YOUR FAMILY, YOUR CHOICES

A little clarity about your data.

The tracker is for your baby. The account and every commercial relationship belong to you, the adult parent or caregiver.

What makes the tracker work

We use your adult email for sign-in and necessary account messages. Your country and timezone support the local experience. Your baby’s name, birth date, optional birth details, feeding records, diaper observations, and notes are used for the tracker you requested. Age is calculated when needed.

Family activity has a separate permission boundary. Parents can access only authorized baby records. Staff access to sensitive records requires elevated permission, a specific reason, and an audit record.

Product improvement and acquisition

First-party events record that a feature was used, without feeding amounts, stool colours, health notes, or medical alerts in analytics payloads. We use these events for product engagement and aggregate retention. Small-group breakdowns require at least five parents.

Landing pages may temporarily remember campaign labels and the referrer’s website origin in session storage, so an account can retain first- and last-touch attribution. We discard referrer queries and arbitrary URL parameters. There is no advertising fingerprinting or precise location collection.

Optional communications and personalization

Marketing choices are separate, unchecked by default, and recorded with their wording and history. Permission for email does not grant permission for SMS or push. Research invitations are a separate choice and do not authorize study participation or research use of health records.

Individual baby-health events cannot be used in advertising, affiliate targeting, sponsor audiences, or product recommendations. General life stage is commercially available only with separate permission. Voluntary interests can support permitted adult personalization. You can withdraw your choices in Settings → Communications.

Advertising and commerce

The MVP has no connected advertising network, payment processor, or commercial email sender. Future sponsored content and affiliate links will be labeled and kept below the logging controls. A configured affiliate redirect may record the product link, placement, content source, and time, without attaching a baby record or health details.

Storage and retention

Queued activity and unfinished forms are stored on your own device so interruptions do not discard your work. Use a trusted device. Successful synchronization removes queue entries; sign-out clears account-specific drafts. Pending changes are never automatically discarded by signing out. You can review changes waiting to sync, download a private recovery copy, or explicitly discard a local change. Discarding a local change does not delete a record already saved to your account. Private pages and API responses are not cached by the service worker.

Account deletion immediately disables access and erases your owned baby records. Records you added to another authorized caregiver’s baby remain with that baby, with your author identity removed. Limited consent evidence, suppression records, and access audits remain according to their purpose. Authentication removal is retried if the provider is temporarily unavailable. Deployment backups follow the configured hosting provider’s expiry policy.

Your controls

Use Settings → Privacy & data to export your information as JSON, delete a baby, or delete your account. Core data-rights exports stay free. Promotional unsubscribe does not stop necessary account-security communications.

Policy version: September 2026. The deployment operator must configure a public support contact, hosting region, maintenance schedule, and backup retention before accepting real family data. These defaults are an implementation policy, not a claim of legal certification.