Privacy Policy

Baby Flow is an all-in-one baby tracking application that helps parents and caregivers monitor feeding, sleep, growth, development, and wellness. We understand that the data you entrust to us is deeply personal — it concerns your child's health and your family's daily life. This policy explains exactly what we collect, why we collect it, how we use it, and the rights you have over it.

By creating an account or using Baby Flow, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein. If you do not agree with these practices, please do not use the service.

When you register for a Baby Flow account, we collect and store the following information:

• Email address — used for login, account recovery, and notifications
• Full name — used to personalize your experience and identify you to caregivers
• Hashed password — stored using industry-standard cryptographic hashing; we never see your plaintext password
• Account role — admin or user, determining access levels within the app
• Account creation date — for record-keeping and retention compliance

You may also sign in using third-party OAuth providers (e.g., Google). In that case, we receive your email address and name from the provider, subject to their own privacy policies.

To provide personalized tracking and developmental guidance, we collect information about your baby that you voluntarily enter, including:

• Baby's name — for display and personalization
• Date of birth or due date — to calculate age-based milestones and content
• Gender — optional; used for growth percentile calculations
• Feeding type — breastfeeding, formula, or combo; used for tailored recommendations
• Parenting style — minimalist, budget-friendly, premium, or eco-friendly; used for product and content suggestions
• Photo — optional profile photo (see Section 4: Photos)
• Description / notes — optional free-text notes about your baby

This data is accessible only to you and caregivers you explicitly invite. We never share baby information with third parties for marketing or advertising purposes.

You may optionally upload photos of your baby for use as profile pictures or within tracking logs (e.g., food introduction photos). Photos are processed as follows:

• Photos are stored on our secure cloud infrastructure and are associated with your account
• Photos are accessible only to you and caregivers you have invited with appropriate permissions
• Photos are never made public, indexed by search engines, or used for training AI models
• Photos are never shared with, sold to, or licensed to any third party
• When you delete a photo or your account, associated photos are permanently removed within 30 days

Baby Flow allows you to log and track your baby's physical growth over time. The growth data we store when you enter it includes:

• Weight — in kilograms and/or pounds
• Height / length — in centimeters and/or inches
• Head circumference — in centimeters and/or inches
• Measurement date and age at measurement — for trend analysis
• Calculated percentiles — based on WHO growth standards, computed locally for your reference
• Measurement source — home, pediatrician, or imported

Growth records are used to generate visual charts and developmental insights within your app. This data is not shared with medical professionals unless you explicitly export and share a report yourself.

Baby Flow is not a medical device and does not provide medical advice. However, to support comprehensive baby care tracking, you may choose to log the following health-related information:

• Feeding logs — timestamps, amounts, feeding method, and notes
• Sleep records — sleep and wake times, sleep quality notes
• Diaper changes — type, consistency, color, and any flagged concerns
• Vaccination records — vaccine name, date, and notes
• Teething records — tooth eruption dates and associated symptoms
• Food reaction logs — suspected allergic reactions, severity, and symptoms
• Medicine reminders — medication name and schedule
• Appointment tracking — pediatrician visit dates and notes

We collect anonymized and aggregated usage analytics to understand how the app is used, identify bugs, and improve features. This includes:

• Feature usage frequency (e.g., which tracking tools are most used)
• App performance metrics (e.g., load times, error rates)
• Device type and operating system (for compatibility optimization)
• Aggregate, non-identifiable event counts

Analytics data is not linked to your personal identity or your baby's data. We do not use analytics to build profiles of individual users or children. You can review what events we track in our open-source analytics implementation.

Baby Flow sends notifications to keep you informed about your baby's care schedule and app activity. Notifications include:

• Feeding reminders — based on your baby's feeding schedule
• Milestone notifications — age-appropriate developmental milestones
• Caregiver activity — when invited caregivers log activities (with your consent)
• AI insights — when new personalized insights are available (AI subscribers only)

You can enable or disable notification categories at any time from your app settings. Essential account-related notifications (e.g., password reset) cannot be disabled for security purposes.

Baby Flow uses cookies and similar tracking technologies (local storage, session storage) for the following purposes:

• Essential cookies — authentication tokens, session management (required; cannot be disabled)
• Functional cookies — theme preferences (dark mode), language, display settings
• Analytics cookies — anonymized usage statistics

We do not use advertising cookies, tracking pixels, or third-party advertising SDKs. You can manage your cookie preferences from Profile → Legal & Privacy → Cookie Preferences. See our full Cookie Policy for details.

Baby Flow integrates with the following third-party services to provide core functionality. Each service has its own privacy policy, and we only share the minimum data necessary for the integration:

• Stripe — processes subscription payments. We share your email and payment metadata; Stripe handles card data directly — we never see or store your card number.
• AI Providers — generate AI-powered insights. Data you submit (baby profile info, tracking logs, your questions) is sent to the provider in real-time and is not stored by the provider for training.
• Cloud Hosting — hosts our application and database infrastructure with enterprise-grade security.
• Email Service — delivers transactional emails (password resets, notifications, caregiver invitations).
• OAuth Providers (Google) — enables social sign-in; we receive your name and email only.

We do not sell, rent, or trade your personal data to any third party. Third-party providers are contractually obligated to handle your data in accordance with applicable privacy laws.

We implement industry-standard security measures to protect your personal and baby data:

• Encryption in transit — all data is transmitted over TLS (HTTPS)
• Encryption at rest — stored data is encrypted on our cloud infrastructure
• Row-level security — database-level access controls ensure only you and your invited caregivers can access your data
• Access controls — strict role-based access for our internal team; no engineer has standing access to user data
• Regular security audits — we periodically review our security posture and dependencies
• Secure password hashing — passwords are never stored in plaintext
• Principle of least privilege — service accounts and integrations have the minimum permissions required

We retain your data only for as long as necessary to provide the service and comply with legal obligations. Retention periods are as follows:

• Active accounts: All data is retained while your account is active
• Inactive accounts: After 24 months of inactivity, we may anonymize or delete your data after sending a notification
• Deleted accounts: All data is permanently removed within 30 days of account deletion
• Billing records: Financial transaction records retained for 7 years (tax compliance)
• Consent records: Retained for account duration plus 3 years (legal compliance)
• Backups: Removed from backup systems within 90 days of deletion from active systems

See our full Data Retention Policy for comprehensive details.

Depending on your jurisdiction, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at privacy@babyflow.app or use the in-app tools available at Profile → Legal & Privacy. We respond to all requests within 30 days.

You can delete your account and all associated data at any time. Here is what happens when you initiate account deletion:

• Immediate: Your account is deactivated; you can no longer log in
• Immediate: All caregiver access to your baby's data is revoked
• Immediate: Any active AI subscriptions are cancelled
• Within 30 days: All baby profiles, tracking logs, growth records, photos, milestones, and AI conversations are permanently deleted from active systems
• Within 90 days: Data is removed from encrypted backup systems
• Retained: Anonymized analytics data and legally-required billing records may be retained

To delete your account, go to Profile → Legal & Privacy → Delete My Account. The deletion is irreversible — once completed, your data cannot be recovered.

Baby Flow is designed to comply with the General Data Protection Regulation (GDPR) for users in the European Union and European Economic Area. Our GDPR compliance measures include:

• Lawful basis for processing — We process data based on your consent, contract performance (providing the service), and legitimate interests (security, fraud prevention)
• Data minimization — We only collect data necessary for the stated purposes
• Purpose limitation — Data is used only for the purposes described in this policy
• Storage limitation — Data is retained only as long as necessary (see Section 12)
• Data subject rights — All GDPR rights are honored (see Section 13)
• Cross-border transfers — Data transferred outside the EEA is protected by Standard Contractual Clauses
• Breach notification — We will notify users and authorities within 72 hours of a confirmed breach
• Privacy by design — Privacy protections are built into our systems from the ground up

EU users may lodge a complaint with their local Data Protection Authority or the Irish Data Protection Commission (our EU representative) if they believe we have violated their GDPR rights.

Baby Flow complies with the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for California residents. Under CCPA, you have the following rights:

• Right to Know — What personal information we collect, how we use it, and who we share it with
• Right to Delete — Request deletion of your personal information
• Right to Correct — Request correction of inaccurate personal information
• Right to Opt-Out — Opt out of the sale or sharing of personal information (we do not sell data)
• Right to Limit — Limit the use of sensitive personal information
• Right to Non-Discrimination — We will not discriminate against you for exercising your rights

To exercise your CCPA rights, contact us at privacy@babyflow.app. We will verify your identity before processing your request and respond within 45 days.

Baby Flow is designed for parents and legal guardians to track information about their children. We comply with the Children's Online Privacy Protection Act (COPPA) and relevant child data protection laws. Our practices regarding children's data include:

• Parental consent required — By creating a baby profile, you confirm you are the parent or legal guardian, or have been authorized by one
• No direct collection from children — We do not knowingly collect information directly from children under 13
• Limited data collection — We only collect data necessary for the tracking features you choose to use
• No targeted advertising — We never use child data for advertising or profiling
• No selling of child data — We never sell data about children
• Photos of children — Stored securely, accessible only to you and invited caregivers, never shared publicly
• Caregiver access controls — You control exactly which caregivers can access your child's data and what they can do
• Right to delete child data — You can delete your child's profile and all associated data at any time

See our full Child Data Protection Policy for comprehensive details. If you believe we have collected data from a child without parental consent, please contact us immediately atprivacy@babyflow.app and we will promptly delete it.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us using any of the following methods: