Privacy Policy

Overview

Bibsy is a baby tracking app built and operated by Bibsy ("we", "us"). This Privacy Policy explains what data we collect when you use Bibsy, how we use it, who we share it with, and the rights you have over it.

By creating an account or using Bibsy, you agree to this Privacy Policy. If you don't agree, please don't use the service.

What information we collect

Account information

• Email address — for sign-in, account recovery, and transactional emails (signup confirmation, password reset, partner invites).
• Password — stored as a salted hash on our behalf by Supabase. We never see or store your plaintext password.
• Display name and avatar colour — what other household members see when reviewing shared baby logs.

Baby and tracking data

You log information about your baby to track care patterns over time. This may include:

• Baby's name, date of birth, sex, weight, height, head circumference
• Feeding logs (bottle, breast, solids), pumping output
• Diaper changes (wet, dirty)
• Sleep sessions and nap timing
• Mood, milestones, vaccines, medications, growth measurements, teething, hygiene events
• Photos uploaded via the memory logger or profile-photo features
• Notes and free-text annotations you add to events

This data belongs to you. We process it solely to provide the Bibsy service.

Device and technical data

• Device type (iOS / Android / web), operating-system version, and app version — used for compatibility and crash diagnostics
• Crash diagnostics and stack traces (via Sentry) — sent automatically when the app encounters an error
• Anonymised usage analytics (via PostHog) — which features get used and which screens are visited. We do notsend your baby's logged data to analytics
• IP address and approximate (city-level) location derived from IP — used for rate limiting and fraud detection

Device permissions you may grant

On iOS and Android, Bibsy asks for permissions only when needed for a specific feature:

• Camera — for taking baby photos in the memory logger or profile spots
• Photo library — for choosing existing photos instead of taking new ones
• Notifications — for feed and sleep reminders if you enable them

These permissions are local to your device. Bibsy only uses them when you actively use the corresponding feature. You can revoke any of them at any time in your device settings.

How we use your information

• To provide the core Bibsy service — logging, viewing, syncing across household members, generating insights from your data
• To send transactional emails — signup confirmation, password reset, partner invites, email-address change confirmations
• To diagnose crashes and improve reliability — via Sentry crash reports
• To understand which features are useful and which are ignored — via anonymised PostHog analytics, so we can prioritise what to build next
• To prevent abuse — rate limiting per-IP on API routes, suspicious-activity detection

What we do NOT do

• We do not sell your personal data to anyone, ever
• We do notuse your baby's logged data for advertising
• We do not use your data to train AI models
• We do not share your data with insurance companies, employers, advertisers, or data brokers

Third-party processors we use

We use the following third parties to operate Bibsy. Each handles specific data on our behalf and is bound by their own privacy commitments:

• Supabase — database and authentication. Stores your account, household membership, baby data, and event logs. Hosted in the United States.
• Vercel — web hosting and global edge network. Serves the Bibsy web app and API routes.
• Sentry — crash diagnostics. Receives error reports and stack traces when the app crashes. Configured to not receive your baby data, passwords, or auth tokens.
• PostHog — anonymised product analytics. Receives events about which features you use, not what you log. Hosted in the United States (US Cloud).
• Resend — transactional email delivery. Delivers signup confirmation, password reset, and partner invite emails to you. Receives your email address and the email content.
• On-device notifications — reminders are scheduled and shown locally on your device. No third-party push service (Apple or Google) receives your data to deliver them.

You can review each processor's privacy policy on their respective websites. We choose processors that take privacy seriously and offer appropriate data-processing agreements.

Data retention

• Your baby and tracking data: retained as long as your account is active. You can delete specific entries any time in the app.
• Your account: retained until you delete it. Account deletion (Settings → Account → Delete Account) permanently removes all your data immediately.
• Crash diagnostics: retained per Sentry's defaults (typically 90 days).
• Anonymised analytics: retained per PostHog's defaults (typically up to 7 years for long-term product insights, with personal identifiers removed).
• Transactional email logs: retained by Resend per their defaults (typically 30 days for delivery diagnostics).

Your rights

You have the right to:

• Accessyour data — everything you've logged is visible in the app. Contact us for a full export.
• Correct your data — edit any entry at any time in the app.
• Deleteyour account — Settings → Account → Delete Account. You'll be asked to type DELETE MY ACCOUNT to confirm. All your data is permanently removed within 30 days.
• Object to specific processing — contact us.
• Data portability — contact us for a machine-readable export.
• Lodge a complaintwith a data-protection authority if you're in the EU/UK.

Children's data

Bibsy is intended for use by parents and caregivers to log information about their babies. Babies are the subject of much of the data but do not interact with the app themselves. The account holder must be at least 13 years old (or the digital age of consent in their jurisdiction).

If you log data about your baby, you do so as the parent or legal guardian. You can delete that data at any time. The data you log about your baby is treated with the same protections as your own personal data described in this policy.

We do not knowingly collect personal information from children under 13 directly. If you believe a child under 13 has created a Bibsy account, please contact us and we'll remove the account.

International data transfers

Bibsy's primary infrastructure is hosted in the United States (Supabase US region, Vercel global edge with US origin, PostHog US Cloud, Resend US region). By using Bibsy, you consent to your data being transferred to and processed in the United States.

If you're located in the EU, UK, or Switzerland, we rely on Standard Contractual Clauses and similar safeguards for international transfers as required by GDPR.

Security

• Passwords are hashed and salted by Supabase; we never see or store plaintext passwords
• All data in transit is encrypted via HTTPS (TLS 1.2+)
• Data at rest is encrypted on Supabase's infrastructure
• Row-level security ensures household members only see their own household's data — never another family's
• Sentry crash reports are configured to exclude passwords, auth tokens, and baby data
• Authentication tokens are stored in HTTP-only cookies (web) or encrypted local storage (native app)
• API routes are rate-limited per IP to prevent brute-force and abuse

No system is perfectly secure. If you discover a vulnerability, please email security@bibsy.app so we can fix it before it's exploited.

Changes to this Privacy Policy

We may update this Privacy Policy as Bibsy evolves. Material changes will be announced via email and an in-app notice. The "Last updated" date at the top of this page reflects the current version.

Continued use of Bibsy after a change indicates acceptance of the updated policy.

Contact us

Questions about this Privacy Policy or how we handle your data? Email us at privacy@bibsy.app.

For account deletion, the in-app flow (Settings → Account → Delete Account) is the fastest path. Email is for everything else.