cloud Messaging (Android) carry notifications to your devices. On Android, Google Maps loads map tiles when you view a location or place, and receives the device’s IP address and the map area.

PostHog Product analytics

Anonymous, unlinked product analytics. Events are not linked to an account, parent or child identity. Automatic lifecycle events are off and session replay is not used. PostHog receives limited product-interaction events and app and build details, with no link to a family account. Tiny Beacon does not send child-entered content to PostHog and does not use these events for advertising or cross-app profiling. You can change the analytics choice in Privacy & data controls.

Sentry Crash and error diagnostics

Crash reports, with personal identifiers minimised and parent context shortened before they are sent.

Expo Push notifications and app delivery

Receives push tokens and device identifiers. Delivers safety notifications to parent devices, and silent connection checks to paired child devices.

Resend Emails (Resend, Inc., United States)

Sends welcome and service emails, emergency SOS fallback emails and optional weekly parent summaries. It receives your email address and name, your child’s first name, and the weekly summary counts.

For the website sign-up, Resend sends the confirmation email and the one notice when message alerts are ready on Android. Section 1.9 explains the sign-up data, confirmation email copy and deletion periods.

Ollama AI safety checks (Ollama Inc., United States)

Runs the cloud AI model that checks content for signs of risk. It is used only for optional features that a parent or legal guardian switches on in the supervised Android edition: screen check-ins and AI review of text conversations (section 9.1).

What it receives.We do not send account identifiers, email addresses or profile names. Screen check-in requests include the child’s broad age group (under 13 or teen) and a count of recent flagged checks. Any names, faces, phone numbers or other details that are visible on the screen, or written in a message, are sent as part of the image or text.

What it returns. A risk level, a confidence score and a short reason. For screen images, it also returns content tags and the text it read from the screen.

What Ollama’s policy says.Ollama’s privacy policy (March 2026) says this content is not stored beyond the time needed to answer, and is not used to train models. It also says data may be processed in the United States, shared with its own cloud and model-hosting providers, and used or disclosed for abuse prevention, safety or legal reasons. It says its service is intended for users aged 18 and over.

We have no separate written data processing agreement with Ollama. These assurances rest on Ollama’s published policy, not on a contract with us. You can use Tiny Beacon without switching on any AI check, and you can turn AI checks off at any time.

Plausible Website analytics (tiny-beacon.com)

Counts page views and button presses in aggregate, with no cookies and no personal data. Nothing it records identifies a visitor.

Google Analytics Website analytics (tiny-beacon.com; Google LLC, United States)

Shows us how visitors use the public pages of tiny-beacon.com, for example which pages are read and how often the download buttons are pressed. It runs only on the website, never in the app. It never runs or sends anything on the family, child access, dashboard, sign-in, email verification or For Kids pages.

What it receives. The page address without anything after it (no query string), the page title, and the site you came from (its address only). It also receives which download or video button was pressed, that a website sign-up form was sent (never the email address), how far you scrolled, how long the page stayed open, and whether this is a new visit. Your browser sends Google its usual technical details, such as browser and device type, screen size and language, and short-lived random identifiers that are not saved on your device.

Your IP address. Google uses it to filter spam, route traffic and estimate a rough location (down to city). For visitors outside the EU, UK and Switzerland, Google says it never links raw IP addresses to user identifiers and discards them after use.

What it does not do.It does not set analytics cookies on your device. Google signals and advertising features are switched off, and the data is not used for advertising. It receives no app data and nothing from your family’s account. Google keeps visit-level data for 14 months; totals in standard reports can stay longer.

Cloudflare Website DNS, CDN and security

Processes IP addresses and request details for tiny-beacon.com. Website traffic only; no app data.

9. Supervised and enterprise editions

In supervised Android editions that include text and call check-ins, the first run after a parent or guardian turns the feature on may include up to the previous seven days of texts and calls already stored on the child’s device. This is so recent context is not lost at setup. Nothing older than seven days is read. If the feature is turned off and later turned on again, the seven-day window starts fresh. It does not cover the period while the feature was off.

Supervised Android editions also include the social-app safety check-ins described in section 1.8, with the same consent, excerpt and retention rules.

9.1 Supervised direct-install edition (Android, separate consent)

In the supervised direct-install Android edition, each added category starts off and needs its own parent or guardian choice. Message and call check-ins in the supervised-plus Android edition also need setup on the child’s device. Turning a choice off stops new collection and removes the related data, as described here.

This edition was installed directly from the Tiny Beacon website and is no longer offered for download. New Android installs use Google Play.

• SMS text:message content and sender and recipient numbers, checked for safety keywords and risk patterns, for the parent’s safety review.
• Call metadata: call direction, times, duration, frequency and unknown-number flags. Call audio is never recorded or accessed.
• Screenshots:the device screen is captured at intervals and checked for high-risk content (such as bullying, self-harm, grooming and adult content). Each captured frame is sent over an encrypted connection to our server, and on to our AI safety-check provider, Ollama (section 8), which checks it and returns a result. The frame is not stored on our server during this check. Only frames rated medium risk or higher are stored, end-to-end encrypted for the parent’s devices.
• App use: app and package names, categories, durations, screen opens and daily totals, for usage summaries and enforcing limits.

These categories are not used for advertising or to build advertising profiles. None of these capabilities exist on iOS, because Apple does not let third-party apps access them. Supervised safety on iOS relies only on Apple’s Family Controls / Screen Time.

AI review of text conversations (deeper conversation review). This runs in the supervised edition only if a parent or legal guardian switches on both text message check-ins and the separate consent for deeper conversation review.

• Recent incoming and outgoing SMS messages with a contact are sent to our AI safety-check provider, Ollama (section 8), to assess grooming risk: up to 24 messages, of up to 2,000 characters each, with at most 50 checks per child per day.
• A check runs when the on-device check spots a warning sign rated medium or higher. It also runs routinely after 8 new messages with a contact (at most once every 30 minutes per contact), even if nothing was flagged on the phone.
• For each check we keep the risk level, confidence score, model version, a short reason when one is returned, and the other person’s phone number. These are kept within the child’s retention window of 7 to 365 days (default 180). High or critical results also alert the parent.
• Turning deeper conversation review off stops future checks and deletes these stored results.

10. Where data is stored, and transfers outside Malaysia

Family account and safety data is stored on Supabase-managed cloud infrastructure in Singapore. It is encrypted in transit (TLS 1.2+) and at rest (AES-256), with access-controlled backups.

Transfers outside Malaysia.Our database is in Singapore. Our service providers in section 8 (including Supabase, Expo, Apple and Google notifications, Google Maps, Google Analytics, Resend, Sentry, PostHog, Cloudflare and Plausible) operate in Singapore, the United States and other countries. So using Tiny Beacon involves transferring personal data outside Malaysia, to provide the service you ask for. For the website sign-up, we rely on Resend’s data processing agreement and reasonable precautions and due diligence to protect the data sent to the United States.

If a parent or legal guardian switches on an optional AI safety check in the supervised edition (section 9.1), the screen image or messages being checked are also sent to Ollama Inc. in the United States and its hosting providers. There is no separate data processing agreement, as section 8 explains. AI checks are optional. You can refuse them or switch them off at any time without losing Tiny Beacon’s other features.

11. Changes to this policy

If we materially change how a child’s data is handled, we will:

• notify all parent accounts in the app
• update the “Last updated” date at the top of this page
• ask for consent again for any change that materially affects how children’s data is handled, including a change to an existing safeguard

Version 1.3.2 (12 November 2026).This version adds the optional website sign-up for adults to receive one email when message alerts are ready on Android. It explains the confirmation email and its retention, the consent record, Resend’s United States processing, the transfer safeguards, withdrawal and deletion deadlines. It does not change anything in the app.

Version 1.3.1 (12 November 2026).This version adds Google Analytics as a second analytics service for the public website (section 8), and adds Google Analytics to the transfers in section 10. It also says that Plausible counts button presses as well as page views, and points to the website analytics from section 1.6. It does not change anything in the app or how the app handles your family’s data.

Version 1.3.0 (12 November 2026). This version names Ollama Inc. (United States) as the AI safety-check provider for optional supervised screen check-ins and deeper conversation review, and says that we have no separate data processing agreement with it. It corrects the earlier description of conversation review, adds the Android social-app safety check-ins, and lists more of what we collect and where it is processed. Families with an AI safety check switched on will be asked in the app to review this version or switch that check off.

12. Contact

Questions about a family choice, a child’s information or deletion? We’re here to help. Use the contact details below.

© 2026 Amir Ariff bin Abdul Hadi. Tiny Beacon is committed to protecting children’s privacy. Built in Kuala Lumpur, Malaysia.