Privacy
Last updated: 2026-10-19.
This website
The site measures page views and button clicks with PostHog in cookieless mode. PostHog counts visitors with a hash that changes every day and stores nothing in your browser. This data goes through our own address, e.newbornlog.com. The download link app.newbornlog.com/get counts each use in the same cookieless mode, with the device type, the store it opens, and the campaign name in the link.
The site also uses Google Analytics to measure visits. Google Analytics
sets cookies (for example _ga) that give your browser a
random ID, and it sends page views, device and browser details, and an
approximate location to Google. Google processes this data under its own
privacy policy. To stop
it, block cookies for this site or use the
Google Analytics
opt-out add-on. The site never sends baby data to Google.
Local use
The NewbornLog iOS and Android apps store your baby's records on your device by default. You do not need an account for local use, and local logging continues without an internet connection. The app contains no advertising.
Local-only data lives on that device only. It is not backed up without Premium, and it does not move to a new phone by itself. On Android, the app's own backup settings keep cloud backup and device-to-device transfer turned off for this data. If you lose or replace your device without using Premium, local-only data is gone. Premium is the supported backup.
Optional Premium
Premium is an optional paid feature. If you turn it on, you create an account with your email address, with Sign in with Apple on iPhone or the web (Hide My Email works too), or with Sign in with Google on Android, and a copy of your baby's records is sent over an encrypted connection to NewbornLog's cloud service. This lets you use the same log across your mobile devices and the web app, and share it with caregivers you invite.
Premium purchases go through the App Store on iPhone, Google Play on Android, and Stripe on the web. Apple, Google, or Stripe processes the payment; NewbornLog never sees your card details. Turning on sync is a separate, explicit step from signing in or buying: you choose which local babies to send, and the app states what it will upload before it sends anything.
We use Supabase to store and sync Premium records and photos, Cloudflare to host and protect the web app, Resend to deliver sign-in emails, RevenueCat to record subscription status, Apple, Google Play, and Stripe to process purchases, Apple for Apple sign-in, and Google for Google sign-in. These providers process data for us only to operate the service. Access to each baby's cloud log is limited to the account owner and the caregivers they invite.
To check your subscription, the apps send RevenueCat a random account or device ID, your purchases, basic device information such as the model, system version, and an app-specific device identifier, and when the Premium screen is shown. RevenueCat never receives your baby's records. The apps contain no advertising and do not track you across other companies' apps or websites. Email sign-in in the apps includes a Cloudflare Turnstile check against automated sign-ins, which runs no analytics. If you use Sign in with Apple, we keep a token from Apple only so that we can disconnect NewbornLog from your Apple Account when you delete your account. If you use Sign in with Google, Google sends us the email address, name, and profile picture link of your Google Account. We keep them with your account only to sign you in, and the app does not store them on your phone.
Web app analytics
The web app at app.newbornlog.com uses PostHog to measure its use: page views, sign-in and sign-up, checkout, invitations, and a count of new entries by type, for example "a diaper change was logged". These events are linked to your account's random ID and to a random ID stored in your browser. They never contain your baby's name, the time or content of an entry, notes, photos, medication or vaccination records, or your email address. We remove sign-in codes and invite codes from web addresses before we send them.
Native app analytics
Native iOS and Android builds that include and enable our analytics measure observed app opens and returns, visible first-run onboarding steps, onboarding completion, the first successful new care entry, invitation acceptance, subscription intent and access-check outcomes, paywall views and confirmed user dismissals, and store purchase outcomes through PostHog. An enabled production build can measure its initial foreground before sign-in or a paywall. We send only the action, fixed categories for the observed step, opening, purchase entry point or outcome where applicable, signed-in or anonymous identity state, app version and platform, with a random installation ID while signed out or your account's random ID while signed in. We do not send the care entry's type, time or content, baby identifiers, names, birth dates, measurements, notes, photos, emails, invite codes or purchase receipts. We do not record screens or automatically capture interactions. You can disable this analytics in Settings. This choice stays on your device; signing out or disabling it discards unsent events. Data already sent cannot be recalled by the switch. Network providers still receive connection metadata; we disable analytics location enrichment.
Health records
Medication and vaccination records are baby data. The app stores and deletes them under the same rules as every other log, and never sends them to analytics.
Data we keep, and how long
These are the rules we work to for how long we keep each kind of data.
| Data | How long we keep it |
|---|---|
| Local-only baby data | Until you delete it or clear the app's data. Android cloud backup and device-to-device transfer stay excluded. |
| Active Premium data | While the account or shared family record stays active. |
| Primary account deletion | Begins promptly; we target completion in the primary system within 30 days. |
| Shared-family records | Remain with the continuing owner and caregivers; a departing member's account identity is anonymized. |
| Deleted data in rolling backups | Expires within 30 further days and is never restored into the live service. |
| App export staging | Deleted after the export succeeds or is cancelled; recovery cleanup within 24 hours. |
| Authentication, security, and service logs | 30 days normally; up to 90 days for a documented incident or abuse investigation. |
| Support requests | 12 months after the request closes, unless a dispute or legal hold applies. |
| Subscription and accounting evidence | At least five years from the relevant Singapore Year of Assessment, limited to the billing and account identifiers we need. |
| Deletion audit evidence | 12 months, as status, time, and a pseudonymous identifier, with no baby content. |
| Legal hold | Only the identified records, with restricted access, reviewed every 90 days. |
A shared historical entry may keep a caregiver's display name after we anonymize the account identifier behind it. A copy you export yourself is outside these rules once you save it. We never use a legal or business reason to keep baby content that is unrelated to that reason.
Your choices
You can download a copy of your data. A baby owner can delete that baby and remove its records. Deleting your account removes your access; records shared with a family remain available to the remaining family members.
Who provides this service
Newborn Log is provided by Kickoff Ventures Pte Ltd, a Singapore company, which controls the data described on this page.