Privacy Policy
Last updated: September 2026
LittleFinds helps adults and parents discover and share kid-friendly public places so families can find practical details that ordinary maps often miss. This Privacy Policy explains what information we collect, why we collect it, who we share it with, and the choices you have.
When we say LittleFinds, we, us, or our, we mean the LittleFinds app and the services that support it. When we say you, we mean the person using the app.
1. Who we are
Data controller: Evert Martin and Bastiaan Mahieu, Belgium. Contact: hello@littlefinds.app
2. Data we collect
• Account: identity from Apple or Google Sign-In (such as a unique ID, email if provided, and name if you share it), the display name and optional profile photo you set in the app, and the time you accept these Terms and this Privacy Policy.
• Public content you create: places you add (including name, category, place types, amenities, description, website, phone, address, and map coordinates), reviews and ratings, amenities you attribute, and photos you upload. These are visible to other users and may appear on https://littlefinds.app place-share pages (name, description, city, coordinates, and cover photo).
• Private to your account: places you save, Likes you give, your activity notification inbox and notification preferences, optional discovery preferences (preferred recommended-age bands and amenities for filtering — not children’s real ages), your own raw visit-cost and recommended-age answers on reviews (not shown on review cards; the place shows a derived community summary), the private app-language authoring context stored with your reviews, and planned routes you explicitly save (origin, destination, optional destination label, stop names, categories and coordinates, the route polyline, and distance and duration). Saved planned routes are private to your account and are not shared with other users. A copy of those snapshots may also be stored on your device in the app’s document directory, keyed by your account id, so the Trips & Itineraries list can show them offline.
• Location and search: approximate or precise foreground location when you allow it (to show nearby places); address and place search or geocoding queries sent through our backend to our map provider; place pins and addresses you confirm when adding or editing a place; and, after an explicit Plan a Trip, Add Stop, Remove stop, Change start, or Change destination action, your current origin, destination, and any stop coordinates sent to Mapbox Directions to draw or update the driving polyline. When Directions returns no destination street name, we may reverse-geocode only the destination pin through our authenticated geocoding gateway and keep village or city, never the full address label.
• Device and preferences: your signed-in session in platform secure storage (excluded from personal-data export), your general in-app language preference, and whether Use Personalised Discovery is on or off — all stored on the device only (not synced to your profile). When you create a review or change its text, the active app language is also stored privately as review authoring context; it does not verify the language of the review text.
• Reports: the report reason and optional details you submit about a place, review, or photo.
• Activity inbox: notifications about reviews and saves on places you created, and about Likes on your own reviews, stored so you can read them in the app.
• Notification preferences: whether you allow activity notifications and which types (new review, review updated, place saved, review likes).
• Subscriptions (iOS): when you subscribe to LittleFinds Premium, Apple processes payment and RevenueCat validates your entitlement and links it to your signed-in account id. We do not receive your full payment card details.
3. How we use data
We use your data to operate accounts, the map, search, listings, reviews, saves, Plan a Trip and saved itineraries, place-share pages, notifications you enable, report handling, product security, legal compliance, and optional LittleFinds Premium subscriptions on iOS. Recommended ages on places are community planning estimates, not children’s real ages or birth dates. Advertising is described below; we do not add a separate product-analytics SDK. We do not sell your personal data.
We process your data on the following legal bases. Operating your account, the map, places, reviews, saves, Plan a Trip and saved itineraries, share pages, and notifications you enable: performance of our contract with you (Article 6(1)(b) GDPR). Legal compliance and cooperation with law enforcement or regulatory authorities: compliance with a legal obligation (Article 6(1)(c)). Product security, fraud prevention, and activity notifications to place owners and review authors: our legitimate interests in maintaining a safe and functioning service (Article 6(1)(f)). Push notifications: your consent given when you grant notification permission; you may withdraw consent at any time in Settings or your device notification settings (Article 6(1)(a)). We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you.
4. Sharing
Other users can see your public profile identity with your contributions. Place owners receive activity about reviews and saves on places they created (including the actor’s display name and profile photo in the inbox and, when enabled, in push alerts). Review authors receive activity when someone likes their review (including that person’s display name and profile photo in the private inbox and, when enabled, in push alerts); identities of people who liked a review are not shown on public review surfaces.
We use service providers that process data on our instructions for authentication, database and file storage, map tiles, geocoding, and Directions, app runtime and push delivery (when you enable notifications), hosting for https://littlefinds.app place-share pages, translation when you tap Translate on a description or review while signed in, and iOS subscription management through RevenueCat and Apple’s App Store. When you subscribe on iOS, Apple is the merchant of record; RevenueCat receives purchase and entitlement status tied to your app user id. When you sign in we use Apple or Google. When you choose Get directions and pick an installed navigation app, only the destination coordinates are sent to that app (we do not send your origin in that handoff). Separately, when you use Plan a Trip, Add Stop, Remove stop, Change start, or Change destination, we call Mapbox Directions with your origin, destination, and any stop coordinates after those explicit taps; saved planned-route snapshots stay private to your account and are not shared with other users. Reports you submit (including your display name and the reported content) are reviewed by the LittleFinds founders for moderation. We may disclose your data where required by applicable law or in response to a lawful request from a law enforcement or government authority. We may also proactively disclose information to law enforcement or child protection organisations where we have a reasonable good-faith belief that disclosure is necessary to prevent harm, protect the safety of users or third parties, or where we have discovered content that may constitute a serious criminal offence, including child sexual abuse material.
5. Storage & retention
Account and content data are stored with our hosting providers while your account is active. If you delete your account, we remove or unlink personal data associated with it where the product supports that: reviews, saves, planned routes, inbox, notification preferences, and discovery preferences are removed; your name is unlinked from places and photo upload records; and we delete your profile photo and review photos from file storage where technically possible. The on-device planned-routes cache for that account is also wiped on account deletion. You may delete an individual saved planned route from Profile. Published places and place photos you added as the place owner may remain as community listings without your name, unless you removed those photos earlier through Edit Place. When you replace your profile photo, we delete the previous profile photo from file storage where technically possible. Reports already under founder review may remain. We may keep records where required by law. We may also retain records beyond our normal retention periods where required by a legal hold, court order, law enforcement request, or ongoing investigation.
Indicative retention periods: account profile, reviews, saves, planned routes, profile photos, and review photos are retained while your account is active and removed on account deletion where the product supports that; public place listings and owner place photos may remain as anonymised community content indefinitely; moderation records are retained for the period needed to handle and evidence the report outcome, and longer where a legal obligation applies; push notification tokens are removed on opt-out or account deletion; application backups may retain any of the above for up to 30 additional days.
6. Security
We use industry-standard measures to protect your personal data, including encrypted connections (TLS) for data in transit and access controls that restrict data access to authorised personnel and systems. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at hello@littlefinds.app.
7. Cookies and web tracking
For in-app advertising and privacy choices, see the advertising section below. The https://littlefinds.app place-share pages are hosted on Vercel and may set essential cookies for serving those pages; no advertising or cross-site tracking cookies are used. If you visit those pages your browser may send standard HTTP request data (such as IP address and browser type) to Vercel's infrastructure.
8. Your rights (GDPR)
If you are in the EEA/UK, you have the right to access your personal data (Art. 15), to rectify inaccurate data (Art. 16), to erasure / the right to be forgotten (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). From Settings in the Profile tab you can request a personal-data export ZIP (profile, places you created including listing details and your owner visit facts, your reviews with your own visit-fact answers, photos, Like counts, and private authoring-language context, Likes you gave, saves, planned routes you saved, photos you uploaded, reports and app feedback you submitted, activity inbox, notification preferences, discovery preferences, and LittleFinds Premium status, without session tokens, device language, push tokens, or other users’ private data), delete your account, or contact hello@littlefinds.app. When you request the export in the app, we first ask you to sign in again with Apple or Google to confirm it is you before the ZIP is prepared. After a successful in-app download you can request another in-app copy after 24 hours; we store the time of your last successful request to enforce this limit, and it is not part of the exported data. You can still request a copy sooner by emailing hello@littlefinds.app. For details of the supervisory authority, see section 12 below.
9. Children
LittleFinds is intended for parents and caregivers. We do not knowingly collect data from children under 13 (or the equivalent age in your country) without appropriate consent.
10. International transfers
Our providers may process data outside your country, including in the United States. For such transfers we rely on the European Commission's Standard Contractual Clauses (SCCs) as the primary safeguard, where an adequacy decision does not already apply. Our main processors include Supabase (database and file storage), Expo (app runtime and push delivery), Apple and Google (authentication), Mapbox (map tiles, geocoding, and Directions), and Google Cloud Translation (only when you use Translate).
11. Changes
We may update this policy. We will post the new version in the app and update the “Last updated” date.
12. Governing law
This policy is governed by Belgian law. LittleFinds is based in Belgium. For GDPR purposes, the lead supervisory authority is the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit, www.dataprotectionauthority.be). You may also lodge a complaint with the supervisory authority in your country of residence.
13. Contact
Privacy questions: hello@littlefinds.app
Advertising on iOS and Android
The app includes Google Mobile Ads (AdMob) and Google's User Messaging Platform (UMP). When advertising is enabled, free users may see clearly labelled ads in place search results. Premium is ad-free. Before requesting ads, we gather your advertising choices after onboarding when the main app opens (and, on iOS, Apple's App Tracking Transparency prompt when UMP presents it). Your choices determine the ad serving mode: personalized ads when you consent to the relevant purposes and allow tracking; non-personalized or limited ads when you refuse or withdraw some choices; and no IDFA in the request if you ask the app not to track. Refusing or withdrawing consent does not remove free search and does not mean ads never appear. We only request ads when Google's UMP reports that ads may be requested.
Ads are not anonymous even when limited or non-personalized: Google may process your IP address (including approximate location), device or app identifiers where allowed, ad interactions and diagnostic data for ad delivery, measurement and fraud prevention. UMP stores your privacy choices on your device. We do not send your LittleFinds account ID, precise location, searches, family preferences, reviews or photos as ad targeting inputs. Where GDPR applies, advertising processing depends on consent and the other legal bases disclosed in the UMP form (Article 6(1)(a) GDPR and related bases). You can change or withdraw your advertising choice through Settings → Preferences → Privacy & Ads Consent when available, without losing free search. Withdrawal changes future ad requests and serving mode; it does not undo earlier processing. Google's privacy policy applies to its processing: https://policies.google.com/privacy. Google may process data internationally; see section 10.