Children's Information Protection
Public consolidated edition, updated November 4, 2026. Operator: 张浩冉 (Zhang Haoran), individual developer. Contact: harnzh@outlook.com.
Read this notice together with the Privacy Policy. Baby Plan is for adult parents, guardians and authorized caregivers, not for children to use independently. Children's identity, birth, family, care, health, photo and behavioral information can be sensitive even when names are removed.
1. Guardian authorization
Provide a child's information only if you are their guardian or have explicit authorization. A family role or an accepted checkbox does not prove guardianship. Limit entries and family membership to what is needed for care. Declining optional AI, photo, microphone or location features does not block unrelated manual logging.
2. Information and purpose
Depending on your choices, the app processes a child's nickname, sex, birth details and measurements, avatar, relationships, feeding, sleep, diapers, activities, growth, vaccination and developmental records, health observations, supplies, plans, notes, times and the person making a record. Birth details can include due date, gestational age, blood type, allergies and history. The purpose is recording, reference, reminders, authorized family collaboration, export and recovery. Optional fields may remain blank.
WHO references are calculated locally and do not upload data to WHO. Growth, vaccination and AI information is not diagnosis, screening, treatment, emergency triage or medication advice.
3. Family storage and photos
Records are local first. For an online family, authorized profiles and care records can be stored in Supabase and shared with valid members. The documented hosting region is Tokyo, Japan. Old local-only profile details and avatars require the relevant informed save/link action before upload. Revoking permission cannot recall copies already made by someone who had access.
An actively saved cloud avatar contains only the processed circular crop, at most 512 × 512 pixels and 256 KiB, without original metadata. It is protected by family permissions and not sent to AI. Note and health-record photo attachments remain local, with up to three processed images of at most 2 MiB each; a user-created JSON backup may include them.
The separate optional care-chart recognition flow sends processed photos, extracted text and reference date/time-zone information to DeepSeek only after confirmation for that submission. Review and remove unrelated identities before sending. Masking does not guarantee anonymity. Drafts require confirmation to become records. Local temporary images/drafts expire after 24 hours from batch creation and are cleared when cleanup next runs. The app service does not persist their content, but provider caches, logs and backups follow separate rules; zero retention or no training use is not promised. See the photo notice.
4. AI, search and system features
Separate AI consent covers active chat, home interpretation and record drafts. Ordinary AI requests may include recent messages, confirmed memories and limited care facts; removing a name does not make health or timing information anonymous. The model cannot directly save or delete records. Confirmed drafts follow existing family-sharing rules.
Web search requires separate consent and a user-enabled switch. Baidu receives restricted general topics rather than the child's records or the user's original question. DeepSeek receives authorized AI inputs and selected result snippets. Declining or withdrawing consent blocks future requests in that scope, not requests already delivered to a provider.
Voice uses on-device recognition without saving/uploading raw audio. Weather location goes to Apple weather/geocoding services without baby/family identifiers. Lock screens, widgets and shared devices may expose information to nearby people. Remote timer ending stores a short-lived activity token and routing/lifecycle identifiers, not names or care notes, and uses Apple push services. See the Privacy Policy for retention and delivery limits.
5. Retention, deletion and guardian rights
You can review or correct records, manage members, export data, clear AI chats, disable/delete memories, withdraw optional consent and request account deletion. Chat retention and memories are separate. Local AI data is not family-shared or included in app-created business backups.
An account deletion request has a seven-day waiting period; restoring it requires reauthentication and explicit confirmation before the deadline. Permanent deletion starts afterwards. Shared-family ownership must be addressed first. The departing member's deletion does not erase shared child records still used by other members. Exclusive families are deleted through the workflow. Local cleanup follows online confirmation and respects other accounts' copies. Soft deletion does not equal immediate destruction of all backups; user exports, screenshots and information received by third parties cannot be recalled automatically.
For access, copies, correction, restriction, deletion or complaints, contact the operator. We will verify your relationship to the child and explain both the action taken and remaining limits. Important processing changes and relevant incidents are handled and notified as required.
6. Protection and providers
The app uses device sandboxing, Keychain, HTTPS, file protection, authentication, family permissions and request limits. No security measure removes every risk. Relevant recipients include authorized family members, Supabase, optional DeepSeek/Baidu services, Apple system services and the file recipients you choose. Provider logs, backups, locations and deletion arrangements differ. We do not sell children's information or use it for unrelated advertising profiles.
Children's privacy contact: harnzh@outlook.com.