Privacy Policy

Last updated: March 2026

1. Who is responsible for your data

The controller responsible for data processing in connection with LittleCast is:

Ziemowit Möller
Am Goldberg 39
D-23843 Bad Oldesloe
[Ziemowit@posteo.de]

2. The short version

LittleCast does not collect your personal data. We have no servers, no user accounts, and no analytics. Everything stays on your device. If you are looking for what data we hold about you — the answer is none.

3. What data LittleCast processes and where it stays

All data created or used by LittleCast is stored exclusively on your device using iOS system storage (SwiftData) and iOS Keychain. This includes:

Data	Where stored	Who can access it
Tonie account email	iOS Keychain	You only
Tonie access token	iOS Keychain	You only
Podcast feed URLs you have added	Device only	You only
Tonie preferences (selected feeds, auto-sync settings)	Device only	You only
Sync history	Device only	You only

LittleCast does not use child profiles. No names, ages, or any information about children is collected or stored by the app.

We have no access to any of this data. It never leaves your device in a form that reaches us.

4. Outbound connections your device makes

When you use LittleCast, your device connects directly to the following third-party services:

Tonie Cloud (Boxine GmbH)

Purpose: viewing and managing content on your Creative Tonie figures
Data transmitted: your Tonie account credentials (login only), audio files you choose to sync
Controller: Boxine GmbH, Düsseldorf, Germany
Privacy policy: tonies.com/privacy

Podcast RSS feeds

Purpose: fetching the podcasts you have chosen to add to your library
Data transmitted: a standard HTTP request containing your device's IP address
Controller: the respective podcast publisher

Podcast Index (Podcastindex.org)

Purpose: anonymous podcast search
Data transmitted: your search query, your device's IP address
No account, no tracking
Privacy policy: podcastindex.org

GitHub (Microsoft Corporation)

Purpose: fetching our publicly available featured feeds list
Data transmitted: your device's IP address
Read-only anonymous request
Privacy policy: docs.github.com

5. Legal basis for processing (GDPR Article 6)

Contractual necessity (Art. 6(1)(b)) — your Tonie credentials are used solely to perform the service you have requested
Legitimate interest (Art. 6(1)(f)) — anonymous connections to Podcast Index and GitHub are necessary for the app's core functionality and carry no meaningful privacy impact

6. Data relating to children

LittleCast does not collect, store, or process any personal data relating to children. The app manages audio content on Tonie figures but does not ask for, record, or transmit any information about the children who use those devices. No child profiles exist within the app.

7. Data retention

Data stored on your device is retained until you delete it, uninstall the app, or erase your device. Signing out removes your credentials and Tonie preferences. Your podcast feed library is retained after sign-out as it contains no personal data.

We have no retention schedule because we hold no data.

8. Your rights under GDPR

Right of access (Art. 15) — we hold no data about you, and will confirm this in writing upon request
Right to rectification (Art. 16) — correct any data directly within the app
Right to erasure (Art. 17) — sign out or uninstall the app
Right to restriction (Art. 18) — not applicable
Right to data portability (Art. 20) — not applicable
Right to object (Art. 21) — not applicable

To exercise any of these rights, contact us at [Ziemowit@posteo.de]. We will respond within 30 days.

9. Data transfers outside the EEA

When your device connects to Tonie Cloud, Podcast Index, or GitHub, your IP address and request data may be processed on servers outside the EEA, including in the United States. These transfers are governed by the privacy policies of those services, not by us.

10. Security

Your Tonie credentials are stored using iOS Keychain (AES-256 encryption, hardware security where available). All connections use HTTPS. We have implemented no additional security measures because we receive no data.

11. Supervisory authority

If you believe your rights have been violated, you may lodge a complaint with your local data protection authority. In Germany: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI).

12. Changes to this policy

We may update this policy if LittleCast's functionality changes. The date at the top reflects the most recent update. Continued use constitutes acceptance of the current policy.

13. Contact

Ziemowit Möller
[Ziemowit@posteo.de]