Privacy policy
Last updated:
Who we are
Little Moments. Contact [email protected] about your information.
Nursery photos and sign-in
Your browser sends your credentials directly to the nursery provider and holds access tokens in memory. Our payment backend does not receive your nursery password, access token, child names, source media URLs, or photo/video files. The website code processes previews on your device.
Payment and account matching
Your browser derives a deterministic SHA-256 hash from the provider identifier and your normalised nursery login email. It sends that hash to our payment server and Stripe to associate a purchase with the same nursery login across devices. The hash is pseudonymous, not anonymous: someone who knows the input can reproduce it.
Stripe stores the checkout/payment identifiers, configured price, payment mode, and payment status. Stripe processes the checkout email, payment details and receipts under its own privacy policy. We retrieve payment data directly from Stripe to verify purchases and handle refunds/disputes; our application does not maintain a separate payment database or store card details.
Cookies and device storage
The lm_source and lm_payment cookies remember account/payment references for up to one year. IndexedDB and exported progress files record download history until you clear or delete them. Older previews may also have an lm_checkout cookie. Browser storage is specific to a device; signing into the same nursery account restores the purchase, not another device’s download history.
Hosting and support
Netlify processes network information such as IP addresses and request details to deliver and protect the site. Our application logs fixed payment error codes, not private payloads. Payment rate limits use a daily keyed hash of the IP address; counter records expire and are cleaned up during subsequent requests. Support emails contain what you choose to send, including a diagnostic summary if you use the troubleshooting links. Do not send passwords, tokens, or children’s photos.
Purpose and retention
Account matching and payment processing support performance of the purchase contract. Security and troubleshooting support our legitimate interests in running a reliable service. Where applicable, transaction records also support legal accounting obligations.
We use Google Analytics with IP anonymisation to measure aggregate site usage and conversion rates. We do not transmit advertising identifiers, nursery credentials, children’s names, or photo contents to Google Analytics. Use “Turn off analytics” at the bottom of any page to stop further analytics collection in this browser. This also removes our Google Analytics cookies. Downloads and payments still work. Your choice is saved on this device using local storage and a preference cookie lasting up to one year; you can turn analytics back on using the same control. This does not delete statistics already collected.
Transaction records are retained for statutory accounting and purchase access verification. Our application checks purchase status directly with Stripe and does not store a separate payment database. Stripe retains its own payment records. Account purchase references are needed to recognise repeat access; deleting them can prevent automatic purchase recovery.
Your choices and rights
You can clear local history and delete exported files. Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your personal data, and object to processing based on legitimate interests. Contact [email protected] to exercise these rights. Some transaction records may need to be retained by law. We normally respond within one month; if a lawful extension is needed, we will explain why.
You can raise a concern with us or complain to the UK Information Commissioner’s Office or your local data protection authority.
Stripe, and hosting providers may process data internationally. Their privacy notices explain their international processing arrangements.
Provider information: Stripe privacy · Google Analytics partner privacy · Netlify privacy.