Privacy Policy
Last updated: November 2026
Tawny is a log of your baby's feeds, sleep, diapers, medicine and growth, kept by you and the people you invite. It holds sensitive information about a child, so we collect as little as we can and never sell it.
What is stored, and where
Everything you log is saved on your iPhone first. If you turn on backup and sharing, which is your choice during setup and can be changed in Settings, your log is also stored on our server so it reaches the people you invite and survives losing your phone. If you keep it on this iPhone only, nothing from your log leaves your device.
On the server we store: your display name, your language, your child's name, birth date, due date and sex if you enter them, every log entry, who made and changed each entry, and your device's push token. You don't need an email address, a phone number or a password.
Your log is not stored in iCloud. It is excluded from iCloud device backups. A random sign-in key is kept in your iCloud Keychain, if you use it, so a new iPhone can sign back in.
Who can see it
Only people you invite to your family, according to the role you give them. Removing someone stops their access to anything new straight away; anything already on their device while it is offline stays there until it next connects.
What we don't do
No advertising. No ad or analytics SDKs. Your log is never used for marketing, data mining or AI training, and it is never sold or shared with data brokers.
Service providers
Our server runs at Hetzner in the EU. Apple delivers notifications; those notifications carry no baby data. RevenueCat handles subscription status, using a random account ID and no log data.
Security
Connections use TLS. Sign-in keys are stored only as hashes. The log is not end-to-end encrypted: it has to be readable by the server to merge changes between caregivers.
Your choices
You can export everything as a file and delete your data from Settings at any time. Deleting removes your account immediately. Families where you are the only member are deleted with it, including from backups within 30 days. In shared families, the log remains for the others, and your name is removed from it. Deleted entries are kept in the trash for 30 days and then erased.
Children
Tawny is for parents and caregivers, not for children to use. A parent or guardian decides what is entered about a child and can delete it at any time.
Your rights
Depending on where you live, you may have rights to access, correct, delete or move your data, and to complain to a regulator. Write to us and we will help. By turning on backup and sharing you consent to this processing, and you can withdraw at any time in Settings.