The details that matter

Privacy Policy

Last updated: October 30, 2026

1. Who this policy covers

This policy explains how ToddlerBites ("we", "us") handles information in the ToddlerBites app and on toddlerbites.app (together, the "Service"). ToddlerBites is made for parents and caregivers. The information about children in the app is entered by those adults.

2. Information we collect

2.1 Information you give us

• Account: your email address, and your name if you add one or if Apple or Google shares it when you sign in with them. If you sign up with email, Firebase Authentication handles your password.
• Child profile: your child's name or nickname, birth date or age, allergies, foods they dislike, texture preference, nutrition goals, notes, and growth measurements (weight and height) if you add them.
• Meal logs: what was offered and eaten, meal type, portions, ratings, reactions, notes, and nutrition estimates.
• Meal photos: photos you take or choose, including before and after photos.
• Voice notes: short recordings you make to log a meal, and the text transcript we create from them.
• Feeding Coach messages: the questions you ask the Feeding Coach.
• Other app content: pantry items, shopping lists, favorite recipes and meal plans.
• Messages to us: anything you send to support.

2.2 Information collected automatically

• App usage (Firebase Analytics): which screens and features you use, onboarding steps, paywall views and purchase steps, and simple counts such as how many allergies a profile has or a child's age in months when a profile is created. These events are linked to your account ID. They are not anonymous.
• Crash reports (Firebase Crashlytics): device model, operating system, app version and technical details about the crash, linked to your account ID.
• Usage counters: how often you use AI features and scans, so we can apply daily limits.

The app does not currently have a setting to turn off app analytics or crash reporting.

2.3 Information from others

• Apple or Google sign-in: your email address and, if you allow it, your name.
• Purchases: Apple processes payments. We receive your subscription status (for example, which plan is active and when it renews or ends) through RevenueCat. We never see your card details.
• Family sharing: caregivers you share a child profile with can add and edit meal logs for that child.

3. How we use your information

• To run the app: keep your child's profile, meal history, plans and lists, and show insights and reports.
• To provide the AI features you choose to use (see section 4).
• To sync your data across devices and with caregivers you invite.
• To manage subscriptions and unlock Pro features.
• To prevent abuse, apply usage limits, and keep the Service secure.
• To fix crashes and understand which features help families, so we can improve the app.
• To answer your support requests.

We do not sell your personal information. We do not use your or your child's information for advertising, and the app does not show ads.

4. AI features: which providers get what

Several features use third-party AI services. Data is sent only when you use the feature. Here is what each one sends:

• Meal photo scan: the photo is sent to Amazon Bedrock (Anthropic's Claude model) to identify foods and estimate nutrition.
• Voice logging: the recording is sent to Amazon Transcribe to turn speech into text. The recording is stored temporarily in our AWS storage while it is transcribed, then deleted. The transcript (and the recipe name, if there is one) is then sent to Amazon Bedrock (Claude) to fill in how the meal went.
• Nutrition from a food name: the food name you type is sent to Amazon Bedrock (Claude).
• AI recipe ideas: your child's first name or nickname, age, allergies, dislikes and texture preference, plus the meal type, available time, cuisine and any pantry items you select, are sent to Amazon Bedrock (Claude). Our recipe generator can also be switched to OpenAI as a backup provider. If that happens, OpenAI receives the same request.
• Feeding Coach: your question, the last few messages of the conversation, and your child's name, age, allergies and dislikes are sent to Amazon Bedrock (Claude). The conversation is saved on your device. Our servers keep only usage counts.
• Read-aloud: the text being read, such as recipe steps, is sent to ElevenLabs to create the voice audio. We may use Amazon Polly for this instead.

We reach Claude through Amazon Bedrock, so these requests go to Amazon Web Services. These providers process the data to return a result to you. We don't use the data for any purpose other than the feature you asked for. You don't have to use these features to use ToddlerBites.

5. Other service providers

• Google Firebase: sign-in (Authentication), cloud database (Firestore) for cloud sync, family sharing, subscription status and usage counters, our server code (Cloud Functions), app analytics (Analytics) and crash reports (Crashlytics). Firebase privacy
• Amazon Web Services: Amazon Bedrock, Amazon Transcribe and Amazon Polly (see section 4), and Amazon S3 for storing meal photos and recipe images. AWS privacy
• OpenAI: backup provider for AI recipe ideas only (see section 4). OpenAI privacy
• ElevenLabs: read-aloud voice audio. ElevenLabs privacy
• RevenueCat: manages subscriptions. It receives your account ID and purchase details from Apple. RevenueCat privacy
• TheMealDB: recipe search. Our server sends only search words such as a dish, ingredient, cuisine or meal category. Your child's age and allergies stay on our server and are used to filter the results.
• Edamam: optional recipe search, currently turned off in the app. If we turn it on, it receives search words, meal type, cuisine, prep time and allergy filters (such as "peanut-free"). It does not receive your child's name.
• Open Food Facts: when you scan a packaged food, the app sends the barcode number to look up the product.

6. Children's data

ToddlerBites is for adults. Children should not use the app or create an account. Everything about a child in the app is entered by a parent, guardian or caregiver.

• What we use: the child's name or nickname, age or birth date, allergies, dislikes, texture preference, nutrition goals, growth measurements, meal logs, meal photos and voice notes that you add.
• Why: only to provide the app's features to you, such as tracking, insights, recipes and the Feeding Coach.
• AI providers: to generate AI features, some of this data goes to the AI providers listed in section 4. The list in section 4 shows exactly what each feature sends. We send only what the feature needs.
• No selling, no ads: we never sell children's data and never use it for advertising or marketing profiles.
• Your control: you can edit or remove a child's details, meal logs and profiles in the app at any time, and you can ask us to delete any remaining data (see section 9).

Please only enter a first name or nickname for your child. Avoid putting identifying details, such as your child's face, in meal photos.

7. Meal photos

Without cloud photos, meal photos stay on your device. With Pro, meal photos you add to a meal log are uploaded to our Amazon S3 storage so they appear on all your devices and for caregivers you share with. Each photo gets a long, random web address. The photo is not listed or searchable anywhere, but anyone who has that exact address can open it. Photos used only for a meal scan are sent for analysis and are not saved by that scan.

If you share a story card to Instagram or another app, the card (which can include your child's name and a meal photo) goes wherever you choose to share it.

8. Sharing

We share information only:

• With caregivers you invite: they can see and edit the shared child profile and its meal logs, including photos.
• With service providers: listed in sections 4 and 5, to run the Service.
• When required by law, or to protect the safety of our users or the Service.
• In a business transfer, such as a merger or sale, where this policy continues to apply.

9. Deleting your data

You can delete your account in the app under Profile > Delete Account. This deletes your sign-in account and the data saved under your account in our cloud database: your user record, child profiles, meal logs, favorites, pantry items and shopping lists.

Some data is not removed by in-app deletion yet. This includes meal photos stored in the cloud, child profiles and meal logs you shared with other caregivers, subscription records, usage counters, and app analytics and crash data. Data saved on your device stays there until you delete the app. To delete everything that remains, email support@toddlerbites.app from the email address on your account and we will remove it.

Deleting your account does not cancel a subscription. Cancel it in your Apple ID settings.

10. How long we keep data

• Account and cloud data: until you delete it or your account.
• Meal photos in the cloud: until you ask us to delete them. Deleting a meal log in the app does not yet delete its stored photo.
• Voice recordings: deleted from our storage as soon as the transcript is ready. The transcript is kept with the meal log if you save it.
• Shared profiles: until the owner removes them or you ask us to delete them.
• Subscription records and usage counters: while your account exists, and until you ask us to delete them, unless we must keep purchase records by law.
• Analytics and crash data: for the retention period set in our Firebase settings.

11. Security

Data is sent over encrypted (HTTPS) connections. AI and storage requests go through our server functions, which check that you are signed in, so provider keys are never stored in the app. Cloud data is protected by sign-in and access rules that limit each account to its own data and to profiles shared with it. No system is perfectly secure, so please use a strong password and keep your device locked.

12. Where data is processed

Our service providers process data in the United States. This includes Amazon Web Services (Amazon Bedrock requests use US regions), Google Firebase (our Cloud Functions run in the US), and the other providers above. If you live outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from those where you live.

13. Your rights

Depending on where you live, you can ask to:

• access or get a copy of your data
• correct it
• delete it
• restrict or object to how we use it
• receive it in a portable format
• withdraw consent at any time (this doesn't affect what we did before)

You can view and edit most data in the app, and Pro users can export meal reports as a PDF. For anything else, email support@toddlerbites.app. We may need to confirm it's your account before acting. You can also complain to your local data protection authority.

13.1 Legal basis (EEA, UK and Switzerland)

• Contract: to provide the app and the features you use, including AI features, sync and subscriptions.
• Consent: for children's details you choose to add that may be health-related, such as allergies and growth measurements, and for website analytics. You can withdraw consent by deleting that data or changing your choice.
• Legitimate interests: to keep the Service secure, prevent abuse, fix crashes and improve the app.
• Legal obligation: where the law requires us to keep or share information.

13.2 California notice

In the last 12 months we collected these categories of personal information: identifiers (email, name, account ID); commercial information (subscription status); internet or app activity (app usage and crash data); audio (voice notes); visual information (meal photos); and sensitive information you choose to add about your child, such as allergies and growth measurements. We collect them for the purposes in section 3 and disclose them only to the service providers in sections 4 and 5.

We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We use sensitive information only to provide the Service. California residents can ask to know, access, correct and delete their information, and we won't treat you differently for using these rights. Email support@toddlerbites.app to make a request.

14. Website

With your consent, toddlerbites.app uses Google Analytics, and may use Microsoft Clarity, to understand page visits, scrolling, App Store button clicks, and where visitors get confused. These tools may use cookies or similar browser storage. We do not send child profiles, allergies, meal logs, photos, voice recordings or other in-app content to website analytics providers.

You can decline analytics in the website consent notice. Your choice is stored in your browser, and the analytics scripts don't load if you decline.

15. Changes to this policy

We will update this page when our practices change and change the "Last updated" date above. Please check it from time to time.