TuppyTuppy Privacy Policy
Draft, for review before Tuppy launches. Tuppy isn't available yet, and this page may change before it is.
Last updated: 29 October 2026
Tuppy ("we", "us") helps families turn everyday tasks into screen time. This policy explains what we collect, why, and the choices you have. We wrote it for parents first, and there is a short version for children at the end.
Who we are (the "data controller"): Brad Mead, trading as Tuppy (a sole trader), [TODO: postal address, added before launch], United Kingdom. Contact: privacy@tuppy.app. Website: tuppy.app.
The short version
- Tuppy is run by a parent. A child can only use it because a parent set it up and is in control.
- For each child we keep a first name and an avatar. We don't ask for a surname, date of birth, school, address, email, phone number or location.
- Photos children take to show a task is done are deleted automatically after 30 days.
- We don't show advertising, we don't use analytics or tracking SDKs, and we never sell or share data for marketing.
- Tups (the in-app coins) can never be bought with real money.
- Data is stored in the UK (London).
What we collect and why
| What | Whose | Why we need it | Lawful basis (UK GDPR) |
|---|---|---|---|
| Parent's sign-in details (an Apple ID identifier and the name or "private relay" email Apple gives us) | Parent | To create and secure the family account | Contract (providing the app you asked for) |
| Child's first name and chosen avatar | Child, entered by the parent | To show whose tasks and Tups are whose | Parental consent, and contract with the parent |
| Tasks, rewards, family rules (daily limits, bedtime, school hours) | Family | To run the app | Contract |
| A record of Tups earned, spent and refunded, and screen-time sessions (start, end, length) | Child | To keep an accurate balance and enforce the limits parents set | Contract |
| Proof photos (taken in the app's camera, with an optional comment of up to 140 characters) | Child | So a parent can check a task was done | Parental consent |
| Requests, rewards asked for, nudges and short fixed replies | Child and parent | To let the family talk about time and rewards without free-text chat | Contract |
| Device name and model of the child's iPhone or iPad, and how many apps are allowed or blocked | Child's device | To show parents which device is paired and enforce the rules | Contract |
| Tuppy Plus subscription status: the product, whether it's active, its renewal or end date, and Apple's transaction ID (Apple handles the payment; we never see card details) | Parent | To switch on Tuppy Plus for your family, and keep it in step with renewals, cancellations and refunds | Contract |
| Push notification token (only if you turn notifications on) | Device | To tell a parent a task is waiting, or tell a child a task was approved | Consent |
| Technical logs (for example error reports, and request times) kept by our hosting provider | Everyone | Security, fixing faults | Legitimate interests |
Screen Time and Family Controls
Tuppy uses Apple's Screen Time technology (FamilyControls, ManagedSettings and DeviceActivity) to lock and unlock apps on a child's device. Apple gives apps opaque tokens, not app names, and the choices of which apps are allowed stay on the child's device. We do not receive, read or store a list of the apps your child uses, their browsing, or how long they spend in each app. Only counts (for example "2 apps blocked") and group names the parent chose are shared with the parent's phone.
What we don't do
No advertising. No third-party analytics or tracking. No profiling of children. No location tracking. No photo library access (the camera is used inside the app only). No selling or renting data. No chat between children and other people.
How long we keep data
- Proof photos: deleted automatically 30 days after they are taken. Parents can delete them sooner.
- Tups records and sessions: while the family account exists, so the balance stays correct.
- Everything else: until a parent deletes the child or the family account, or asks us to. When an account is deleted we remove its data from live systems within 30 days, and from backups within 90 days.
- While the account is active, we keep its data so Tuppy keeps working. A parent can delete everything at any time in the app: Settings → Delete account.
Who we share data with
Only the services we need to run Tuppy, which act on our instructions (our "processors"):
- Google Firebase (Firestore, Cloud Functions, Storage, Authentication): stores the data. We use the europe-west2 (London) region. Google may need to access it for support, and that access is covered by Google's data processing terms. We will set out the exact safeguards for any access from outside the UK here before Tuppy launches.
- Apple: sign-in (Sign in with Apple), push notifications (APNs), and the App Store (including Tuppy Plus subscriptions, which Apple bills).
We may share information if the law requires it, or to protect a child's safety. We will not share data with anyone else without a parent's consent.
Children and parental control
Tuppy is designed for children under a parent's supervision, following the ICO's Age Appropriate Design Code (the Children's Code):
- Parental consent. Children cannot create an account. A parent creates the family, adds each child, and pairs the child's device with a one-time 6-digit code that expires after 10 minutes.
- Best interests. Children see only what the parent has set up. Settings that matter (limits, bedtime, blocked apps) are behind a parent PIN and Apple's Screen Time authorisation.
- Data minimisation. The table above is all we collect. Nothing is collected "just in case".
- No nudging. No ads, no reward-spending pressure and no way to buy Tups. Notifications are plain and can be switched off.
- Transparency. The child's short version is below. Parents can see everything stored about their child.
- Default settings. Notifications are off until a parent turns them on. Photos are on a 30-day timer from the start.
- No detrimental use. We don't use children's data in ways that are harmful to them.
- We are not part of the Apple "Kids" category, and Tuppy is for parents to run for their own family, not for schools.
If you are a child's parent and believe a child created an account without you, contact us and we will delete it.
Your rights
Under UK GDPR you (and a parent, on behalf of a child) can ask to: see your data; correct it; delete it; restrict or object to how we use it; receive a copy in a portable format; and withdraw consent at any time (this doesn't affect what we did before). Email privacy@tuppy.app. We respond within one month, and we won't charge a fee unless a request is clearly unreasonable.
In the app, a parent can delete a child, delete photos and delete the whole family account from Settings.
If you are unhappy, please contact us first. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113.
Security
Data is encrypted in transit and at rest by our hosting provider. Access to a family's data is limited by security rules to that family's own parents and the child it concerns. Money-like data (the Tups ledger) can only be changed by our server, never directly by an app. No system is perfectly secure; if we ever have a breach that puts people at risk, we will tell the affected parents and the ICO as the law requires.
Changes
If we change this policy in a way that matters, we will tell parents in the app before it takes effect. Previous versions are available on request.
For children (the short version)
Hi! Tuppy only knows your first name and the picture you picked. When you take a photo to show a job is done, only your grown-ups see it, and it disappears after 30 days. We don't show ads and we don't share your stuff. If anything worries you, tell your grown-up.
Contact
Brad Mead, trading as Tuppy, [TODO: postal address, added before launch], United Kingdom.
- Privacy: privacy@tuppy.app
- Help with the app: support@tuppy.app
- Anything else: hello@tuppy.app