Privacy Policy
The short version. Blooming Baby stores the records you create about your family so the app can show them back to you. We do not sell your information, we do not share it with advertisers, and there is no ad network in the app. The pattern summaries the app generates are produced on your own device, not by sending your child’s records to an outside AI service. You can export or permanently delete everything from inside the app at any time.
This policy explains what Blooming Baby (“we”, “us”) collects, why, where it is kept, and what control you have over it. It applies to the Blooming Baby mobile app and to bloomingbaby.app.
1. Who this policy is for
Blooming Baby is intended for use by parents, guardians and caregivers who are 18 years or older. The app is not directed to children and children may not create accounts.
The records you keep in the app describe a child, but the account, and the decision to record anything at all, belongs to you as the adult account holder. You are the one who chooses what to enter, and you can remove any of it at any time. We do not knowingly allow anyone under 18 to register.
2. What we collect
All of the following is information you choose to give us. We do not buy data about you from anyone else.
| Category | What it includes | Why we hold it |
|---|---|---|
| Account | Email address and a securely hashed password. If you sign in with Google, we receive your email address and basic profile information from Google — never your Google password. | To create your account, sign you in, and let you recover access. |
| Your profile | Display name, and optionally a general location such as a city or area. We never ask for a street address or precise GPS location. | To personalise the app and, where relevant, keep guidance regionally appropriate. |
| Child profile | The name or nickname you give, date of birth, and sex if you provide it. | To calculate age and organise records for the right child. |
| Care records | Feeds, sleep, diaper changes, foods and allergen introductions, growth measurements, medications, milestones, and any free-text notes you write. | These are the app’s core purpose — to keep your record and show it back to you. |
| Your own check-ins | Mood and self-care entries you optionally record for yourself, plus any measurements or medications you log for yourself. | To show you your own history over time. This is optional and can be left empty. |
| Photos | Images you attach to milestones or diaper entries. | To display them in your timeline. Stored privately, never in a public location. |
| Subscription status | Whether your account is on the free or paid tier, and when the current period ends. | To unlock paid features. We never see or store your card number. |
| App settings | Reminder preferences, streak and badge progress, and which onboarding steps you finished. | To make the app behave the way you set it up. |
| Waitlist (website only) | Your email address, the page you signed up from, and the site that referred you. | To email you once when the app launches. |
What we deliberately do not collect
- Precise or background location.
- Your contacts, calendar, call history or messages.
- Advertising identifiers, or any cross-app or cross-site tracking data.
- Card, bank or payment details — these go directly to Apple or Google and never reach us.
3. How the app’s insights work
Blooming Baby can summarise patterns in your logs — for example how feeds or naps have trended over recent days. This runs as a model on your own device. Your child’s records are not transmitted to an external AI provider in order to generate these summaries, and the summaries are not used to train anyone’s model.
If you choose to download an optional on-device language model, the download is fetched from a model host. That request tells the host that a download happened; it does not contain any of your family’s data.
4. Where your information is stored
We use Supabase as our hosting provider for our database, account system and file storage. Data is currently stored on Supabase infrastructure in the Asia–Pacific (Mumbai, India) region. If you use the app from another country, your information will be transferred to and stored there.
Every record is protected by row-level security rules enforced by the database itself, which restrict each row to the account that owns it. Photos are stored in private buckets and are served only through short-lived signed links to the account that uploaded them.
5. Who we share it with
We do not sell your personal information, and we do not share it for advertising or marketing purposes.
We share information only with the service providers who make the app run, and only to the extent they need it:
| Provider | Purpose | What they receive |
|---|---|---|
| Supabase | Database, authentication and file hosting | All account and record data described above |
| Sign-in with Google, if you choose it | Confirms your identity to us; we receive email and basic profile | |
| Apple / Google Play | App distribution and subscription billing | Payment details, handled entirely by them — we receive only whether a subscription is active |
| Cloudflare | Hosting for this website | Standard web request data such as IP address, for security and delivery |
We may also disclose information where we are legally required to, or where it is necessary to protect someone’s safety. If our business is ever transferred to another owner, we will tell you before your information becomes subject to a different policy.
6. How long we keep it
- While your account is open: your records are kept so the app can show them to you.
- When you delete your account: your profile, your children’s records and your uploaded photos are permanently deleted from our live systems. Encrypted backups may retain a copy for up to 30 days before they roll over, after which the data is gone.
- Waitlist emails: deleted once the launch email has been sent, or sooner if you ask.
7. Your rights and controls
You can do all of the following without contacting us:
- See and correct — every record in the app can be opened, edited or deleted individually.
- Export — produce a PDF summary of your records to keep or share with your pediatrician.
- Delete everything — Settings → Delete account permanently removes your account and all associated records. This cannot be undone.
Depending on where you live, you may also have rights under laws such as the GDPR (EU/UK), the CCPA/CPRA (California), or your local data protection legislation — including the right to access, correct, delete, restrict or object to our processing of your information, to receive it in a portable format, and to complain to your data protection authority. To exercise any of these, write to privacy@bloomingbaby.app. We will respond within 30 days and we will not charge you or treat you differently for asking.
8. Security
Traffic between the app and our servers is encrypted in transit using TLS, and data is encrypted at rest by our hosting provider. Passwords are hashed and are never stored or visible in readable form. Database-level access rules restrict every record to its owning account.
No system is perfectly secure. If a breach ever affects your personal information, we will notify you and the relevant authorities as required by law.
9. Cookies and analytics
This website does not use advertising cookies or third-party tracking pixels. The app does not contain an advertising SDK. If we later add privacy-respecting product analytics or crash reporting to help us fix problems, we will update this policy and say clearly what is collected before it starts.
10. Changes to this policy
If we make a material change, we will update the date at the top of this page and notify you in the app or by email before the change takes effect. Continuing to use Blooming Baby after that point means you accept the updated policy.
11. Contact us
Privacy questions and data requests: privacy@bloomingbaby.app
Anything else: hello@bloomingbaby.app