Arfy Privacy Policy
Arfy is a play app that helps kids aged 4 to 9 get curious about new foods. It is made by Pippa LLC. The account belongs to a parent or guardian, never to the child. This policy covers Arfy only. Pippa LLC's other apps, including Pippa, have their own documents, and those documents do not apply to Arfy.
The short version
- An adult creates the account. Children never sign up or sign in.
- We save your email, your child's first name or nickname, their meals, their food list, how each food visit went, and Arfy's outfit, so nothing is lost if you switch phones.
- Plate photos stay on your phone. Arfy does not send them to us or to anyone else.
- No AI in this version. No photo or text goes to OpenAI or any other AI service.
- No ads, no third-party analytics, no tracking, no push notifications and no in-app purchases.
- We never sell data.
- You can get a copy of the data, stop saving, or delete the account from Settings at any time.
1. What we save on our servers
| Data | What it includes | Why |
|---|---|---|
| Your account | Your email address and password. The password passes through our server to our sign-in provider, which stores it in protected form. We do not store it ourselves. | Creating and securing the account, sending sign-up and password reset codes |
| Your agreement | A record that you confirmed you are a parent or guardian aged 18 or older, a record that you agreed to the current policies, the policy versions, and the time | Showing that an adult set up the account and agreed. Our server stores no meals or foods without a current agreement. |
| Your child's profile | The first name or nickname you enter (24 characters at most; it does not have to be a real name), and a default age group field. This version of Arfy does not ask your child's age, so this field holds the same default (6 to 7) for every child. The profile also holds a setting that says photos are kept on the phone only. | Greeting your child and keeping their entries together |
| Meals | When the meal was, which meal it was (breakfast, lunch, dinner or snack), the food's name, whether it was skipped, how it was logged, and how their tummy felt after, if answered. No amounts, calories or weight. | Showing you and your child their meals |
| Food list and food visits | Food names, which group a food is in, how far a visit went (for example looked, smelled, touched or tasted), a liking word (like, maybe, not yet), and taste words your child picked (for example crunchy or sweet) | Showing progress at your child's own pace, in words and never in scores |
| Arfy's state | Arfy's name, the outfits and items owned and chosen, and whether setup was finished | Keeping Arfy the way your child left him |
| Technical records | Random record numbers, an account number, and the times records changed | Saving and syncing correctly |
When the app talks to our server, your IP address reaches Cloudflare and Amazon Web Services because that is how internet traffic works. Arfy's server code does not save it with your records.
2. What stays on your phone
- Plate photos. The camera opens only when someone uses it in the app. Photos are saved inside the app on that phone. Arfy has no feature that uploads them, so they do not move to a new phone.
- Boy or girl, if you choose to answer. You can skip it.
- Meal times and reminders. Reminders are optional and off until you turn them on. They are scheduled by your phone, not sent by us. They can show your child's name on the lock screen.
- Voice and sound settings. Arfy's voice uses clips built into the app and your phone's own text-to-speech. Arfy never records your child's voice.
- Your date of birth. It is used once on the phone to check that you are an adult. It is not stored or sent. Only a flag saying "this phone was handed to a child" is kept if the check fails.
Phone backups. On Android, Arfy turns off backup and device transfer. On iPhone, Arfy keeps plate photos and its app data out of iCloud and device backups. iPhone apps can't exclude their preferences, though, and your child's nickname and food list are kept there, so those two can still reach a device backup in your own Apple account until the account is deleted.
What happens to data on the phone. Signing out keeps everything on the phone for when you come back. If a different account signs in on that phone, Arfy first erases everything the previous family saved there. Deleting the account erases everything Arfy saved on the phone.
3. What Arfy does not do
- No AI features. Nothing is sent to an AI service.
- No advertising, and no advertising or analytics tools from other companies.
- No tracking across other apps or websites.
- No push notifications from a server.
- No in-app purchases or subscriptions.
- No chat, no social features, no public profiles, and no way for your child to send information to other people.
- No location, no contacts, and no microphone recording.
- No connection to clinics, doctors or care teams.
- We never sell or rent data, and we do not use it to train AI models.
4. Children's privacy: notice to parents
Arfy is made for children aged 4 to 9, so this section is written for you as the parent or guardian. It follows the kind of notice the US Children's Online Privacy Protection Act (COPPA) calls for.
Who runs Arfy
Pippa LLC, 1997 Timber Ct, Gurnee, IL. Phone: 714-787-9947. Email: pippa.app.general@gmail.com.
What we collect about your child from you
The first name or nickname you enter, and any changes you make in the grown-up areas of the app.
What we collect from your child's play
When your child uses Arfy, the app saves what they tap: the meals they show Arfy, how a food visit went, the liking and taste words they pick, how their tummy felt, and Arfy's outfit. The full list is in section 1. Your child has no box for typing free text, and they can't share anything with other people through Arfy.
Your child can use the camera in the app to show Arfy their food. Those photos stay on the phone (section 2). A photo could show a face if someone is in the shot, so please keep faces out of plate photos.
How we use it
Only to run Arfy for your family: to show your child their foods and meals, to show you how things are going, and to keep it all safe if you change phones. We do not use it for advertising or for building a marketing profile, and we do not require a child to give more information than an activity needs.
Who receives it
Only the service providers in section 6, which store it for us and act on our instructions. We do not give children's information to anyone else, except where the law validly requires it.
Your agreement
Before anything is saved to our servers, an adult goes through these steps: passes an age check on the phone, reads a summary and links to these policies, confirms being the child's parent or guardian and agrees, then creates an account, confirms being 18 or older, and enters a code emailed to them. If our policies change in a way that needs a new agreement, the app stops saving to our servers until you agree again.
Your rights
- Review and get a copy. Settings, the meal calendar and the food list show what is saved. To get a copy, use the data copy option in Settings. It holds what is on our servers plus the plate photos on that phone. iPhone opens the share sheet, and Android saves a zip file where you choose. Entries still waiting to be saved are not in the copy, because the copy only covers what reached our servers.
- Correct. Change your child's name in Settings. For anything else, email us and we will fix it.
- Delete. Delete one meal in the meal calendar, one food in the food list, or the whole account in Settings. See Delete your account. You can also ask us by email.
- Refuse further collection. You can stop at any time in Settings, with "Withdraw consent" on iPhone or "Stop saving to my account" on Android. Arfy then stops sending new entries, and our server stops accepting them. New entries stay on the phone. What is already saved stays in your account, and you can still delete single meals or foods, which reach our servers even while consent is withdrawn. To reverse it, tap "I agree" in Settings. Deleting the account ends all collection. Signing out stops that phone from sending anything.
We will check that a request comes from the account holder, usually by asking you to write from the account's email address, and we respond within 45 days.
How long we keep it
See section 7. In short: until you delete it or delete the account. There is no automatic time limit while the account is open.
5. How we use information
To create and secure the account, save and sync your child's entries, answer support requests, keep the service working and safe, and meet legal duties. We do not use it for anything else.
6. Service providers
| Provider | What they do for us |
|---|---|
| Amazon Web Services (Cognito, DynamoDB) | Sign-in, sign-up and password emails, and the database that holds the account and your child's entries, in the us-east-1 region (United States) |
| Cloudflare | Runs the server code the app talks to. Entries pass through it on their way to the database. Arfy does not use Cloudflare storage in this version, because no photos are uploaded. |
Apple and Google distribute the app and run your phone, and they have their own privacy policies. We do not send them your child's entries.
7. How long we keep information
- While the account is open: we keep your entries until you delete them or the account. They do not expire by themselves, and we do not delete quiet accounts automatically.
- A single meal or food removed: its content is removed from our database when the phone next syncs. A blank marker with no food name or other content stays so that your other phones know it is gone. It is removed when the account is deleted.
- Technical sync numbers expire by themselves after 180 days.
- When you delete the account: your entries, your child's profile and your agreement records are removed from our live database in that same request, and your sign-in is removed too. If removing the sign-in fails, we retry it every day until it is gone.
- Recovery backups: our database keeps rolling backups for disaster recovery. Deleted data can remain in those backups for up to 35 days, then it ages out.
- What we keep after deletion: a deletion receipt with a random receipt number, a scrambled one-way version of the account number, the times, and how many items were removed. It holds no email, no name and no child data. We keep it as a record that the deletion happened, with no set end date.
8. Security
Data travels over encrypted connections and is encrypted in our database. Every record sits under the account that owns it, and each request is checked against that account's sign-in. Settings in the app sit behind a grown-up lock. No system is perfectly secure. If a breach affects your data, we will tell you without unreasonable delay and within the time the law requires.
9. Your privacy rights
Wherever you live, you can see, get a copy of, correct or delete your information, and you can withdraw your agreement. Most of this is in Settings. You can also email pippa.app.general@gmail.com. We respond within 45 days, and if we need longer we will say so. We will never treat you differently for asking. Because we sell nothing and show no ads, there is nothing to opt out of under "do not sell or share" laws.
10. Changes
The date and version at the top show the current policy. If we make a material change, we will ask you in the app to agree before it applies. If a future version adds something that sends data somewhere new, such as cloud photo backup or AI food naming, we will update this policy first and it will stay off until you choose it.
11. Contact
Pippa LLC, pippa.app.general@gmail.com.