Privacy Policy — Pipou: Baby Tracker
Also available in Español and Français.
1. Summary
Pipou: Baby Tracker ("Pipou", "the app") helps parents log feeds, sleep, diapers and pumping. By default, everything stays on your phone. If you choose to share with another caregiver ("Family"), the entries you share are stored on our cloud database (Google Firebase, located in the European Union) so that both phones can see them. The app asks for your consent before that happens. There is no sign-up, no advertising, no analytics and no tracking.
2. Information stored only on your phone
- your baby's name (optional), date of birth and feeding method, entered at setup;
- every feed, sleep, diaper and pumping entry you log, and any notes you add;
- running timers and app settings (units, night mode), and the time you gave consent to Family sharing.
Your baby's name, date of birth and feeding method are never sent to our servers. The app excludes its local data from iCloud/computer backups (iPhone) and from Google cloud backup and device-to-device transfer (Android).
3. Information stored on our servers — only if you use Family sharing
Family sharing starts only when you invite a caregiver or join with an invite code, and only after you tick the consent box ("I agree to this, and I am this baby's parent or guardian"). If you choose "Not now", nothing is created or sent. From the moment you agree:
| What | Why |
|---|---|
| An anonymous account ID created by Firebase Authentication on your phone (no name, email or phone number) | To know which phone belongs to which family |
| A family record: the account IDs of its members (up to 2), which member owns it, and when it was created | To let only family members see the entries |
| Each shared entry (type — feed, sleep, diaper or pumping; start/end time; left/right duration and last side; amount in ml; milk type; diaper type; pumping duration; any note you add, up to 200 characters; which account created and last edited it; when it was edited or deleted) | To show the same log on both phones |
| Invite codes (8 characters, valid up to 48 hours, single use), the family they belong to, who created them and when | To let a second caregiver join |
When you create a family, the entries already on your phone are uploaded too. When you join a family, the app asks whether to add your existing entries; if you say no, only entries made after joining are shared.
Information about a baby's feeding, sleep and diapers may be considered health information about a child. We process it only to provide Family sharing — never for advertising, profiling or analytics — and we never sell it.
Google, as our hosting provider, also processes technical data needed to deliver the service, such as your IP address and device/SDK information in network requests. The Firebase software in the app reports limited, non-identifying diagnostic information to Google about its own operation; we do not use it for analytics.
4. Who processes the information
- Google (Firebase Authentication and Cloud Firestore), as our data processor under the Firebase Data Processing and Security Terms. The Firestore database is in the European Union (multi-region
eur3: Belgium and the Netherlands). Firebase Authentication is a global service and may process the anonymous account ID outside the EU, including in the United States; such transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses included in Google's terms. - The other member of your family sees all shared entries.
We do not use any other third party. We do not sell or rent your information, and we do not share it for advertising.
5. Legal basis (EU/EEA/UK)
- Providing Family sharing that you ask for: performance of a contract (GDPR Art. 6(1)(b)).
- Health information about your child: your explicit consent, given as the child's parent or guardian (Art. 9(2)(a)), which you give on the consent screen before sharing starts.
- Security and abuse prevention (for example limiting attempts to guess invite codes): our legitimate interests (Art. 6(1)(f)).
6. How long we keep it
- On your phone: until you delete it, use Delete my account and data, or delete the app.
- Shared entries and the family record: while the family exists. When you delete a single entry, the server keeps it marked as deleted (so the other phone also removes it) until the shared data is deleted as described below.
- Invite codes: until they are used or revoked, or until the family's data is deleted. An expired code can no longer be used.
- Anonymous account ID: until you delete your account in the app.
Deleted data is removed from our live database straight away. Google may keep encrypted copies in its own backup systems for a limited period under its deletion policy before they are overwritten.
7. Deleting your data and your other rights
In the app:
- Family → Leave the family. A member can tick "Also delete what I recorded from the servers". If you are the only member left, leaving deletes the family's data from our servers.
- Family → Delete the family's data from the servers (the family's owner). Every shared entry and invite is erased, and the other member stops seeing them. Each phone keeps its own copy.
- Settings → Delete my account and data. Erases everything on this phone and anything of yours on our servers: the entries you created, your sign-in, and — if you own the family — the family's shared data for everyone. This cannot be undone.
The family owner can also remove the other member; that person stops seeing the shared entries. Leaving, being removed or deleting withdraws your consent; the app will ask again before you share in future.
By email: you can ask to access, correct, export or delete your information, restrict or object to processing, or withdraw consent, at sendtoichime@gmail.com. We answer within one month. Because accounts are anonymous, please use the in-app options where possible; if you have deleted the app, tell us roughly when you created or joined the family so we can try to find your data.
If you are in the EU/EEA or UK you may also complain to your data-protection supervisory authority — for example the AEPD (Spain) or the CNIL (France).
Deleting the app deletes your local data but does not delete what you already shared. Use Delete my account and data first, or ask the other member to delete the family's data, or email us.
8. Children
The app is used by parents and caregivers aged 18 or older. It is not directed to children. The information concerns a baby and is entered by the baby's parent or guardian, who confirms this at setup and again on the consent screen.
9. Security
Data is encrypted in transit (TLS) and at rest by Google. Access rules allow only members of a family to read or write its entries; invite codes are 8 characters long, expire after 48 hours, can be used once, and repeated wrong attempts are slowed down. Anyone who can unlock your phone can open the app.
10. Changes to this policy
We will update this policy when our practices change (for example if we add purchases), change the effective date and, for material changes, tell you in the app before the change applies.
11. Contact
Tung Tran Thanh · Hanoi, Vietnam · sendtoichime@gmail.com