Cutiko holds your children's photos and your family's story. In short, this is what we do with them:
This is a summary. The full policy below has the details, including how long we keep each thing.
Last updated: 19 October 2026
Cutiko is made by Surfy Ltd, a company registered in England and Wales (company number 15026168), registered office at 14-2e Docklands Business Centre, 10-16 Tiller Road, London, E14 8PX, United Kingdom. When this page says we, it means Surfy Ltd.
Cutiko is a place for a family's memories of their children. That is private by nature, so this page says plainly what we hold, who can see it, and how to take it back. If anything here is unclear, write to us on the contact page.
Your email address. It is your account. You sign in with a six-digit code sent to it; there are no passwords. We use it for sign-in codes, for messages about your plan, and to tell you when someone adds you to a family's space. We do not send marketing.
Your family and children. The name you give your family, and for each child a name and a date of birth. You enter these; we never ask for more than that.
The story. Everything you post: captions, the time a moment happened, feeds, sleeps, nappies, medicines and their doses, milestones, reminders, and the photos and videos you attach. Where you have brought a story over from another app, the import is kept in the same way, with a note of which app it came from.
Photos and videos. Photos are resized in your browser before they are uploaded, and the hidden data a camera writes into a photo, including where it was taken, is dropped at that point and never reaches us. Videos are uploaded and converted on our server to a size that plays well on a phone. We keep the converted copy only, and that is the quality you can download them in.
Who you share with. The spaces you create, who is in each, and what each space is allowed to see. People are added by email address, so we hold the addresses of everyone you invite.
Your phone, if you use the app. When you allow notifications, the app gives us a device token so we can send them. Timers that run on your lock screen use a second token of the same kind. Both are tied to your signed-in browser and go when you sign out.
Billing. If you subscribe on the web, a reference to your Stripe customer record and the state of your plan. If you subscribe in the iOS app, the identifier Apple gives the purchase and the state of your plan. Card details never reach us.
When you visit cutiko.app. A random visitor identifier kept in your browser's storage, the country and city your address belongs to, your browser's description of itself, your screen size, the page you arrived on and the site that sent you. Your IP address is turned into a place against a database on our own server and is not stored.
Parents see everything in their family. Everyone else sees only the spaces they have been added to, and within a space only what its settings allow: which children, which kinds of moment, and whether photos are included. The same rule decides both what appears on a page and which files the server will hand out, so there is no second door.
We look at your content only when you ask us to help with it, or when the law requires it.
Cutiko stores information about children, entered by their parents or guardians. The service itself is for adults: you must be 18 or over to have an account, and you must be the parent or guardian of a child you add, or have their parent's permission.
We use one cookie, and only once you are signed in: it lets our media server check that a photo or video is yours to see. Everything else lives in your browser's own storage: your visitor identifier, your theme, and your sign-in. There are no advertising cookies, no third-party analytics and no tracking pixels. Nothing on the site is loaded from anyone else's servers.
We never sell your data, and we show no advertising. Your data leaves us in four directions only:
Email we send comes from our own mail server on our own domain, so your address passes through no email provider. The subprocessors page says what each of these companies receives.
Cutiko runs on a dedicated server we rent in the United States. The database, the photos, the videos and the mail server are all on that machine. We are a UK company, and UK data protection law governs how we handle your data wherever it sits; transfers outside the UK rest on the safeguards that law requires.
You can ask us what we hold about you and your family, get a copy, correct it, have it deleted, or object to how we use it. Write to us on the contact page and we answer within a month. Downloading your photos and videos needs no request: it is free, on every plan, at any time.
Close your account from Settings and it is deleted after 7 days, with your family, children, story, photos, videos and spaces; until then you can change your mind there and keep it. If you are unhappy with how we handled something, you can also complain to the UK Information Commissioner's Office at ico.org.uk.
When this policy changes, the new version appears here with a new date. If a change matters, we tell you by email before it takes effect.