Privacy Policy

1. Introduction

Baby Novum ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we handle information when you use the Baby Novum mobile application ("App").

2. Information We Collect

2.1 Data You Create in the App (Stored Locally)

All data you enter into Baby Novum is stored locally on your device using an encrypted SQLite database. This includes:

• Pregnancy information (due date, gestational age, baby name)
• Health metrics (weight, blood pressure, kick counts, contraction logs, ultrasound records, lab results, swelling data)
• Nutrition data (supplement logs, hydration records)
• Wellbeing data (mood check-ins, diary entries, EPDS screening results, breathing session logs)
• Photos and media (belly photos, ultrasound images)
• Personal letters to your baby
• Birth preparation data (hospital bag checklists, birth plan, budget, shopping lists)

This data never leaves your device unless you explicitly choose to export it (e.g., via the PDF export feature, which saves the file locally to your device).

2.2 Subscription and Payment Data

If you purchase a Premium subscription, payment is processed entirely by Apple (App Store). We use RevenueCat to manage subscription status (active/inactive). RevenueCat receives an anonymized app user ID and subscription status — it does not receive your name, email, health data, or any other personal information.

2.3 Crash Reports

The App may collect anonymized crash reports to help us identify and fix technical issues. These reports do not contain any of your personal health data, diary entries, or photos. You can opt out of crash reporting in your device settings.

2.4 Advertising Measurement (Meta / Facebook SDK)

We run advertising campaigns for Baby Novum on Facebook and Instagram. To find out which of those ads actually bring people to the App — and stop paying for the ones that do not — the App includes the Meta (Facebook) SDK, which feeds Meta's advertising measurement and attribution system (Meta Audience Network).

On iOS this is switched off until you agree to it. At first launch the App shows Apple's App Tracking Transparency prompt; if you decline, or never answer, nothing described in this section is ever sent. See Section 7.

If you allow tracking, Meta receives:

That is the complete list. There is no fifth event and no additional field.

What is never sent — to Meta or to anyone else:

3. How We Use Information

We do not collect the personal data described in Section 2.1, so we cannot and do not use it for anything.

The anonymized crash data in Section 2.3 is used solely to improve the stability and performance of the App.

The advertising events in Section 2.4 are used for one purpose: working out which advertising campaigns bring people who go on to find Baby Novum useful, so we can spend the advertising budget on those instead of the rest. They are not used to build a profile of you inside the App, and the App never reads anything back from Meta. Your experience of Baby Novum is identical whether you allow tracking or not — no feature is locked, delayed or degraded either way.

4. Data Security

We take the security of your data seriously:

• AES-256 encryption — all diary entries, letters to baby, and sensitive health data are encrypted at rest on your device.
• Biometric protection — you can enable Face ID or fingerprint authentication to protect access to the App.
• No cloud sync — your pregnancy data is never uploaded to external servers.
• The ads SDK is isolated — the Meta SDK described in Section 2.4 runs alongside the App, not inside its database. It receives the four events we explicitly pass to it and has no route to anything else.

Our iOS Privacy Manifest declares tracking (NSPrivacyTracking = true), because sharing the advertising identifier with Meta is tracking under Apple's definition and we are not going to describe it as anything else. What that declaration covers is the advertising identifier and the four conversion events — no health or pregnancy data is declared, because none is collected.

While we implement strong local security measures, the security of your device itself (lock screen, operating system updates) also plays a role in protecting your data.

5. Device Permissions

The App requests certain device permissions to provide its features. We only request permissions that are necessary for specific functionality:

• Camera — to capture belly photos and ultrasound images
• Photo Library — to save and load pregnancy photos from your gallery
• Microphone — to record voice diary entries
• Face ID / Biometrics — to protect your private diary and letters
• Notifications — to send reminders for supplements, appointments, and kick counting sessions (local notifications only, no remote servers involved)
• Calendar — to add pregnancy appointments to your device calendar (optional)
• App Tracking Transparency — to ask permission before using your advertising identifier for the measurement described in Section 2.4. Declining costs you nothing inside the App.

You can manage these permissions at any time in your device's Settings app. Revoking a permission will disable the corresponding App feature but will not affect your existing data.

6. Third-Party Services

Baby Novum uses a minimal set of third-party services:

• Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) — advertising measurement and attribution via the Meta / Facebook SDK and Meta Audience Network. Receives only the identifiers and events listed in Section 2.4, and only if you allow tracking. Meta Privacy Policy
• RevenueCat — subscription management. Receives anonymized subscription status only. RevenueCat Privacy Policy
• Apple App Store — payment processing. Governed by Apple's privacy policy.
• Google Fonts — fonts are loaded from Google's CDN on our website only (not in the App).

Meta is a separate controller, not our processor

For the advertising data in Section 2.4, Meta Platforms Ireland Limited acts as an independent data controller in its own right — not as a processor acting on our instructions. Once an event reaches Meta, Meta decides on its own how it is processed, for how long it is retained and how it is combined with other data it holds, under its own Privacy Policy. We cannot delete it on your behalf. Your rights over that data are exercised against Meta directly — Section 7 explains how.

We do not sell your personal data, and no data broker has ever been given access to anything. Apart from the identifiers and four events in Section 2.4, we share nothing with advertisers.

7. Advertising Consent and How to Withdraw It

Legal basis: your consent. Everything in Section 2.4 is processed on the basis of consent — Article 6(1)(a) GDPR — collected through Apple's App Tracking Transparency (ATT) prompt shown at first launch. There is no legitimate-interest fallback here: if you decline, no advertising identifier and no event is sent, then or later.

Withdrawing consent on your iPhone

You can withdraw consent at any time, as easily as you gave it, and without giving a reason:

• Settings → Privacy & Security → Tracking, then switch Baby Novum off.
• To do the same for every app at once, turn Allow Apps to Request to Track off in the same screen.

The change takes effect immediately: iOS stops handing out your advertising identifier and the SDK stops sending events. Nothing in the App changes and nothing you have stored is affected.

Data Meta already holds

Withdrawing consent stops future events; it does not reach back into Meta's systems. To control what Meta does with data it already received, use Meta's own controls — Meta Ad Preferences — or contact Meta directly under its Privacy Policy.

You can also write to us at [email protected] and we will confirm your opt-out in writing.

8. Do Not Sell or Share My Personal Information (California)

We do not sell personal information and never have — we receive no money or other value for it.

We do, however, have to be straight about the other half of the CPRA. Passing your advertising identifier and conversion events to Meta so it can measure and target advertising counts as "sharing" for cross-context behavioural advertising under the California Consumer Privacy Act as amended by the CPRA. Treat it as sharing, because that is what it is.

• Categories shared: identifiers (advertising identifier, IP address) and internet/device activity (device model, OS version, the four conversion events including subscription amount and currency).
• Purpose: advertising attribution and campaign measurement.
• Recipient: Meta Platforms Ireland Limited.
• Never shared or sold: the sensitive personal information in Section 2.1 — health and pregnancy data, diary entries, photos and letters. None of it is shared, sold, or used to infer anything about you.

How to exercise your right to opt out

The opt-out mechanism is the tracking control on your device, and it works before anything is shared rather than after:

• Decline the App Tracking Transparency prompt when the App first asks — nothing is ever shared.
• Or, at any time: Settings → Privacy & Security → Tracking → switch Baby Novum off.
• Or email [email protected] with the subject "Do Not Sell or Share My Personal Information" and we will process the request and confirm it.

No discrimination. Opting out costs you nothing. We will not deny you any feature, charge you a different price, or give you a lesser version of Baby Novum because you said no.

9. Your Rights (GDPR & CCPA)

Depending on your location, you may have the following rights regarding your data:

• Right to Access — Since all your data is stored on your device, you have full access to it at all times within the App.
• Right to Deletion — You can delete all your data at any time by using the "Delete All Data" option in the App's Settings screen. This permanently removes all locally stored data. Uninstalling the App will also remove all data.
• Right to Portability — You can export your data using the PDF export features available within the App.
• Right to Withdraw Consent — You can withdraw consent to advertising measurement at any time, without penalty. See Section 7.
• Right to Opt Out of Sale or Sharing — We do not sell your personal data. We do share the advertising identifiers and events in Section 2.4 when you consent to it. See Section 8.
• Right to Object and to Complain — You may object to processing and lodge a complaint with your national data protection authority.

How to Delete Your Data

To delete all your Baby Novum data:

• Open the App → Settings → Account → Delete All Data
• Or simply uninstall the App from your device

10. Data Retention

Your data is retained on your device for as long as you use the App and have not deleted it. We do not retain copies of your data on any servers.

We do not retain the advertising events in Section 2.4 either — they are sent to Meta and we keep no copy. Meta retains them under its own retention schedule, which is described in its Privacy Policy.

11. International Users

Baby Novum is available globally. Your pregnancy data, diary, photos and letters stay on your device, so Baby Novum performs no international transfer of them — there is nothing to transfer.

The advertising data in Section 2.4 is the exception. If you allow tracking, it is sent to Meta Platforms Ireland Limited in Ireland and may be processed by Meta outside your country, including in the United States, relying on the transfer safeguards Meta sets out in its own Privacy Policy (Standard Contractual Clauses and the EU–U.S. Data Privacy Framework). If you decline tracking, no data leaves your device for this purpose.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will notify you of significant changes through the App. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the App after changes are posted constitutes your acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your data, please contact us:

Email: [email protected]

We will respond to privacy-related inquiries within 30 days.