Privacy policy

01 Who we are

tiho is a baby sleep-tracking app with AI sleep coaching, for iOS and Android. It is operated by Krasava Ltd (registered in Bulgaria), which is the data controller for the personal data described here. You, the parent or legal guardian, hold the account. Your baby is the person the data is about.

This policy covers the tiho app and the coach dashboard at coach.tihoapp.com. If you have a coach account, §10 explains what it holds. Our website (tihoapp.com) shows no ads and sets no advertising cookies. It uses privacy-respecting, EU-hosted analytics (PostHog) that by default stores nothing on your device: anonymous page statistics only. If you accept the cookie notice, we set a single first-party analytics cookie so those statistics can tell returning visitors from new ones; decline it and the site works identically. For any privacy question or request, email support@tihoapp.com. Our registered address is available on request.

02 Your baby's data

This is the most important thing to understand about tiho, so it comes first.

The account holder is always an adult parent or legal guardian. Your baby never uses tiho and has no account. Everything tiho holds about your child is information you voluntarily enter, control, and can delete: their name, date of birth, an optional photo, and sleep records. tiho is not directed to children and collects nothing from a child.

Because that information concerns a minor and can include a photo and sleep details, we treat it with particular care, and we're committed to handling it in line with children's-data protections such as COPPA and the GDPR.

03 What we collect

Account

• A random account ID.
• If you sign in with Apple or Google: your email and name, only as Apple or Google return them (with Apple you can use Hide My Email), the ID Apple or Google uses for your account, and which of the two you used. Google also returns a link to your profile picture, which our sign-in provider keeps with your login. More in Google user data below.
• If you use tiho as a guest: no email or name from anyone. The account gets a hidden placeholder email and a backup key instead, explained below.
• The first name you type during setup, and what you are to your baby (mom, dad, or other). Your first name is shown to the people you invite, so they know who invited them.
• We never ask you to create a password.

Google user data

When you sign in to tiho, or to the coach dashboard, with Google, tiho asks Google only for your basic profile (the openid, email and profile permissions). We get no access to anything else in your Google account, such as your contacts, calendar, Drive, Gmail, or photos.

• What we receive: your name, your email address and whether Google has verified it, a link to your Google profile picture, and the ID Google uses for your account.
• How we use it: only to run your tiho account: creating it, signing you in, and recognising it if you write to us about it. tiho doesn't show or use your profile picture.
• Sharing: we don't sell it, use it for advertising, or use it to train AI models, and none of it goes to our AI provider (see §06). Supabase stores it as our sign-in provider (see §07). Parents never see a coach's name or email from Google (see §10).
• Storage and protection: it's kept with your account in our backend in the United States (see §11), behind the protections in §15.
• Keeping and deleting it: we keep it while your account exists. Deleting your account deletes it with everything else (see §12). You can also remove tiho's access at any time in your Google Account, under Security, in your connections to third-party apps and services.

tiho's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Guest accounts and their backup

You can use tiho without Apple or Google, as a guest. So that a lost, reset, or replaced phone doesn't take a guest's records with it, tiho backs the account up on its own:

• The account gets a hidden placeholder email made from its account ID, ending in guest.tiho.invalid. That address can't receive mail. We never show it, and nothing is ever sent to it.
• Your phone makes a random key and keeps it in the phone's own secure storage: iCloud Keychain on iOS, Google Block Store on Android. Apple or Google sync it through your own account, so it survives deleting the app and comes back on a new phone set up from that account. If that sync is off, there is nothing to restore on a new phone. The saved entry holds the key, the account ID, and the placeholder email.
• Our sign-in provider stores only a one-way hash of the key, as the account's password. You never create, see, or type it.
• The key has one use: getting the same guest account back after you reinstall tiho or move to a new phone.
• If you later sign in with Apple or Google, the backup is retired and the app removes the key from your phone. Signing out or deleting your account removes it too, and deleting the account also deletes the hash.

Your baby

• Name, date of birth, and pronouns (optional). If you add your baby before they're born, their due date, which we keep after you confirm the birth.
• An optional photo, resized on your device to a small image and stored in a private space. Only you and the people you share your baby with can see it.
• Time zone, locale, and the sleep method you choose (Behavioral or Responsive).
• The family's usual wake and bed times from setup (for a young baby, when they last woke), and the number of naps if you set it. These shape the daily plan.

Sleep

• Each sleep's type (nap or night), the put-down / asleep / wake times and derived durations, where your baby slept, and how they fell asleep (from fixed lists).
• Night wakings (time, length, and reason), and the local date and hour.

Notes you write

You can attach a free-text note to a sleep. It's meant for general sleep notes. It is not a place for health or medical information, and we ask you not to put any there. We can't monitor what you type, so if you do choose to include something sensitive, you're doing so on your own initiative. Bear in mind a note is part of the baby's shared journal. Anyone you've invited to that baby can see it: a co-parent (who can also edit it) and a coach (read-only, within their access window). On our side, no one at tiho reads your notes. An automated check looks only for a few keywords, such as illness, teething, or a safety topic, so the coaching can take them into account and point you to "see your pediatrician" when it matters. We don't analyze notes for anything else. For a baby with tiho+, notes are part of what our AI provider receives to write the coaching (see AI coaching).

Notifications and the lock screen

• Push notifications. If you allow notifications, your phone gives us a push token: an address Apple or Google use to reach that device. We store it with your account and the platform (iOS or Android), and use it only to send tiho's notifications: the reminders you keep on, such as a nap coming up or a sleep still running, your morning brief and insights, and notices about sharing, your subscription, or the service. A notification's text can include your baby's name, and it reaches your phone through Apple's or Google's push service. Reminders about a shared baby go to each of its parents. We delete a token when Apple or Google tell us it no longer works.
• Live Activities (iPhone). While your baby is settling or asleep, tiho can show the sleep in progress on your lock screen and in the Dynamic Island. When the baby is shared with a co-parent, each iPhone's Live Activity gives us an update token, which we store with your account and the baby. When one parent logs a change, we send the new content through Apple's push service to the other parent's Live Activity: your baby's name, whether they're settling or asleep, when it started, the number of wakings, where they're sleeping, and the expected wake time. We keep the latest content for that baby to do this. A token is deleted when its Live Activity ends. You can turn Live Activities off in iOS Settings.

Where your install came from (Android)

On Android, Google Play tells the app which link or ad led to the install, as campaign tags. The app reads them once per install and saves them in our analytics (PostHog), on the profile tied to your random account ID: the source, medium, campaign, content, and term tags, and the raw text Google Play passes on. We use this to see which ads and links bring people to tiho, and whether they go on to subscribe. These tags stay in our analytics; they aren't sent to an ad platform. iOS doesn't give apps this information, so nothing is collected there. Measuring our Meta and Apple ads is separate, and §08 covers it.

How you use the app

The app sends usage events to our analytics provider (PostHog), tied to your random account ID: the screens you open, the features you use, and error reports when something breaks. Some events describe what you logged, in numbers and fixed choices, never words: that a sleep was started, ended, edited, or added afterwards, with its type (nap or night), its length, where your baby slept, and the number of wakings and their reasons. The profile tied to your ID holds your baby's age range (such as 4 to 12 months), the method you chose, your plan, how many babies you have, the app version, and the platform. Our servers also record events about the coaching they write, such as a morning brief being made and what it cost, under a random ID for the baby. Analytics never receive your baby's name, date of birth, or photo, your notes, your email or name, or the coaching text.

Also

• The Memories tiho awards from your records, the AI coaching tiho generates for you (stored with metadata such as age band and method), and your subscription status mirrored from the app store (no card details; those stay with Apple or Google).
• Sharing data: who you've invited, single-use invite codes (stored only as one-way hashes), an optional name or email label you type for an invitee, whether a co-parent is the baby's mom, dad, or other if you say so, and an audit log of sharing actions.

What we deliberately don't collect

No advertising identifier on iPhone (IDFA): tiho never asks to track you. No precise GPS location, no password you create, no biometrics. (On Android, outside the EU, your phone's advertising ID goes to Meta for ad measurement, unless you switch it off; see §08.) We don't record sleeping position, swaddle, room temperature, or household risk factors. Our only sense of location is an approximate region inferred from your IP address by our analytics provider. That's standard for any website, and never precise.

04 How we use it

We use your data to run the app's sleep tracking, generate your coaching and schedule suggestions, deliver the notifications you enable, keep a sleep in progress up to date on your lock screen and a co-parent's, let a guest get their account back, keep the app stable and secure, and let you share with the people you choose. On Android we also use the install source to see which ads and links bring people to tiho, and outside the EU we measure our ads on Meta and Apple Ads (see §08). There are no ads inside tiho, nothing about your baby is ever used for advertising, and we never sell your data.

05 The legal bases we rely on

Under the GDPR we have to point to a lawful reason for each thing we do with your data. In plain terms:

• To run tiho: performance of our contract with you. Creating your account, and backing up a guest account so you can get it back; storing and showing your baby's sleep; generating the AI coaching that is part of tiho+; sharing with people you invite, including keeping a sleep in progress up to date on a co-parent's phone; and managing your subscription. You enter this contract by agreeing to our terms in order to use the app.
• Optional extras you switch on: your consent. Push notifications and an optional baby photo. You can withdraw at any time by turning them off or deleting them, without affecting anything done beforehand.
• Notes you write: provided on your own initiative. The free-text note field is for general notes, not health or special-category data, and we ask you not to enter it. If you choose to include something sensitive anyway, you're providing it yourself and consenting to us storing it as your private note; you can delete it at any time.
• To keep tiho safe and working: our legitimate interests. Security, preventing abuse, keeping the app stable, usage analytics that never see your baby's name, birth date, or photo, or your notes, and on Android, learning which ads and links bring new installs. Our interest is a reliable, well-made product that people can find, weighed against your privacy.
• To measure our advertising (UK): our legitimate interests. Sharing installs, app opens, trials and subscriptions with Meta, and learning from Apple Ads which campaign led to an install (see §08). You can object at any time by switching off More → Tracking → Ad measurement. In the EU, the EEA and Switzerland, ad measurement doesn't run at all.
• Legal obligations. Keeping subscription and tax records for as long as the law requires.

The core of tiho, including the AI coaching that defines tiho+, is part of the service you sign up for, so using the app means agreeing to that processing. It isn't an optional toggle. Anything that genuinely is optional (a photo, push, or anything sensitive you choose to type into a note) is marked as such and is up to you.

06 AI coaching

tiho's coaching is generated by AI, for babies with tiho+. To write it, our server sends your baby's recent sleep context to our AI provider, OpenAI, through their API. For a baby without tiho+, nothing is sent. This is what is sent:

• Your baby's name as you typed it, their age in weeks and their age range, and the pronouns you chose. The name lets the coaching speak about your baby naturally. The age is essential: what's normal for sleep, and what's safe, changes week by week in the first years, so every piece of coaching depends on it.
• The method you chose, the app's language, and the date.
• Recent sleep records, from the last day up to the last month depending on the card: each sleep's type and times, where your baby slept and how they fell asleep, and night wakings with their times, lengths, and reasons.
• Your notes on those sleeps, with any keyword flags from the automated check described above.
• Totals and averages tiho works out from your records, and for a coaching nudge, the pattern that prompted it.
• For the monthly recap, which month of your baby's life it covers, and that month's start and end dates.

• Your baby's date of birth is never sent, only their age. A monthly recap runs from one monthly birthday to the next, though, so the birth date could be worked out from its dates.
• Nothing sent identifies you or your family directly. Your own name, email, account ID, photos, and location are never sent to the AI, and neither is a surname, unless you typed one into your baby's name.
• Under OpenAI's API data-usage terms, your data is not used to train their models and is not retained for training.
• The AI is informational sleep coaching, not medical advice. See our terms.

This processing is inference only: every output is a suggestion you read and judge for yourself. It makes no automated decision with legal or similarly significant effects.

07 Who processes your data

tiho relies on a short, named list of providers, each doing one job. None is a data broker. One, Meta, is an advertising company: it measures our ads, and never receives anything about your baby (see §08).

08 Ads and measurement

We advertise tiho on Facebook and Instagram, and on the App Store through Apple Ads. To learn which of our ads bring parents to tiho, we share a few app events with Meta. There are no ads inside tiho. This started with tiho 2.2 (October 2026); earlier versions send nothing to Meta.

Where it runs

Ad measurement is off in the EU (Ireland included), Iceland, Liechtenstein, Norway, Switzerland, the EU's overseas regions, Guernsey, Jersey, the Isle of Man and Gibraltar, and on any phone with no region set. There, nothing at all goes to Meta. Everywhere else, the UK included, it's on until you switch it off. tiho decides this on your phone at each launch, from the phone's region and your App Store or Google Play country, and the stricter of the two wins. No location data is used for it. We may also turn it off, or off by default, in more countries later.

What we share

• From the app, through Meta's SDK: that tiho was installed and opened. With these go Meta's anonymous app ID, device information (app version, operating system version, device model, language, time zone, screen size, mobile carrier), and your IP address. On Android, also your phone's advertising ID.
• From RevenueCat, our subscription provider, on its servers: your trials, subscriptions, renewals and cancellations, with the product, price and currency, Meta's anonymous app ID, and a hashed (scrambled) version of your tiho account ID. From iPhones, also your device's vendor ID and IP address.
• On iPhone, no tracking: tiho never shows Apple's tracking prompt, so Meta never gets your iPhone's advertising identifier (IDFA). Meta measures iPhone ads through Apple's SKAdNetwork and its own aggregated measurement.

What we never share

Anything you log about your baby: sleep, naps, wakings, notes, names, ages or photos. Nor your name, email or phone number. The app sends Meta no events of its own, only the automatic install and app-open events above.

Why

To learn which of our ads bring parents to tiho, and to show our ads to people more likely to find tiho useful.

Apple Ads

On iPhone, where ad measurement is on, the app passes Apple's attribution token to RevenueCat, and Apple tells us whether the install came from one of our Apple Ads campaigns, and which one, with no personal identifier.

Your choice

• Switch off More → Tracking → Ad measurement in the app (it's there wherever ad measurement runs). Meta logging stops right away, the SDK doesn't start on later launches, and Meta's anonymous ID is deleted from RevenueCat, so it stops sending your subscription events to Meta. The setting is per phone.
• On Android, you can also reset or delete your advertising ID in your phone's settings.
• In Facebook or Instagram, Accounts Center → Your activity off Meta technologies lets you disconnect what apps share with Meta and turn off future activity.
• In the US, the Digital Advertising Alliance's aboutads.info/choices (and its AppChoices app); in Canada, youradchoices.ca.

Legal basis (UK)

Our legitimate interest in measuring our advertising. You can object at any time: switching off Ad measurement does it, or email support@tihoapp.com. In the EU it doesn't run, so it needs no basis there.

Who receives it

Meta Platforms, Inc. in the United States, and RevenueCat as our processor. International transfers rely on the providers' Standard Contractual Clauses and, for the UK, the UK Addendum to them.

How long it's kept

What has reached Meta is kept under Meta's terms; see Meta's Privacy Policy and RevenueCat's Privacy Policy. Deleting your tiho account doesn't yet delete your record at RevenueCat (your purchase history and Meta's anonymous ID): email us and we'll delete it.

Your rights

You can ask for access to this data, ask us to delete it (see How to delete your data), and object to it at any time. The controller is Krasava Ltd, Bulgaria (see Who we are).

09 Sharing with co-parents & coaches

tiho only shares your data with people you choose to invite, and you can revoke access at any time:

• Co-parents you invite are parents in tiho too. They share the baby's full journal, can add or edit sleeps and their notes, and can edit the baby's profile: name, birth date, pronouns, method, nap count, usual times, and photo. On iPhone, a sleep in progress also shows on their lock screen. Only the parent who added a baby can delete it; a co-parent can leave at any time.
• When you invite a co-parent, you can say whether they are the baby's mom, dad, or other. We store that with the invite and with their access, for our own statistics.
• Coaches you invite get a read-only view of your baby's profile and photo, sleep, stats, and the notes attached to them, only after you approve them. They see a rolling 7-day window, or the full history if a parent of the baby has tiho+. Coaches never see your AI insights.

A coach is a person you choose. We don't select, vet, employ, or endorse them, and inviting one through tiho does not make them your medical adviser. They access your data purely as your invitee, are required to keep it confidential and use it only to advise you, and their invite is single-use, expiring, and revocable. Every sharing action is recorded in an audit log only you can see.

10 Coach accounts

Sleep coaches use tiho through the coach dashboard at coach.tihoapp.com, with an account of their own, separate from any parent's. This section is for them.

What a coach account holds

• Your email address, and how you sign in. If you use a password, our sign-in provider stores it only as a one-way hash. If you use Apple or Google, we get the email and name they return (see Google user data).
• The name you give when you sign up, or the one Apple or Google return, and a marker that this is a coach account. Parents don't see your account's name or email. In their sharing list, you appear under the label they typed on the invite.
• Your access to each client: which babies you were invited to, when you accepted each invite, and when the parent approved, revoked, or denied it. The babies' data belongs to their parents and is described in the sections above. You can only view it, within the window their plan allows.
• Your sign-in session, kept in the browser you use. Sign out of all devices in the dashboard's settings ends it everywhere.

We hold a coach account to run the dashboard you signed up for: performance of our contract with you.

Emails we send coaches

The only emails a coach account gets are about signing in, such as a link to reset your password when you ask for one. Our sign-in provider, Supabase, sends them. We don't send coaches newsletters or marketing. A parent's invite never arrives by email either: it's a link the parent sends you themselves.

Analytics on the dashboard

The dashboard counts the pages you open, tied to your account ID, in our EU-hosted analytics (PostHog). A page's address can include a client's random ID, never their name. These analytics set no cookies, record no sessions, and never see the sleep data or notes you view. We rely on our legitimate interest in a dashboard that works, as we do for the app.

How long we keep it, and how to delete it

A coach account stays until you delete it. To delete yours, email support@tihoapp.com from the address on the account, and we'll delete it within 30 days. That removes your sign-in and every client access you hold. Each parent's sharing history keeps the record that a coach had access, without a link to your account. Usage analytics stay under your random account ID unless you ask us to erase them too. To stop seeing one client without deleting your account, use Leave engagement in the dashboard.

11 Where your data lives

Krasava Ltd is based in Bulgaria, but your account and baby data are stored in the United States (our backend and AI provider), while our analytics are hosted in the European Union. Outside the EU, the ad measurement events in §08 go to Meta Platforms, Inc. in the United States. If you're in the EU/UK, this means your personal data is transferred to the US. Those transfers rely on appropriate safeguards: Standard Contractual Clauses and each provider's data-processing agreement. You can ask us for a copy of them.

12 How to delete your data

You can permanently delete your tiho account, and everything tied to it, from inside the app:

1. Open tiho and go to the More tab.
2. Scroll to the bottom and tap Delete account.
3. Press and hold the confirmation button. Deletion happens immediately, and cannot be undone.

What this deletes: your account and sign-in identity (Apple, Google, or a guest's backup key and its hash), your baby profiles (name, date of birth, pronouns, photo), every sleep record (naps, nights, wakings, notes) and the Memories earned from them, all AI-generated insights and coaching, every sharing invitation and co-parent/coach access grant you created, and your notification settings, push tokens, and Live Activity tokens. Baby photos are erased from storage, including one a co-parent added. A baby you added is deleted for everyone you shared it with, and the app lists those babies before you confirm.

What is kept: usage analytics events under your random account ID, which leads back to nothing we hold once the account is gone, unless you ask us to erase them too (see How long we keep it). Apple and Google hold their own purchase records under their policies, and we retain anonymised billing records where tax and accounting law requires. Your record at RevenueCat, our subscription provider (purchase history and, where ad measurement ran, Meta's anonymous ID), isn't yet deleted with the account: email us and we'll delete it. Deletion from our live database is immediate; any short-term operational backups our provider holds are cycled out within 30 days.

If you can't open the app: email support@tihoapp.com from the address linked to your account, and we'll delete it within 30 days. A guest account has no email we could match, so instead install tiho on a phone signed in to the same Apple or Google account: the guest account comes back from its backup, and you can delete it in the app.

Deleting only part of your data: you can remove a single baby, and its whole sleep history, from More → Children: open the child and hold Delete at the end of the page. Only the parent who added a baby can delete it, and it's deleted for everyone it's shared with. Its photo is erased from storage within two days. You can also delete individual sleep entries from the journal, without deleting your account. Uninstalling the app does not delete your synced data. Use Delete account, or email us. For a guest, the backup key also stays in your iCloud Keychain or Google Block Store, so installing tiho again brings the account back.

13 How long we keep it

We don't purge data on a timer: your records stay until you remove them (see How to delete your data above). Cancelling a paid subscription is a separate step. Do it in the App Store or Google Play so you aren't billed again; we can't do it on your behalf.

Two honest caveats: usage analytics events are kept separately and are not removed when you delete your account. They stay under your random account ID, which no longer leads back to you once the account is gone; email us and we'll erase them too. And we may retain subscription/purchase records for around 7 years where tax and consumer law requires it.

14 Your rights

Depending on where you live, you can access, correct, export (port), restrict, or delete your personal data, object to processing based on our legitimate interests, and withdraw consent at any time. You can do most of this yourself in the app; for anything else, email support@tihoapp.com and we'll respond within 30 days, free of charge.

tiho makes no automated decisions that produce legal or similarly significant effects. The AI only offers suggestions you read and judge (see §06).

If you think we've mishandled your data, please tell us first so we can put it right. You also have the right to lodge a complaint with a data protection authority: in the EU/EEA, the supervisory authority where you live or work; in the UK, the ICO; in Canada, the Office of the Privacy Commissioner of Canada; in Australia, the OAIC.

US residents (including California): we don't sell your personal information for money. Sending device identifiers and app events to Meta for advertising (§08) can count as "sharing" for cross-context behavioral advertising under California law, and as targeted advertising under other states' laws. You have the right to opt out of it: switch off More → Tracking → Ad measurement in the app (more ways in §08). We don't sell or share anything about your baby, and we don't knowingly collect personal information from children: tiho is used by parents.

15 Security

• Row-level security on every table: you can only reach your own data, or data explicitly shared with you. Coaches are additionally limited to the time window the baby's plan allows.
• Baby photos live in a private bucket with no public access.
• Sign-in uses JWTs, and refresh tokens are held in your device's secure storage. A guest's backup key sits in iCloud Keychain or Google Block Store, and our servers keep only a one-way hash of it. Sensitive operations run through restricted server-side functions, and our keys and signing secrets never ship in the app.
• Invite codes are stored only as one-way (SHA-256) hashes, account deletion is rate-limited, and deletes cascade so nothing is left orphaned.
• If something does go wrong, we'll investigate promptly and notify you and the relevant authority where the law requires it.

16 Changes

We'll post any update here with a new date. For small clarifications, that's all. For a material change, especially one that introduces a genuinely new use of your data, we'll also say so in the app's update notes on the App Store and Google Play, and where the law requires your consent for that new use, we'll ask for it rather than treat your continued use as agreement.

17 Contact

Krasava Ltd is the data controller. For any privacy question or to exercise a right, email support@tihoapp.com.