Privacy

The free plan needs no account and creates none. Everything you track — the items, their schedules and every date you marked one done — is written to a database on your own phone and is never sent anywhere. There is nothing for us to hold, disclose or lose, and the app works with no internet connection at all.

The trade is real and worth stating plainly: because we hold nothing, we cannot give anything back. If the phone is lost or wiped, so is that history. Pro exists to back it up, and that is what the rest of this page describes.

Your email address, so you can sign in and get your list back on another phone. Your password is not stored: authentication is handled by Supabase Auth, which keeps a hash of it and never the password itself.

The items you track — the name you gave each one, its emoji, its category and how often it comes round — and one row for every time you marked one done, with the date and time of that completion. Your phone stays the original; what we hold is a copy of it. Nothing else about you is kept in this app’s database — the companies that run the infrastructure keep their own service logs, as any host does.

There is no analytics, no advertising, no third-party tracking and no crash reporting in the app. Nothing is sold or shared for marketing, because nothing is collected for it.

Your account and your tracked-item history are stored in a hosted PostgreSQL database run by Supabase, which also handles signing in. Your phone reaches it through a small service of ours running on Cloudflare’s network, which passes your backup between the two and stores nothing of its own. Both are processors for this data. Your list and your history go to nobody else — the two processors named in the next section are sent your email address and a subscription record, and never the things you track.

Both, as operators of that infrastructure, keep their own service logs of the requests made to them in the ordinary way any hosted service does; those logs include technical details such as an IP address.

Which rows a signed-in account may read or write is decided by row level security policies in the database itself, so one account cannot see or change another account’s items — that rule is enforced by the database on every request, not by the app or that service being careful. The service has no way round it: it connects as a role that cannot bypass those policies and cannot delete a row at all.

If Pro ends, the backup stops being updated and is not deleted, so resubscribing picks up where it left off. You can delete it yourself at any time, on either plan: Settings, then Delete my cloud copy. That removes the copy we hold and leaves your phone exactly as it is.

Buying Pro is handled by Google Play, which is the seller. We never see your card, and no payment detail reaches us or is stored by us.

Whether a subscription is currently active is tracked for us by RevenueCat, so the app can tell whether to back your list up. They are sent an identifier for your account and the record of the subscription itself — when it started, whether it renews, when it ends. They are not sent the things you track, your history, or your email address.

The mail this app sends you — confirming an address, resetting a password, telling you the password changed — is delivered by Resend, who are sent your email address and the message itself for that purpose alone. We send no marketing mail, and there is nothing to unsubscribe from.

All three are processors acting on our instructions. None of them is sent your list or your history, and nothing here is ever sold or used for advertising.

Your backup is kept for as long as the account exists, and stops being updated if Pro ends rather than being deleted, so resubscribing picks up where it left off. Deleting your cloud copy or your account removes it immediately, as described above.

The subscription record held by RevenueCat and by Google Play outlives that, because both keep a record of a purchase having happened; ask us and we will have the RevenueCat one deleted too.

This app is not directed at children, and we do not knowingly collect anything from one. There is nothing in it aimed at them and no account is needed to use the free plan at all.

In this version, a question typed into the Ask tab is matched against your own list on the phone. The text of the question is not sent to any server, no AI or machine learning service is involved, and nothing about what you asked is recorded.

That describes this version. It is not a promise about a future one: if a version ever answers questions with the help of a service off the phone, this page will say so before it ships.

Reminders are scheduled by the phone itself, at the time you pick, on days something is due. There is no push service, so no schedule of yours is uploaded anywhere in order to remind you, and turning notifications off changes nothing about what is stored.

Deleting an item hides it. The row is marked as archived rather than removed, and from then on the item and its completions do not appear anywhere in the app. Keeping the row is what lets a deletion be undone and keeps the completion history intact; it is not kept in order to be used for anything else.

Deleting your account removes it all. Your items and every completion belonging to them are deleted with the account, archived ones included, because they exist in the database only as rows belonging to your account.

You do it yourself, in the app: Settings, then Delete account. It asks for your password first, and tells you how many items and completions are about to go. There is no waiting period and no copy kept afterwards, so it cannot be reversed by us or by you. If you cannot get into the app, email support@tinylantern.app from the address you signed up with instead.

Everything stored about you is visible in the app: your list, and the History tab. If you want a copy in another form, or something corrected or deleted, email support@tinylantern.app.

Last updated 2 September 2026.