Privacy Policy
Effective and last updated: October 22, 2026
The short version
- The T.O.O.T.H. App works without an account. We never ask for your last name, email, phone number or address.
- Everything stays on your phone unless you turn on family sharing. Then a copy is kept in our cloud database so other family phones can see it.
- There are no ads, no analytics, no tracking, and no cookies set by the T.O.O.T.H. App. We never sell or rent your information, and we never use it to train AI.
- The T.O.O.T.H. App isn't connected to any dentist or dental record, and no dental office can see your family's Vault.
- No real money moves through the app. The Vault is a running tally the grown-ups keep.
- You can download a copy of your data or delete it from your phone and from the cloud at any time, right in the app. Open the Fairy Vault panel and tap Your data.
- Who we are
- What the T.O.O.T.H. App is
- Information involved
- What we don't collect
- Where it's stored
- Sharing links: who can see what
- How we use it
- Who we share it with
- Children's privacy
- Teeth, health and HIPAA
- How long we keep it
- Your choices and rights
- Security
- Cookies and tracking
- Camera
- Money
- Changes to this policy
- Contact us
1. Who we are
The T.O.O.T.H. App (from the Terrestrial Office Of Toothfairy Holdings, our playful name for the Tooth Fairy's back office) is made and run by Mid-Atlantic AI LLC ("we", "us"). This policy covers the T.O.O.T.H. App web app and installed app at the address you're using now. If you have a question, email john@midatlantic.ai, and a person will read it and answer.
2. What the T.O.O.T.H. App is, and isn't
The T.O.O.T.H. App helps grown-ups play Tooth Fairy. You pick the tooth that came out, choose an amount and a note, and print a card with a QR code. In the morning, your child scans the card and watches a short animated visit from the fairy. The app keeps a running "Fairy Vault" total of what the fairy left. If you choose, family members can add to that total from their own phones.
The T.O.O.T.H. App is a game and a keepsake. It is not a bank, a payment service or a medical tool. The "which tooth is next" hints are general averages for when children usually lose each baby tooth. They aren't dental advice.
3. Information involved
Here is every piece of information the app handles, who provides it, and where it goes.
| Information | Who enters it | Where it's kept | Who can see it |
|---|---|---|---|
| Child's first name (optional) | Parent | Your phone. The printed card and its QR code. The cloud, if family sharing is on. | You; anyone holding the card; people with your family links (section 6) |
| Child's birth month and year (optional, no day) | Parent | Your phone; the cloud if family sharing is on | You and phones connected with the parent link. It is not shown on the grandparent page. |
| Which baby teeth came out, and the dates | Parent, by tapping a tooth | Your phone; the card and QR code; the cloud if sharing is on | You; card holders; people with your family links |
| Fairy amounts, amounts taken out, Vault total | Parent | Your phone; the cloud if sharing is on | You; people with your family links see the total |
| Note from the fairy (up to 120 characters) | Parent | Your phone; the card and QR code; the cloud if sharing is on | You; card holders; phones connected with the parent link |
| Family chip-ins: the giver's name as the kids say it (like "Grandma"), amount, note, date | The family member who chips in | The cloud. The giver's phone also remembers the name they typed. | The parents, and everyone with the family's invite link (the latest 20 chip-ins are shown there) |
| "Where to send real money" note (optional, for example a Venmo or Cash App name) | Parent | The cloud | Everyone with the family's invite link |
| Reveal style and app settings | Parent | Your phone (and inside the card's QR code) | You |
| Abuse-limit code: a one-way scrambled code made from your IP address and the date | Created automatically when you turn on family sharing | The cloud, for one hour, then deleted | Nobody. It's made with a secret key, so it can't be turned back into your IP address without that key, and we don't try. It's used only to count how many new Vaults one network creates. |
| Technical request data: IP address, browser and device type, time | Sent automatically by your browser | Our hosting providers' logs (section 5) | Our hosting providers; us only when fixing a problem or stopping abuse |
All fields are optional except the ones needed to make a card: the tooth and the amount.
4. What we don't collect
We don't collect your last name or your child's last name, email addresses, phone numbers, home address, photos, voice, precise location, contacts, payment card or bank details, or any login or password. The app has no accounts at all. We don't receive any information from your dentist, and the app has no field for patient numbers, insurance or dental records.
5. Where your information is stored
On your phone
The T.O.O.T.H. App saves its data in your browser's own storage on your phone, so it works offline. That data stays on the phone unless you turn on family sharing. If you open the T.O.O.T.H. App in more than one browser, or in the browser and as an installed app, each one keeps its own separate copy.
On the printed card
The fairy card's QR code holds the details of that one visit: the child's first name, the tooth, the amount, the fairy's note, the date and the reveal style. The details live in the part of the link after the "#", which browsers don't send to our servers. Keep in mind:
- Anyone who finds the card and scans it can see those details.
- If you scan the card with a different app instead of the T.O.O.T.H. App's own Scan a fairy card button, that app sees the link, and its own privacy policy applies. Examples are your camera app or Google Lens. Your browser may also keep the link in its history.
In the cloud (only if you turn on family sharing)
Family sharing keeps a copy of your Vault in a database we run on Supabase. Supabase hosts it on Amazon Web Services in the United States (Northern Virginia). Every connection is encrypted. The database is encrypted at rest by the provider. Apps and websites can't browse the database. Everything that reads or changes an existing family's Vault requires that family's secret link: the parent link for full access, or the invite link for the grandparent page and chip-ins. As the operator, we have administrator access to the database to keep the service running. We don't look at family Vaults unless you ask us for help, or to investigate a security problem.
Hosting logs
Two providers keep standard technical logs for security and reliability. Cloudflare delivers the app's files, and Supabase runs the database. Those logs may include your IP address, browser and device type, and the time of each request. If a page fails to load, your browser may also send Cloudflare an automatic error report. We don't routinely look at these logs. We may review them to fix a problem or stop abuse, and we never use them to identify families or to track anyone. The providers keep them for a limited time under their own policies.
6. Sharing links: who can see what
Because there are no accounts, family sharing works with private links. Treat a link like a house key: anyone who has it can use it.
- The invite link (
#join-…) is for grandparents and other family. Anyone who has it can see the child's first name, which teeth came out and when, the Vault total, the latest 20 chip-ins (names, amounts and notes), and your "send real money" note. They can also add chip-ins. They can't see the birth month or the fairy's notes, and they can't change or delete anything. - The parent link (
#parent-…) gives full access, the same as your own phone. Only send it to the other parent. Right now a parent link can't be switched off on its own. If it ever reaches the wrong person, delete the family Vault from the cloud (section 12) and turn family sharing on again. That creates new links. - The share buttons ("Share the news", "Say thank you", the tooth news picture) use your phone's own sharing menu. What you send, and to whom, is up to you. It goes through the apps you pick, and we don't receive a copy.
7. How we use information
We use the information only to make the T.O.O.T.H. App work: to draw the tooth map and the cards, play the fairy visit, keep the Vault total, and sync between family phones you've connected. We don't:
- sell, rent or trade it;
- use it for advertising, or let advertisers or data brokers use it;
- build profiles of you or your child;
- use it to train artificial intelligence. The T.O.O.T.H. App doesn't send your data to any AI service;
- send you marketing. We don't have your email or phone number.
8. Who we share it with
Only the service providers that run the app: Cloudflare (delivers the app) and Supabase (the family-sharing database, hosted on Amazon Web Services). They process data for us to provide their services. We don't share it with anyone else, including dental offices, advertisers and data brokers. We would disclose information only if a valid law or legal process required it, and only what was required. If the T.O.O.T.H. App were ever transferred to another company, this policy would still protect the information collected under it. Any change would follow section 17.
9. Children's privacy
The T.O.O.T.H. App is made for parents and other grown-ups to use with their children. The setup screen is marked "Grown-ups only". Children take part by watching the fairy's visit and tapping to open their surprises. They aren't asked to type anything or to give any information. We don't knowingly collect personal information directly from children under 13. The child's first name, birth month and tooth history are entered by a parent, and only to make the game work. We never ask for more information than a feature needs.
Parents can see everything the app keeps about their child, on screen. You can download a copy, delete it from your phone, delete it from the cloud, or ask us to do any of that (section 12). If you think a child has given us information without a parent's involvement, email us and we'll delete it.
10. Teeth, health and HIPAA
A record of which baby teeth your child has lost is personal, and we treat it with care. The T.O.O.T.H. App isn't a healthcare provider and isn't operated for one. It's not connected to any dental office or dental record system, and it doesn't receive information from your dentist. For those reasons the U.S. health privacy law HIPAA doesn't apply to the T.O.O.T.H. App. We still follow the practices in this policy, and we'll tell you if something ever goes wrong (section 13). If your dentist ever recommends the T.O.O.T.H. App, using it doesn't share anything with them.
11. How long we keep it
- On your phone: until you delete it in the app, clear the browser's site data, or remove the app. On iPhone, Safari may erase a website's storage after a while without use. Adding the T.O.O.T.H. App to the Home Screen and opening it from the icon helps keep it.
- In the cloud: until a parent deletes the family Vault in the app. We also delete it automatically if no parent's phone has opened it for 24 months.
- Removed entries: when you remove an entry, its name, note, date and tooth are erased from the cloud. A small stub (an ID, the type, the amount and a time) stays until the Vault is deleted, so the removal reaches your other phones.
- Chip-in phones: a family member's phone remembers the invite link and the name they typed, until they tap "Forget this Vault on my phone" or clear the browser's data.
- Hosting logs: kept for a limited time by Cloudflare and Supabase under their own schedules.
- We don't make our own backup copies of family Vaults. Our database provider may keep short-term copies for its own disaster recovery, and those expire on its schedule.
12. Your choices and rights
In the app, open the Fairy Vault panel and tap Your data. From there you can:
- Download a copy of everything on that phone, as a file;
- Delete from this phone: erases everything the T.O.O.T.H. App saved there;
- Delete the family Vault from the cloud (when family sharing is on): permanently erases the cloud copy for every connected phone, and the family links stop working;
- remove any single entry with the ✕ next to it;
- on a chip-in page, Forget this Vault on my phone.
You can also email john@midatlantic.ai to ask what we hold, ask for a copy, ask us to correct or delete it, or ask a question. We'll respond within 30 days, usually much sooner. Because there are no accounts, we can't look up your family by name. To act on a cloud Vault, we'll ask you to send the family's invite link from your app, so we know which Vault is yours. We honor these requests from everyone, wherever you live, and using them never changes how the app works for you.
13. Security
What we do:
- Every connection uses HTTPS encryption.
- The database can't be browsed from the internet. Anything that reads or changes a family's Vault requires that family's secret link.
- Parent links are stored only as a one-way fingerprint (a hash), not in readable form.
- The secret part of every link sits after the "#", so it doesn't end up in web server logs.
- There are limits on how much can be saved, on how many chip-ins a Vault accepts per day, and on how many new Vaults one network can create per hour. These are to prevent abuse.
- The app loads no outside scripts, ads or trackers. Its files all come from our own site.
No system is perfectly secure. The T.O.O.T.H. App's main safeguard is that family links stay private, so share them only with people you trust, and keep your phone locked. If we learn of a breach involving your information, we'll promptly post a notice in the app and on this page, explain what happened and what to do, and notify authorities where the law requires.
14. Cookies and tracking
The T.O.O.T.H. App doesn't set cookies. It uses your browser's storage to save your Vault, and an offline cache of its own files so it works without a signal. There's no analytics software, advertising, tracking pixel, fingerprinting or cross-site tracking. That means there's nothing to opt out of, and "Do Not Track" or Global Privacy Control settings change nothing.
15. Camera
The Scan a fairy card button asks to use your camera, only to read the card's QR code. The camera turns on only while the scanner is open. The images are read on your phone and are never saved or sent anywhere.
16. Money
No payments go through the T.O.O.T.H. App, and we never see bank or card details. Chip-ins are promises recorded in the Vault. The grown-ups handle the real money themselves. If you add a Venmo or Cash App name, it's shown to everyone with your invite link. Those services have their own privacy policies.
17. Changes to this policy
If we change this policy, the date at the top changes too. For a material change, especially anything that would share information in a new way, we'll show a notice in the app before the change takes effect. We'll ask for your permission where the law or this policy requires it.
18. Contact us
Mid-Atlantic AI LLC · john@midatlantic.ai