Privacy Policy

Version 1.0 · effective 10 November 2026. Written by the Babykin team to match what the app and servers actually do; not reviewed by a lawyer. If the Vietnamese and English versions differ, the Vietnamese version prevails.

1. Summary

2. Who is responsible

Babykin (“we”) is developed and operated by Vũ Đình Mạnh, an individual based in Ninh Bình, Vietnam, who decides how the data described here is processed (data controller). Privacy contact: support@babykin.app (reply within 72 business hours).

3. Users and children’s data

• Babykin is used by adults: parents, caregivers, remote grandparents and relatives, and guests viewing a shared link. It is not intended for use by children.
• Baby information is entered by parents. The person who creates a family confirms they are the baby’s parent or legal guardian and consents to storing the baby’s information (recorded with document version and time). Caregivers add entries to the journal the parents created.
• Care logs (feeding, sleep, diapers, temperature, medicine, weight, height, vaccinations) are treated as sensitive: visible only to family members with the right role, never used for analytics or advertising.
• Babykin is not a medical app: no diagnosis, no treatment advice, no comparison against “norms”.

4. What we collect

• Account: a Firebase user ID. You can start anonymously and later link Apple or Google. Firebase receives the name and email from that provider (Apple may relay a private email). Babykin’s servers do not store your email (unless you turn on “Allow us to contact you” when sending feedback) — only display name, optional avatar, language, text size, time zone and quiet hours. For Apple accounts we keep an encrypted refresh token so we can revoke Sign in with Apple when you delete your account.
• Family and baby: family name, members, roles, relationship labels, invites and view links; baby name, date of birth, optional gender, avatar and time zone; logs (type, times, measurements, notes, attachments visible only to parents and caregivers), care calendar, “firsts” milestones, daily summaries.
• Photos, videos and interactions: posts, captions, comments, reactions, mentions. Photos are re-encoded on the device and EXIF (including GPS) is removed before upload; videos are re-encoded to 720p on the device and we do not read or use any location in them. Premium can keep originals. Camera, microphone and photo library are used only when you choose to capture or pick media (system picker; no full-library access).
• Photo views, visible to parents: when a photo is on screen for about one second, Babykin records who viewed it and when. Parents can see the viewer list for every post, caregivers for their own posts, everyone else only a count; parents may get a “Grandma just viewed Na’s photo” notification. Grandparents and caregivers are told this when they join, on their screens and on the guest page: “Parents will see when you have viewed a photo.” There is no hidden viewing mode.
• Guests (no account): view links contain a random token; we store only its hash. The guest’s browser keeps a random ID in page storage (localStorage, not a tracking cookie) so reactions are remembered and views are not double-counted. An optional “How are you related to the baby?” label is shown to the family. The guest page has no ads, analytics or third-party code and is marked noindex.
• Devices and notifications: an app-generated device ID, OS, app version, FCM token, Live Activity tokens and a read-only token for home-screen widgets.
• First-party usage analytics: events such as “logged a feed” or “opened Photos” with technical properties (log type, screen, app version, language, text size, baby age in days). The server replaces user and family IDs with keyed one-way hashes (HMAC-SHA256) and rejects any event carrying names, emails, phone numbers, captions, comments, notes, URLs or IP addresses. Photos, baby names and health values are never sent. Stored in Cloudflare Workers Analytics Engine only. Turn it off any time: Family → Account → “Send usage stats and crash reports” — the app then sends neither analytics nor crash reports and deletes unsent events on the device.
• Crash reports (first-party): error type, a hash of the failing code location, screen, app version and OS; on iPhone, crash and hang diagnostics come from Apple MetricKit. No error text, user data or photos; no Crashlytics, Sentry or other external crash service.
• Payments: Babykin sells nothing today — every feature is free and we receive no payment data. The rest of this item applies only once paid plans launch; we will announce it in the app and update this policy first. Payments are handled by Apple. We receive Apple-signed transaction data (transaction ID, product, purchase and expiry dates, renewal/refund status) to unlock Premium for the family. We never receive card details.
• Server logs: IP addresses and request metadata are used only for abuse prevention (e.g. limiting invite-code guesses for a few minutes) and in Cloudflare’s short-lived technical logs for debugging; never for location or tracking.
• Feedback and bug reports (only when you send them): from Account → “Feedback & bug report” (or the “Report a problem” button when something fails) we receive the type (bug or idea), the text you write, up to 3 images you choose (re-encoded with EXIF/GPS removed on the device and stripped again on the server), a ticket number, and your family and role at the time. Technical info (on by default, can be unticked, with a “View” button showing exactly what is sent): app version and build, iOS version, device model, language, text size, role, network type, current screen, number of unsynced items, last sync time and the last 20 error codes on the device — never captions, comments, log content, baby or member names. Your email is stored only if you turn on “Allow us to contact you”, and only to reply. Feedback is stored in Cloudflare (D1, R2); a text-only summary (no images) is sent via Cloudflare Email to support@babykin.app for the Babykin team.

5. How we use data

To run the app (store and sync logs, photos and videos between members, offline use); to enforce roles; to send the notifications you enabled; to power home-screen widgets and Live Activities; to write the daily summary (section 7); to unlock Premium; to understand which features help, fix bugs and measure stability; to read and answer your feedback; and to prevent abuse. We do not use data for advertising or marketing profiles, we do not sell or rent it, and we do not use it to train AI models.

6. Processors and location

We share data only with these providers, solely to operate Babykin:

• Cloudflare, Inc. — Workers servers, D1 (account and family directory), Durable Objects (one private store per family), R2 (photos and videos), Analytics Engine, Email Service (feedback summaries to the support mailbox); Workers AI only once the feature in section 7 is turned on.
• Google (Firebase) — Authentication and Cloud Messaging.
• Apple — Sign in with Apple, in-app purchases, APNs push delivery, on-device MetricKit diagnostics; the iCloud mailbox that receives email sent to support@babykin.app (including feedback summaries).

Cloudflare chooses data-centre locations automatically, usually near where data is created (for users in Vietnam, typically Asia-Pacific), which may be outside Vietnam; requests travel over Cloudflare’s global network. Firebase processes sign-in data on Google’s global infrastructure. We disclose data to authorities only when Vietnamese law requires it.

7. AI daily summary

Not enabled in the current version. Before turning it on we will update this policy and tell you in the app.

This is how it will work: each morning Babykin may write one sentence about the baby’s previous day from the recorded numbers. The server computes every number; an AI model running in Cloudflare Workers AI only smooths the wording. The baby’s name is replaced with a placeholder before anything is sent to the model; notes, photos, comments and member names are never sent. Every summary says “Automatic summary of your log, not medical advice.” If the AI fails, a fixed template is used. You can report a summary as wrong to hide it.

8. Retention

• Family logs, photos, videos, comments: until you delete them or the family is deleted.
• Deleted items: hidden immediately; deletion markers kept up to 90 days so all devices sync correctly. Media files of deleted posts are removed after 24 hours. Deleted babies can be restored, photos and videos included, for 30 days, then they are erased with their files.
• Family deletion: the family keeps working for 7 days (the owner can cancel), then the whole family store, photos, videos, invites and view links are erased within about 10 minutes.
• Data export ZIP files: 24 hours.
• Hashed analytics and crash events: 3 months in detail; daily aggregates (hashed IDs only) up to 24 months.
• Feedback and bug reports (text, images, technical info, contact email): 12 months from sending, or until you delete your account; the summary in the support mailbox is deleted on the same schedule.
• Abuse-prevention counters with IP: minutes to one hour. Server technical logs: a few days, per Cloudflare’s configuration.
• Consent records and payment events: kept after family deletion for as long as the law requires, as proof of consent and for reconciliation.

9. Your rights and controls

• View, edit, delete your own entries, posts and comments (parents can delete any content in the family).
• Export (parents): Family → Data → Export. ZIP with logs (CSV), post list and photos/videos; download link valid 24 hours; free.
• Delete family (owner): Family → Data → Delete family; cancellable for 7 days.
• Delete account: Family → Account → Delete account. Your account, devices, notification settings, the feedback you sent (images included) and Apple sign-in authorization are removed or revoked immediately (feedback summaries in the support mailbox within 30 days) and you leave every family. Content you posted stays with the family, shown as “Deleted user” (ask a parent to remove it). Owners of a family with other members must transfer ownership first; a family with no other members is deleted after 7 days.
• Sign out wipes all family data from the device, including widget photos; unsent entries are lost (the app warns you first).
• (Once paid plans exist) Auto-renewing Premium is not cancelled by deleting your account — cancel in iPhone Settings → your name → Subscriptions.

You may also request access, correction, restriction, objection or lodge a complaint under Vietnam’s personal data protection law (the Personal Data Protection Law and its implementing regulations; previously Decree 13/2023/ND-CP). Email support@babykin.app.

10. Security

HTTPS everywhere; every request is checked against your family membership and role; each family’s data lives in its own store; media has no public URLs — in the app every view uses a signed link that expires within minutes to an hour; photos on a guest view link load only while the link is active (parents can revoke it); widget photos use a per-device read-only token that stops working when you sign out; export download links last 24 hours; because these tokens are part of the URL they may appear in Cloudflare’s short-lived technical logs; invite, view-link and widget tokens are unguessable and revocable; photos shared outside the app always have EXIF removed; grandparents cannot share photos outside unless parents allow it. No system is perfectly secure; if a breach affects you, we will notify you and the competent authority as required by law.

11. Changes

For material changes we update the version number above and tell you in the app; where consent is required, the app asks again before you continue.

12. Contact

support@babykin.app — reply within 72 business hours. Support page: babykin.app/support.