Privacy Policy

Public consolidated edition, updated November 4, 2026. Operator: 张浩冉 (Zhang Haoran), individual developer. Contact: harnzh@outlook.com.

This notice describes Baby Plan (宝贝计划) for iPhone and iPad. The app is intended for adult parents, guardians and authorized caregivers. Its interface is currently primarily in Simplified Chinese. This English notice explains the current processing scope; reading this website does not record or replace any consent required inside the app.

1. Accounts and consent records

Depending on your chosen sign-in method, we process phone numbers and country codes, email addresses, usernames, password input, Apple sign-in information, user IDs, display names and login sessions to create and protect your account. Authentication uses Supabase Auth and the relevant Apple, SMS or email provider. Passwords are not written to the app's business database; local session credentials are stored in Keychain.

The server records the type and version of a notice, account association, source, consent time and withdrawal time. Consent does not itself verify legal guardianship. Important changes may require new consent in the app.

2. Baby profiles and care records

We process the information you choose to enter, including a baby's nickname, birth details, sex, avatar, family relationships, feeding, sleep, diapers, bathing, outdoor activity, growth, vaccinations, development, health observations, formula and supplies, care plans, notes, dates, the person recording an event and synchronization status. Optional fields may be left blank.

Birth details can include birth time, due date, gestational age, birth measurements, blood type, allergies and medical history. When saved to an online family after the sharing notice, these fields can be stored with the profile and made available to authorized members. Legacy details stored only on a device are not silently uploaded; the relevant profile synchronization or linking flow asks the user to review and save them.

Growth calculations use on-device code and reference data. Displaying WHO references does not send baby information to WHO. Records, references and AI output are not medical diagnosis or treatment advice.

3. Local storage and family sharing

Records are stored locally first. When linked to an online family, authorized baby profiles, care records, growth, vaccination, development, health observation, supply and plan information, together with the identifiers and version/deletion status needed for synchronization, may be stored in Supabase and shared with authorized members of that family. The project is documented as hosted in Tokyo, Japan. Services and subprocessors may process information elsewhere under their applicable arrangements; the whole chain is not promised to remain in China.

Personal AI chat and confirmed memories, local note/health-record photo attachments and device notification permissions are not family synchronization data. Withdrawing family access cannot recall screenshots, exports or copies already saved by someone who previously had access.

4. Photos, voice and system permissions

If you actively save or edit a baby's photo avatar in an online family after the sharing notice, only the final circular crop is re-encoded as a JPEG of at most 512 × 512 pixels and 256 KiB. The original filename, album identifier, EXIF/GPS metadata and pixels outside the crop are not uploaded. Old local avatars are not automatically migrated. Avatars do not have a public image URL and are not sent to AI.

Photos attached to notes or health observations remain local; each record supports up to three processed attachments of at most 2 MiB each. They are re-encoded with source metadata removed, and may be included in a user-created JSON backup. These attachments are not automatically uploaded to family storage or AI.

Care-chart photo recognition is a separate optional function. After you review and explicitly confirm each submission, processed and masked images, text recognized from those images, and a reference date/time zone are sent through the app's authenticated service to DeepSeek. The input may still contain sensitive information; masking is not a guarantee of anonymity. Recognition produces drafts for review, not automatic records. Processed images and incomplete drafts are temporarily stored on the device; they become unavailable 24 hours after the batch was created and are cleared when the app next performs cleanup. You may clear them earlier. The app service does not persist photo or recognition content. DeepSeek uses disk context caching, generally cleared hours to days after disuse; this is not a maximum for all logs and backups. We do not have a specific guarantee covering all training use, retention, locations or deletion of each request. See the photo processing notice.

Voice input is optional and only runs when on-device recognition is supported. Raw audio is neither saved nor uploaded. Editable transcription is sent for draft generation only after you actively request it; cancelling does not send it. Keyboard input remains available if on-device recognition is unavailable.

Location is used, with permission, for Apple weather and city/area lookup. Notifications, alarms and Live Activities provide care reminders and timer displays. System photo and file pickers handle the items you select. Denying optional permissions does not prevent unrelated manual logging. Apple system services, photo-library originals and operating-system backups follow your Apple settings and their own terms.

5. Live Activity delivery

For remote ending of a timer, the service stores the activity push token and the routing identifiers needed to associate the current account, family, baby and record, together with environment and lifecycle/delivery status. These routes do not contain names, notes or care payloads. They are used to send an end/delete update through Apple Push Notifications. Routes expire 24 hours after the last registration and are removed by a cleanup task scheduled every five minutes; processing can be delayed by an outage. Sending or acceptance by Apple does not prove display on another device. Account and family permissions are checked before registration and delivery.

6. Optional AI and web search

AI runs when you actively request it and have given the relevant separate consent. Ordinary chat can include your question, up to 12 recent messages in the current context segment, enabled memories you confirmed, and a limited care summary. A new context segment starts after 30 minutes of inactivity without deleting old local messages. Home-page interpretation does not include ongoing chat history. The structured summary excludes names, account IDs, record UUIDs, avatars, attachments, notes and custom titles, but timing and health facts can still be sensitive. Free text you enter can contain personal information.

Record-draft generation uses the latest input and limited request/time context instead of the broader care summary. Drafts must be reviewed before saving. The model cannot directly modify or delete business records. Confirmed records then follow ordinary family sharing rules.

Requests pass through the app's authenticated Supabase service to DeepSeek. DeepSeek processes inputs, outputs and necessary service information under its applicable policies. We do not promise zero retention or no training use for all provider-side processing. Deleting local data cannot recall a completed third-party request.

Web search has separate consent and an initially off switch. The server derives restricted general topics for Baidu Search rather than sending the user's original question, care summary, identifiers, memory or chat history to Baidu. Result titles, domains and snippets may be passed to DeepSeek with the ordinary authorized AI request. Health-related search is restricted to designated official sources. Search is not emergency triage or individualized treatment. The app server does not retain search queries or results, but account-linked daily usage counts may be retained; counts older than 30 days are cleared on later admission and can remain longer if no later request occurs. Provider-side retention, training, location and per-request deletion guarantees are not fully verified. See the web-search notice.

7. Retention, protection and recipients

Core service providers include Supabase for authentication, family storage and service endpoints; Apple for selected sign-in and system services; the relevant SMS/email providers including Alibaba Cloud for account verification; DeepSeek for optional AI; and Baidu for optional general-topic search. Authorized family members and recipients of files you export also receive the data you choose to share. We do not sell children's data or include an advertising-profiling SDK.

Local care records remain while used. Cloud account/family records remain for the service relationship; soft deletion, synchronization receipts, service logs and backups may retain information after it disappears from an interface. We do not claim that every provider backup is erased immediately or invent an unverified maximum retention period.

Local AI history is separated by account and baby, capped at the newest 500 messages. You can choose to keep messages indefinitely (default), 90 days, 30 days or seven days; cleanup runs when the app is next opened. Confirmed memories are separate, up to 40 items of 1–300 characters, and are not deleted merely by clearing chat or changing chat retention. AI files use device file protection and are excluded from app-created business backup/export. These protections are not a guarantee against all risk.

8. Export, withdrawal and deletion

You can review and correct records, manage family access, export the available data, clear local AI history, disable/delete memories and withdraw AI or web-search consent in Data & Privacy. Withdrawal blocks future requests within that scope, but does not recall requests already sent or automatically delete confirmed records. Exported files can contain sensitive data and photos; you control where you save or share them. Restore replaces the confirmed local scope and does not mean overwriting cloud data.

Account deletion is available at Family → Settings → Data & Privacy → Delete Cloud Account. A request starts a seven-day waiting period and signs you out. Before the deadline, you must authenticate using the original account and explicitly confirm restoration to cancel; merely signing in is insufficient. Permanent deletion starts after the deadline and cannot be cancelled. Shared-family owners must address ownership transfer first. Shared records and historical attribution used by other members remain; an exclusively owned family is removed through the deletion workflow. Following server confirmation, local cleanup occurs on a later online verification and only covers that account and family copies not referenced by another local account. Exports, other people's copies and information already received by providers are not automatically recalled. Contact us if you cannot access the in-app process.

9. Children, changes and contact

Only a guardian or someone explicitly authorized by a guardian should provide children's information. Family roles are access settings, not proof of legal guardianship. We assess and handle incidents and notify affected people as required. We update notices when processing changes and seek new consent where required. For access, correction, deletion, restrictions or complaints, contact harnzh@outlook.com. We will verify the requester's relationship and explain completed actions and limitations.

Provider information: Supabase privacy policy, DeepSeek privacy policy, DeepSeek API terms, Baidu Cloud privacy policy.