Privacy by design
Your memories belong to you.
TenderShots deals with some of the most personal photographs a family owns. So privacy isn’t a setting or a policy page you have to find. It’s how the product is built.
How this preview handles your photographs
Specific, and true of the studio you can use today.
01
Editing happens on your device
When you choose a photograph, your browser opens it. The enhancement, the looks and the decorations run in a background thread of this page. While you edit, the photograph isn't sent anywhere.
02
Faces are found on the device, too
Face protection uses MediaPipe's face detector, running in your browser. Its model and runtime are served from this site, so not even the detector is fetched from someone else.
03
You choose where a memory is kept
Without an account, saved memories stay in this browser's own storage (IndexedDB) and nowhere else; clearing this site's data removes them. With an account, pressing Save uploads that one memory, its original and its TenderShot, so you can see it on any device. Nothing is uploaded until you press Save.
04
Encrypted, and only yours
Photographs in an account are encrypted in your browser (AES-256-GCM, a fresh key for every memory) before they're uploaded, and can only be opened by you, signed in. Not even the TenderShots team can see them. There are no public profiles, no feed and no share links.
05
Location and camera details are left behind
A phone photograph carries hidden metadata: where it was taken, when, on what. Before anything is kept, downloaded or shared, it's redrawn at full size without it, the original included.
06
Yours to take, or to delete
From your account, download everything as one ZIP, every TenderShot with its original. Delete a memory, or the whole account, at any time: the photographs are erased from our storage, not hidden.
07
No tracking
The only cookie is the one that keeps you signed in, plus the sign-in token Privy keeps in your browser. No analytics, advertising or tracking scripts, and fonts are served from this site.
08
No training on your photographs
Nothing you make or keep here is used to train any model. If that ever changes, it will be opt-in, explained in plain words, and off by default.
The principles, for every version to come.
- Photographs private by default
- No public baby profiles
- No public feed
- No selling of photographs, ever
- Clear consent around model training
- As little image data kept as possible
- Secure processing
- Unnecessary metadata removed
- A plain account of how photographs are handled: this page
In your hands, always.
Delete a single memory, or your whole account, at any time. Download everything, with every original, whenever you like.
The details, in plain words.
Last updated 9 October 2026
Who looks after your data
TenderShots, a product of Neonatal DAO, is responsible for the personal data described here.
What we keep, and why
- Your account: your name, the email (or wallet) you sign in with, and the id our sign-in provider, Privy, gives you. We never see or store a password.
- Your children’s details, if you add them: a name and a birthday or due date, to remind you of milestones.
- The memories you keep: each original (without location or camera details), its TenderShot, and the words and dates you add. Encrypted, for you alone.
- Sign-in records: which devices are signed in (the browser name and when), so you can see and sign them out; and a short history of what you did, shown on your account page.
- Messages you send us through the contact form, so we can reply.
- Network addresses, briefly (15 minutes), only to stop abuse of sign-in and the contact form.
Who else handles it
Only the companies that run TenderShots for us: Privy, which handles signing in (your email or wallet, and the one-time codes it sends you), and our hosting, database, photo storage and email providers. They store or carry data on our instructions and for no other purpose. Photographs reach our storage provider already encrypted, so it can’t see them. We never sell personal data, and we don’t use advertising or analytics services.
How long we keep it
As long as you have an account. Delete a memory and its photographs are erased straight away; delete your account and everything goes with it. Encrypted backups, kept to protect against data loss, roll over within 30 days. Signing in on a device lasts 30 days from when you last used it.
Your rights
You can see, download, correct and delete your data yourself, from your account, at any time. You can also ask us for any of these, or object to how we use your data, through the contact page. We’ll answer within a month. If you’re not happy with our answer, you can complain to your data protection authority.
Children
TenderShots is for parents and other adults. Children don’t have accounts: their photographs and details are kept by the adult who adds them, and are never shown to anyone else.
Cookies
One: the cookie that keeps you signed in, alongside the sign-in token Privy keeps in your browser’s storage. Both are essential, so there’s nothing to accept or decline.