Privacy policy
Last updated: 27 September 2026
Tiny Sprouts ("we", "us", "our") makes everyday clothes for babies and children and sells them through tinysprouts.in and the Tiny Sprouts mobile app for iPhone and Android. This policy explains what personal data we collect, why, who we share it with, and the choices you have.
We are Tiny Sprouts Creations, registered at No. 54, 1st Main, KGS Layout, Vijaynagar Extension, Bangalore 560040, Karnataka, India. We are the data fiduciary for the personal data described here under India's Digital Personal Data Protection Act, 2023.
1. Who the app is for
The Tiny Sprouts app is for parents and guardians aged 18 or over. It is not directed at children, and we do not knowingly collect personal data from a child directly. Where a parent adds a child's details to their account, the parent provides that data on the child's behalf and is responsible for it.
2. What we collect and why
Your account
What: name, email address, and mobile number. If you sign in with Google or Apple, we receive your name and email from that provider, and Apple may give us a relay address instead of your real one.
Why: to create your account, sign you in, send order updates, and let you reorder.
Where it lives: Shopify's customer account system. See section 4.
Your children's details
What: a first name or nickname for each child and the size band you choose for them, for example 6 to 12 months or 2 to 3 years.
Why: so the app can show you the right sizes and remember them between visits.
What we do not ask for: a child's date of birth, photograph, school, or any other detail. We ask for the minimum needed to pick a size. You can delete a child's entry at any time from the Account screen.
Orders, delivery and payment
What: delivery address, order contents, order history, and GST invoice details if you request one.
Why: to deliver what you bought, handle returns, and meet our tax obligations.
Payment: we never see or store your card, UPI, or bank details. Checkout, including payment, is run by Shopify and its payment providers. Their handling of payment data is covered by their own policies.
Design files you upload
What: the image or PDF you choose from your phone when you order a Create Your Own item, plus any notes you write with it.
Why: to print it on the garment you ordered. The file is attached to your order and sent to our print team so they can prepare a proof.
Access to your photos: when you pick a file, your phone shows its own file or photo picker. We receive only the file you select, never your whole photo library.
Retention: we keep uploaded design files for 90 days after the order is delivered, in case of a reprint or return, and then delete them. We do not use your designs for anything other than your order, and we never display them publicly.
Device and diagnostic data
What: if the app crashes, Apple or Google may pass us a crash report, if your phone is set to share them, containing the device model, operating system version, app version, and a technical description of the failure. We use no other crash reporting tool. The app does not collect your location or contacts. The app and our website use advertising and measurement tools from Meta and Google, which are described in section 5.
Why: to find and fix bugs.
Support messages
What: anything you send us by email, WhatsApp, or through the app's support links.
Why: to answer you.
3. What we do not do
- We do not sell your personal data.
- We do not share your personal data with data brokers.
- We do not use your children's details for anything except sizing.
- We do not use your uploaded design files for anything except your order.
4. Who we share data with
We share personal data only with providers that help us run the store and the app, and only what each one needs.
| Provider | What they do for us | What they receive |
|---|---|---|
| Shopify | Runs the store, accounts, orders and checkout | Account, order and delivery details |
| Shopify's payment providers | Process payment | Payment details, handled by them directly |
| Google and Apple | Sign in, if you choose to use them | Confirmation that you signed in |
| Shopify (file library) | Stores your uploaded design files | The design file and your order number |
| Apple and Google | Pass on crash reports from their app stores, when your phone is set to share them | Diagnostic data described in section 2 |
| Delivery partners | Deliver your order | Name, address and phone number |
| Google and Meta | Advertising and measurement, as described in section 5 | Website activity, and your email address or phone number in encrypted (hashed) form |
| Meta | Measures our app advertising, as described in section 5 | App installs, opens and shopping activity, device details, and your phone's advertising identifier where you allow it |
Some of these providers store data outside India. Where they do, we rely on their contractual commitments to protect it to a standard equivalent to Indian law.
5. Advertising
We advertise Tiny Sprouts on Google and Meta (Facebook and Instagram). To do this:
- Our website uses measurement tags from Google (Google Ads and Google Analytics) and Meta. These record the pages you view, items you add to your basket, and purchases you complete on tinysprouts.in, and share those events with those companies so that we can measure our advertising and show you relevant ads. This means your activity on our website may be linked to your activity on their services.
- Our app includes Meta's software development kit (SDK). It tells Meta when the app is installed and opened, and when you view a product, add it to your cart, start checkout, or complete a purchase, together with the product, price and quantity. It also sends basic device details, such as the device model, operating system and app version, and your phone's advertising identifier where you allow it. It never sends your name, email address, delivery address, your children's details, or your design files. Meta uses this to tell us which ads led to app installs and sales, and to show you relevant ads, so your activity in our app may be linked to your activity on Meta's services.
- On iPhone, the app asks your permission before it tracks you. If you choose Ask App Not to Track, Meta does not receive your advertising identifier and measures our ads only in aggregate, through Apple's privacy-preserving tools. On Android, the app uses your phone's advertising ID, which you can reset or delete at any time in your phone's settings.
- We may share your email address or phone number with Google or Meta in an encrypted (hashed) form, so that they can recognise you and show you our ads, or avoid showing you offers meant for new customers. Google calls this Customer Match. These companies may not use the details we share for any other purpose.
- If you gave us your contact details at an exhibition, event, or sign-up form, we may use them in the same way.
You can ask us to stop at any time by emailing support@tinysprout.in, and we will remove your details from these audiences. You can also turn off ad personalisation in your Google account at myadcenter.google.com, and in your Meta account settings. To stop app tracking, on iPhone turn off tracking for Tiny Sprouts in Settings, Privacy & Security, Tracking; on Android, delete or reset your advertising ID in your phone's Google or privacy settings, under Ads.
6. How long we keep data
| Data | Kept for |
|---|---|
| Account and children's details | Until you delete your account |
| Orders and invoices | 8 years, as required by Indian tax law |
| Uploaded design files | 90 days after delivery |
| Crash reports | 90 days |
| App advertising events sent to Meta | We do not keep them. Meta keeps them under its own data policy |
| Support messages | 2 years |
7. Your rights and choices
You can:
- See and correct your data from the Account screen in the app or by emailing us.
- Delete your account from the Account screen in the app, under Settings, or by emailing us. Deleting your account removes your profile and children's details. Order records are kept for the period in section 6 because tax law requires it, but they are no longer linked to a usable account.
- Withdraw consent for anything optional, such as marketing emails, at any time.
- Complain to us using the contact below, and if you are not satisfied, to the Data Protection Board of India.
We respond to requests within 30 days.
8. Security
Data travels between the app and our systems over encrypted connections. Access to customer data is limited to staff who need it to fulfil orders or provide support. No system is perfectly secure, so if we learn of a breach affecting your data we will tell you and the authorities as the law requires.
9. Changes to this policy
If we change this policy in a way that matters, we will show a notice in the app and update the date at the top.
10. Contact
Grievance Officer: Kashyap Hebbar K
Email: support@tinysprout.in
Post: No. 54, 1st Main, KGS Layout, Vijaynagar Extension, Bangalore 560040, Karnataka
Indian law requires us to name a Grievance Officer for privacy complaints. We will acknowledge your complaint within 48 hours and resolve it within 30 days.