Privacy Policy

1. Who we are

Hearth & Hero Studios provides the TwoHearths app and is responsible for the personal information processed through the service.

In this policy, “TwoHearths”, “Hearth & Hero”, “we”, “us” and “our” refer to Hearth & Hero Studios.

You can contact us through the Contact page on the Hearth & Hero Studios website.

2. What TwoHearths is

TwoHearths is a family wellbeing app designed primarily for children whose lives may involve two homes, although it can also be used with a single Hearth.

Children can use TwoHearths to record things such as:

• how their day felt
• activities or things they want to remember
• later reflections about a previous day
• how their shell felt before or after moving between Hearths
• Worry Stones
• requests for help from a chosen grown up

Grown ups can use TwoHearths to manage family access and review information that the child has chosen to record or share.

TwoHearths is not a medical, diagnostic, counselling, safeguarding, legal or forensic service.

We do not use a child's records to decide why they felt a particular way, who caused a feeling, or whether one home or parent is better than another.

3. Information we collect

The information we process depends on how TwoHearths is used.

Grown up account information

When a grown up creates or uses a TwoHearths account, we may process:

• name or display name
• email address
• Firebase account identifier
• family membership
• account creation information
• family invitations and connection information

Passwords are handled through our authentication provider. We do not store readable account passwords in the TwoHearths database.

Child profile information

A family may create a child profile containing information such as:

• the child's chosen or entered display name
• profile identifier
• avatar choice
• whether the profile is active
• the family the profile belongs to

TwoHearths does not require a child to create their own email address or independent online account.

Hearth information

Families may create one or two Hearths.

This may include:

• a private grown up label, such as “Dad's House” or “Mum's House”
• a child facing Hearth label
• a symbol or visual identifier
• information needed to associate relevant records with a Hearth

We ask grown ups to keep private Hearth labels neutral and respectful.

Daily Check Ins

A child may choose to record:

• a rating from 1 to 5
• the date
• activities they choose
• an optional note about the day
• optional Hearth context
• technical information needed to preserve and verify the record

Reflections

A child may later add a reflection to an earlier Check In.

The original Check In is preserved rather than silently replaced.

A reflection may contain:

• a new rating
• selected activities
• an optional note
• the time the reflection was created
• technical integrity information

Journey with Tim

Where a family uses two Hearths, a child may record how heavy their shell feels around a move between Hearths.

These records can include:

• a shell weight from 1 to 5
• whether the record was made before leaving or after arriving
• date and time information
• technical integrity information

Journey records are recorded app moments. They are not GPS records and do not prove where a child physically was or when an actual journey took place.

4. Worry Stones

Worry Stones are treated differently from ordinary Check Ins.

A Worry Stone is private by default.

A child can choose to:

• keep it privately with Tim
• share it with one or more chosen grown ups
• ask a chosen grown up for help

A private Worry Stone is not included in the Common Wellbeing Report.

A grown up does not automatically receive the worry a child wrote on a private Worry Stone.

If a child chooses to share a Worry Stone, TwoHearths creates a separate sharing record for the chosen recipient.

Sharing with one grown up does not automatically share it with every grown up connected to the family.

5. Help Requests

A child can ask a chosen grown up to check TwoHearths.

A Help Request is designed to reveal as little information as possible.

The request itself does not need to contain the worry the child wrote on their Worry Stone.

If the child separately chooses to share a Worry Stone with that grown up, the sharing event can be linked to the Help Request.

TwoHearths does not automatically interpret a Help Request as evidence of danger, abuse or any particular event.

6. Who can see a child's information

Access depends on the type of information and the child's choices.

Connected grown ups may be able to see ordinary wellbeing records for a child they are authorised to access.

However:

• private Worry Stones remain private
• Worry Stones are only shown to recipients selected by the child
• Help Requests are recipient specific
• information shared with one grown up is not automatically disclosed to another

We design access around family membership and authenticated accounts rather than making child records publicly accessible.

7. Reports

A grown up may generate a Common Wellbeing Report.

Depending on the selected options, a report may contain information such as:

• Daily Check Ins
• activities
• notes
• later reflections
• Journey records
• factual summaries and patterns
• trusted timing and record integrity information

Private Worry Stones are not included in the Common Wellbeing Report.

Information explicitly shared with a particular grown up is kept separately from the common report dataset.

Reports are intended to preserve what the child chose to record. TwoHearths does not use them to determine what caused a feeling or to assess either parent, Hearth or quality of care.

8. Report fingerprints and verification receipts

TwoHearths may create a deterministic SHA 256 fingerprint from the canonical dataset used for a report.

The fingerprint helps establish whether a dataset remains consistent with the dataset used when the report was created.

Each export also receives its own verification receipt identifier.

Two reports created from the same unchanged dataset may therefore have:

• the same SHA 256 fingerprint
• different verification receipt IDs

The receipt records information about the export and receives a server generated creation time.

The fingerprint is calculated from the report dataset rather than from the visual PDF file itself.

It does not prove:

• that a child's statement is factually true
• that an event happened
• why a child felt something
• who caused a feeling
• that one Hearth is better or worse
• that a PDF file itself has never subsequently been edited

The public verification information on our website does not provide public access to a child's Firestore records or act as a public child data lookup service.

9. Information stored on the device

Some information is deliberately stored locally.

Grown up PIN

The grown up PIN protects access to grown up areas on that installation of TwoHearths.

The readable PIN is not stored in the TwoHearths cloud database.

The app stores a salted, one way representation of the PIN on the device.

The PIN is a local privacy control. Firebase Authentication remains the account identity and authorisation system.

Because the PIN belongs to the installation, clearing app data or uninstalling the app may remove it and require a new PIN to be created.

Biometrics

Where supported, a grown up may choose to use fingerprint, Face ID or another operating system biometric mechanism to unlock the grown up area.

TwoHearths does not receive or store a copy of your fingerprint, face image or biometric template.

Biometric matching is performed by the operating system on the device.

Report data

TwoHearths may securely store downloaded report information on the device so the same historical information does not need to be repeatedly downloaded.

Where supported, this information is stored using platform protected storage.

A grown up can clear saved report data from Account & Privacy settings.

Signing out may also remove locally saved report information.

Saved or shared PDF files are different. Once a grown up deliberately saves or shares a PDF outside TwoHearths, that copy is controlled by the storage location, application or person it was shared with.

10. Technical and integrity information

To operate and protect the service, TwoHearths may process technical information such as:

• record identifiers
• account identifiers
• family and child identifiers
• installation identifiers
• app version
• platform
• client creation time
• trusted server receipt time
• record hashes
• schema versions
• report receipt information

This information is used for purposes such as security, reliability, synchronisation, audit history and record integrity.

We do not use this information to determine the emotional meaning of a child's records.

11. Notifications

Where notifications are enabled, families can control different notification types separately.

These may include:

• child Check In reminders
• grown up reminders
• child initiated Help Request notifications
• other appropriate family alerts

We aim to minimise the amount of private information displayed in notifications, particularly on shared devices and lock screens.

A notification should not reveal what was written on a private Worry Stone or unnecessary sensitive information.

Notification preferences can be changed in the app.

Where push notifications are used, technical device tokens may be processed by the relevant platform notification services in order to deliver them.

12. How we use personal information

We use personal information where necessary to:

• provide TwoHearths
• authenticate grown up accounts
• connect authorised family members
• maintain child profiles
• save the child's chosen records
• preserve record history
• show information to authorised grown ups
• deliver information the child explicitly chooses to share
• create requested reports
• maintain report integrity and verification receipts
• protect private areas of the app
• provide notifications where enabled
• provide support
• prevent abuse or unauthorised access
• maintain and improve the reliability and security of the service
• comply with applicable legal obligations

We do not use children's wellbeing records to build advertising profiles.

13. Our approach to children's wellbeing data

TwoHearths deals with information that can be very personal.

Some information about a child's emotional wellbeing may be considered particularly sensitive and, depending on its nature and use, may fall within special category data under UK data protection law.

We treat this information accordingly.

TwoHearths deliberately avoids:

• diagnosing children
• predicting mental health conditions
• automated emotional profiling
• deciding why a child feels something
• ranking parents or Hearths
• automatically assigning blame
• using wellbeing records for targeted advertising

Where data protection law requires an additional condition for processing special category information, we will identify and document the appropriate condition and obtain explicit consent where that is the condition relied upon.

14. Our lawful bases

Depending on the processing involved, we may rely on:

Contract

Where processing is necessary to provide the TwoHearths service requested by the grown up account holder.

Legitimate interests

Where necessary for purposes such as:

• service security
• preventing misuse
• maintaining technical reliability
• responding to support requests
• protecting the integrity of records

We balance those interests against the rights and interests of children and adults.

Consent

Where consent is the appropriate legal basis, including optional functionality where required.

Consent can be withdrawn where the processing depends on consent.

Legal obligation

Where we need to process information to comply with applicable law.

Where information amounts to special category data, we also identify an appropriate condition under Article 9 of the UK GDPR.

15. Advertising

TwoHearths does not show advertising to children in Child Mode.

Child wellbeing records, Worry Stones, Check Ins, Journey records and reports are not used to personalise advertising.

Any advertising or monetisation introduced in grown up areas must remain separated from Child Mode and from children's wellbeing information.

If our advertising practices materially change, this Privacy Policy and any required consent controls will be updated before those changes are used in production.

16. Automated decision making

TwoHearths does not make solely automated decisions about a child that have legal or similarly significant effects.

Tim is a companion character, not an artificial intelligence therapist.

TwoHearths does not automatically decide:

• whether a child is happy or unhappy overall
• whether a child is at risk
• whether a parent has behaved appropriately
• whether one home is better
• what caused a recorded feeling

The app may calculate factual values such as averages, counts and ranges. These calculations are presented as summaries of recorded data, not conclusions about the child or family.

17. Service providers

We use trusted technical providers where necessary to operate TwoHearths.

These may include services provided by Google Firebase, including authentication and Cloud Firestore.

Platform providers such as Apple and Google may also process technical information when the app is downloaded, when platform security features are used, or where notifications are delivered.

Service providers may process information only for purposes necessary to provide their services and subject to their own legal and contractual obligations.

We do not sell children's personal information.

18. International data transfers

Some service providers may process information in countries outside the United Kingdom.

Where personal information is transferred internationally, we use or rely on appropriate legal safeguards as required by applicable data protection law.

19. How long we keep information

We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected, including providing the service, protecting account and record integrity, meeting legal obligations and resolving disputes.

Family and child information will normally be retained while the relevant TwoHearths account or family remains active.

When an account or family is deleted, information will be deleted or anonymised where appropriate, subject to any information that must temporarily remain in secure backups or be retained to meet legal obligations.

Technical and security information may be retained for a shorter or longer period where reasonably necessary to maintain service security and integrity.

We will not keep identifiable child wellbeing information indefinitely merely because it may be useful in the future.

20. Account and data deletion

A grown up can request access to or deletion of personal information associated with their account.

Requests can be made through the privacy and account controls in TwoHearths where available, or by contacting Hearth & Hero Studios.

Because a family may contain:

• more than one grown up
• shared child profiles
• information belonging to or shared with another family member

deleting one grown up account does not necessarily mean that every family record can automatically be deleted without considering the rights and access of other people.

We will assess deletion requests carefully and comply with applicable data protection law.

Our append only record design prevents ordinary users from silently rewriting a child's history. It does not prevent Hearth & Hero Studios from deleting personal data where deletion is legally required.

21. Security

We use technical and organisational measures intended to protect personal information.

These include, where applicable:

• authenticated access
• family based access controls
• Firestore security rules
• append only emotional records
• separate revision history
• trusted server timing
• recipient specific sharing
• local PIN protection
• operating system biometric protection
• encrypted or platform protected local report storage
• report fingerprints and immutable verification receipts

No online service can guarantee absolute security.

If we become aware of a personal data breach, we will investigate it and meet any applicable notification obligations.

22. Children's privacy

Children have privacy rights of their own.

A grown up using TwoHearths does not own a child's personal information simply because they created the family account.

We design TwoHearths to give children appropriate privacy and choice, particularly around Worry Stones and information they choose to share.

We provide a separate Kids Privacy Policy written in more child friendly language.

We encourage grown ups to read it with their child.

23. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights including:

• the right to be informed
• the right to access personal information
• the right to correct inaccurate information
• the right to request deletion
• the right to restrict processing
• the right to object to certain processing
• the right to data portability where applicable
• the right to withdraw consent where processing relies on consent
• rights relating to automated decision making

These rights are not absolute and may depend on the circumstances.

Children can also have data protection rights independently of their parents or grown ups.

To exercise a privacy right, contact Hearth & Hero Studios through our Contact page.

We may need to verify the identity and authority of the person making a request before disclosing or changing information.

24. Complaints

If you have concerns about how we use personal information, please contact Hearth & Hero Studios first so we can try to resolve them.

People in the United Kingdom also have the right to complain to the Information Commissioner's Office, the UK's independent data protection regulator.

25. The TwoHearths website and verification page

The Hearth & Hero Studios website contains information about TwoHearths, including legal information and report verification guidance.

The public TwoHearths verification page is informational.

It does not provide public access to:

• child profiles
• Check Ins
• Worry Stones
• family records
• Firestore receipts
• report datasets

Do not upload or publish a child's report, Worry Stone or other sensitive information on a public website unless you understand the privacy consequences.

26. Links to other services

Our website or app may contain links to external services.

Those services operate under their own privacy practices, and Hearth & Hero Studios is not responsible for how an unrelated external service handles personal information after you choose to leave TwoHearths.

27. Changes to this policy

We may update this Privacy Policy as TwoHearths develops, laws change or our service providers change.

Where a change materially affects how we use children's personal information, we will take reasonable steps to make families aware of the change and obtain new consent where required.

The date at the top of this page shows when this policy was last updated.

28. Contact us

For privacy questions, data access requests, deletion requests or other concerns about TwoHearths, please contact:

Hearth & Hero Studios

via the Contact page at HearthandHero.com.

Please avoid including a child's private Worry Stone or other sensitive information in an ordinary email unless it is genuinely necessary.