Privacy policy
Effective from 21 October 2026, updated 23 October 2026 (online shop littlebigheart.store, app language, notice emails, backups)
This policy explains what data is collected when you use the little big heart app and box, why, how long it is kept and what rights you have over your data. It applies to the web app, the Android app published on Google Play, and the website and online shop littlebigheart.store.
little big heart is a message box for adults and families. It is not a security, surveillance or tracking device. All data described here is needed so that your message and photo reach the box and so that you can see whether it arrived.
1. Data controller
Watchdog OÜ (registry code 17537572)
Sepa tn 4-2, 71003 Viljandi, Estonia
Email: info@look360.eu
If you have any questions about this policy or your data, write to info@look360.eu.
2. What data we process
2.1 Account
You can create an account yourself (with an email code or your Google account), or one is created when you open an invite link or a personal link made by the box owner.
- The name you enter when joining or change later in settings.
- The app language you choose (or that the app takes from your device's language), so that email codes, notice emails and notifications reach you in your language.
- A profile picture, if you add one (optional). It is stored as a square JPEG without the original photo's metadata (such as EXIF) and shown on the box screen next to your name.
- A sign-in token: a long random code that works instead of a password. The server only keeps a hash of it, not the code itself.
- Your email address, if you add it in Settings (optional). We send a 6-digit code to it to confirm the address and to sign you in. We also send a notice when someone asks to join your box or when a box owner answers your request. We do not send advertising or newsletters.
- A password, if you set one (optional). We do not keep the password itself, only a hash calculated from it.
- Your Google account ID and its email address, if you link your account with Google (optional).
- Signed-in devices: how you signed in (email code, password or Google), when you signed in and when the device was last used. We only keep a hash of the device's sign-in code.
- Which boxes you belong to and in what role (owner or sender), when you joined and when you confirmed that you are an adult.
- When you last used the app.
2.2 Messages (as a sender)
- The message text (up to 240 characters).
- A photo or a video of up to 15 seconds, if you add one. Photos are resized and saved as JPEG without the original file's metadata. Videos are converted into a format the box can play.
- The heart colour, the time of sending and, for scheduled messages, the chosen delivery time.
- Events about your message: when it was read, whether a heart was sent back from the box and whether it was marked as a favourite.
2.3 As a box owner
- Everything listed in 2.2 for all messages sent to your box.
- The list of box members (names, roles, joining time) and the invite links you have created.
- The technical status of the box, so you can see whether it is online.
2.4 Asking for an invite
If you ask a box owner for an invite, we store the owner's email address you entered, your message (if you wrote one), when you asked and the status of the request (pending, accepted, declined or cancelled). If a box owner with that email exists, we send them a notification and an email, and they see your name, email and message. If someone asks you for an invite, you see their name, email and message and can accept or decline the request. We do not tell the person asking whether a box owner with that email exists.
2.5 What the box sends to the server
The box checks for new messages about every 10 seconds and sends a technical status report about every 10 minutes: firmware version, uptime, Wi-Fi signal strength, the reason for the last restart, free memory, memory card status, the number of messages and favourites on the card (as a count, not content) and short technical log lines. The box does not send data about opening the door or touches.
2.6 Notifications
If you allow notifications, we store your device's notification subscription address (in the Google Play app, the Firebase Cloud Messaging registration token) so that we can tell you when a message was read, a heart was sent back or a message became a favourite.
2.7 Server log
For each request the server records the IP address, the time and the address requested. We use this for security, troubleshooting and limiting excessive requests.
2.8 What we do not collect
We ask for your email address if you create an account with your email, add it for signing in or ask for an invite (sections 2.1 and 2.4). The app does not ask for your phone number; an order in the online shop asks for it for parcel delivery (section 2.9). We do not collect location or contacts. The app contains no analytics or advertising code. We do not sell your data or share it for marketing.
2.9 Orders in the online shop littlebigheart.store
If you order a box on littlebigheart.store, payment takes place on Stripe's payment page. For each order we receive your name, email address, phone number, billing address, the chosen Omniva parcel locker, frame colour, quantity and amount, a VAT number for business buyers, and the time and status of the payment. Card details stay with Stripe and never reach us.
2.10 Notice of withdrawal
If you use the "Withdraw from contract" form, we receive your name, email address, order details, any additional information you write, the time the notice arrived and your IP address. We send a confirmation with the content of your notice to your email.
2.11 Website
The website littlebigheart.store is hosted on GitHub Pages (GitHub Inc.). When a page is opened, GitHub sees the visitor's IP address and technical browser data. The website has no cookies and no analytics or advertising code.
3. Purposes and legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account (name, token, membership) | Using the app and the box, identifying the right person | GDPR Art. 6(1)(b), performance of a contract |
| Profile picture | Showing your picture next to your name on the box screen | GDPR Art. 6(1)(a), consent (you add and remove it yourself) |
| Messages, photos, videos | Delivering the message to the box and showing it | GDPR Art. 6(1)(b), performance of a contract |
| Events (read, heart, favourite) | The sent messages view and notifications | GDPR Art. 6(1)(b), performance of a contract |
| Email, password hash, Google account, signed-in devices | Creating an account and signing in, including on another device or after signing out | GDPR Art. 6(1)(b), performance of a contract (you add and remove them yourself) |
| Invite requests (owner's email, message, status) | Asking for an invite and the owner's decision | GDPR Art. 6(1)(b), performance of a contract (you start it yourself) |
| Notification subscription | Sending notifications to your device | GDPR Art. 6(1)(a), consent (the device's notification permission) |
| Box technical status and log | Keeping the service running and investigating faults | GDPR Art. 6(1)(f), legitimate interest |
| Server log (IP address) | Security and preventing misuse | GDPR Art. 6(1)(f), legitimate interest |
| Order data (section 2.9) | Fulfilling the order, delivery and customer communication | GDPR Art. 6(1)(b), performance of a contract |
| Order and payment data in our accounts | Meeting accounting and tax obligations | GDPR Art. 6(1)(c), legal obligation |
| Notice of withdrawal (section 2.10) | Handling the notice and sending a confirmation | GDPR Art. 6(1)(c), legal obligation (Law of Obligations Act) |
4. Who receives data
- The box owner and the people near the box see the messages sent to it. That is what the service is for.
- If you ask for an invite, the box owner sees your name, email and message (section 2.4).
- The server is located in Estonia and run by us. The connection to the server goes through Tailscale Inc. and Cloudflare Inc. A connection through Cloudflare (app.littlebigheart.store) is opened on Cloudflare's server so that it can be passed on to our server; both see technical connection data such as the IP address and time.
- Every night we make a backup of the server data (accounts, messages, photos and videos, shop orders). The backup is encrypted with our key (AES-256) before it leaves the server and is stored in a data centre of Oracle's cloud service (Oracle Cloud Infrastructure) in Stockholm, Sweden. Oracle only stores the encrypted file and cannot see its contents.
- Payments in the online shop are processed by Stripe (Stripe Payments Europe Ltd, Ireland), which receives the order and payment data (section 2.9). Stripe also processes data as an independent controller, for example to prevent fraud.
- For parcel delivery we pass your name, phone number, email and parcel locker to Omniva (AS Eesti Post).
- Technical data about website visits is seen by the website host GitHub Inc. (section 2.11).
- Notifications are delivered by your device's or browser's push service (Google on Android and in Chrome, Apple on Apple devices, Mozilla in Firefox, Microsoft in Edge). The notification content is encrypted; the service sees the time of sending and the target device. In the Google Play app, notifications are delivered by Google's Firebase Cloud Messaging, which sees the notification title and text.
- Emails with sign-in codes are sent through our email provider Elkdata OÜ (veebimajutus.ee, Estonia).
- If you sign in with Google, Google confirms your account ID and email address to us. We do not send your messages or any other data to Google.
These providers may process data outside the European Union. If you do not allow notifications, nothing is sent to push services and the rest of the app works the same.
5. How long we keep data
| Data | Retention |
|---|---|
| Account data | Until the account is deleted |
| Messages, photos and videos | Until the sender deletes their account, the recipient deletes the photo on the box or the box is reset to factory settings |
| Box technical log | 180 days, up to 500 lines per box |
| Invite links | 30 days after they expire or are used up |
| Notification subscription | Until you turn notifications off or the push service reports that the subscription is no longer valid; if no notification is delivered for 12 months, it is deleted automatically |
| Email, password hash, Google account | Until you remove them in Settings or delete your account |
| Signed-in devices | Until you sign out, the box owner renews your link or you delete your account |
| Sign-in code | Valid for 10 minutes, deleted at the latest 6 hours after it expires |
| Invite requests | A pending request for up to 30 days; an accepted, declined or cancelled request 30 days after the decision |
| Order and payment data | 7 years from the end of the financial year (Accounting Act) |
| Notices of withdrawal | 3 years from receipt (limitation period for possible claims) |
| Server log (IP address) | 90 days |
| Backups (encrypted) | 14 days; if no new backups are made in the meantime, the 7 most recent are kept. Deleted data may remain in the backups during this period. |
Photos already saved on the box's memory card stay on the box until the recipient deletes them there or resets the box to factory settings.
6. Your rights
You have the right to access, correct and delete your data, restrict its processing, receive it in a machine-readable format and object to processing (GDPR Art. 15-21; in the United Kingdom, the same rights under the UK GDPR). We reply within one month.
In the app: Settings → Your account
- "Download my data" gives you a zip file with your profile and the messages you have sent.
- "Delete my account" immediately deletes your account and all your data from the server. Details: account deletion.
You can also send a request to info@look360.eu.
If you are a box owner, deleting your account does not delete the box or other members' accounts. All data of a box is deleted when the box is reset to factory settings.
7. Complaints
If you think your data has been processed incorrectly, please write to us first. You also have the right to contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. If you live in another EU or European Economic Area country, you can also contact that country's data protection authority; in the United Kingdom, the Information Commissioner's Office (ico.org.uk).
8. Age limit
Accounts are for adults. When joining, you confirm that you are at least 18 years old. We do not ask for a date of birth. Children may look at messages on the family box screen, but they do not create accounts or send us any data.
9. Data on your device and on the box
The app keeps your sign-in token and language choice in your device's browser storage (in the Google Play app, in the app's own storage). They are removed when you sign out, clear the browser data or uninstall the app. The Google Play app also keeps a newer version of the app's web code, which it downloads from our server. The box keeps recent messages and favourites on its memory card so they can be viewed in the gallery.
10. Security
The connection between the app, the box and the server is encrypted (https). Sign-in tokens, invite links and box keys are stored hashed or encrypted on the server. Messages can only be seen by box members who are entitled to see them. Excessive requests are rate-limited.
11. Changes
We will announce significant changes in the app. The current version is always on this page.