SmartHarmony AI › LittleRhythm › Privacy
LittleRhythm — Privacy Policy
Effective date: 17 October 2026 (app version 1.1.4 and later; section 4a applies from 1.1.7; differences for earlier versions are noted where they apply) · Provider: SmartHarmony AI LLC ("we", "us") ·
Contact: support@smartharmonyai.com
The short version
LittleRhythm is private by default. Everything you log about your
child — sleep, feeding, diapers, pumping, growth, health notes, medications, milestones, and
activities — is stored on your own device(s), in an encrypted database. We do not
run an account system, we do not collect your logs on a server of ours, we never sell your data,
we never show ads, and we never share your child's data. We use one
ad-measurement service, Tenjin, to learn which of our own ads brought people
to the app (section 8), and, from app version 1.1.4, Google Analytics for Firebase to
understand how the app is used (section 9). Neither ever receives your child's data.
A few optional features can send limited information off the device — AI
insights, voice logging and caregiver sync. They are off by default and you control
them. Usage analytics (section 9) is on by default and you can switch it off at any
time. Three things always run: the store's own purchase processing, crash and error reports with all
personal information removed (section 5), ad measurement (section 8), and an anonymous install count of our own (section 9a).
Where data leaves the device it is minimized, pseudonymized, and/or end-to-end
encrypted, as described below.
Who we are
LittleRhythm is developed and operated by SmartHarmony AI LLC. For any privacy
question or request, contact support@smartharmonyai.com.
What we store, and where
- On your device. Your care logs live in an encrypted SQLite
database (SQLCipher) on your phone. The database key is generated on-device and held in
the platform secure enclave (iOS Keychain / Android Keystore), accessible only when your device
is unlocked. We do not receive or store your logs on a server of ours.
- No LittleRhythm account. You don't create an account or give us your name or
email to use the app. The only time we ever receive an email address is if you type one into
Report a problem so we can reply — optional even then. We never ask for your name at all.
- Backups and exports are yours. You can create a device backup or an
encrypted export file that you own and control. We do not hold your backups.
- Caregiver sync (if you enable it) stores encrypted copies of your
care data in a cloud folder you choose (see the dedicated section below). We never hold
or can read them.
Features that transmit data (optional ones are off by default; each section says which)
1. AI insights
If you turn this on (part of LittleRhythm Pro), the app sends a limited, pseudonymized
summary of your numbers — ages in weeks, counts, and intervals — to phrase your insights in
plain language. The request does not include names, photos, email addresses,
free-text health notes, medication names, exact birth dates, or unique device/subscription
identifiers. Every insight is computed on your device first; the AI only rephrases it and never
makes a medical decision.
The request is sent over TLS to our LLM broker (operated by SmartHarmony AI and
delivered through Cloudflare), which authenticates your subscription with a short-lived token and
forwards the request to our AI provider, Anthropic (Claude models). The broker
holds the provider key; the app never does. The request is configured for zero data
retention and is not used to train models. You can turn AI insights off at any time.
2. Voice logging
If you choose voice logging, LittleRhythm requests temporary access to your device's
microphone to recognize the command you speak. It is activated only when
you initiate it (tap the voice button); a transcription is shown on screen and the app
then acts on it.
- Speech-to-text is performed by your device's operating-system speech
recognizer (Apple on iOS, Google on Android). Depending on your
device and OS settings, this may be processed on-device or by that operating-system
provider, under Apple's or Google's own privacy terms. LittleRhythm does not
intentionally retain audio recordings after the recognition request completes.
- Turning the transcript into a log entry happens on your device — first with
offline rules, then, where available, with an on-device language model (Apple
Foundation Models on iOS, Gemini Nano on Android); nothing leaves the device in this step.
- Optional cloud assist. For phrases the on-device path can't handle, and only
if you are a subscriber and have consented, the transcript text (no audio, no
identifiers) may be sent to our AI broker and Anthropic under the same zero-retention terms as AI
insights. This is never the default.
3. Caregiver sync (LittleRhythm Pro)
Caregiver sync lets the adults in one household (for example two co-parents, or a parent and a
nanny) keep the same care log across their phones — including across iPhone and Android. It is
optional and off until you set it up, and it is built so that we never
operate a sync server and never hold or can read your data.
- What leaves the phone. Only end-to-end encrypted blobs
(AES-256-GCM, a fresh key stream per file). Each blob is an encrypted copy of your care-log
records. File names are opaque; no baby names, dates, notes, or other readable metadata are
exposed.
- Where they are stored. In a folder you choose using your
phone's own file picker (Android Storage Access Framework; iOS document picker / Files). That
folder is backed by your own storage provider — e.g. iCloud Drive, Google Drive,
Dropbox, OneDrive, Nextcloud, or local storage. The account is yours, not ours,
and we ship no storage-provider SDKs. Your chosen provider stores only ciphertext and can see file
names, sizes, and timestamps — never the contents.
- Whether it is stored temporarily or permanently. The encrypted blobs persist
in your chosen folder until they are deleted or compacted. The app periodically writes a fresh
encrypted snapshot and deletes older incremental files to keep the folder small.
- Which server or cloud handles it. No SmartHarmony AI server is involved in
sync. The only party that stores anything is the cloud provider you selected, under your
account and their privacy policy.
- What identifiers are created. A random household ID, a
per-device random ID, and a small key-verification value. These are random and pseudonymous — they
contain no name, email, or contact detail, and they are not sent to us.
- The encryption key. A random 256-bit household key is
generated on one device and shared to the other device by scanning a QR code
screen-to-camera (or, for remote setup, a one-time spoken passphrase). The key
never travels over any network or through any cloud, and we never receive it. It
is stored in the device secure enclave alongside the database key.
- What metadata is visible to SmartHarmony AI. None. Because
sync flows through your own storage provider and everything is encrypted with a key only your
household holds, we cannot see your data, file names, sizes, or that a sync even occurred.
- How a caregiver disconnects and deletes synced data. To remove a caregiver,
rotate the household key in the app — the app writes a fresh snapshot under the
new key and deletes the old blobs, so previously shared files become unreadable to the removed
device. Any participant can also disable sync, and can delete the shared folder from their own
storage provider. "Delete all my data" (below) removes the local database and keys on that phone.
- Is this an account? There is no LittleRhythm account — no
email, password, or profile on our servers. A "household" is only a shared key held on your
devices, not an identity we hold.
Sync runs strictly after your entry is saved locally and never blocks logging; if the folder is
unreachable, entries stay "pending" and sync later. Delivery is near-real-time
(seconds to minutes, depending on your storage provider).
4. Subscriptions
Purchases are processed by Apple and Google. We use
RevenueCat to confirm your subscription status; it receives a randomly-generated
pseudonymous identifier — the same random install identifier described in section 9 — and your
purchase details — not your care logs.
4a. Free trial and fraud prevention — app version 1.1.7 and later
From version 1.1.7 every new install gets a 14-day free trial with no card and no store purchase.
So that one device cannot restart the trial by reinstalling, the app keeps a random trial
ID (not derived from your device, account or baby) in the iOS Keychain or Android Block
Store, and checks with our server that the install is genuine:
- What our server receives: the random trial ID, the trial start time, and a
device-integrity check — Apple DeviceCheck on iOS or Play Integrity on Android.
Apple stores two bits per device for us; neither is a device identifier we can read.
- What it is used for: granting the trial once and fraud prevention. We store only
a one-way hash of the trial ID with the start time. No care logs, names, dates of birth,
measurements or advertising ID are involved.
- Retention: the ledger entry is kept while it can still prevent a repeat trial
(up to 400 days); on iOS the Keychain entry can outlive the app by design, which is how a reinstall is recognised. Delete all my data does not remove this random ID, because doing so would let a trial restart; it contains nothing about you, and you can ask us to delete the server-side entry by contacting us.
4a. Free trial and fraud prevention — app version 1.1.7 and later
From version 1.1.7 every new install gets a 14-day free trial with no card and no store purchase.
So that one device cannot restart the trial by reinstalling, the app keeps a random trial
ID (not derived from your device, account or baby) in the iOS Keychain or Android Block
Store, and checks with our server that the install is genuine:
- What our server receives: the random trial ID, the trial start time, and a
device-integrity check — Apple DeviceCheck on iOS or Play Integrity on Android.
Apple stores two bits per device for us; neither is a device identifier we can read.
- What it is used for: granting the trial once and fraud prevention. We store only
a one-way hash of the trial ID with the start time. No care logs, names, dates of birth,
measurements or advertising ID are involved.
- Retention: the ledger entry is kept while it can still prevent a repeat trial
(up to 400 days); on iOS the Keychain entry can outlive the app by design, which is how a reinstall is recognised. Delete all my data does not remove this random ID, because doing so would let a trial restart; it contains nothing about you, and you can ask us to delete the server-side entry by contacting us.
5. Crash reporting
The app always sends crash and error reports, with all personal information removed, so we can
fix bugs. They are not optional, because they contain nothing about you or your child. These go to our own self-hosted GlitchTip instance
— not to a third-party crash-reporting service. Every event is rebuilt from an allow-list before it
leaves the device, so it carries a message, a file basename, the app and OS version, and nothing about
you or your child.
6. Contacting support (Report a problem)
Nothing is sent unless you fill in the form and tap send. When you do, we receive:
- Your description — the words you type.
- An optional reply email — only if you supply one. It is never pre-filled and
never read from your device's accounts. Without it we simply cannot reply.
- Optional screenshots — off by default, never captured automatically. You attach
them yourself, preview them, and can remove any before sending. Maximum five.
- Your device model, OS version and app version, so we can reproduce the problem.
We do not ask for your name. The form has no name field: a support reply needs a
reply channel, not a legal name — and on a child-care product the name a parent types is as often the
child's as their own. Your care logs are never attached.
A screenshot of the app may show your baby's name, dates or health notes. That is why they are
optional, off by default, and previewed before sending — please check each one first.
7. Update / feature manifest
The app fetches a small, read-only, signed configuration file over HTTPS (via Cloudflare) to
enable or disable features and deliver content updates. It contains no personal data
and sends none about you.
8. Ad measurement (Tenjin)
We advertise LittleRhythm in other apps. To learn which of our ads led to an install and
whether those ads pay for themselves, the app includes the Tenjin measurement SDK.
LittleRhythm shows no ads and contains no ad-serving or ad-network SDK.
- What Tenjin receives from the app: an install/app-open signal; the store's
install referrer (Android) or Apple's privacy-preserving SKAdNetwork / AdAttributionKit signal
(iOS); a device identifier Tenjin requires to count an install — the advertising ID
on Android, and on iOS the app-vendor identifier (IDFV), which is not shared with other
companies' apps; technical device details (model, OS
version, language, country, time zone, app version, IP address); a random Tenjin installation
ID; and three app events, onboarding completed, subscription screen viewed and, from
version 1.1.4, first care entry saved (that one happened, never what was logged).
- What Tenjin receives from RevenueCat: subscription lifecycle events for that
installation ID (trial started, converted, renewed, cancelled, expired, billing issue) with product
and price, so we can compare ad spend with subscription revenue.
- What it never receives: your child's name, age, birth date, photos, or any care
log, health note, symptom, medication, or feeding record; your name or email; your store account.
- iOS: LittleRhythm never asks to track you and never uses your iPhone's
advertising identifier (IDFA). Your install is not matched to an ad you saw in another app;
we learn how our ads perform only in aggregate, through Apple's privacy-preserving
SKAdNetwork reports, which contain no identifier for you.
- Android: you can reset or delete your advertising ID at any time in Android
Settings → Privacy → Ads.
- Your "Ad measurement" choice (gear (More) → Privacy & data → Privacy, off by
default) controls whether Tenjin and Google may use this install for ad personalisation and as ad
user data (the EU Digital Markets Act consent signals), and whether optional extra device
identifiers are sent. Counting which ad brought you here happens either way, without any child
data.
9. Usage analytics (Google Analytics for Firebase) — app version 1.1.4 and later
To understand how LittleRhythm is used and improve it, and to measure our own advertising, the
app includes Google Analytics for Firebase, provided by Google.
- What the app sends: a random identifier for this installation of the app
(the Analytics app-instance ID); app-usage events such as first open, onboarding steps completed
(the step's name, never your answers), the first care entry saved (its kind — sleep, feeding or
diaper — never what was logged), the subscription screen viewed or closed, and whether a restore
succeeded; and technical details (device model, OS and app version, language, time zone).
- Approximate location: Google derives an approximate location (country,
region, city) from your device's IP address. We never collect precise location.
- Subscription events: our subscription provider RevenueCat sends Google
Analytics your subscription events (trial started, purchase, renewal, cancellation, expiration,
billing issue, plan change) with product and price, linked to the same app-instance ID.
- What it never receives: your child's name, age, birth date, photos, or any care
log, health note, symptom, medication, or feeding record; your name or email; your store account.
We do not set a user ID, and we do not turn on Google signals or ad personalisation.
- Advertising: we may use these measurements to see which of our own ads lead to
use of the app (Google Ads conversion measurement). Whether Google may use this install for ad
personalisation follows your separate Ad measurement choice (section 8), which is off by
default. On iOS no advertising identifier (IDFA) is collected.
- Your choice: Product analytics (gear (More) → Privacy & data →
Privacy) is on by default. Switching it off stops the app from sending further
analytics events and stops RevenueCat from sending further subscription events to Google
Analytics. It does not affect your subscription, and it does not change ad measurement (section 8).
- Deletion: Delete all my data gives the app a new, unconnected
app-instance ID. Analytics data already sent is kept by Google for up to 14 months and then
deleted; to have it deleted sooner, contact us and we will request deletion from Google.
9a. Install count and campaign attribution (our own, anonymous) — app version 1.1.7 and later
To know how many people install and keep using LittleRhythm — without relying on advertising
companies for that number — the app keeps an anonymous install identifier: a random
code generated on your phone the first time the app opens. It is not derived from your phone, your
advertising ID or any account, and it is stored inside the app, so deleting the app deletes
it; reinstalling creates a new one. It is the same random code RevenueCat uses for your
subscription (section 4).
- What the app sends to our own server (never to a third party): the identifier;
the app version and build; phone or tablet; iOS/Android and its major version number; the app's
language; whether this is a test or review installation; the day the app was opened (at most once
a day); and two milestones — that onboarding was completed and that the first feed, sleep, diaper
or pumping entry was logged. Only that it happened, never what was logged.
- Country: our server records the two-letter country our network provider
(Cloudflare) derives from the connection. Your IP address is not stored and not passed on.
- Never included: your child's data or any care log, your name or email, your
advertising ID (IDFA / GAID), the iOS vendor ID (IDFV), your device model, or your IP address.
- Android, only if you turn on "Ad measurement": the random Tenjin installation
ID (section 8) is attached to this record so we can see which of our campaigns brought installs.
Turning the switch off removes it. On iPhone this link is never made.
- Deletion: Delete all my data also erases this record: its activity and
any Tenjin link are deleted, and only an anonymous marker (the random identifier, the day it was
first seen, and whether it was a test install) is kept so that historical install totals do not
change. After that, the app sends nothing more for this installation.
- Free trial and subscription (app version 1.1.7 and later): the free trial starting
(section 4a) and whether the subscription later became paid are linked to the same random identifier,
so we can tell which campaigns lead to a trial and to a subscription. This uses the same identifier, the
subscription provider RevenueCat, and no new advertising identifier. On iPhone the campaign is read
from Apple's own privacy-preserving Apple Ads attribution token held by RevenueCat; we do not receive it
from the app.
Notifications
Reminders and nudges are scheduled locally on your device. LittleRhythm does not
use remote push notifications and does not create a push token or send your device an
identifier for messaging.
Who processes data for us
We share personal data only with the providers below, only for the purpose shown, and only when
the related feature is used. Each handles data under its own privacy policy and only on our
instructions.
| Provider | What is shared | Purpose |
|---|
| Apple, Google (app stores) | Purchase and subscription details | Process purchases and deliver the app |
| RevenueCat | Pseudonymous ID + purchase details (no care logs) | Confirm subscription entitlement |
| Anthropic (Claude), via our Cloudflare-delivered broker | Pseudonymized numeric summaries (AI insights) or a transcript (voice cloud assist) — no names or identifiers | Phrase insights / interpret a spoken command; zero retention, no model training |
| Apple / Google speech recognizer (OS) | Your spoken audio for the current command | Convert speech to text; may be on-device or on the OS provider |
| Our self-hosted GlitchTip (not a third party) | Crash and error reports with all personal information removed | Diagnose and fix crashes |
| Our self-hosted Chatwoot support desk (not a third party) | What you type in Report a problem: your description, an optional reply email, and any screenshots you choose to attach — never a name, never your care logs | Answer your support request |
| Tenjin | Advertising ID (Android); IDFV — never the IDFA (iOS); install referrer / SKAdNetwork signal, device and app technical details, IP address, a random installation ID, two app events, and subscription events from RevenueCat — never care logs or child data | Measure which of our ads led to installs and subscriptions (ad measurement); no ads are shown in the app |
| Google (Google Analytics for Firebase), from app version 1.1.4 | Random app-instance ID, app-usage events, device and app technical details, IP-derived approximate location, and subscription events from RevenueCat — no care logs | Usage analytics and measuring our own advertising (section 9) |
| Our own operator console (not a third party) | The anonymous install record in section 9 — a random identifier, app/OS versions, language, country, open days and two milestones; never care logs or child data | Count installs and active use of the app |
| Cloudflare | Network requests for the broker and signed manifest (no care logs) | Secure delivery/CDN and proxy |
| Your chosen storage provider (caregiver sync) | End-to-end encrypted blobs only — we cannot read them | Store the encrypted sync folder in your own account |
What we do NOT do
- We do not show ads and include no ad-serving or ad-network SDK. We use one ad-measurement
SDK (Tenjin, section 8) to measure our own campaigns and, from version 1.1.4, Google Analytics for
Firebase (section 9) for usage analytics. LittleRhythm never asks to track you on iOS and never
uses the iPhone advertising identifier (IDFA). Other providers are used for
subscriptions, optional AI, crash reporting, and the features above — as listed.
- No precise location collection.
- No selling or renting of personal information.
- No collection of your care logs on our servers.
Children's information
LittleRhythm is intended for parents and caregivers (adults) to record
information about the children in their care. Any information about a child is entered by you and
stored on your device (and, if you enable caregiver sync, in your own encrypted
cloud folder). The app is not directed to children and does not knowingly collect personal
information directly from children. You control that information and can delete it at any time.
Your choices and controls
- Toggles in gear (More) → Privacy & data → Privacy: AI insights,
voice logging, caregiver sync, ad measurement and app-lock are off until you turn them on;
product analytics (from version 1.1.4) is on until you turn it off.
- Export your data to an encrypted file you own.
- Delete all my data — wipes the on-device database, timers, and profile, and
purges the encryption keys, which also renders any residual encrypted copies (including platform
backups and sync blobs written with the old key) permanently unreadable. It also erases the
anonymous install record on our server (section 9).
- Disconnect / rotate sync — remove a caregiver by rotating the household key,
disable sync, and delete the shared folder from your storage provider.
- Biometric app lock (Face ID / Touch ID / passcode) is available.
Data retention
| Data | Retention |
|---|
| On-device care logs | Until you delete them |
| AI-insight requests | Not retained by the AI provider (zero-retention configuration); not used for training |
| Voice audio | Not retained by us; transcription is transient and handled by the OS recognizer |
| Caregiver-sync blobs | Kept (encrypted) in your chosen folder until you delete/rotate; older increments are compacted away automatically |
| Crash and error reports | Retained on our own GlitchTip instance for up to 90 days, then deleted |
| Subscription records | Kept by Apple, Google, and RevenueCat per their policies for as long as needed to manage your entitlement |
| Usage analytics (Google Analytics for Firebase) | 14 months, then deleted by Google; deleted sooner on request |
| Ad-measurement data (Tenjin) | Kept by Tenjin on our behalf for as long as needed to report campaign results, under Tenjin's data-retention terms; deleted on request to support@smartharmonyai.com |
| Install record (section 9) | Days the app was opened: 25 months. The record itself: deleted 25 months after the app was last opened. After Delete all my data: only the anonymous marker described in section 9 |
| Support correspondence | Kept for up to 24 months after your request is resolved, then deleted |
| Signed manifest / broker requests | No personal data; broker requests are not stored after the response is returned |
Security
- Encryption at rest on the device: the care-log database is encrypted with
SQLCipher, keyed from a secret held in the device secure enclave (Keychain / Keystore) and
available only when the device is unlocked.
- Encryption in transit (HTTPS/TLS) for the optional network features.
- End-to-end encryption for caregiver sync (AES-256-GCM), with a key that never
leaves your household.
- Optional biometric / passcode app lock.
No method of storage or transmission is completely secure, but we design LittleRhythm to keep
your data on your devices and to minimize and protect anything that leaves them.
International users
Because your data stays on your devices (and, for sync, in the storage account you choose), it
resides wherever those are. The optional AI feature processes pseudonymized requests through our
broker and Anthropic's infrastructure; subscription processing is handled by Apple, Google, and
RevenueCat in their respective regions. Usage analytics (section 9) is processed by Google, including
in the United States.
Changes to this policy
If we change how the app handles data, we'll update this page and its effective date. Material
changes will be surfaced in the app.
Contact
Questions or requests (including data-deletion help):
support@smartharmonyai.com.