Privacy policy

Covers the Tutum and Tutum Kids apps. Last updated 14 November 2026.

The short version

• We do not run ads, sell information, or track you across other companies' apps or websites. Neither app contains analytics or advertising code.
• There is no Tutum account. Your family's information lives on your own devices and your own family hub.
• We, the developer, do not run a server that receives your family's data, apart from feedback you choose to send us.
• Parents are in control: in Tutum Kids a parent can export everything about a child, remove a child and all of their data, or delete all family data.

Tutum

Tutum is a family home app. Your home data lives on your family's Tutum hub (a Mac in the home, or an iPhone running as a limited phone hub). Paired devices talk to the hub on your home network, or through an optional relay that carries encrypted traffic to your hub. The relay is not a place where we read your home data.

• Location sharing is optional and off until you turn it on. It goes only to your hub, encrypted end to end. You can pause it or make it approximate. Location history, including optional trip distance, speed, and activity, is deleted from the hub automatically after 7 days.
• Cameras are optional and off until you add one. Photos stay on the hub and are deleted after 7 days. Tutum never uses microphones.
• Permissions Tutum may ask for: Local Network (to find your hub), Camera (only to read the pairing code shown on your Mac; nothing is recorded), Location and Motion & Fitness (only if you turn on the features that use them).
• Feedback: you can send us a short typed note from the app. An optional bug report (off by default, previewed before sending) adds the app version, system version, hardware model, relay status, and recent error lines, with names, email addresses, locations, and network details removed.
• Notifications are local to your devices. Tutum does not use remote push notifications in this version.

Tutum Kids

Tutum Kids is a chat app for children. A parent sets it up, behind a parent passcode, and supervises it. It is designed for families and follows the rules for apps made for kids: no ads, no analytics, no in-app purchases, no links out of the app for children, and no sign-in for children.

What stays on the device

Child profiles (first name, avatar, age band, time and message limits), a hashed parent passcode and optional child PINs, chat history, safety flags, usage counts, daily and weekly reports, homework activity, and urgent alerts waiting to be sent. Connection secrets are stored in the device's secure keychain.

What leaves the device

• Chat messages. To get an answer, each message a child sends goes, together with the child's first name and age band, to the AI service the parent connected: a webhook address the parent provides and a database the parent provides (for example a Neon Postgres database). The reply comes back the same way. This is the parent's own service, not ours; we never receive chat messages.
• Report emails, only if a parent turns them on, are sent through the parent's own email server and leave out chat text.
• Urgent safety alerts, when Tutum Kids is connected to the family's Tutum hub, go to that hub. An alert contains the child's first name, the kind of alert, and the time. It never contains chat text.

What Tutum Kids never collects

Location, contacts, photos or videos, the microphone or camera, health data, advertising identifiers, or browsing history. Pasted images are blocked. Messages are checked on the device for safety topics before a child sees a reply.

Parent controls: export and deletion

• Export a child's data: Parent Settings → Children → Export data saves everything the app keeps about that child as a file (no passcodes, PINs, or connection secrets).
• Remove a child: Parent Settings → Children → Remove deletes that child's chats, flags, reports, digests, and alerts waiting to be sent from the device.
• Delete all family data: Parent Settings → Family → Delete all family data erases every child, chat, report, alert, setting, the parent passcode, and the saved connection, and returns the app to first-time setup.
• Copies already sent to the parent's own webhook or database are controlled by the parent and must be deleted there.

Children's privacy

Tutum Kids is meant to be set up and controlled by a parent or guardian, who chooses whether to connect an AI service and can review, export, or delete a child's information at any time. We do not collect children's personal information on our own servers, and we do not use it for advertising or tracking. If you believe we have received a child's information by mistake, for example in a feedback note, write to privacy@tutumfamily.com and we will delete it.

Retention

Information stays on your devices and your hub until you delete it or uninstall the app, except where noted above (for example, the hub's 7-day limit for location history and camera photos). Feedback notes are kept only as long as needed to fix problems.

Security

Connection secrets are kept in the device's secure keychain. Hub traffic is encrypted. On iPhone and iPad, Tutum Kids' report file uses the system's data protection.

Changes

If this policy changes in a material way, we will update the date above and post the new text at this address.

Contact

Privacy questions or deletion requests: privacy@tutumfamily.com. General help: Support.