Privacy Policy

Operated by Tiny Anvil Studios LLC · Effective date: June 24, 2026 · Last updated: June 24, 2026

This Privacy Policy explains how Tiny Anvil Studios LLC (“Tiny Anvil,” “we,” “us,” or “our”), the company that operates the Nibble mobile application (“Nibble”), collects, uses, and shares information when you use the Nibble mobile application and related services (the “Service”). Nibble is a pediatrician-built guide for starting solid foods and introducing allergens. By using the Service, you agree to this Policy.

The short version

Tiny Anvil collects what it needs to give your baby a personalized feeding plan: your email, the baby profile you enter, and the progress and reactions you log.
Some of this is health information about your child. Tiny Anvil treats it carefully and stores it securely.
Tiny Anvil does not sell your data or the health data about your child, does not share it for advertising, and uses no advertising SDKs, ad networks, data brokers, or tracking pixels. The App Store label for Nibble says Data Used to Track You: None.
Apple handles all payments. Tiny Anvil never sees your card number.
You can access or delete your data at any time. Just ask.

1. Who we are

The Service is operated by Tiny Anvil Studios LLC, based in the State of Washington, USA. For any privacy question or request, contact us at hello@tinyanvilstudios.com, or write to us at 522 W Riverside Ave, Ste N, Spokane, WA 99201.

2. Information we collect

Information you provide

Account information. Your email address, used to sign in (via a one-time code) and to send you account and reminder messages.
Baby profile. The information you enter to generate the plan, for example your baby’s first name (optional), age or date of birth, feeding approach, and risk factors you choose to share, such as eczema or a known egg allergy. Some of this is health information about your child.
Progress and logs. Foods you mark as introduced, maintenance activity, supplements, and entries you add to the reaction log (which may describe symptoms). This is health information.
Feeding screening responses. If you use the picky-eating screening, the answers you give about growth or weight, swallowing or choking, food restriction, mealtime distress, and pain. This is health information about your child. Where possible, the screening is processed on your device and the individual answers are not stored.
Caregiver information. If you invite a partner, family member, or caregiver to your household, the email address you provide for them.

Information collected automatically

Device and usage data. Basic device information, such as app version, device type, and operating system. If Tiny Anvil turns on product analytics, they will be first-party only, limited to in-app usage events such as screens viewed and features used, will not include health information, and will never be used for advertising or cross-app tracking. Product analytics are off at this time.
Push tokens. If you enable reminders, a device push token so we can deliver notifications.

Information from third parties

Subscription status. When you start a trial or subscribe, Apple and our subscription provider (RevenueCat) tell us whether your subscription is active. We do not receive your full payment card details.

3. How we use information

To generate and personalize your baby’s feeding plan and safe-serving guidance.
To save your progress and reaction log and sync it across the caregivers in your household.
To send reminders you’ve enabled and important account messages.
To manage your subscription, trial, and billing status.
To maintain, secure, troubleshoot, and improve the Service.
To comply with law and enforce our Terms.

4. Sensitive health information

Nibble is a consumer wellness and education app. It is not a HIPAA-covered entity, and the Service is not a substitute for medical care. We do, however, recognize that the baby profile and reaction log can contain health information about your child. We limit access to it, store it securely, never use it for advertising, and never sell it. We use it only to provide the Service to you and the caregivers you invite. If we ever experience a breach of unsecured health information, we will notify affected users as required by the FTC Health Breach Notification Rule and applicable law.

Washington consumer health data

Tiny Anvil maintains a separate consumer health data privacy policy under the Washington My Health My Data Act, published as its own page with its own link in the app. See the Nibble Consumer Health Data Privacy Policy. It describes the consumer health data Tiny Anvil collects, including the baby profile, the reaction log, and the picky-eating screening, how Tiny Anvil uses and shares it, who receives it, and your Washington rights, including how to access or delete it and how to withdraw consent.

5. Children’s privacy

Nibble is intended for use by parents and caregivers who are 18 or older. The Service is not directed to children under 13 and is not designed for a child to operate. Children under 13 are not permitted to create accounts, access the Service independently, or provide personal information directly to Tiny Anvil. The information about your infant or child is provided by you, the adult account holder, so that Tiny Anvil can deliver personalized feeding guidance.

Tiny Anvil collects only the child-related information that is necessary to provide the Service, limits internal access to that information, and retains it only for as long as the account is active or as required by law. Tiny Anvil does not use a child’s information for behavioral or targeted advertising, does not sell it, and does not share it with third parties for marketing or advertising purposes. No advertising SDKs, ad networks, or tracking pixels operate on a child’s information.

A parent or legal guardian may at any time request to review the personal information collected about their child, request that Tiny Anvil delete that information, or direct Tiny Anvil to stop collecting or using it. Tiny Anvil will process a verified deletion request within a reasonable period and will confirm when the deletion is complete.

If you believe a child under 13 has provided personal information to Tiny Anvil directly without a parent’s or guardian’s involvement, contact hello@tinyanvilstudios.com. Tiny Anvil will promptly investigate and delete the information.

6. How we share information

We do not sell your personal information, and we do not share health information with advertising networks or data brokers. Tiny Anvil uses no advertising SDKs, ad networks, or attribution pixels. We share information only as follows:

With your household. Caregivers you invite can see the shared plan, progress, and reaction log for your household.
With service providers who process data on our behalf under contract (see Section 7).
For legal reasons, if required by law or to protect rights, safety, and the integrity of the Service.
In a business transfer, such as a merger or acquisition, in which case we will notify you and any successor must honor this Policy.

7. Service providers

We rely on a small set of trusted providers, each handling only what’s needed for their function. Each provider acts as a processor under contract and may use the data only to perform its function for Tiny Anvil.

Supabase: secure database, authentication, and sync (stores your account, baby profile, and logs).
Apple App Store: payment processing for subscriptions.
RevenueCat: subscription management (entitlement status, not card data).
PostHog: first-party product analytics, if enabled. Analytics are off at this time, are configured to exclude health data, and are never used for advertising.
Resend: delivery of account and reminder emails.
Expo: push notification delivery.

8. Data retention

We keep your information for as long as your account is active or as needed to provide the Service. If you delete your account, we delete or de-identify your personal information within a reasonable period, except where we must retain limited records to comply with law, resolve disputes, or enforce our agreements.

9. Security

We use technical and organizational safeguards including encryption in transit, access controls, and row-level data isolation so that one household cannot access another’s data. No method of transmission or storage is 100% secure, but we work to protect your information and to limit who can access it.

10. Your rights and choices

Access, correct, or delete. You can edit your profile in the app or contact us to access or delete your data.
Reminders. You can turn push notifications on or off at any time in your device settings or in the app.
California residents. Tiny Anvil lists the categories of personal information it collects and the types of providers it shares them with in Sections 2, 6, and 7. Tiny Anvil does not share personal information with third parties for those third parties’ own direct marketing. Because the Service does not track you across other companies’ sites or apps, Tiny Anvil does not change its behavior in response to Do Not Track browser signals, and the Service uses no advertising or cross-site tracking technology. You can access, correct, or delete your information as described above.
Users outside the United States. The Service is intended for users in the United States and is offered from the United States. Tiny Anvil does not target the Service to individuals in the European Economic Area or the United Kingdom. If that changes, Tiny Anvil will update this Policy to add the disclosures those laws require.
Nevada residents. Nevada law lets residents submit a verified request to opt out of the sale of certain covered information. Tiny Anvil does not sell covered information as Nevada defines it. To submit a request, email hello@tinyanvilstudios.com.
Connecticut residents. If you are a Connecticut resident, you may ask Tiny Anvil to confirm whether it processes your personal data, to access, correct, delete, or receive a copy of it, and to appeal a decision on your request. Tiny Anvil does not sell personal data, does not use it for targeted advertising, and does not profile you in ways that produce legal or similar effects, so those opt-outs do not apply. Tiny Anvil processes your child’s health data, which is sensitive data, only to provide the Service and with your consent. To make a request, email hello@tinyanvilstudios.com.

To exercise any right, email hello@tinyanvilstudios.com. We may need to verify your identity before acting on a request.

11. Where your data is processed

We are based in the United States and process data in the United States. If you use the Service from outside the U.S., you understand your information will be processed in the U.S., which may have different data-protection laws than your country.

12. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you in the app or by email and update the “Last updated” date above. Your continued use after changes take effect means you accept the updated Policy.

13. Contact us

Questions or requests? Email hello@tinyanvilstudios.com.