Version: 2026-10-11-1. This policy accompanies the Terms and parent notice presented in LittleVoice. Your account keeps the version you acknowledge.
BNS Development Inc. operates LittleVoice, an adult app and connected device for private family voice messages. This policy covers that service and our website and support. Our designated privacy contact is:
Privacy Officer, BNS Development Inc.
35 Woodstock Road SW, Calgary, Alberta T2W 5V8, Canada
info@bnsdevelopments.com · +1 403-269-1755
The main points
- App accounts belong to adults. A parent or legal guardian must authorize a child's participation through the separate parent-notice and verification process. Accepting Terms or verifying an email alone does not establish parental authority.
- We process recordings to deliver family messages. Application hosting and voice storage are in the United States. Audio is processed on our servers and is not end-to-end encrypted.
- Free recordings normally expire after 30 days. An explicitly selected archive option can extend access. The app shows deadlines; favourites alone do not extend retention.
- We do not sell or rent personal information, use child information for targeted advertising, or use family recordings for general AI-model training or voice cloning.
- Parents can request access, correction or deletion of their child's information and refuse further collection. See the choices and contact methods below.
What we collect and why
| Information | Purpose |
|---|---|
| Adult email, name, account/session identifiers, household roles, language and settings | Sign in, manage access, provide the selected service and respond to requests |
| Parent-provided child nickname, family/device association and settings | Route messages and operate the child's device; use a nickname rather than a full name where possible |
| Family contacts, adult email, relationship/nickname, invitations, approvals and optional contact photo or spoken name | Maintain the approved circle and help identify the intended contact; we do not read your phone's address book |
| Voice recordings and playback conversions; sender/recipient, duration, timestamps, expiry, delivery and listening events | Deliver, play, download and delete private messages |
| Device identifiers, software versions, setup/connectivity events, push tokens, IP/request information, authentication and security records | Connect the app/device, deliver optional notifications, diagnose faults and prevent abuse |
| Signed parent form, adult name/email/account reference, signature/date, notice version and review decision | Establish parental authorization before child activation; no government ID or child's photograph is requested |
| Support and privacy correspondence and proportionate identity/authority checks | Resolve requests and exercise privacy rights |
| Website requests, sign-in/language preferences, adult contact-form details and device-order information | Operate the website, reply to enquiries and process device orders; checkout presents the purchase-specific disclosures |
We do not request a child's birth date, email, school, precise GPS location, contact book or photograph. Network information can indicate approximate location. Voice messages can incidentally contain other voices, background sounds or sensitive details; share only what is appropriate and authorized.
Recording and use
The app accesses the microphone when an adult chooses to record. The device records during defined interactions, such as after a button press or prompt; it is not designed as an always-listening room monitor. Audio may be captured locally before confirmation. An unconfirmed message is discarded; a confirmed message may remain queued on an offline box before upload.
We check and convert uploaded audio for playback. This is not semantic moderation, speaker identification or a voiceprint. The current service does not provide cloud transcription, translation, voice cloning or an AI companion.
We use the information above for the described messaging, account, verification, security, support and deletion purposes. Operational measurements help us manage capacity and faults; identifiable logs and hashed identifiers are not treated as anonymous merely because they lack a name. A new optional purpose requires its own notice and any required consent before use.
Who receives information
Your family circle. Approved adults receive messages according to the permissions a parent selects. Active household parents and guardians can review both directions of a child's conversations. Trusted members access their own conversations. A parent's review does not mark a recording as listened to by its intended recipient. Authorized downloads and exports can contain recordings, names, contact details and activity. Recipients can keep copies, and people near a speaker can hear playback.
Service providers. The current service uses these services for the functions listed:
| Service | Information and function |
|---|---|
| Hetzner | Application/database hosting in the United States; service account, device and message data |
| Cloudflare | Network protection and Tunnel, request metadata, private R2 objects and service email; current voice storage uses U.S. jurisdiction |
| Expo, with Apple and Google push delivery | App notification tokens, delivery metadata and notification text; this can include the child's nickname and message duration, but not the recording itself |
| Vercel | Website hosting and request handling, including a country estimate used to display the relevant offer |
| Formspree | Website contact-form name, adult email, topic, optional order number and message so we can respond |
| Shopify and its checkout/payment services | Device product/cart and checkout processing, adult order contact/delivery/payment information and order status; device purchases are separate from the currently unavailable paid archive subscription |
These providers operate internationally; the U.S. location of our server or storage bucket does not mean every network, email, push or support operation occurs there. Contact our Privacy Officer for information about our provider arrangements and foreign processing. We remain responsible for the obligations applicable to our use of providers. Foreign authorities may access information under their local laws.
BNS conducts parent-form review; we do not send forms to an identity-verification vendor. Do not send identification or child recordings by ordinary email. We can arrange a proportionate secure process if a particular rights request needs additional verification.
We may disclose limited information when required by a valid legal obligation or permitted to address a credible security or safety concern. We evaluate such requests rather than granting unrestricted access. A business transfer must respect applicable privacy obligations and existing commitments; it does not authorize unrelated use of child recordings. We do not disclose child information for independent marketing or cross-context behavioural advertising.
Retention and deletion
The following rules describe the service's actual retention triggers. Validity of a token or link is distinct from erasure of its database record or underlying file.
| Information | Retention and deletion |
|---|---|
| Free recordings and playback copies | Normally 30 days from the accepted original recording time; current device messages without a reliable original timestamp use first server receipt. The app shows expiry. |
| Archive-protected recordings | The optional no-card trial lasts 14 days, followed by 14 days to download trial-protected recordings. New grace-period recordings follow the free rule. Future paid offers require separate purchase terms. Manual deletion overrides archive protection. |
| Temporary hosted exports | Access lasts up to 24 hours, shortened by underlying expiry or revoked access. An hourly cleanup job removes expired exports; failed removal is retried. |
| Deleted or expired audio and upload remnants | Access is blocked when deletion is accepted or expiry applies. Cleanup jobs normally run every five minutes and retry failures. Previously issued object download links can remain usable for their short lifetime, normally five minutes. We do not promise physical removal by the next job if a storage service is unavailable. |
| Restricted backups | Separate operational aging target of 35 days. Failed backup pruning or restoration work can delay physical erasure. Deletion records and isolation/recovery procedures are used to keep restored erased information out of ordinary service; a backup is not a means to recover a deleted recording for a user. |
| Signed parental form | Unreviewed submissions expire after 30 days. The active image is removed on review, withdrawal or expiry. Backups age separately. The account keeps a minimized versioned decision/notice receipt to establish the authorization history; account deletion removes the account receipt. |
| Active account, family, contact, nickname, session and notification records | Kept to operate and secure participation until removed or the account is deleted. Expired sessions do not authorize access but their database rows do not currently have a separate age-based deletion schedule. Unused guest starts with no participation are pruned after 30 days. |
| Login codes and recovery challenges | Expire promptly for authentication; a daily job removes records more than a day past expiry. |
| Family-service emails and cost/security counters | Email records are removed after 30 days and sensitive payloads cleared at a terminal delivery outcome. Daily billable-usage records are pruned after 35 days; monthly records after 13 months. |
| Terms/safety receipts, security audit and support records | Terms/safety receipts follow account deletion. Limited security and operational audit records, such as event identifiers, listening timestamps and recognition or session activity, can remain after account identifiers are removed; there is no automatic fixed-age purge for all such records. Support and rights-request records are reviewed for the actual request, security or legal purpose. Contact us for access or deletion; these records are not promised the audio's 30-day expiry. |
| Runtime application logs | Production container logs rotate at a bounded size, rather than a fixed number of days. Provider logs and backups have separate handling. |
We limit retention to the stated purpose. A specific legal preservation requirement may require restricted information to be kept longer; it must not become a general indefinite archive of child recordings. Contact us about overdue deletion or information no longer needed; a technical failure does not remove our duty to address it.
Removing a contact stops participation but does not automatically erase every past message. Account deletion removes owned-household recordings and that adult's sent/received recordings, affecting other participants. Read the app's deletion confirmation.
An offline box receives deletion instructions when it reconnects; it cannot be erased remotely while disconnected. Independently saved recipient files or recordings of playback are outside our direct control. Protect downloaded copies. Before transfer or disposal, use the supported removal/erasure process or contact us. Changing Wi-Fi alone does not erase family information.
Your choices and children's rights
Use the available app controls for contacts, notifications, downloads and deletion. A verified parent or guardian can review the child's information, ask for correction or deletion, or refuse future collection. Contact info@bnsdevelopments.com, phone +1 403-269-1755, or write to the address above. Include “LittleVoice privacy request” and enough account information to locate the request; do not include a login code or sensitive recordings.
Parental authorization can be withdrawn in Legal settings without accepting changed Terms. This stops new child messaging for families the account owns. Existing recordings keep their ordinary expiry unless separately deleted; you may request deletion at the same time. We explain which necessary features must stop. Optional notification permission can be declined separately.
We verify identity/authority proportionately and respect other people's rights, applicable custody restrictions and a capable child's independent rights. A request does not require account deletion or purchase. We respond within applicable legal deadlines and explain any lawful extension, refusal or available complaint route. Ordinary app recipient permissions do not defeat a verified parent's legal access rights.
Canadian complaints may be made to the applicable privacy regulator, including the Office of the Privacy Commissioner of Canada, Alberta or British Columbia's Information and Privacy Commissioner, or Quebec's Commission d'accès à l'information. U.S. users may contact the FTC or their state attorney general. Statutory rights that apply to you continue to apply whether or not individually listed here.
Technical storage, communications and safeguards
The app and website use technical storage for authentication, preferences and security. The website uses Vercel’s country estimate to show Canadian or U.S. offers; its former country-selection cookie is no longer used. The adult web-account language preference cookie lasts up to one year. Shopify supplies the device cart/checkout and its related technical storage. You can remove browser cookies through browser settings. Optional shopping analytics are described in the website supplement below; embedded service providers still receive requests. On-device credentials use protected system storage; notification settings are controlled in the app and operating system. Logging out revokes the session online or queues revocation when offline. Downloaded or shared files may remain with the recipient you choose.
Necessary sign-in, security, privacy and service notices are separate from optional promotions. Any promotional email needs its own applicable choice and unsubscribe method; we do not send marketing to a child's profile or box.
We use encrypted transport, restricted access, private storage and other safeguards. Authorized staff or providers may need access to operate, secure or support the service or respond to lawful requests. No system is perfectly secure. We investigate incidents and notify people and authorities when required.
We identify policy versions and give appropriate notice of material changes. Before materially changing child-information practices, we give a new direct notice and obtain renewed authorization where required. Updating this policy alone does not authorize a new use of existing recordings.
Shopping website analytics — October 12, 2026
This website supplement applies to the shopping website and Shopify checkout. It does not add analytics to the LittleVoice app, family accounts, recordings or parent-verification pages.
If you choose Allow analytics on the shopping website, Google Analytics helps us understand page visits, product views, successful cart additions, checkout clicks and successful contact-form submissions. We send event details, product identifiers, quantities, currency and amounts. We do not send contact-form contents, names, email addresses, payment details, family recordings or sign-in links to Google Analytics. Page addresses exclude query strings and private account routes. We separately send validated public campaign labels (source, medium, campaign name or ID, creative label and keyword label) from tagged marketing links, so we can understand which campaigns bring visitors. Unrelated URL parameters and advertising click IDs are excluded. Google receives technical request data and uses analytics identifiers/cookies to measure visits; this can include device/browser information and an approximate location derived by Google. These reports are not anonymous at the point of collection.
Analytics is optional. Choosing No thanks does not affect ordering. Use Privacy choices on shopping pages to change your choice at any time. Your choice is saved in this browser. Google advertising personalization and Google signals are disabled; we do not use this integration for advertising audiences.
Shopify checkout has separate privacy controls. Where analytics processing is permitted there, our checkout integration sends checkout-start and completed-order events to the same LittleVoice Google Analytics property. Order events include an order identifier to prevent duplicate purchase counts, product quantities, currency, amounts, tax and shipping. They exclude billing and delivery addresses, customer contact details and card information. Website and checkout reports may not connect the same visit across both domains, and consent choices or blockers can cause some activity to be absent.
Google processes this information as our analytics provider and may process it outside your country. For privacy requests or questions about website analytics, contact info@bnsdevelopments.com. The other privacy-policy sections continue to explain account information, service providers, retention and your rights.