BabyStory Privacy Policy

Effective date: September 9, 2026 · Last updated: September 9, 2026

BabyStory ("the App") is a baby care logging app that lets parents and invited family members record feedings, sleep, diapers and other daily care events, and keep a shared photo album for their baby.

This policy explains what information the App collects, why it is collected, how it is stored and shared, and what choices you have. If you have questions, contact us at nerdens.seong@gmail.com.

1. Who is responsible for your data

The developer of BabyStory is the controller of the personal data described below.

• Contact: nerdens.seong@gmail.com

The App has no separate server of its own. It uses Google Firebase (Firebase Authentication, Cloud Firestore, and Cloud Storage for Firebase) as its backend. Google acts as our data processor.

2. Information we collect

We only collect information that you or your invited family members enter into the App. We do not buy, scrape, or import personal data from any other source.

2.1 Account information

2.2 Baby profile

• Baby's name (or nickname you choose)
• Baby's date of birth
• An optional baby profile photo

This information is entered voluntarily by you, the adult guardian, and is used to label records and to calculate the baby's age and age-relative statistics inside the App.

2.3 Care records

Records you create for a baby, which may include:

• Record type: breastfeeding, bottle feeding, solid food, pumping, diaper, sleep, bath, temperature, medicine, or a free-form memo
• Start time and, for timed activities, end time
• Amount in milliliters (bottle feeding, pumping)
• Body temperature in degrees Celsius
• A free-text note you type
• The account that created the record and the creation time

Some of this information (body temperature, medicine, feeding) may be considered health-related data about your baby under the GDPR and similar laws. We process it only to provide the logging and statistics features you asked for, and never for advertising, profiling, or analysis of any kind.

2.4 Photos

• Images you either capture with the device camera or select from your device's photo library and upload
• An optional caption and the date you assign to each photo

Photos are stored as image files in Cloud Storage for Firebase. On the free plan they are resized on your device to a 2,048-pixel long edge and re-compressed before upload; while a Premium subscription is active, the file you picked is uploaded at its original quality. Either way, the App does not read, store, or use location (GPS/EXIF) information from your photos, and it does not scan or analyze the content of your images.

The App requests camera access only at the moment you choose to take a new photo, and photo library access only at the moment you choose to upload an existing photo, or to scan a family invite QR code from a saved image instead of typing the code. QR codes are decoded entirely on your device — the photo is never uploaded and nothing beyond the code itself is read from it. The App does not browse or upload anything you have not selected, and it does not request microphone, contacts, location, or health-app permissions.

2.5 Family sharing information

• Invite codes generated by a baby's owner (a 6-character code with an expiration date), which can be shared as plain text, a link, or a QR code that encodes the same code
• Membership records showing which accounts have joined which baby, each member's role (owner or member), and when they joined

2.6 App lock (Face ID, Touch ID, or device passcode)

If you turn on the optional app lock in Settings, the App asks your device's operating system to verify your identity — Face ID, Touch ID, fingerprint, or your device passcode — before showing your data again after the App has been in the background. This check is performed entirely by the operating system; the App only receives a yes/no result and never receives, collects, or stores any biometric data. Nothing about your face or fingerprint ever leaves your device.

2.7 Notifications and device registration

This applies only if you turn on at least one notification in Settings. If you leave them all off, none of the following is created; if you turn them all off after having used them, the stored device registration is deleted.

• Notification token. A random string that Firebase Cloud Messaging issues to this installation of the App. It is the only way a notification can reach you while the App is closed, and the value itself contains nothing that identifies you.
• Platform. "ios" or "android".
• The language the App is set to. A language tag (for example "ko" or "en-GB") used to decide which language a notification should be written in.
• Your device's time zone. An IANA time zone name (for example "Asia/Seoul"). It is used only to send the weekly summary on your local Sunday evening and to avoid sending anything between 9 p.m. and 9 a.m. in your local time. This is not location data — the App collects no GPS or IP-based location, and a time zone name is no more precise than a city.

These four values are stored in the Cloud Firestore document users/{account}/devices/{token}, which Firebase Security Rules make readable and writable only by your own account. Which notifications you have switched on (unaccepted invite, quiet-log reminder, family activity, weekly summary) is stored on your user document as well.

To decide whether a notification is due, our server (Firebase Cloud Functions) reads when a baby was last logged, when an invite code was created, the list of family members and each member's view permissions, and a record of what was already sent so that the same reminder is not repeated too often. Those values are written only by the server and cannot be modified from the App.

Notifications never contain anything you entered. What is sent is a fixed, pre-translated sentence plus a value naming the kind of notification — never your baby's name, the text of a record or diary entry, or a photo. Delivery passes through Apple's (APNs) and Google's (FCM) push infrastructure.

2.8 Subscription and billing information

This applies only if you purchase BabyStory Premium, the paid subscription. If you do not subscribe, none of the following is created.

• Transaction identifier. When a purchase completes, the App sends only one identifier issued by the store to our server (Firebase Cloud Functions) — the App Store transaction identifier on iOS and macOS, or the Google Play purchase token on Android. The server then queries Apple's App Store Server API or the Google Play Developer API directly with that value to confirm the product, the expiry date, and whether the subscription is active. Nothing the App itself reports is trusted as the basis for granting Premium.
• Account token. So that a purchase can be matched to an account, the App attaches to the purchase a UUID-shaped value derived from your Firebase account identifier (uid) with a one-way SHA-256 hash (the App Store's appAccountToken, or Google Play's obfuscatedAccountId). The store returns that value to our server, which recomputes it the same way. It contains no email address, name, or any other personal information; it exists only to stop someone else's purchase from unlocking Premium on your account, and it is not stored.
• Result of the check. From the store's answer we store the product id, the original transaction identifier, and the subscription expiry date in a server-only document in Cloud Firestore (entitlements/{account}). The App reads that document only to show whether Premium is active and until when. Because Premium applies per family, the family members sharing a baby's record are told only whether that baby is on Premium — never who paid, nor any transaction identifier.
• Store server notifications. When a subscription renews, is cancelled, or is refunded, Apple or Google notifies our server. The server takes only the transaction identifier from that notification and asks the store again, as above.
• No payment details are collected. Payment happens entirely within the App Store or Google Play. The developer never receives or stores card numbers, billing addresses, your Apple Account or Google Account email, or any other payment or billing information.

2.9 Growth album PDF export

When you export a growth album as a PDF during a Premium subscription, the PDF is built on your device. The baby name, date of birth, photos, captions, diary entries, and daily summaries that go into it are already stored in your account; exporting does not send anything anywhere new and does not store anything extra. The finished PDF file does not leave your device until you save or share it yourself.

There is one exception. If, and only if, the album actually contains Han (Chinese or Japanese) characters, the App downloads once — and then caches on your device — a font file able to print them, from the font server Google operates at fonts.gstatic.com. Only a font file at a fixed address is requested; nothing about your baby or the album is sent. The request itself does reveal your device's IP address to Google, whose own privacy policy governs that processing. Korean and Latin albums use a font bundled inside the App, so no such request is made.

2.10 App store rating prompt

The App may show the operating system's in-app review prompt at most once, either right after a family invite is accepted or once you have saved a certain number of care records (30). Everything used to decide whether to show it — whether it was already shown, the record count, the date of first launch — is stored only on your device and is never sent to our server. Whether you write a review and what rating you give is handled by Apple or Google; the developer cannot see whether you reviewed the App or what score you gave.

2.11 Technical information and crash reporting

Google Firebase processes standard operational data required to run the service — for example the IP address of a request, timestamps, and error information — for security, abuse prevention, and reliability. See the Firebase Privacy and Security documentation for details.

The App also uses Firebase Crashlytics to help us find and fix bugs. When the App crashes or hits certain internal errors, Crashlytics automatically collects a stack trace and other diagnostic information, your device model, operating system version, the App version, and a Crashlytics installation identifier — a random ID generated for the app install, not linked to your account or email address. The App may also log a small number of non-fatal errors with a fixed, developer-written description of what failed (for example "photo upload"); these descriptions never include anything you typed, your baby's name, your email, a photo path, or an invite code. Crash reporting is turned off in development/debug builds of the App.

3. What we do NOT do

The following reflects what the App's code actually does. The exceptions are the limited, anonymous product analytics and the crash/diagnostic reporting described in 3.1 and 3.2 below — beyond that, the App contains no advertising, attribution, or third-party tracking libraries:

• No advertising. The App shows no ads and contains no advertising SDK.
• No third-party tracking. The App includes no third-party analytics, attribution, or advertising SDK. The only analytics and diagnostic tools it uses are Firebase Analytics and Firebase Crashlytics, both components of Google Firebase acting on our instructions.
• No cross-app or cross-site tracking, and no advertising identifier (IDFA/AAID) is requested or used. The App does not present an App Tracking Transparency prompt because it does not track you across other companies' apps or websites.
• No sale or sharing of personal information for advertising or any other commercial purpose.
• No profiling or automated decision-making based on your data. Whether a notification is due is decided by fixed rules written in advance — for example "no record for three days" — not by any analysis of your behaviour.
• No access to your contacts, calendar, location, microphone, or health data. The time zone name used for notifications (section 2.7) is a device setting, not location data.

3.1 Limited, anonymous product analytics (Firebase Analytics)

To understand which features are actually used, the App records a small, fixed set of usage events with Firebase Analytics. These events never include anything you typed — your baby's name, a photo, the text of a note or diary entry, an email address, an invite code, or a document identifier is never included in any event. Only the type of action and, where relevant, a count is sent.

The events recorded are:

• Signing in and signing up, and which sign-in method was used;
• Adding a baby, switching between babies, and editing a baby's details;
• Creating an invite code, sharing an invite link, accepting an invite, removing a member, leaving a family, deleting a baby, changing a family permission (which permission was turned on or off), and applying a permission preset;
• Adding, editing, and deleting a care record (its type, and where in the app it was entered from);
• Adding, editing, deleting, or resetting a care-log button (custom action);
• Saving or deleting a diary entry and picking a mood (never the text — only whether text and a mood were present);
• The number of successes and failures in a photo upload batch, and viewing, deleting, or captioning a photo;
• Hitting a free-plan limit, which route opened the subscription screen, starting a purchase, and completing a subscription (monthly or yearly);
• Reaching each onboarding step and the choice made there;
• The outcome of a local notification permission request, the outcome of a push permission request, and — if you open the App by tapping a notification — the kind of notification it was;
• Turning simple view on or off, a settings change (which setting was changed to what), and the care-rhythm card being shown;
• Which route opened a share card and what kind was shared, and a milestone card being shown, dismissed, or its share button tapped;
• Which route opened the weekly summary, and whether it was shared;
• Starting a growth album export (the date range and the number of items), completing it (the page count), or cancelling it;
• What triggered the app rating prompt;
• Signing out, deleting an account, and which screen you opened.

The App also stores the following user properties so that usage can be looked at by group. All values are recorded as buckets only, so that no individual can be identified:

• Plan (free or premium);
• How many people share the baby's record (1 / 2 / 3–4 / 5 or more);
• How many babies you use (1 / 2 or more);
• The age band of the baby you are viewing (before birth / newborn / 0–3 months / 3–6 months / 6–12 months / 12 months or more);
• The text size and theme you chose in the App.

3.2 Crash and diagnostic reporting (Firebase Crashlytics)

If the App crashes or hits an unhandled error, Firebase Crashlytics collects the error, a stack trace, the device model, the OS version, the App version, and a Crashlytics installation identifier generated at random per app install. The App does not attach your account identifier or email address to a crash report. See section 2.11 for the full description. Crash collection is turned off in development (debug) builds.

4. How we use your information

We use the information above only to:

1. Create and authenticate your account and keep you signed in;
2. Store, display, and let you edit your baby's care records and photos;
3. Calculate in-App summaries and statistics (for example daily feeding totals or sleep duration), which are computed for you and are not shared with anyone;
4. Share records among the family members invited to the same baby;
5. Keep the service secure — for example by enforcing access rules and expiring invite codes;
6. Send the notifications you switched on, at a time that matches your local clock and outside your local quiet hours (section 2.7);
7. Confirm payment for the paid subscription and grant or expire Premium entitlements (section 2.8);
8. Keep the App stable and improve it through limited usage analytics and error diagnostics (sections 3.1 and 3.2);
9. Respond to your support requests.

Legal bases (EEA/UK users)

• Performance of a contract (Art. 6(1)(b) GDPR) — providing the account, records, photos, and sharing features you asked for, and providing and validating a subscription you purchased.
• Consent (Art. 6(1)(a), and Art. 9(2)(a) for health-related entries such as temperature or medicine) — you decide what to record, and you may withdraw consent at any time by deleting the entries or your account.
• Consent (Art. 6(1)(a)) — notifications are sent only for the items you switched on yourself in Settings, and you can switch any or all of them off at any time.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure and preventing abuse, and the limited, non-identifying usage analytics and error diagnostics we rely on to run and improve the App.

5. Who can see your data

• Family members you invite. Everyone who joins a baby using that baby's invite code can see and edit that baby's profile, care records, and photos, and can see the display name of other members. Only the owner can create invite codes or remove members. You should share invite codes only with people you trust.
• Google (as our processor). Your data is stored in Google Firebase. Google processes it on our instructions under Google's data processing terms. This includes the usage events and diagnostic information sent to Firebase Analytics and Crashlytics (sections 3.1 and 3.2) and the delivery of notifications through Firebase Cloud Messaging (section 2.7).
• Apple. Delivering a notification on iOS or macOS requires Apple's push service (APNs), which receives the device token and the fixed notification text — nothing else. Separately, if you subscribe through the App Store, Apple processes purchase information as an independent controller because payment happens there. The only information that passes between us and Apple is the transaction identifier and the account token described in section 2.8 — never your email address, your name, or anything about your baby. Apple's own privacy policy governs its processing.
• Google Play (only if you subscribe on Android). Payment happens in Google Play, so for that part Google also acts as an independent controller. The only information that passes between us and Google Play is the purchase token and the account token described in section 2.8.
• Nobody else. We do not sell, rent, or share your personal information with advertisers, data brokers, or any other third party.

We may disclose information if we are legally required to do so by a valid legal process, but we have no other reason or mechanism to hand your data to anyone.

Server-side access control. Access is enforced by Firebase Security Rules on Google's servers, not just in the app: a request for a baby's profile, care records, or photos is rejected unless the requesting account is a member of that baby. Uploaded photo files are protected by the same membership check. The download links the App generates to display your photos contain an unguessable token and are never published anywhere; if you forward such a link to someone else, that person could open that image, so treat photo links as private.

6. Where your data is stored (international transfers)

• Cloud Firestore records and Cloud Storage photo files are stored in Google's asia-northeast3 (Seoul, Republic of Korea) region.
• Firebase Authentication account data (email address, password hash, display name) is operated by Google as part of its global identity infrastructure and may be processed on servers outside your country, including in the United States.

Where personal data of EEA/UK users is transferred outside those regions, the transfer relies on the European Commission's Standard Contractual Clauses as incorporated into Google's terms.

If you are a user in the Republic of Korea, this constitutes notice of outsourcing (위탁) and overseas transfer of personal data to Google LLC and its affiliates for the purpose of cloud hosting, authentication, and file storage, for as long as you use the service.

7. How long we keep your data

• Your account, baby profiles, care records, and photos are kept for as long as your account exists, so that your history remains available to you.
• A care record or photo you delete in the App is removed from our database, and a deleted photo's image file is removed from storage as well. Deleted items are not recoverable by you.
• Invite codes expire automatically 24 hours after they are created.
• The device registration described in section 2.7 is kept for as long as you leave a notification switched on. Turning them all off deletes it immediately, and if the token stops working — because you removed the App or blocked its notifications — the server deletes that device document the next time it tries to send. Of the sending history, only the timestamps needed to decide when the same reminder may be sent again are kept, per account.
• The subscription check result (section 2.8) is kept for as long as your account exists, because it is what determines your plan, and is deleted with your account. Purchase history held by Apple or Google Play follows their own policies and cannot be deleted by the developer.
• When you request account deletion, we delete your account and the personal data associated with it without undue delay and in any event within 30 days, except where we are required to retain something by law.
• If you are the owner (admin) of a baby, you can delete it directly in the App at any time — this immediately and permanently erases its care records, photo files, and every family member's access to it. Deleting your account has the same effect for every baby you own.
• If you only joined a baby someone else owns, you can leave it directly in the App at any time, which removes only your own membership; the baby's records and photos are unaffected and remain available to the owner and any remaining members. Deleting your account has the same effect for every baby you merely joined.

Backups held by our provider are overwritten on a rolling basis.

8. Your rights and choices

You can, at any time:

• Access and correct your data directly in the App — profile name, baby profile, every care record, and every photo caption are editable.
• Delete individual care records, photos, or — if you own it — a whole baby directly in the App.
• Leave a shared baby you only joined, which removes your access to it without affecting the baby for its owner or other members.
• Turn each notification on or off in Settings. Turning them all off deletes this device's registration (section 2.7). You can also block the App's notifications entirely in your operating system's settings.
• Sign out on any device.

You may also contact nerdens.seong@gmail.com to:

• Request deletion of your account and its data;
• Request a copy of the personal data associated with your account (portability);
• Ask us to restrict or object to processing;
• Withdraw consent you previously gave.

We will verify that the request comes from the email address registered to the account before acting on it, and we will respond within 30 days.

EEA/UK users have the right to lodge a complaint with their local data protection supervisory authority. Users in the Republic of Korea may contact the Personal Information Protection Commission (privacy.go.kr, +82-118). California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use personal information for cross-context behavioral advertising.

9. Children's privacy

BabyStory is designed for adult parents and guardians. The App is not directed to children, and we do not knowingly allow anyone under the age of majority in their country (16 in the EEA unless national law sets a lower age, 14 in the Republic of Korea, 13 in the United States) to create an account.

Information about a baby or child stored in the App — name, date of birth, care records, photos — is entered voluntarily by the adult account holder about their own child or a child in their care, and is visible only to the family members that adult invites. We do not use children's information for advertising, analytics, profiling, or any purpose other than displaying it back to the family.

If you believe a child has created an account, contact nerdens.seong@gmail.com and we will delete it.

10. Security

• All communication between the App and Firebase uses TLS encryption.
• Data stored in Cloud Firestore and Cloud Storage is encrypted at rest by Google.
• Passwords are hashed and managed by Firebase Authentication; neither the App nor the developer can see your password.
• Access to every document and file is checked on the server by Firebase Security Rules against your account's membership of the baby in question.
• Invite codes are randomly generated, cannot be listed or enumerated, and expire after 24 hours.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and share invite codes only with people you trust.

11. Changes to this policy

If we change this policy, we will update the "Last updated" date at the top and publish the revised version at this URL. For material changes — for example, if we ever began collecting a new category of data — we will provide notice in the App or by email before the change takes effect.

12. Contact

Questions, requests, or complaints about this policy or your data:

nerdens.seong@gmail.com

We aim to respond within 30 days.