Privacy Policy

Babilly ("we," "our," or "us") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our baby tracking application and related services (collectively, the "Service").

Because our Service involves health-related data about infants, we take privacy extremely seriously and comply with applicable healthcare privacy regulations including HIPAA where applicable, as well as the GDPR and CCPA.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. This policy applies to all users of the Service, including parents, caregivers, and daycare providers.

We collect the following categories of information to provide and improve our Service:

Account Information: When you register, we collect your email address, full name, and authentication credentials. We use secure token-based authentication and never store passwords in plain text. If you sign in with Google, we receive your Google email address and basic profile name as returned by Google's OAuth API.

Baby Profile Data: Name, date of birth, gender, photo, weight, and height for the babies you create profiles for. This data is entered and controlled by you, the parent or legal guardian. Photos are stored as file URLs and are accessible only to authorized users.

Health & Activity Logs: This constitutes the core health data of the Service and includes:

• Feeding records (breastfeeding duration, bottle amounts, solid food introductions, snacks, water intake)
• Sleep logs (start/end times, duration, quality, location)
• Diaper change records (wet, dirty, mixed)
• Breast milk pumping session records (duration, volume per side, total volume)
• Milk storage inventory (location, amount, expiry dates, status)
• Weight and growth measurements
• Developmental milestone records (date, category, photos, notes)
• Food introduction and allergen tracking logs
• Personal journal entries (text content, mood, tags, photos)
• Activity logs (bath, tummy time, medicine, temperature, playtime, outdoor activities)

Caregiver Information: Email addresses and display names of individuals you invite to share access to a baby's profile. We store invite codes and sharing tokens to facilitate secure access. Caregivers can only see the data categories you explicitly permit.

Daycare Information: When using daycare features, we collect daycare facility name, license number, address, phone number, staff emails, and staff activity logs for audit purposes. Daycare staff can view and log activities for linked babies during care hours.

Device and Usage Data: We collect non-identifiable technical information including device type, operating system, app version, browser type, IP address, and general usage patterns to improve the Service, monitor for abuse, and ensure security.

Communication Data: Records of emails sent through the Service (such as schedule shares, weekly reports, pediatrician summaries, and breach notifications) for audit and delivery verification.

Photos and Media: Photos you upload for baby profiles, milestones, journal entries, food logs, and recipes are stored as file URLs and are accessible only to users with appropriate permissions.

We use the information we collect for the following specific purposes:

• To provide, operate, and maintain the Service, including displaying your baby's tracking data within the app
• To generate insights, trends, charts, and weekly summaries from your logged data
• To enable caregiver and daycare sharing when you explicitly invite others
• To send app-related notifications and reminders that you configure (feeding, pumping, schedule reminders)
• To generate and deliver weekly reports and pediatrician visit summaries
• To provide customer support and respond to your inquiries
• To detect, prevent, and address fraud, abuse, technical issues, and security problems
• To improve and develop new features based on aggregate, anonymized usage patterns
• To comply with legal obligations and law enforcement requests where required
• To maintain audit trails for compliance with healthcare and data protection regulations

We do not sell your personal data or your baby's health data to third parties. We do not use your data for advertising or build advertising profiles. We do not share your data with data brokers.

If you are located in the European Economic Area or the UK, we process your personal data under the following legal bases:

• Performance of a contract: Processing your data to provide the baby tracking Service you requested.
• Consent: Processing caregiver emails, sharing data, photos, and sending notifications where you have provided explicit consent. You may withdraw consent at any time.
• Legitimate interests: Maintaining security, preventing fraud, and improving the Service where it does not override your rights.
• Legal obligation: Complying with applicable laws, including healthcare and data protection regulations.

Caregivers: When you share a baby profile via invite code, you choose the role that invite grants: a Recorder can add entries for your baby and edit the ones they created, while a Viewer can only look at what has been recorded. You can change a caregiver's role or revoke their access at any time. Caregivers do not have access to your account information or other babies' data.

Daycare Providers: If you use the Daycare feature, the linked daycare staff can view and log activity for your baby during their care hours, subject to the permissions you grant. All daycare activity is logged with timestamps and staff email for accountability. Daycare access can be revoked at any time.

Service Providers: We may share data with trusted third-party vendors who help operate our infrastructure (e.g., cloud hosting, email delivery, analytics). These providers are contractually bound to keep data confidential and process data only on our instructions. See Section 11 for our sub-processor list.

Legal Requirements: We may disclose data if required by law, court order, or to protect the rights, safety, and security of our users. We will challenge requests that we believe are overly broad or improper.

Business Transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred. We will notify you via email and require the successor to honor this Privacy Policy.

No Sale of Data: We do not sell, rent, or trade your personal information or health data to any third party for marketing or advertising purposes.

We implement industry-standard security measures including encryption in transit (TLS 1.3) and at rest (AES-256). Access to health data is restricted through Row-Level Security (RLS) policies that enforce per-user and per-record authorization at the database level, ensuring that each user can only access data they own or have been explicitly granted access to.

For our daycare features, we maintain HIPAA-aligned safeguards including access audit trails, breach notification procedures, and staff confidentiality agreements. All data access is logged and monitored for unauthorized activity.

We conduct regular security reviews and vulnerability assessments. Access to production systems is restricted to authorized personnel using multi-factor authentication. See our Security Policy for full technical details.

However, no method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users and relevant authorities in accordance with applicable laws.

We retain your data for as long as your account is active. When you delete individual records within the app, we use a soft-delete mechanism — the data is marked as deleted and hidden from your view but retained in the database for compliance, analytics, and recovery purposes. A full audit trail of all deletions is maintained in a separate, tamper-resistant log.

To permanently delete your account and all associated data, use the "Delete Account" option in your account settings. Account deletion requests are processed within 30 days. Upon deletion, all owned babies, logs, journals, milestones, schedules, and sharing records are permanently removed from our database. Full instructions, including how to request deletion if you can no longer sign in, are set out at Delete your account.

Certain data may be retained in anonymized, aggregate form for analytics purposes, or where required by law, after account deletion. This anonymized data cannot be used to identify you or your baby.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (the "right to be forgotten").
• Restriction: Request that we limit the processing of your data.
• Portability: Request your data in a structured, machine-readable format for transfer to another service.
• Objection: Object to the processing of your data based on legitimate interests.
• Withdrawal of consent: Withdraw consent at any time where processing is based on consent.
• Opt-out of notifications: Disable push notifications and reminders in your device or app settings.

CCPA (California residents): You have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, please contact us at privacy@babily.app. We will respond within 30 days.

Your data may be processed in countries other than your own, including the United States. When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms.

By using the Service, you acknowledge that your data may be transferred to and processed in the United States or other jurisdictions with different data protection laws than your country of residence.

Our Service is designed for use by parents and caregivers (adults 18+). We do not knowingly collect personal information directly from children under 13 (or the minimum age in your jurisdiction). The information we collect about infants is entered by and controlled by their parent or legal guardian.

If you believe we have collected personal information from a child in violation of applicable law, please contact us at privacy@babily.app and we will promptly delete it.

We use the following categories of third-party processors to operate the Service:

• Cloud Infrastructure: Hosting and database services for data storage and processing (e.g., cloud platform providers).
• Email Delivery: Services to send schedule shares, reports, notifications, and invitations on your behalf.
• Authentication: OAuth providers (e.g., Google) for secure sign-in. See Section 13 for details on Google API integration.
• Analytics: Aggregate, anonymized usage analytics to improve the Service.
• File Storage: Cloud storage for photos and media uploaded to the Service.

All processors are bound by Data Processing Agreements (DPAs) that require confidentiality, security, and compliance with applicable data protection laws. We do not engage processors that would sell or misuse your data. We will notify users in advance of any new processor that will have access to personal data.

We use minimal storage technologies to operate the Service:

• Authentication tokens: Stored in local storage or secure cookies to keep you logged in across sessions.
• User preferences: Theme preference (dark/light mode) and app settings stored in local storage.
• Session data: Temporary session information to maintain your authenticated state.

We do not use advertising cookies, tracking cookies, or third-party analytics cookies. We do not use cookies for targeted advertising or cross-site tracking.

You can clear local storage and cookies at any time through your browser settings, which will log you out and reset your preferences. Most browsers allow you to refuse or delete cookies; however, some features of the Service may not function properly without them.

Babilly uses Google's OAuth API to provide "Sign in with Google" functionality. When you choose to sign in with Google, we request access to the following Google account data:

• Email address: Used as your account identifier and for communication.
• Basic profile information: Your name as it appears in your Google account.

We use the Google People API or Google OAuth2 API (basic profile scope) solely for the purpose of authentication. We do not request access to your Google Contacts, Google Drive, Gmail, Google Calendar, or any other Google services.

Your Google password is never shared with Babilly. Google provides us with a limited access token that allows us to retrieve only your email and basic profile information.

You can review and revoke Babilly's access to your Google account at any time by visiting Google Account Permissions. Revoking access will prevent future sign-in with Google but will not delete your Babilly account.

Our use of Google API scopes is limited to authentication and complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google data to third parties for advertising purposes.

If you use the Service as a mobile app, we may send push notifications to your device for:

• Feeding and pumping reminders that you configure
• Schedule and routine reminders
• Caregiver and daycare update notifications
• Important account or security alerts

You can enable or disable push notifications at any time in your device settings (iOS Settings → Notifications → Babilly, or Android Settings → Apps → Babilly → Notifications). You can also configure specific reminder settings within the app.

We do not send marketing push notifications. Push notification delivery relies on Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM), which may process device identifiers to deliver notifications.

We may update this Privacy Policy from time to time. We will notify you of significant changes via the app or email at least 30 days before they take effect. Continued use of the Service after changes constitutes acceptance of the updated policy.

The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a privacy concern, please contact us:

Email: privacy@babily.app
Data Protection Officer: dpo@babily.app

We aim to respond to all inquiries within 30 days, and privacy-related requests within 72 hours where possible.