Last updated: 4 November 2026. This page explains, in plain words, what personal data Little World collects, why, how long we keep it, and how you can ask us to change or delete it.
In short: You can use Little Sounds, Little Play, and Little Bites without an account. We do not sell personal data, we do not run advertising, and we do not use advertising trackers. We collect only what is needed to run the site, send a launch email you asked for, reply to feedback, or — if you create an account — keep your personal settings in sync across devices. You can ask us to delete your data at any time by emailing hello@littleworld.fyi.
Little World is a small set of mini apps for new parents, made in Singapore by Sprouthous and published at littleworld.fyi. This policy covers littleworld.fyi, Little Sounds at sounds.littleworld.fyi, Little Play at play.littleworld.fyi, Little Bites at bites.littleworld.fyi, and any future Little World app on a littleworld.fyi subdomain that links to this page.
For questions about this policy, or to make a request about your data, contact us at hello@littleworld.fyi. Please include the email address you used, so we can find the right record and verify that you are the account holder before we share or change anything.
We follow Singapore's Personal Data Protection Act (PDPA), which sets the rules for collecting, using, disclosing and protecting personal data in Singapore. Where this page says "personal data", it means information that can identify you, such as an email address.
When you visit any Little World page, our hosting provider, Cloudflare, may process technical information needed to deliver the page and keep the site safe, such as your Internet Protocol (IP) address, browser type, and the pages you request. We use this for security, for rate limiting (for example, to stop spam signups), and to fix errors. We do not use it for advertising, and we do not build an advertising profile about you.
If you sign up on a "Coming soon" card, we collect only your email address and which app you chose (for example, Little Movements, Little Signs, or Little Bites). The purpose is narrow: to send you one email when that app launches. We do not use this list for newsletters, marketing for other apps, or any other purpose without fresh consent from you. The form also says you can unsubscribe by replying to the launch email. After a launch email is sent, we delete that app's signup rows, or mark them as notified and then delete them. We do not merge this list into user accounts.
If you send feedback or email us, we receive what you send, including your message and, if you give it, your email address so we can reply. We use it only to reply and to improve the apps. We do not sell feedback, and we do not publish it with your name or email unless you explicitly ask us to. The feedback form on the About page sends your message to us via Brevo — it is forwarded to hello@littleworld.fyi only, is not stored on our server first, and is handled the same way.
Little Sounds can be used without an account. As a guest, your practise list, learned words and hidden words are stored only in your own browser (local storage) and are not sent to our server, except that flagging a word for review requires an account.
If you create a Little Sounds account today, we collect your email address and a hashed version of your password. "Hashed" means the password is turned into a one-way code using Password-Based Key Derivation Function 2 (PBKDF2) with many rounds — we never store your password in plain text, and we cannot read it back. We also store your account settings in our database: which words you marked as learned or hidden, words on your practise list, flags you submitted, and whether you are an admin or reviewer. A session cookie keeps you signed in for up to 30 days; it is set to be readable only by the server (HttpOnly), sent only over HTTPS (Secure), and limited to the Sounds subdomain. We do not collect a child's name or photo in Little Sounds, and we do not track which words a child looks at for advertising.
Little Play has no account today. Activities you save or mark as tried are stored only in your own browser (local storage) and are not sent to our server. They are lost if you change device or browser, or clear browser data, until account sync launches (see below).
Little Bites can be used without an account. As a guest, your feeding logs, solids logs, allergen and reaction logs, readiness checklist, and birth month and year are stored only in your own browser (local storage) and are not sent to our server. If you sign in with a Little World central account, those same items are stored against your account (not your email address directly) in the central account database, so they sync across devices. The polyclinic summary is made from your log entries and is not sent anywhere unless you copy or download it yourself.
Little Bites collects only the birth month and year of your child, as provided by you, so it can show age-appropriate foods. We do not ask for, and you should not provide, a child's full birthday, name, or photo. Feeding and allergen logs are health-related notes you choose to keep. They are general information for your own tracking, not medical advice, and they are not used for advertising or shared with other users.
What is not collected in Little Bites: a child's name, photo, exact birthday, school, or location; any other person's personal data; and any data from your private Little Bites app, if you used one before this public launch. The public app starts empty for everyone, including existing Little World users, unless you sign in and choose to import guest logs from that browser.
One Little World account signs in once and works across littleworld.fyi and Little Bites. Little Sounds still uses its own account today, and Little Play has no account today, so the Sounds and Play sections above are still accurate for those apps. When you choose to create a central account:
openid, email and profile only. We would not ask Google for your contacts, calendar, Drive files, or any other Google data, and we would not store a Google access token. Google's own handling of your Google account is covered by Google's Privacy Policy. A Google account would be linked to a Little World account by Google's stable account identifier, not by email alone, so an email match alone could never take over an existing account — an existing account would first need to be signed in with an email code, then linked from inside the account.Little Bites guest logs are not collected by the server until you sign in and choose to import them, as described in the Little Bites section above.
We use a small number of service providers, and only for the jobs named here. They do not receive data for their own marketing, and we do not sell data to anyone.
We will disclose personal data only if required by law, or to protect the security of the site and its users, and then only the minimum necessary.
Little World apps are for parents and guardians, not for children to create accounts on their own. Accounts are parent accounts. We do not knowingly collect personal data directly from a child. The only child-related information we collect is the birth month and year a parent provides, for age-appropriate content, as described above. We do not collect a child's name, photo, exact birthday, school, or location. If you believe a child has provided personal data directly, contact us at hello@littleworld.fyi and we will delete it.
We may keep a minimal record needed to prove a deletion request was handled, or required by law, but we will not keep your personal items after deletion for any other purpose.
We do not buy, scrape, or borrow email addresses. Every address on a contact list was given to us directly, for a specific purpose.
Notify me launch lists. At signup we check the email format and keep only one row per email and app, so duplicates are not created. Before a launch email is sent, we remove test addresses and any address that previously bounced or asked to unsubscribe. After sending, we check for bounces, remove bounced addresses, and remove anyone who replies to unsubscribe immediately. We then delete that app's list, so we do not keep a long-term list of people who did not engage with the launch email.
Accounts. We do not delete an account just because it has not been used recently — a parent may return after months, and deleting would destroy their saved words and activities. If an account email becomes undeliverable — for example, login codes repeatedly bounce — please contact us at hello@littleworld.fyi to correct it, after we verify your identity. Accounts are deleted on request, or if disabled for abuse, not for inactivity alone. When central accounts launch, we will also ask an account holder to update their email on next sign-in if delivery to that address has repeatedly failed.
Email campaigns, if sent through Brevo in future. Brevo automatically suppresses hard bounces, unsubscribes, and spam complaints, and we will not re-add a suppressed address. If we ever switch email providers, we will carry the suppression list over, so a suppressed address is not mailed again by the new provider.
Under the PDPA, you may ask us to:
To make a request, email hello@littleworld.fyi from the email address on the account, or tell us enough to identify the record. We will verify your identity first, so we do not share or change another person's data by mistake, and we will respond within 30 days, as the PDPA requires for access and correction requests. If we cannot meet a request in full, we will explain why. You can also delete your own central account from the Little Bites account panel, and that deletion will cover your profile, your Little Bites logs and readiness checks, and your Play saved and tried items. If you also have a separate Little Sounds account today, contact us to ask for that to be deleted separately, as Sounds has not moved to central accounts yet.
We protect personal data with measures proportionate to a small site: all pages are served over HTTPS; passwords and login codes are hashed, never stored in plain text; session cookies are set HttpOnly and Secure; sign-in attempts and signups are rate-limited; access to account data is limited to the site operator, with separate reviewer and admin permissions for dictionary editing and user management; and service providers are used only for the jobs in section 3. No system is completely secure, so if you believe your account may have been accessed by someone else, email us immediately and sign out everywhere if you can.
If we change this policy, we will update the date at the top of this page and post the revised version here. For material changes — for example, a new kind of data collected, or a new service provider — we will highlight the change on this page. Continued use of Little World after a change means you accept the revised policy. If a change affects an account you already hold, we will not use your existing data for a new purpose without fresh consent where the PDPA requires it.
Questions, requests, or complaints about privacy: hello@littleworld.fyi, or via the About page. If you are not satisfied with our response, you may contact Singapore's Personal Data Protection Commission (PDPC).