Baby Tracker privacy policy

Effective October 24, 2026. Developed by Ryan Schaefer.

Your journal and family sharing

Supported care records, including sleep, feeding, diapers, Growth measurements, baby profiles, photos, milk inventory and caregiver information, are saved on your devices. Existing personal journals synchronize through Apple iCloud. When you create or migrate to a central family journal, Baby Tracker's family service stores and processes those records on Cloudflare to provide shared access and synchronization. The family service therefore receives central journal content; it is not limited to purchase verification.

Sign in with Apple connects your account. The service processes your Apple account identifier and authorization/session credentials to authenticate you; Apple handles the sign-in prompt. The owner chooses who may join through a private invitation and assigns Viewer or Caregiver access. Owners manage invitations, membership and the shared profile photo. Caregivers can edit records; viewers can read them. Exports are shared only when you choose to share them.

Growth and your shared journal

Weight, height or length, and head circumference records synchronize with your baby’s journal through iCloud or the central family service, depending on the journal. Family members you invite can view these measurements. Only the owner and caregivers can add, edit or delete them. Growth records are included in explicit full backups and may be restored to the shared journal. Older local Growth archives and migration recovery copies remain protected on the device and excluded from automatic device backups. You choose where to save or share backup files.

Optional background family alerts

In versions with background alerts, you can connect in Notifications settings using the iCloud account already signed in on your device, without a separate app sign-in. Our notification service, hosted on Cloudflare, checks the journals selected on your device using your current iCloud access. It processes baby names, activity types and start/end times to deliver your selected updates through Apple Push Notification service. It does not request journal photos, free-text notes or measurement values. The service stores encrypted authorization tokens, device notification tokens, selected journal identifiers, delivery preferences and limited duplicate-prevention metadata. It does not store a full copy of your journal or use this information for advertising or analytics. iCloud authorization and notification credentials are used only for this connection. Disconnect background alerts in Notifications settings to remove that device connection and its stored service data. Unrenewed service connections expire after 90 days; iCloud authorization may expire sooner and require reconnection. Removing the app alone does not immediately disconnect the service. Cloudflare and Apple process network and delivery information under their respective service policies.

Queued care reminders

In versions that support remote care reminders, the phone sends upcoming notification text to the optional background-alert service. Depending on your notification privacy choices, this text can include a baby’s name, sleep or feeding totals, activity titles and reminder times. It is linked to your authorized account, device and selected journals, and used only to deliver your reminders. It is encrypted in service storage, not used for advertising or tracking, and does not include journal photos, free-text notes or Growth measurements.

The service accepts reminders no more than 36 hours ahead. Queued text is removed from active storage after successful delivery or cancellation, or by cleanup scheduled for the end of the five-minute delivery retry window. Cleanup also runs when a notification token or iCloud authorization has expired; service outages can delay it. Disconnecting removes the connection and queued reminders from active storage. An older paused test connection is cleaned when it next checks in or its previously scheduled expiration runs; it is not restored for delivery after the reminder deadline.

Cloudflare’s storage recovery history may retain encrypted prior alert state for up to 30 days after removal from active storage. These copies are not used to restore disconnected accounts or replay expired reminders. Disconnecting does not remove notifications already delivered by Apple. Change notification privacy and delivery choices in the app’s Notifications settings.

Premium purchases and family access

In versions with Premium, you can choose to connect, purchase, restore a purchase or check family access. Apple processes payments. Our Premium verification service, hosted on Cloudflare, receives Apple-signed product and transaction information and checks purchase, renewal, expiration, grace-period and refund status with Apple. It processes linked account and installation identifiers, encrypted iCloud authorization and session credentials, purchase identifiers, access status and limited duplicate-prevention metadata. These are linked account and purchase records, not anonymous information. We do not receive your payment-card details.

For legacy iCloud journals, the Premium service uses journal and iCloud-zone identifiers to verify existing access and ownership with Apple. That legacy access check requests the journal identifier rather than journal contents. Central family journals use service-managed membership and store the journal contents described above. The separate optional background-alert service processes the information described above. Premium information is used for purchases, restore, owner-paid family access and refund handling, not advertising or cross-app tracking.

Only the journal owner needs Premium for family features. Caregivers and viewers do not need a separate purchase for that journal. They receive the access status needed to use the journal, not the owner's purchase identifiers or payment details. Verified family access may remain readable through connection failures until a confirmed loss of access. Caregiver edits and changes to a participant’s own reactions require identity and family-access verification within the previous 72 hours and never continue beyond the known subscription or billing-grace expiry. Basic owner logging remains available offline. A lifetime purchase has no scheduled expiration but still needs periodic verification for refunds. A connection failure is not proof that the owner canceled.

Delete your Premium account

Open Settings > Premium > Delete Premium account to remove your Premium verification account and its purchase records, access snapshots, notification metadata and installation credentials from the active service. We verify your current account identity before deletion. Every installation's service session is revoked. A small linked security receipt containing the deletion request identifier and timing remains for no more than 24 hours and five minutes to prevent delayed retries from deleting a newly created account. Cleanup failures are shown in the app and can be retried; an unconfirmed request is not reported as completed.

Deleting your Premium account does not cancel Apple billing. Use Manage Subscriptions to cancel renewal; cancellation is not required before requesting deletion. It does not delete your journal, active timers, CloudKit sharing membership, separately connected background alerts, saved exports or previously delivered notifications. Owners can keep basic logging. Other devices may retain their last verified access until its short cache period ends, and older app versions retain their existing iCloud access. Use the separate journal and background-alert controls described in this policy to remove those records or connections.

Ordinary app refresh does not recreate a deleted Premium account. You can explicitly reconnect or restore a valid Apple purchase using the same iCloud identity. A protected service key allows that identity's purchase-binding token to be reproduced without keeping a deleted personal purchase registry. Apple purchase and refund checks still apply. A lifetime purchase does not cancel an existing recurring subscription.

Premium retention and recovery

Active Premium accounts retain the limited purchase-verification records needed to provide access until you delete the account. Unrenewed installation sessions expire after 30 days. Removing the app, disconnecting background alerts or canceling renewal does not itself delete Premium service records. Cloudflare's storage recovery history may retain encrypted prior versions for up to 30 days after removal from the active service; these recovery copies are not used to provide access or restore a deleted account. Apple retains purchase information under its own policies. We do not operate an additional personal purchase-registry backup.

Your controls

You can leave shared babies, delete babies you own, delete entries and export records you are permitted to export. You choose whether to share an export or photo. Removing the app does not automatically delete your iCloud or central family records. Deleting a Premium verification account preserves journal records; use the separate journal controls or contact support for a journal-erasure request. Notification and widget privacy choices are personal to each device.

Security and retention

Connections use HTTPS. Central family records are encrypted in Cloudflare storage and decrypted by the family service to process authorized requests; this is not end-to-end encryption. Journal records are retained to provide the journal until you remove them. Deleting a central journal record removes its content from service responses and retains only minimal identifiers and deletion markers needed for synchronization. Resumable background cleanup removes retained copies of that deleted content from active service history and request receipts. For records deleted before this cleanup was introduced, cleanup begins when the family next connects to the service; service outages can delay completion. Active records and newer, explicitly restored versions are preserved. Deleting a Premium verification account alone does not delete journal records. Contact us for assistance with journal-erasure requests. Cloudflare storage recovery may also retain earlier encrypted state for up to 30 days after removal from active storage. Existing iCloud journals remain subject to Apple's storage and recovery behavior. Historical free-text notes and retired medicine, temperature, symptom and reaction records are preserved in a protected archive on each upgraded device, excluded from automatic cloud backups. CloudKit database caches are also excluded from automatic device backups; supported journal records sync through iCloud or the central family service, depending on the journal. Keep an explicit backup if you need to preserve unsynced records. Backup restoration keeps these records and archived drafts local. Saved doctor questions and retired note templates use protected local storage excluded from automatic backups. Doctor questions are removed with their baby. Older draft preferences are sanitized only after their original data and photos are protected locally. Baby removal clears local drafts and archives, preserving photos referenced by other babies; failed file cleanup is retried on reopening. Editable legacy cloud records are removed after local preservation; other devices and shared families must update and finish syncing. Explicit exports can include archived data; you choose where to save or share them. Data submitted to earlier services follows the retention rules applicable when submitted; contact us for removal assistance. This support website's hosting provider, Cloudflare, may process network addresses and operational security logs under its own service policies.

No tracking or advertising

The app includes no advertising, third-party analytics, data sales, cross-app tracking or HealthKit integration. It does not use your data to train AI models. Baby Tracker is a journal and reminder tool, not a medical diagnostic service.

Contact

Email Rhynockgames@gmail.com for privacy questions or deletion requests. Please avoid sending sensitive journal content.