Privacy Policy
Effective Date: July 23, 2026
Tiny Arc ("we", "us", or "our") operates the Tiny Arc mobile application ("App"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your personal data.
By using the App you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.
1. Information We Collect
1.1 Information You Provide
When you create an account and use the App, you may provide:
- Account information: email address and password (managed via Supabase Authentication).
- Profile information: name, age, height, weight, gender, working days, sport days, and nutritional goals.
- Mood and productivity data: daily mood ratings, productivity scores, and associated dates.
- Food and nutrition data: meal descriptions, calorie and macronutrient values, water intake, and food product data retrieved via barcode scanning.
- Symptom data: bloating levels, energy ratings, stool consistency, and other digestive health indicators.
- Journal entries: free-text daily journal notes.
- Weight history: weight measurements over time.
1.2 Information Collected Automatically
- Precise location data: if you grant permission, we access your device's location at approximately 100-metre accuracy to retrieve local weather data. Your raw latitude and longitude coordinates are transmitted to our weather data provider (OpenWeatherMap) to fetch current conditions. We store only the derived weather readings and a general location name (city name) in our database — raw coordinates are not persisted on our servers.
- Device and usage information: device type, operating system version, app version, and general usage patterns necessary for the App to function.
- Advertising identifiers: if you consent via Apple's App Tracking Transparency (ATT) prompt or Android's ad ID permissions, third-party ad networks may collect your device advertising identifier (IDFA/Ad ID) and usage data to deliver and measure personalised advertisements. This data may be used for tracking as defined by Apple.
2. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the App's features and services.
- Generate mood analytics, food impact analysis, weekly digests, and wellness insights based on your tracked data.
- Display weather-mood correlations using your location-based weather data.
- Sync your data across devices via your authenticated account.
- Send push notifications (such as daily reminders and streak alerts) if you have enabled them.
- Retrieve nutritional information for food products via barcode scanning using the USDA FoodData Central API.
- Display advertisements through third-party ad networks.
- Diagnose technical issues, prevent abuse, and improve the App.
3. Data Storage and Security
Your data is stored in two places:
- On your device: a local SQLite database stores your data for offline access and fast performance.
- In the cloud: data is synced to our backend powered by Supabase, which uses PostgreSQL with Row Level Security (RLS). This means each user can only access their own data at the database level.
We implement reasonable technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.
4. Third-Party Services
The App uses the following third-party services, each with its own privacy policy:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Authentication and cloud database | Account data, all user-submitted content |
| Google AdMob | Advertising | Device identifiers, ad interaction data |
| RevenueCat | In-app purchase management | Purchase history, subscription status, anonymous app user ID |
| USDA FoodData Central | Nutritional data lookup | Barcode/search queries (no personal data) |
| OpenWeatherMap | Local weather data | Precise location coordinates (latitude, longitude) transmitted per request; no personal identifiers sent |
We do not sell, rent, or trade your personal data to any third party.
5. App Privacy Data Collection Summary
The following table summarises the data Tiny Arc collects, in line with Apple's App Privacy requirements:
| Data Type | Collected | Linked to Identity | Used for Tracking | Purpose |
|---|---|---|---|---|
| Email Address | Yes | Yes | No | App Functionality (account) |
| Health & Fitness (sleep, mood, symptoms) | Yes | Yes | No | App Functionality |
| User Content (journal, food entries) | Yes | Yes | No | App Functionality |
| Precise Location | Yes | Yes | No | App Functionality |
| Purchases | Yes | Yes | No | App Functionality |
| Identifiers — User ID | Yes | Yes | No | App Functionality |
| Identifiers — Device ID (IDFA / Ad ID) | Yes | No | Yes | Third-Party Advertising |
| Usage Data / Diagnostics (AdMob) | Yes | No | Yes | Third-Party Advertising / Analytics |
Third-party data recipients: Google AdMob, RevenueCat, OpenWeatherMap, and Supabase (data processor).
6. Advertising and Tracking
The App displays advertisements through Google AdMob. AdMob and its mediation partners may collect device identifiers and usage data to serve and measure advertisements. On iOS, we request your consent through Apple's App Tracking Transparency (ATT) framework before any tracking occurs. On Android, the advertising ID permission is used.
You can limit ad personalisation through your device settings:
- iOS: Settings > Privacy & Security > Tracking
- Android: Settings > Privacy > Ads
7. Push Notifications
We may send push notifications for daily entry reminders, streak alerts, and achievement milestones. You can enable or disable notifications at any time through your device settings or within the App.
8. Data Retention and Account Deletion
We retain your data for as long as your account is active.
You can delete your account at any time directly in the App (Settings > Account > Delete Account). When you request deletion, your account is scheduled for permanent deletion and you are signed out immediately. A 30-day grace period then applies: if you sign in again within 30 days, the deletion is cancelled and your account and data are fully restored. If you do not sign in within 30 days, your account and all associated personal data (including profile, mood, food, sleep, symptom, and journal entries) are permanently and irreversibly deleted from our servers. This ensures your erasure request is completed within one month, as required by Article 17 of the GDPR.
Residual copies may persist in encrypted backups for a short period after deletion and are purged automatically as part of the normal backup rotation cycle; backups are never used to restore deleted accounts.
Locally stored data on your device is removed when you uninstall the App. Anonymised or aggregated data that cannot identify you may be retained indefinitely for analytical purposes.
9. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access: request a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate data.
- Erasure: request deletion of your personal data. You can do this yourself at any time via Settings > Account > Delete Account in the App (see Section 8 for how deletion works).
- Restriction: ask us to restrict processing of your data.
- Portability: receive your data in a structured, commonly-used format. The App includes a data export feature that lets you export your tracked data.
- Objection: object to processing of your data for certain purposes.
- Withdraw consent: withdraw consent at any time where processing is based on consent (such as location access or ad tracking).
To exercise any of these rights, contact us at support@tinyarc.io. We will respond within 30 days.
10. European Economic Area (EEA) Users
If you are located in the EEA, the legal bases for processing your data are:
- Contract: processing necessary to provide the App's services (account management, data sync, core features).
- Consent: location data, personalised advertising, and push notifications.
- Legitimate interest: improving the App, diagnosing technical issues, and preventing abuse.
Your data is processed by Supabase, whose servers may be located outside the EEA. Supabase maintains appropriate safeguards for international data transfers in accordance with applicable data protection laws.
11. Children's Privacy
The App is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete that information.
12. Data Export
The App provides a built-in data export feature that allows you to download your tracked data (mood, food, symptoms, productivity, and more) in a portable format. You can access this feature from the Trends & Analytics section of the App.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by updating the "Effective Date" at the top of this page. Your continued use of the App after changes take effect constitutes acceptance of the updated policy.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:
Tiny Arc
Email: support@tinyarc.io