Privacy Policy

Overview

Tender Years (“we,” “us,” or “our”) is an app for parents of young children. We take your privacy seriously and designed the app to collect only what’s needed to make it work. This policy explains what data we collect, why, and how we protect it.

Throughout this policy, “household” means the shared workspace you create inside Tender Years when you sign up — the account-level data container that holds your routines, tasks, and notes, and that you can invite a partner into. It refers to a Tender Years account, not the physical people who live with you.

Data we collect

When you use Tender Years, we collect the following:

Account information. Your email address and display name, provided when you sign up. We use passwordless magic-link authentication—we never store a password for your account.

App data. The routines, schedules, events, and notes you create inside your household. This is the core content you and your partner build together in the app.

Your kids’ ages. During setup we may ask roughly how old your kids are (under 1, 1, 2, 3, 4, or 5+) so we can suggest things that fit this stage. We ask for ages only, never birthdates.

Partner connection. When you invite a partner to your household, we store the link between your two accounts so you can share the same view.

Things you ask us to organize. When you paste a list, type or send a quick capture, or share a screenshot, we process it to turn it into tasks, open questions, and upcoming events, and we save the results to your household. See “AI and how we use it” below for what we send to be processed and what we keep.

Trying the app without an account

You can paste a brain dump and see it organized before creating an account. The paste briefly travels through our classifier (see below) to do the organizing. The text and the organized result are then stored in your own browser (in localStorage) until you complete email sign-up, at which point the items are saved into your new household. If you don’t complete sign-up, this browser-side draft is dropped automatically after one hour.

If you choose to hold your items while you sign in, we also keep a copy of the organized items (never the original paste) on our servers, together with the email address you entered, so they survive switching browsers or devices. The items are cleared from that copy once they’re saved into your household, and if you don’t finish signing in within an hour, we stop using them.

Likewise, if you answer setup questions (like your kids’ ages or who handles which routines) before creating an account, we hold those answers with your email address so they can be applied when you sign in. They’re deleted once they’re applied, and if you don’t sign in within seven days, we stop using them. To have them deleted sooner, email us.

AI and how we use it

Some features use a large language model to do the sorting and thinking you ask for: turning a brain dump, a quick capture, or a screenshot into tasks and events; looking over what you’re holding and suggesting what to tend to next; helping you think through something you’re stuck on; and helping you plan around a change to your week. The model only organizes and suggests. Everything it produces stays yours to edit, dismiss, or delete.

Your daily and weekly views, your routines, and syncing with your partner run without a language model. If you’d rather not send anything to one, you can leave the features that use it alone and the rest of the app still works.

When you do use one of those features:

What we send. The content you’ve asked about: the text you typed or pasted, the screenshot you shared, or the items being organized (their titles, dates, notes, and tags). We also send the context needed to make sense of it, which can include the current date, the first names of the people in your household, your children’s ages, and the parts of your routines and schedule the request is about, along with a per-request account identifier. We don’t send your email address, your contacts, or your location.

Where it goes. Anthropic, the maker of Claude. Anthropic acts as a data processor for us. Per Anthropic’s API terms, requests sent through their API are not used to train their models. For full processor details see Anthropic’s privacy and trust documentation.

What we keep. The results you keep: the tasks, events, and next steps that end up in your household. We don’t keep the original words of what you type, paste, or send, the screenshots you share, or the back-and-forth while you plan or think something through. For quick captures (including through Siri or a text message), we keep a record of what each capture did, like what kind of item it became and whether it worked, so we can find and fix mistakes, but not what it said. We also keep usage records (which feature ran and when, tied to your account so we can apply rate limits) to manage cost.

Why we use AI. The whole point is to take something messy off your head and turn it into something organized with a clear next step.

How we use your data

We use your data to run the app: showing you and your partner the same weekly view, syncing changes in real time, and enabling features like the weekly planning ritual. We use your email address for the things the app actually needs to send you — the code that signs you in, an invite you sent to your partner, a welcome note when you first sign up, and at most one quiet check-in if you haven’t been back in a couple of days. When you create an account, we also add you to our newsletter for occasional product updates; every newsletter email includes an unsubscribe link, and you can unsubscribe at any time.

Third-party services

We use a small number of trusted services to run Tender Years:

Supabase hosts our database and handles authentication. Your data is stored in a Postgres database with row-level security policies that ensure you can only access your own household’s data. Supabase’s infrastructure runs on AWS.

Plausible Analytics provides privacy-friendly, cookieless website analytics. Plausible does not use cookies, does not collect personal data, and is compliant with GDPR, CCPA, and PECR. We use it to understand aggregate usage patterns (page views, feature adoption) without tracking individual users.

Anthropic processes what you ask us to organize or think through, as described in “AI and how we use it” above. Anthropic acts as a data processor; under their API terms, requests are not used to train their models.

Cloudflare Turnstile protects the entry point you can use without an account from automated abuse. Cloudflare receives signals from your browser (IP address, browser environment, behavioral timing) to decide whether you’re a person; we do not receive these signals. Turnstile only runs on the surface that’s usable without an account.

Sentry captures error reports so we can find and fix bugs. Error reports include technical context (browser type, page URL) and basic metadata about what broke (e.g., the length of the text you were sorting, never the content). We never send the actual text you typed or pasted to Sentry.

Resend delivers the emails the app needs to send you — your sign-in code, partner invites, a one-time welcome, and at most one quiet re-engagement check-in if you haven’t been back. Resend processes your email address to deliver these messages.

Buttondown manages our newsletter for product updates. When you create a Tender Years account, we share your email address with Buttondown so we can send you occasional updates about new features and what we’re working on. Every email includes an unsubscribe link, and you can unsubscribe at any time without affecting your Tender Years account.

An assistant you connect. In Settings you can create a read-only key for an assistant you already use (for example Muse). Each time that assistant asks, Tender Years answers with your household data, which then sits with that assistant’s provider under their terms, not ours. Nothing is sent unless the assistant asks. Keys expire after 90 days, and you can revoke one at any time in Settings.

Cookies and browser storage

Tender Years uses only essential cookies required for authentication (keeping you logged in). We do not use advertising cookies, tracking cookies, or any third-party cookies. Plausible Analytics is fully cookieless.

When you try the app without an account, your draft items are stored in your browser’s localStorage so they can be carried into your new household if you sign up. This draft is dropped automatically after one hour, or when you complete sign-up.

Cloudflare Turnstile (active on the surface you can use without an account) may set a short-lived clearance cookie on your browser as part of its bot-detection process.

Abuse prevention

Because AI-backed features cost real money for every request, we apply rate limits and bot checks on the endpoints that use them. This is to protect the service (and the price of running it for everyone), not to track you. We do not build profiles of users for advertising or any other purpose.

Data security

All data is transmitted over HTTPS. Our database uses row-level security to ensure users can only access their own household’s data. Authentication uses secure, time-limited magic links—no passwords are stored.

Data retention

We retain your data for as long as your account is active. To delete your account, email us at hello@thetenderyears.com and we’ll take care of it.

What deletion removes. Your account, your profile, your email address, and the other personal information tied to your account. If you’re the only member of your household, we also delete the household and everything in it.

What stays with your household. Household content is shared. If others are still in your household, the routines, tasks, and notes you added stay with them, because they’re part of the household’s shared record too. Delete anything you want gone before you leave, or tell us what to remove.

What deletion can’t recall. Copies that already left Tender Years: a calendar app that synced your feed, an assistant you connected, or a link someone opened. Deleted data may also remain in routine database backups for a limited time, until they’re overwritten. Anonymized, aggregate analytics data (via Plausible) may be retained indefinitely, as it can’t be linked back to you.

Children’s privacy

Tender Years is designed for parents and caregivers, not for children. We do not knowingly collect personal information directly from children. Parents may include their child’s name in routine names, events, or notes. This information is stored securely and is visible to the members of your household and to anyone you choose to share it with, such as through a calendar feed or an assistant you connect. It is also processed by the service providers described above to run the app. You can remove it at any time by editing or deleting the content, or by contacting us.

Your rights

You can request access to, correction of, or deletion of your personal data at any time by emailing us. If you’re on the waitlist mailing list, every email includes an unsubscribe link.

We don’t sell your data

We do not sell, rent, or share your personal information with third parties for marketing purposes. The third-party services listed above are used solely to operate and improve Tender Years.

Changes to this policy

If we make meaningful changes to this policy, we’ll update the date at the top and, where appropriate, notify you by email. Continued use of Tender Years after changes constitutes acceptance of the updated policy.

Contact

Questions about this policy or your data? Reach us at hello@thetenderyears.com.