Privacy Policy
Last updated: July 15, 2026
Tuptu ("the app", "we") is a mobile app that helps parents plan developmental activities for their children. This document explains what data we process and why.
The data controller is the individual behind the Tuptu project, contact: contact@tuptu.app.
1. What data we collect
1.1 Data stored only locally on your device
Your child's profile (name, date of birth), activity completion history, parent notes, and app settings are stored locally in a database on your phone (SQLite). We do not send this data to our servers and we have no access to it. If you uninstall the app or delete a child profile, this data is gone — we don't keep a copy.
1.2 Data sent to the AI model (weekly plan generation)
To generate an activity plan, the app sends to our server-side function (Supabase Edge Function), which communicates with our language model provider (Anthropic), only the child's age in months and general, anonymous plan parameters (e.g. a chosen development area). We do not send:
- the child's first or last name,
- exact date of birth,
- any other data that could identify the child or parent.
The model's response is validated server-side and client-side before it reaches the screen — we never display unverified content.
1.3 Technical data
The app may locally store connectivity status (offline/online) needed for local sync to work correctly. We do not currently use third-party analytics or behavioral tracking tools. If this changes, this policy will be updated in advance.
1.4 Email address (waitlist / contact)
If you join the waitlist at tuptu.app or contact us, we process your email address solely to send you information about the app and to respond to your message. We do not share it with third parties for marketing purposes.
2. Legal basis and purpose of processing
We process data based on:
- necessity for providing the service (GDPR Art. 6(1)(b)) — data sent to the AI model to generate a plan,
- consent (GDPR Art. 6(1)(a)) — waitlist / newsletter sign-up.
3. Children's data
Tuptu is an app for parents and caregivers, not for children. A child profile is created and managed exclusively by the parent/caregiver. We do not target the app directly at children and do not collect data directly from children. Data about a child (age in months, anonymized) is processed only to the extent necessary to generate personalized developmental content, based on the parent's explicit action.
4. Data processors
- Supabase — Edge Functions infrastructure mediating calls to the AI model.
- Anthropic — language model provider generating plan content (receives only age in months and anonymous parameters, per section 1.2).
- Cloudflare — hosting for tuptu.app and email routing.
We do not sell or share personal data for advertising purposes.
5. Your rights
Under GDPR you have the right to: access your data, rectify it, erase it, restrict processing, data portability, and object to processing. Since most child data lives only on your device, you can delete it yourself in the app settings (deleting the child profile) at any time. For data we hold ourselves (e.g. waitlist email), write to contact@tuptu.app — we will respond and act on your request.
You also have the right to lodge a complaint with your national data protection authority (in Poland: UODO).
6. Content safety
All AI-generated content for a child is automatically checked for safety and age-appropriateness before it is shown. App content does not replace medical or educational professional advice — where content touches on health topics, we display an appropriate disclaimer.
7. Data retention
We keep local data for as long as you use the app, until you manually delete it or uninstall the app. Waitlist email addresses are kept until you unsubscribe or until launch, whichever comes first.
8. Changes to this policy
If we change how we process data (e.g. add analytics), we will update this document and notify you of material changes in the app or on the website.
9. Contact
Privacy questions: contact@tuptu.app