Privacy Policy

1. Introduction

Baby Bloom ("we", "our", or "us") is committed to protecting the privacy and security of your baby's information. This Privacy Policy explains how we collect, use, store, and protect your data when you use our baby tracking application.

Our Core Privacy Principles:

• Your baby's data belongs to you and your household
• Enterprise-grade encryption protects all sensitive information
• We never sell or share your data with third parties for marketing
• You have complete control over your data with easy export and deletion
• Transparent about what data we collect and why

2. Information We Collect

2.1 Baby Health & Activity Data

• Feeding Records: Breastfeeding (left/right breast, duration), bottle feeding (amount, formula type), solid food introduction, pumping sessions
• Sleep Logs: Sleep start/end times, nap duration, sleep patterns, nighttime vs. daytime sleep
• Diaper Changes: Change times, diaper type (wet/dirty/both), color, consistency, notes
• Growth Measurements: Height, weight, head circumference, measurement dates, WHO percentile data
• Health Records: Vaccination dates and types, medication names and dosages, temperature readings, doctor visit notes, symptom descriptions
• Milestones: Developmental achievements, milestone dates, photos (stored locally if added)

2.2 User & Household Information

• Account Information: Email address, full name, profile picture (optional)
• Baby Profiles: Baby names, birthdates, gender (optional), profile photos (optional)
• Household Members: Caregiver names, email addresses, roles (admin/caregiver/viewer)
• App Preferences: Theme settings, unit preferences (metric/imperial), notification settings, language preferences

2.3 Technical & Usage Data

• Device Information: Device type, operating system version, app version
• Usage Analytics: Feature usage patterns, error logs, crash reports (anonymized)
• Authentication Tokens: Supabase session tokens, Apple Sign In tokens

2.4 Information We Do NOT Collect

• Location data or GPS tracking
• Contacts or phone numbers (except for invited caregivers)
• Social media accounts or connections
• Financial information (handled by Apple/RevenueCat)
• Browsing history or third-party app usage

3. How We Use Your Information

We use your information exclusively to provide and improve Baby Bloom's services:

3.1 Core App Functionality

• Activity Tracking: Store and display feeding, sleep, diaper, and health records
• Smart Insights: Analyze patterns to provide helpful insights about your baby's routines
• Growth Charts: Plot measurements on WHO percentile curves
• Reminders: Send intelligent notifications based on your baby's patterns
• Multi-Caregiver Sync: Share data securely across household members
• Offline Access: Cache data locally for offline use with background sync

3.2 Service Improvement

• Analyze anonymized usage patterns to improve features
• Debug and fix technical issues
• Test new features with beta users (opt-in only)
• Improve app performance and stability

3.3 Communication

• Send important service updates and security notifications
• Respond to support requests and feedback
• Notify about app updates and new features (optional)

4. Data Storage & Security

4.1 Supabase Cloud Storage

All baby data is stored securely in Supabase (PostgreSQL database):

• End-to-End Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
• Row-Level Security: Database policies ensure users only access their household's data
• Geographic Location: Data stored in secure data centers with redundant backups
• Access Controls: Strict role-based access controls for household members
• Regular Backups: Automated daily backups with point-in-time recovery

4.2 Local Device Storage (MMKV)

• Active Timers: Feeding and sleep timers stored locally for persistence
• App Settings: User preferences cached on device
• Offline Cache: Recent data cached for offline access
• Protected Storage: Device's built-in security (Keychain on iOS)

4.3 Security Measures

• Multi-factor authentication support
• Secure session management with automatic expiration
• Regular security audits and penetration testing
• Compliance with industry-standard security practices
• Incident response plan for security breaches

5. Third-Party Services

5.1 Supabase (Database & Authentication)

• Purpose: Secure cloud database and user authentication
• Data Shared: All baby data, user profiles, household information
• Privacy: Supabase Privacy Policy

5.2 Firebase Cloud Messaging (Notifications)

• Purpose: Push notifications for reminders and alerts
• Data Shared: Device tokens, notification preferences
• Privacy: Firebase Privacy

5.3 RevenueCat (Subscription Management)

• Purpose: Manage premium subscriptions and in-app purchases
• Data Shared: User ID, subscription status, purchase receipts
• No Baby Data: RevenueCat does not receive any baby health or activity data
• Privacy: RevenueCat Privacy Policy

5.4 Apple Sign In

• Purpose: Secure authentication with Apple ID
• Data Shared: Email (or private relay email), name
• Privacy: Apple Privacy Policy

5.5 No Analytics or Tracking

Baby Bloom does NOT use:

• Google Analytics or similar web/app analytics
• Facebook Pixel or social media tracking
• Third-party advertising networks
• Behavioral tracking or profiling services

6. Data Sharing & Multi-Caregiver Access

6.1 Household Sharing

Baby Bloom enables secure data sharing within your household:

• Invite System: You control who can access your baby's data by sending email invitations
• Role-Based Access: Assign roles (Admin, Caregiver, Viewer) to control permissions
• Real-Time Sync: All household members see the same data in real-time
• Revoke Access: Remove household members anytime from settings

6.2 We Do NOT Share Your Data With:

• Advertisers or marketing companies
• Data brokers or analytics firms
• Social media platforms
• Insurance companies or healthcare providers
• Government agencies (except when legally required)

6.3 Legal Disclosure

We may disclose your information only when:

• Required by law (court order, subpoena)
• Necessary to protect user safety or prevent harm
• Investigating fraud or security incidents
• Enforcing our Terms of Service

7. Your Privacy Rights

7.1 Data Access & Export

• View All Data: Access all stored information about your baby through the app
• Export Data: Download complete records in standard formats (CSV, JSON)
• Share Reports: Generate and share reports for pediatrician visits

7.2 Data Correction

• Edit any activity log or health record directly in the app
• Update baby profiles and household member information
• Correct inaccurate information anytime

7.3 Data Deletion

• Delete Individual Records: Remove specific activity logs or entries
• Delete Baby Profiles: Permanently remove a baby's complete data
• Delete Account: Request complete account deletion from Settings → Account → Delete Account
• Deletion Timeline: Data permanently deleted within 30 days of request

7.4 Marketing Preferences

• Opt out of promotional emails anytime
• Control push notification preferences in Settings
• Unsubscribe links included in all marketing emails

7.5 Contact for Privacy Requests

To exercise your privacy rights, contact us at: [email protected]

8. Children's Privacy

Baby Bloom is designed for parents and caregivers to track information about children. The app itself is not directed at children under 13.

• Parents/guardians control all data entry and management
• Children do not have direct access to the app
• Compliant with COPPA (Children's Online Privacy Protection Act)
• No data collected directly from children

9. International Users & GDPR

9.1 GDPR Compliance (EU Users)

For users in the European Union, Baby Bloom complies with GDPR:

• Legal Basis: Consent and contract performance
• Right to Access: Request copies of your data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: "Right to be forgotten"
• Right to Data Portability: Export data in machine-readable format
• Right to Object: Object to data processing
• Right to Withdraw Consent: Withdraw consent anytime

9.2 Data Transfer

Data may be transferred and stored in countries outside your residence. We ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs)
• Adequate data protection measures
• Compliance with local data protection laws

10. Data Retention

10.1 Active Accounts

• Baby data retained as long as your account is active
• Activity logs kept indefinitely for historical tracking
• You can delete individual records anytime

10.2 Inactive Accounts

• Accounts inactive for 2+ years may be flagged for deletion
• Email notification sent before deletion
• 30-day grace period to reactivate account

10.3 Deleted Accounts

• All personal data permanently deleted within 30 days
• Anonymized aggregate data may be retained for analytics
• Backups purged within 90 days
• Legal hold data retained as required by law

11. Changes to Privacy Policy

We may update this Privacy Policy periodically to reflect:

• New features or functionality
• Changes in legal requirements
• Improvements to our security practices
• User feedback and requests

Notification of Changes:

• Material changes: Email notification + in-app notice
• Minor updates: Updated "Last modified" date at top
• Continued use constitutes acceptance of changes

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data:

For urgent privacy concerns or security issues, please mark your email as "URGENT" in the subject line.

13. Summary

Your Privacy Matters:

• ✅ Your baby's data is encrypted and secure
• ✅ You have complete control over who accesses data
• ✅ We never sell your information to third parties
• ✅ You can export or delete your data anytime
• ✅ Transparent about our practices and third-party services
• ✅ Compliant with GDPR, COPPA, and privacy laws

Thank you for trusting Baby Bloom with your precious memories and important health information. We take this responsibility seriously and are committed to protecting your family's privacy.