NanaSays — Privacy Policy

Last updated: 13 August 2026

This policy explains what personal information the NanaSays app ("NanaSays", "we", "us", "our") collects, why we collect it, who we share it with, how long we keep it, and the rights you have. Please read it alongside our Terms of Use.

NanaSays is designed for use by adults — parents and carers — to help plan days out and activities for children. It is not intended for use by children themselves.

1. Who we are

NanaSays is operated by Carmel, trading as NanaSays, based in the United Kingdom. For the personal information described in this policy, we are the "data controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018).

If you have any questions about this policy or your information, contact us at nanasaysapp@hotmail.com.

2. The information we collect

We collect only what we need to run the app. Depending on how you use NanaSays, this may include:

Type of information	What it is	Why we collect it
Account details	Your email address and password. If you choose to sign in with Google, we receive basic account information from Google (such as your email address).	To create and secure your account and let you sign back in.
Information about your children	The first name or nickname and the age (or age band) of each child you add. You choose whether to add this.	To tailor activity, clothing and event suggestions to the ages of the children in your family.
Location	Your device's location, or a place you search for, used to show what's near you.	To show local weather, nearby venues and days out, and local events. See section 4 for who this is shared with.
Your saved content & preferences	Your weekly planner entries, saved activities and app settings.	To remember your plans and preferences between visits.
Feedback	The ratings and any optional comments you submit through the in-app feedback feature.	To understand what's working and improve the app.
Technical & usage data	Standard technical information needed to deliver and secure the service (for example, basic request logs held by our hosting and backend providers).	To keep the app running, secure and reliable.

Please verify this table against your app before publishing. Only list data you actually collect. For example, confirm whether your app stores the user's location (to remember their area) or only uses it in the moment — and word the "Location" row accordingly.

3. Why we're allowed to use it (legal bases)

Under UK data protection law we must have a lawful basis for using your information. We rely on:

Performing our agreement with you — to provide the app you've asked to use (your account, saved plans and preferences).
Your consent — for access to your device location (which you grant through your device's permission prompt and can withdraw at any time in your device settings), and for the optional information you choose to add about your children.
Our legitimate interests — to keep the app secure and reliable and to improve it using feedback, in a way that doesn't override your rights.

4. Who we share it with

We do not sell your personal information, and we do not use it for advertising or ad-tracking.

We use a small number of trusted service providers to run the app. These providers process data on our behalf, or receive limited information to perform a specific function:

Our backend and database provider (Supabase) — securely stores your account, your children's details, your saved content and feedback.
Our hosting provider (Cloudflare) — serves the app.
Google — only if you choose "Sign in with Google", to authenticate you.
Local-data providers — to show what's near you, we send your location (coordinates) to:
- a mapping/places provider (Geoapify) to find nearby venues and days out;
- a weather provider (Open-Meteo) to show your local forecast;
- an events provider (Skiddle) to find local family events;
- a map-tile provider to display the map.

We may also disclose information if required to do so by law, or to protect the safety of our users.

Update this list if you add or change providers (for example, if you later add Ticketmaster for events, or switch map tiles). The location sent to the providers above is used to return local results and is subject to each provider's own terms.

5. Information about your children

NanaSays is for parents and carers, not for children. Any information you add about a child — a name or nickname and an age — is provided by you, and only to personalise the suggestions we show you.

You decide whether to add this information, and you can edit or remove it at any time in the app.
We use it only to tailor suggestions to your children's ages. We do not use it for advertising and we do not share it except with the backend provider that stores it for you (see section 4).
We ask that you only add information about children you are responsible for.

This is the most sensitive part of your app and the area most worth a professional review. Because you process personal data relating to children, the ICO's Age Appropriate Design Code ("Children's Code") is relevant. A short legal check is strongly recommended before launch.

6. How long we keep your information

We keep your information for as long as your account is active. If you delete your account, or ask us to delete your information, we remove it from our live systems, except where we're required to keep something to meet a legal obligation. Backups are overwritten in the ordinary course of time.

7. Your rights

Under UK data protection law you have the right to:

ask for a copy of the information we hold about you;
ask us to correct information that's wrong;
ask us to delete your information ("right to erasure");
object to, or ask us to restrict, certain uses of your information;
ask for your information in a portable format;
withdraw consent (for example, turn off location access) at any time.

To exercise any of these, contact us at nanasaysapp@hotmail.com. To delete your account and associated data, use "Delete account" in the app settings (Profile → Delete account). Your account and all associated data will be permanently deleted immediately.

If you're unhappy with how we've handled your information, you can complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk. Our ICO registration number is [ICO REGISTRATION NUMBER — ADD WHEN RECEIVED, STARTS WITH Z].

8. Security

We take reasonable steps to protect your information. Data is encrypted in transit (over HTTPS), passwords are stored in a hashed form by our authentication provider, and access to stored data is restricted. No method of transmission or storage is completely secure, but we work to protect your information and to keep our providers' security up to date.

9. International transfers

Some of our providers may process data outside the UK. Where they do, we rely on those providers' safeguards (such as approved data-transfer mechanisms) to protect your information to UK standards.

10. Changes to this policy

We may update this policy from time to time. When we make significant changes, we'll update the "Last updated" date above and, where appropriate, let you know in the app.

11. Contact us

Carmel, trading as NanaSays
Email: nanasaysapp@hotmail.com
United Kingdom