Privacy Policy

Effective date: August 26, 2026

Made Today is operated by Adam LaFave (“Made Today,” “we,” “us,” or “our”). This Privacy Policy explains how Made Today handles information when you use the Made Today iPhone app, widget, support pages, and related services (collectively, the “Service”).

Made Today is built for parents, guardians, educators, and other adult caregivers. Full-resolution artwork remains on your device or in the storage account you choose. Made Today’s backend stores the organizing information needed to make that artwork searchable and available to authorized archive members; it does not store the full-resolution artwork files.

1. Information we process

We process the following categories of information:

• Account information. Your Supabase account identifier, email address, sign-in provider, authentication and session information, and account creation or update times. If you use Sign in with Apple and choose Hide My Email, we receive your Apple private relay address instead of your personal address.
• Family and archive information. Child names, aliases, grade, color choice, and archive status; archive ownership, member email addresses, roles, invitations, and permission status; and archive organization preferences.
• Artwork metadata. Titles, dates, notes or tags, favorites, recognized text, grouping and version information, content checksums, on-device-derived perceptual hashes and feature fingerprints used to detect possible duplicates, storage provider, file and folder references, and information used to find or verify a managed file. This metadata is linked to your account and visible to other authorized members of the same archive according to their role.
• Artwork files and device input. Scans, selected photos, short videos, recorded sound, and generated video poster images. These files may contain a child’s artwork, handwriting, image, voice, or other personal details. They begin in private app storage on your device and are saved to the local, iCloud Drive, Dropbox, or Google Drive location you select. Full-resolution media is not uploaded to Made Today’s Supabase backend or Sentry.
• Storage connection information. The provider and folder you connect, provider file or folder identifiers, connection and health status, and encrypted Dropbox or Google Drive OAuth credentials. Provider access is used only to perform storage actions you request or to maintain the archive connection. iCloud access is managed by Apple and your device.
• Invitations and sharing. The recipient email address you enter for an invitation, a protected lookup value, invitation status and expiration, delivery status, membership role, and content-free audit records of archive and permission changes. An invitee’s email is encrypted for delivery. Active archive members can see the owner’s and other members’ email addresses and roles so they can understand who has access.
• Purchase information. StoreKit product and entitlement status, an account token that links an eligible purchase to your Made Today account, and Apple transaction identifiers, purchase environment, ownership type, purchase date, and revocation status. Apple processes payment details; Made Today does not receive your full payment-card information.
• Product analytics. Account-linked, content-free events such as onboarding completion, first and milestone saves, quota reached, paywall display, and purchase outcome. Event properties are limited to fixed categories and do not contain artwork, child names, recognized text, file names, paths, provider identifiers, or media.
• Operational diagnostics. Account-linked operation, outcome, broad error category, coarse duration range, storage-provider category, app version, build number, and iOS major version. Sentry may receive an account identifier, crash or hang stack trace, app and device state, and recent content-free operation breadcrumbs. Sentry is configured not to collect screenshots, view hierarchies, full-resolution media, child or artwork text, file paths, or automatic network request details. Service providers may process an IP address as part of ordinary network delivery or security logging.
• Support communications. The information you include when you contact support, such as your reply address, app and iOS versions, storage-provider category, approximate incident time, and message. Do not send passwords, sign-in codes, OAuth tokens, private offer codes, or child artwork unless we provide an appropriate secure method and specifically ask for it.

2. How information is collected

We receive information:

• directly from you when you create an account, add family or artwork details, connect storage, invite someone, change a setting, make a purchase, or contact support;
• from your device when you scan, record, import selected media, use the widget, or the app reports a content-free product or operational event;
• from Apple for authentication, iCloud access, and StoreKit entitlement verification;
• from Dropbox or Google when you authorize a connection and when the app performs a storage action you request; and
• from another user when that person invites you to or manages your role in a shared archive.

The app uses Apple’s out-of-process Photos picker, so it receives only the photos or videos you select. Camera and microphone access occurs only after you grant the relevant iOS permission and choose a capture feature.

3. On-device analysis

Made Today crops scans, recognizes text, suggests a child, suggests subject tags, detects possible duplicates, and creates video previews on your device. The full-resolution image, video, or audio is not sent to Made Today, Supabase, Sentry, or a third-party AI service for this analysis, and Made Today does not use your artwork or metadata to train machine-learning models.

If you choose to save recognized text, the resulting text becomes artwork metadata and syncs to Made Today’s backend and authorized archive members. You can turn recognized-text saving off in Settings before future saves and can edit or delete saved metadata in the app.

4. How we use information

We use information to:

• create and secure accounts, authenticate users, and keep sessions working;
• save, sync, organize, search, display, share, export, migrate, verify, and delete archive records and managed files as directed by authorized users;
• provide shared-archive roles, invitations, permission checks, and security audit history;
• connect to and operate the storage provider you choose;
• verify purchases, restore entitlements, apply the free artwork allowance, and provide eligible family-shared access;
• maintain the widget and a bounded local thumbnail cache;
• send sign-in, invitation, welcome, security, and service messages;
• diagnose failures, respond to support, prevent abuse, secure the Service, and comply with law; and
• understand activation, reliability, and purchase outcomes and improve the Service using content-free analytics.

We do not sell personal information, share it for cross-context behavioral advertising, serve third-party ads, create advertising profiles, or track you across other companies’ apps or websites.

5. When information is disclosed

We disclose information only as described below:

• Authorized archive members. Archive metadata, member email addresses and roles, and the managed artwork available through the connected storage folder are available to authorized members according to their role. Cloud-folder access is controlled separately by the relevant storage provider and the folder owner.
• Apple. Apple provides Sign in with Apple, iCloud Drive, device permissions, StoreKit, App Store distribution, and related platform services.
• Supabase and email delivery providers. Supabase hosts authentication, account and archive metadata, encrypted provider credentials, Edge Functions, analytics, and operational events. The configured email provider delivers sign-in, welcome, and invitation messages.
• Dropbox and Google. These providers store and process artwork files when you connect them. Made Today requests Google Drive access that can recognize files copied into the connected archive during migration, but uses that access only to create, read, copy, organize, move, verify, and delete managed files in the connected Made Today Archive folder. Made Today’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
• Sentry. Sentry processes the limited crash, hang, and diagnostic information described above.
• Legal, safety, and business needs. We may preserve or disclose information when reasonably necessary to comply with law or valid legal process; enforce terms; investigate fraud, abuse, or security incidents; protect users, the public, or the Service; or complete a merger, financing, reorganization, or sale. If personal information is transferred in a business transaction, the recipient must honor this Policy until it provides legally sufficient notice of a change.

Providers that process information for Made Today are required to protect it consistently with this Policy and applicable law and may use it only to provide their services to us. Storage providers also process files under the separate account and terms you maintain with them.

6. Storage and retention

We keep information only for as long as reasonably necessary for the purposes described above:

• Account, membership, archive, child, and artwork metadata is generally retained while the relevant account or archive remains active.
• Open invitations expire automatically. Invitation, delivery, operation, and audit records may remain with the archive for security, support, and permission history until the archive is deleted or the records are no longer reasonably needed.
• Encrypted Dropbox and Google Drive credentials are retained while the connection is active and are deleted when the connection or its archive is deleted. Disconnecting instructs the provider to revoke access where supported and removes the stored credential; the provider may take additional time to complete revocation.
• Raw operational events in Supabase are automatically deleted after 14 days. Content-free product analytics remain linked to the account until account deletion or an earlier scheduled deletion. Deidentified aggregate statistics may be retained longer.
• Sentry diagnostic events are retained for no more than 90 days. We may delete them sooner when they are no longer useful.
• Purchase and entitlement records are kept as needed to verify access, process revocations, prevent fraud, and meet legal, accounting, or App Store obligations.
• Support communications are retained only as long as reasonably needed to resolve the request, protect the Service, and maintain an appropriate support record.
• Local caches, temporary media, provider bookmarks, and widget thumbnails remain on the device until the app clears them, you sign out or delete the app, or iOS removes them.

Files kept by Apple, Dropbox, or Google—including backups or recoverable deleted items—are retained under that provider’s settings and policy. Made Today cannot delete those provider copies merely by deleting your Made Today account.

7. Your choices and deletion controls

You can:

• edit or delete child and artwork metadata in the app;
• delete individual managed artwork files through the app;
• turn name detection or recognized-text saving off for future analysis;
• choose or disconnect a storage provider and revoke provider access in that provider’s account settings;
• manage archive members, leave an archive, revoke invitations, or delete an archive if your role permits;
• sign out to remove the account’s local archive cache from that device; and
• use Settings → Delete Account and complete fresh authentication to delete your Made Today account.

An archive owner must first transfer ownership or delete each owned archive before deleting the owner account. Account deletion removes the account, memberships, account-linked metadata, encrypted credentials, product analytics, operational events, local cache, and widget data as applicable. It does not delete artwork files already stored locally, in iCloud Drive, Dropbox, or Google Drive. Delete those files separately if you no longer want them. Some minimal transaction, security, or legal records may be retained where required by law or no longer identify you.

8. Privacy rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information; to object to or restrict certain processing; or to withdraw consent where processing relies on consent. You may also have the right to appeal a denied request or complain to your local privacy regulator.

To make a request, use the Support & FAQ link in Made Today Settings or the developer contact on Made Today’s App Store product page. We may need to verify your identity and authority over an archive before acting. Authorized agents may submit requests where applicable law permits, subject to verification. We will not discriminate against you for exercising a privacy right.

For residents of California, Made Today has not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months and does not use or disclose sensitive personal information to infer characteristics. Because we do not track people across third-party services, browser or device “Do Not Track” signals do not change the Service’s behavior.

9. Legal bases for processing

Where applicable law requires a legal basis, we process information:

• to perform our contract with you and provide features you request;
• with your consent, such as when you grant a device permission or authorize a storage provider;
• for legitimate interests in securing, supporting, diagnosing, and improving a privacy-preserving service, balanced against your rights; and
• to comply with legal obligations and protect legal rights.

You may withdraw a device or provider permission through iOS or the provider. Withdrawal does not affect processing already completed and may prevent the related feature from working.

10. Children’s privacy

Made Today is a general-audience service for adults and does not permit children to create accounts or use the Service independently. An adult may choose to enter information about a child and is responsible for having the authority to do so and to share it with other archive members and the selected storage provider.

We do not knowingly collect personal information online directly from a child under 13. If you believe a child created an account or submitted information directly without appropriate adult involvement, contact us so we can investigate and delete it. Adults can review, correct, or delete child-related metadata through the app or a verified privacy request.

11. Security

Made Today uses reasonable administrative and technical safeguards, including authenticated access, role-based and row-level authorization, encryption in transit, encrypted server-side provider credentials, short-lived OAuth state, and limited client permissions. No system can be guaranteed completely secure. Protect your device, email account, Apple Account, storage accounts, and invitation codes, and notify us through Support if you suspect unauthorized access.

12. International processing

Made Today is operated from the United States. Apple, Supabase, the configured email provider, Sentry, Dropbox, Google, and their subprocessors may process information in the United States and other countries where privacy laws differ from those where you live. Where required, we and our providers rely on legally recognized transfer safeguards.

13. Changes and contact

We may update this Policy when the Service or legal requirements change. We will post the revised Policy, update its effective date, and provide additional in-app or email notice when required. If a change requires consent, we will request it before applying the change to information in that manner.

Questions, complaints, and privacy requests may be sent through the Support & FAQ link in Made Today Settings or through the developer contact shown on Made Today’s App Store product page.