Privacy Policy

BackToYou is a children's safety NFC keychain product operated by Tian Chen, sole proprietor, based in New York, United States. Our website is backtoyoubty.com. You can reach us any time at support@backtoyoubty.com. For safety or tag-specific questions, email safetytag@backtoyoubty.com.

For the purposes of applicable data protection law, Tian Chen, sole proprietor is the controller of the personal information described in this policy.

Account information

• First name and last name
• Email address
• Phone number for your account
• Password — stored only as a salted cryptographic hash. We never store or have access to your password in plain text.
• The date and time you agreed to our Terms of Service and this Privacy Policy

Tag information (entered by you, the parent or guardian)

• Child's first name
• Parent phone number, and an optional second phone number
• Optional photo of the child
• Optional notes for a finder, and optional medical notes
• An alert email address for location notifications

Usage and security data

• When a tag is scanned, and when a finder chooses to share their location
• IP addresses, used strictly for security, abuse prevention, and rate limiting
• Basic technical information such as browser user agent for troubleshooting and abuse prevention

Payment information

We do not collect or store payment card information. Payments are processed by third-party payment providers under their own terms and privacy policies.

• To display your child's information on their unique, private tag page when the keychain is tapped by a finder
• To send SMS alerts to the registered parent when someone taps the tag or shares their location
• To send email alerts to your registered alert email when a location is shared
• To operate, maintain, secure, troubleshoot, and improve the BackToYou service
• To respond to your support requests
• To comply with legal obligations and to enforce our Terms of Service

We never use your data for marketing or advertising, and we do not run behavioural advertising or ad tracking on our site.

• We never sell your personal information to third parties.
• We never track your child's location. Location is only ever shared when a finder explicitly taps the "Share Location" button on the tag page, and that location is forwarded directly to the parent. We do not build location histories and we do not retain shared locations beyond what is needed to deliver that single alert.
• We never share your information with anyone except the service providers we need in order to operate the service, or where we are legally required to do so.

We use a small number of vendors who process data on our behalf under their own privacy terms:

• Supabase — database and file storage. supabase.com/privacy
• Twilio — SMS delivery. twilio.com/legal/privacy
• Resend — email delivery. resend.com/legal/privacy

We may also disclose information if required by law, subpoena, or valid legal process, or where necessary to protect the safety of a child or any person. If BackToYou is ever involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, and we will notify registered users by email before their information becomes subject to a different privacy policy.

BackToYou is designed for and directed at parents and legal guardians — not children. We do not knowingly collect personal information directly from children, and children are not permitted to create accounts.

All information about a child (first name, optional photo, optional notes, optional medical notes) is entered into the service by the parent or legal guardian who created the account, and that parent or guardian provides verifiable consent for that collection and display by creating the account and registering the tag. We do not knowingly collect personal information from children under 13. We collect only the minimum child information necessary to help a finder reunite a child with their parent, and we do not condition use of the service on providing more child information than is reasonably necessary.

A parent or guardian may review, correct, or delete their child's information at any time from their dashboard, or by emailing support@backtoyoubty.com. If you believe a child under 13 has provided us information directly, contact us and we will delete it promptly.

We retain your data for as long as your account is active. You can delete your account and all associated data at any time by contacting us at support@backtoyoubty.com. Tag data — including the child's name, photo, phone numbers, and notes — is removed immediately when a tag is cleared or deactivated, and the stored photo is deleted from our file storage at the same time.

We may retain limited security records (such as rate-limiting and login attempt logs) for a short period for fraud and abuse prevention, and we may retain records we are legally required to keep.

We use industry-standard security measures, including encryption in transit (HTTPS), encrypted password storage, row-level security on our database, restricted server-side access to sensitive data, mandatory two-factor authentication on accounts, and rate limiting on all public endpoints.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.

You have the right to access, correct, export, or delete your personal data, and to withdraw consent for SMS or email alerts at any time. Most of this you can do directly from your dashboard; for anything else, email support@backtoyoubty.com and we will respond within 30 days.

Depending on where you live, you may have additional rights (for example under the California Consumer Privacy Act). We do not sell or share personal information for cross-context behavioural advertising, and we will not discriminate against you for exercising any privacy right.

You can stop receiving SMS alerts at any time by replying STOP to any BackToYou message, and resume by replying START. Stopping SMS alerts may mean you no longer receive notifications when your child's tag is scanned.

BackToYou is operated from the United States and our service providers store data in the United States. If you use the service from outside the United States, you understand that your information will be processed in the United States.

We may update this policy from time to time. We will notify registered users by email of any significant changes, and the "last updated" date at the top and bottom of this page will always reflect the current version. Continued use of the service after a change takes effect means you accept the updated policy.

Questions, requests, or complaints: support@backtoyoubty.com. Safety or tag-related matters: safetytag@backtoyoubty.com. You can also use our contact page. See also our Terms of Service.