Baby Steps Privacy Policy

Controller and contact

NYXIAOZHAN is the controller for Baby Steps. Address: New York, USA. Privacy requests may be sent to [email protected].

Data Protection Officer: [email protected].

EU representative: NYXIAOZHAN.

Information we process

• Account identity from Google sign-in: Firebase identifier, email, display name, and profile photo.
• Child profile and potentially sensitive health or development information: name, birth date, sex, avatar, growth measurements, milestones, logs, dates, and notes.
• Preferences, reminders, time zone, family-sharing invitations, permissions, inbox activity, and enrolled push-notification device metadata.
• Agreement and explicit health-data consent versions and acceptance timestamps.
• Security and operational information such as IP address, browser information, authentication events, and server logs.
• With optional consent, pseudonymous Google Analytics identifiers, sanitized public or virtual app-screen views, fixed onboarding progress events, and the fixed category of newly created records.
• Files selected for avatar processing and backup files you deliberately import or export.

Purposes and legal bases

• Provide the authenticated journal, records, backups, and sharing features as necessary to perform the service requested by the account holder.
• Process child growth and development information only after the owner records explicit account-wide consent and confirms lawful authority. Consent can be withdrawn from Settings.
• Protect accounts, prevent misuse, troubleshoot failures, and maintain service reliability based on our legitimate interests in operating a secure service.
• Comply with applicable legal obligations and respond to lawful requests.
• Measure sanitized page, screen, onboarding-funnel, and record-category usage through Google Analytics only with optional consent. Refusing Analytics does not affect access to Baby Steps.

Recipients, hosting, and transfers

Application and database data is hosted by NYXIAOZHAN in USA. Google Firebase Authentication processes sign-in and request-verification information. When push notifications are enabled, the browser vendor's standards-based push service processes an encrypted notification and device-specific delivery endpoint. When Analytics is accepted, Google Analytics processes pseudonymous usage information. Selected child profiles are disclosed to another registered user only through an owner-created sharing invitation.

Providers may process information outside your country. Where the GDPR requires it, transfers must rely on an adequacy decision, approved contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism. See Google's Firebase privacy information, Privacy Policy, and data-processing terms.

Baby Steps does not sell personal information and does not currently serve advertising. Analytics consent never authorizes advertising.

Retention

Account and child records are retained while the account and relevant profiles remain active. Deleting a profile removes its active-service records; deleting an account removes the account and all children it owns. Children merely shared with that account remain with their owners. Routine backups are retained for up to 30 days and security or operational logs for up to 30 days unless a longer period is required for a documented legal or security need.

When the progressive web app is used, account-separated snapshots of previously viewed journal and sharing data may be stored on that device for offline access. Measurements and logs created, edited, or deleted offline are held in an account-separated local queue until they sync or are explicitly discarded. Snapshots expire after seven days; queued changes and snapshots are cleared on sign-out, account switching, or account deletion. Anyone who can unlock the device and browser profile may be able to view locally available journal data.

Push subscriptions are retained while notifications remain enabled on a device and are removed on device opt-out, account deletion, or when the browser push service reports that a subscription has expired. Completed notification delivery records follow the operational log-retention period.

GA4 user and event-level data is configured for 14 months. Analytics cookies are configured for no more than 395 days and can be removed immediately by withdrawing Analytics consent.

Your rights and choices

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent at any time without affecting processing that was lawful before withdrawal. Settings provides record editing, child deletion, sharing controls, a complete personal-data JSON export, consent preferences, health-data consent withdrawal, and account deletion.

Health-data consent withdrawal requires deletion of every child profile owned by the account because Baby Steps cannot provide those features without processing their records. Analytics can be rejected or withdrawn without losing service access.

Contact [email protected] for requests not available in the app. You may also lodge a complaint with the data-protection supervisory authority where you live or work. EU authorities are listed by the European Data Protection Board.

Children, automated decisions, and security

Baby Steps is for adult parents, legal guardians, and authorized caregivers; it is not directed to children. The profile owner must have lawful authority to provide each child's information. Baby Steps does not make automated decisions with legal or similarly significant effects and is not a medical device, diagnosis, medical advice, or emergency service.

We use authenticated access controls, ownership checks, encrypted transport supplied by the hosting platform, and data minimization. No system is completely secure; protect your Google account, devices, and exported files.

Policy changes

Material changes will be published with a new effective date and communicated in the application when appropriate. A new purpose, such as advertising, requires separate consent and updated disclosures.