1. Overview
tinyout ("we", "us") helps parents and caregivers find toddler-friendly events around NYC. This policy explains what information we collect when you use tinyout.com (the "Service"), why we collect it, and who we share it with. By using the Service, you agree to this policy.
2. What We Collect
We try to collect as little as possible. The data we do collect:
- Email address — when you sign up for the Friday digest or create an account.
- Neighborhood — to personalize event suggestions for the area you care about.
- Kid age ranges — to filter events to the right age bracket.
- Saved studios — stored in your browser's localStorage. We don't see this data; it lives on your device.
- Basic request data — IP address, browser user-agent, and referrer, used for anti-abuse, rate limiting, and aggregate analytics.
We do not collect payment information. We do not knowingly collect information from children.
3. Why We Collect It
- Send you the Friday digest of toddler events tailored to your neighborhood and kid's age.
- Maintain your account and let you save studios across devices.
- Understand which events and pages are popular so we can improve the Service.
- Protect the Service from bots, scrapers, and abuse.
4. Third Parties We Share With
We use a small set of trusted vendors to operate the Service. We don't sell your data to anyone. Each vendor only sees the data needed to do its job:
- Loops — email delivery for the Friday digest and account-related emails. Receives your email address and digest preferences (neighborhood, age range).
- Supabase — authentication and database hosting. Stores your account, email, neighborhood, and age preferences.
- Vercel — web hosting. Receives standard request data (IP, user-agent, URL) when you load a page.
- Mapbox — map tiles and geocoding. Receives the coordinates of map views you load on the Service.
- Cloudflare Turnstile — bot protection on signup forms. Receives a short-lived browser token for verification.
- Google Calendar — only when you click "Add to Calendar" on an event. We don't share anything; the click hands the event details directly from your browser to Google.
5. Cookies & Local Storage
We use the minimum cookies/storage needed to run the Service:
- Session / authentication — keeps you logged in.
- Cloudflare Turnstile — short-lived verification token to confirm you're not a bot when you submit a form.
- Local storage — saved studios and your zip/location preference, stored on your device only.
- Optional analytics — aggregate visit counts; no cross-site tracking.
6. Your Rights
- Unsubscribe from the Friday digest at any time using the unsubscribe link in any email we send you.
- Delete your account and associated data by emailing hello@tinyout.com from the address on file. We'll confirm and process the deletion within a reasonable time.
- Access or correct your stored data — email us and we'll send what we have or update it.
- Clear local data (saved studios, zip preference) by clearing your browser's site data for tinyout.com.
7. Data Retention
We keep your account data for as long as your account is active. If you delete your account, we delete the associated data from our primary database promptly; backups age out within ~30 days.
8. Children's Privacy
tinyout is intended for use by parents and caregivers — adults. We do not knowingly collect personal information from children under 13. If you believe we have, contact us and we'll delete it.
9. Changes to This Policy
We may update this policy as the Service evolves. Material changes will be reflected in the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.
10. Contact
Questions about this policy or your data may be sent to hello@tinyout.com.