Little Hours privacy policy
Effective 14 October 2026.
Who we are
Little Hours is made by Rajgopal & Co Pty Ltd (ABN 34 695 070 298), Victoria, Australia. This policy says what the app keeps, where, why, and what you can ask of us. It is for adults: parents, carers and the helpers they invite.
Free in beta
Little Hours is free while in beta; we'll tell you before that changes.
On your phone first
Everything you record (feeds, sleeps, nappies, medicines, notes, vaccinations) is stored on your phone. If you don't turn on family sharing, it stays there.
Your plan
When Little Hours first opens it gets a random install id from our server, with no family data, ready for when plans start. Nothing you record is sent with it, and nothing syncs until you turn on sharing.
Health information
Much of what you record is health information, which the law treats as sensitive: feeds, sleep, medicines, temperatures, symptoms, growth, vaccinations, pregnancy and postnatal check-ins (bleeding, mood, recovery). Children's profiles (names and dates of birth) are entered by their parents. We use all of it only to show it back to your family, never for anything else.
Family sharing
If your family turns on sharing, your records sync to the Little Hours server in Amazon Web Services' Sydney region, so the parents and helpers you invite see the same timeline. Parents see everything. Helpers see the children's profiles and records, handover notes, the expressed-milk stash and the names of family members, not a mother's own records.
Backups
The server streams a backup of its database to AWS storage in Sydney, kept for 3 days, and AWS keeps a daily copy of the whole server for 7 days. When you delete a record, the server keeps only a marker that it was deleted (its id, kind, child and time, none of what it said) so every phone removes it too. The deleted content stays in the backups for up to 7 days.
How data travels
Traffic between the app and our server, including voice recordings, is encrypted and goes through Cloudflare's network: the encrypted connection ends at Cloudflare and travels on to our server through a Cloudflare tunnel.
Signing in
If you sign in with Apple or Google, they receive the sign-in request. We keep the account id they give us, your email address and your name; for Apple, also a refresh token, used only to revoke the sign-in when you delete your account. Session tokens are stored only as hashes. We never see your Apple or Google password.
Your voice
Voice commands are turned into text on your phone by its built-in on-device recogniser; the audio isn't sent to Apple or Google. On a phone that can't do that, the recording is sent to our server only if your family shares, turned into text there, and discarded straight away; without sharing, you type instead. We never store recordings.
Overseas
Our server and backups are in Sydney. Some of the services we rely on are run from overseas or by overseas companies: Cloudflare (a US company with a global network) carries traffic to the server, and Apple and Google (US) handle sign-in. Each receives only what it needs to do that job.
Logs and limits
Your IP address is held in memory for a short time to limit repeated attempts. Server logs may record IP addresses and the pages requested; they are kept only briefly and overwritten as they fill.
What we never do
No ads. We don't sell or rent your data. No third-party analytics or tracking.
How long we keep it
Your account and family data until you delete them; logs briefly; backups up to 7 days after a deletion.
Deleting your account
Delete your account from the Family tab, or say "delete my account". Before anything is deleted the app shows exactly what goes: your account, and the family if you are its last parent (its children, entries and helpers' access). We remove it from our server and ask Apple to revoke the sign-in straight after. If another parent stays in the family, the family carries on: the entries you made stay with it, with your name on them, unless you delete them first. Without the app, see /delete-account.
A copy of your data, and your rights
You can download your data in the app at any time, as a readable summary and a complete JSON file, or ask us for a copy at [email protected] with your account id. You can also ask us to correct anything. We reply within 30 days. If you are unhappy with our answer you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Changes
This policy is effective from 14 October 2026. If we change it in a way that matters, we say so in the app before the change applies, and the date here changes.
Contact
Questions or requests: [email protected].