Privacy policy

The short version

• You give us two photos of adults (or one photo of a couple). We make a picture of what your baby might look like.
• We delete your photos within 1 hour. Our generation partner keeps them for at most 30 days for abuse monitoring only and does not train on them.
• Your baby pictures are deleted from our servers within 24 hours.
• If you report a picture, we keep that picture (not your photos) for 30 days so a person can review it.
• You can delete everything we hold about your photos at any time: Settings → Delete my data now. See how to delete your data.
• There are no accounts. We know your phone only by a random install ID.
• Usage data, screen recordings and crash reports are shared only if you say yes when the app asks, and you can switch them off in Settings. Whatever you answer, we count each purchase, and how many installs reach each step of the app, without your install ID or device details.
• We do not sell your data. We do not show ads. We do not use your photos to train AI.
• Little Us is for adults only (18+). We refuse photos of faces that look under 18.

1. Who we are

Little Us is made by Softguard Limited, registered in England and Wales (company number 11819642), registered office Freedman House, Christopher Wren Yard, 117 High Street, Croydon, CR0 1QG ("we", "us"). We are the controller of the personal data described here. Contact us about anything in this policy at privacy@softguard.io.

2. What Little Us does with your photos

1. On your phone. When you pick a photo, the app looks for faces on your phone using Google ML Kit. It tells you if a face is too small, blurry or missing. The face boxes it finds are sent with the photo so our server checks the same faces.
2. Before anything leaves your phone, the app shows you which AI company will make your picture and how long it keeps photos. Nothing is uploaded until you agree. If you say no, nothing is uploaded.
3. On our server. We resize your photo, check each face again (with a face-finding model called YuNet) and estimate each face's apparent age (with a model called FairFace). If a face looks under 18, we refuse it and you are asked for another photo. Then we cut out one square picture around each face.
4. Payment. You buy one generation through Google Play (see section 6). We check the purchase before we start.
5. Generation. We send the two face pictures (not your full photos) to our generation partner. We never send photos to a partner you did not agree to.
6. Your result. The baby picture comes back to our server and then to your phone.

All of this runs on our own servers and those of our hosting provider, DigitalOcean, in Frankfurt, Germany (EU). The only exception is the generation partner in section 4.

3. How long we keep things

What the records without pictures contain. For each photo we keep: the picture's width and height, where each face was in the picture (a box: position and size), quality scores (blur, face size, how front-on the face is, whether the eyes are visible), the estimated apparent age of each face, any warnings (for example "too blurry"), and timestamps. For each job we keep: which partner and model ran it, how long it took, what it cost us, and any error. These records contain no pictures, no face landmarks and no face "fingerprints" (biometric templates). We cannot recognise you from them. They stay linked to your random install ID.

On your phone. Photos you pick are copied into the app's own cache on your phone so your session can be restored. Baby pictures you save go to your phone's gallery. These stay on your phone and are under your control. Deleting the app removes the app's cache.

4. Our generation partner

This is the only company that receives your photos. The app shows you the same information and asks for your agreement before any photo is uploaded.

We may add or change partners. If we do, the app will show you the new list and ask you again before any photo goes to a new partner. We will update this policy at the same time.

5. Analytics, session recordings and error reports

We use PostHog (PostHog Cloud, EU region, Frankfurt) to understand how the app is used and to find bugs. Only if you say yes. The first time you open the app it asks whether to share usage data and crash reports. If you say no, or do not answer, the analytics software is not started, and our server sends nothing about you to PostHog, except feedback you choose to give, a record of each purchase and a count of the steps you reach, none of them linked to you (see below). The app works the same either way. You can change your answer in Settings: turning it off stops sharing straight away, and turning it on starts the next time you open the app. When you turn it off, the app sends one last event saying that analytics was turned off, along with any usage events it had not sent yet, and then sends nothing more.

What we send to PostHog:

• Events about what happens in the app, for example "photo picked", "paywall viewed", "purchase completed", "result rated", "result shared". Each event carries your random install ID, a session ID, the app version, the platform and any experiment group you are in.
• Counts and scores from the face checks: how many faces were found, blur scores, warnings and the rounded estimated age of each face. No pictures, no face boxes, no landmarks.
• Device and app details that the PostHog software collects automatically, such as device model, operating system version and screen size. PostHog uses the IP address the app's events arrive from to estimate your approximate location (country and city), then discards the IP address: it is not stored with the events.
• Session recordings. PostHog records what is on screen while you use the app, so we can see where people get stuck. By default it masks all text and all images. On top of that, we explicitly mask the photo slots, the couple confirmation screen, the generating screen and the result screens, so your photos and baby pictures are not recorded.
• Crash and error reports. When the app or our server hits an error, we send the error message and where in the code it happened. Before an error report leaves your phone, the app replaces any file path in it with "<path>", so a photo's file name is not sent.

What we never send: your photos, baby pictures, image data, face landmarks, face geometry, file paths or photo metadata (EXIF). Both the app and the server strip these out before anything is sent.

Feedback you choose to give. When you rate a result ("That's us", "Not quite us", the 1–5 score, the "What's off?" choices) or report an image, we send that rating or report to PostHog even if you said no to analytics, because you are telling us something on purpose. If you said no, it goes from our server, not from the app, under a new random ID each time. It carries the rating and which image model made it, without your install ID, the job it is about or any device details, so it is not linked to your install or to your other ratings. The text you type under "What's off?" never leaves your phone; we only send how long it is.

Purchases. Whatever you answered, when our server first sees a purchase it sends PostHog one record of it, so we can count sales and revenue: which product, which store, whether it was a test purchase, the price paid and what we receive after the store's fees (in US dollars), which offer the paywall showed, whether it was refunded, whether you said yes to analytics, and the hour it was bought (UTC). It is sent without your install ID or device details, under a new random ID each time, with no purchase or store transaction ID, no country and nothing about where you installed the app from, so it is not linked to your install or to your other purchases.

Steps through the app. Whatever you answered, the first time your install reaches each step of the app, our server sends PostHog one count of it, so we can see where people stop: installing the app, answering the analytics question (with your answer, yes or no, and the version of the question), a photo accepted, the paywall shown, a paid picture started, and a paid picture delivered. Each count is sent under a new random ID, without your install ID or any other ID, device details, country or where you installed the app from, and dated only to the hour (UTC), so it is not linked to your install or to your other steps. Our server learns these steps from the requests the app already makes to run the service; nothing extra is read from your phone. If your phone is one of our test devices or a Google test machine, the count says so, so we can leave it out.

Wording and settings. When it starts, the app asks our own server for its current wording and settings (for example, which price line you see), so we can change them without an app update. That request carries no install ID and nothing about you, and everyone gets the same answer, whatever you answered about analytics. Older versions of the app asked PostHog for this instead, and only if you said yes.

Testing changes. When we try out a change to the app (for example, whether your first picture is free), our server may put your install into one of two groups at random. It keeps which group you are in, under your random install ID, so you stay in the same one, and it deletes that with the rest of your data. If you said yes to analytics, PostHog is also told which group you are in.

6. Payments

Purchases go through Google Play billing (and the App Store if we launch on iOS). We use RevenueCat (United States) to handle purchases.

• RevenueCat receives your random install ID (as its "app user ID") and your purchase records from Google Play: what you bought, when, the price and currency, the store transaction ID, and whether it was refunded. It also receives basic device and app details from its software.
• Our server asks RevenueCat for your purchases when you start a generation, and keeps a record of each purchase and which job it paid for.
• Whatever you answered about analytics, our server sends PostHog a record of each purchase, without your install ID or device details (see section 5).
• We never see your card or bank details. Google handles payment. Google's own privacy policy covers what Google collects when you pay.

7. Where you came from (install attribution)

On Android, if you said yes to sharing usage data, the app reads the Google Play Install Referrer once Play answers. If Play does not answer, it tries again the next few times you open the app (at most five), and then stops. This tells us if you installed from a link someone shared from Little Us, from one of our ads, or from a Google ad. We only use these things from it: whether the link was a shared result, a partner invite or one of our ad links; an 8-character random share code from a shared link; the name we gave our ad (for example wedding_us); whether it contains a Google Ads click marker; and whether the source was Google Play itself or a paid click. To check that this works, we also send the names of the fields the referrer contained (such as utm_source or gclid), never their values, how long Play took to answer, and whether Play reported a click. We never send a click ID itself, only that the install came from an ad. Anything else counts as a normal install. We send this as one event to PostHog. We do not keep the referrer on your phone; we only remember that we have read it, or how many times we have tried.

When you share a result or invite your partner, the link contains that same kind of random share code, so we can count how many installs a share leads to. The code does not identify you or the person you send it to.

8. Your random install ID

There are no accounts, no names, no email addresses and no phone numbers in Little Us. When you first open the app, our server gives it a random ID. This ID links your uploads, jobs, purchases and analytics events together. You can see it in Settings. If you email us (for example through "Send feedback"), the email includes this ID so we can help you; we then also have your email address and whatever you write.

9. Adults only

Little Us is for people aged 18 and over. It is not directed at children. Every photo must show adults. Our server estimates the apparent age of every face and refuses any face that looks under 18. Age estimates can be wrong; if an adult is refused, try a different photo. We do not knowingly collect data from children. If you think a child has used the app, contact us and we will delete their data.

10. What we do not do

• We do not sell your personal data.
• We do not share your data for cross-context behavioural advertising (targeted ads).
• There are no advertising SDKs in the app.
• We do not use your photos to train AI models, and our generation partner has told us it does not either.
• We do not use face data to identify you, recognise you, or match you against other people.

11. Why we are allowed to use your data (UK and EU GDPR)

You can withdraw your consent to our generation partner at any time by emailing us. Your photos are deleted within 1 hour anyway; withdrawing stops future uploads. You can withdraw your consent to analytics in Settings at any time.

12. Your rights

You have the right to access, correct, delete, restrict or object to our use of your data, and to get a copy of it. Where we rely on consent, you can withdraw it.

• To delete now: Settings → Delete my data now. This deletes, straight away, every photo, face picture, baby picture and share card of yours still on our servers, any baby picture you reported, and cancels any job still waiting. Saved images on your phone stay on your phone. It does not erase the records without pictures (section 3), your purchase and consent records, or data held by PostHog and RevenueCat. To have those deleted, follow these steps.
• For anything else: email privacy@softguard.io with the install ID from Settings. We have no other way to find your data, because we do not know who you are.

We will answer within one month.

UK: you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). EU: you can complain to the data protection authority in your country. We would like the chance to help first.

US residents: depending on your state (for example California, Colorado, Connecticut, Virginia), you may have rights to know, access, correct and delete your personal information, and to opt out of its sale or sharing for targeted advertising. We do not sell it or share it for targeted advertising. To use your rights, email us as above. We will not treat you differently for using them.

13. Who receives your data

We may also disclose data if the law requires it.

International transfers. OpenAI and RevenueCat are in the United States. When your data goes there, we rely on the transfer safeguards recognised under UK and EU data protection law.

14. Security and changes

Your data travels over encrypted connections (HTTPS). Photos are stored in a private storage bucket and are only reachable through links that expire after 15 minutes.

If we change this policy, we will update the date at the top. If the change affects which companies receive your photos, the app will ask for your agreement again first.