Privacy Policy

1. Data controller

The controller responsible for the processing described in this policy is Walking LLC, a company incorporated in Virginia (United States), owner and operator of the Baby Tracking app and website. For privacy questions or to exercise your rights, email [email protected]. This policy also serves as the information notice required by the General Data Protection Regulation (GDPR) for people accessing the service from the European Economic Area or the United Kingdom.

2. Information we process and its source

Depending on how you use the service, we may process:

• Account: name, surname, email address, a password stored in encrypted form, and Apple sign-in identifier when that option is used.
• Baby profile: name, date of birth, sex and optional photograph.
• Records: feeding, diapers, sleep, weight, height, dates, times, quantities, ingredients and caregiver notes.
• Collaboration: the caregiver who creates each entry and email addresses used for invitations.
• Subscription: premium subscription status, app store purchase identifiers and the associated user identifier, managed through RevenueCat and App Store or Google Play.
• Security and usage: session tokens, IP address, access date and time and technical logs needed to authenticate, protect and maintain the service.

Unit, language and reminder preferences may be stored locally on the device.

Source of the data: data comes from the information you enter in the app; from Apple, if you use "Sign in with Apple"; and from Apple, Google and RevenueCat in relation to your subscription status. We do not obtain personal data from sources other than these.

3. How we use information

We use it to create and manage accounts; authenticate access; synchronize history between authorized caregivers of the same profile; display timelines, calculations, charts and summaries; generate a PDF requested by the user; send invitations and service notices; manage subscriptions; provide support; and protect the service against unauthorized access and fraudulent use.

4. Legal basis

We process the data needed to provide the requested service on the basis of performance of the contract for use of the app; with the consent of the adult entering a child's information and adding a photograph; for our legitimate interest in maintaining security, preventing fraud and resolving incidents; and to comply with legal obligations. The adult adding a child's data confirms that they are authorized to do so and may withdraw consent at any time, without affecting the lawfulness of earlier processing.

5. Sharing

We do not sell personal data. Records may be visible to caregivers invited to the same profile. We rely on the following processors, which process data only on our instructions and under confidentiality and data protection obligations:

• DigitalOcean — hosting of the infrastructure and database (United States).
• RevenueCat — subscription management (United States).
• Apple — "Sign in with Apple" and purchases made through the App Store.
• Google — purchases made through Google Play.
• Lark — delivery of service emails (invitations and notices).

We may also disclose data to authorities or third parties where legally required or necessary to protect rights, safety or the integrity of the service. Profile photographs are currently stored on our servers; as the service evolves they may be stored with cloud infrastructure providers, under the same safeguards.

6. Data location and international transfers

Information is hosted and processed in the United States. If you access the service from the European Economic Area, the United Kingdom or another territory whose law governs international transfers, those transfers rely, where required, on the Standard Contractual Clauses approved by the European Commission or other appropriate safeguards provided for by applicable law.

7. Retention and deletion

We keep information while your account remains active. When you delete the account —from the app or by email request— associated data is erased from our systems and we do not keep a separate copy; backups that may still contain it are overwritten in their normal rotation cycle. We would only retain specific data beyond that point if a legal obligation, security or fraud prevention required it in a particular case. Technical and access logs are kept only for as long as needed for the security and maintenance purposes described. We may in the future delete accounts that remain inactive for a prolonged period, with prior notice to the associated email; we do not do this today.

Request account deletion

8. Your rights

You may request access, correction, deletion, restriction, objection or portability where applicable, and withdraw consent without affecting earlier processing. Contact us from the email linked to the account so we can verify the request. If you believe the processing does not comply with the law, you have the right to lodge a complaint with a supervisory authority: if you are in the European Economic Area, with the authority of your country of residence (in Spain, the Spanish Data Protection Agency, www.aepd.es); if you are in the United Kingdom, with the Information Commissioner's Office (ICO).

9. Automated decision-making

We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you. Charts, calculations and summaries are operations performed on the data you enter.

10. Children's data

Baby Tracking is intended for adults responsible for a child, not for children to use independently. Child data should only be entered by someone authorized to manage it.

11. Security

We apply reasonable technical and organizational measures, including authentication, password encryption and protected communications. No system can guarantee absolute security.

12. Changes

We may update this policy to reflect service or legal changes. The current version and its update date will be published on this page.