CareCribOpen the web appPrivacy Policy
Effective: [DATE] · DRAFT — pending attorney review
CareCrib ("we", "us") is a care log for parents and caregivers of babies. It is operated by [CareCrib LLC], a Texas limited liability company. Contact: hello@carecrib.app.
The short version
- Your baby's records are stored on your phone.
- If you turn on Family Sync, your records are encrypted on your phone before they are uploaded. We store only encrypted data we cannot read.
- Photos and videos never leave your phone.
- No ads, no analytics, no tracking, no selling or sharing of your data.
- You can delete everything at any time in Settings → Data → Delete all data on this device.
What we collect and where it lives
| Data | Where it is stored | Who can read it |
|---|---|---|
| Baby profile, feeds, sleep, diapers, medications, doses, symptoms, vitals you enter (e.g. Owlet readings), growth, therapy goals, appointments, questions and doctor's instructions, notes | On your device (browser storage / app storage) | Only people with your device |
| Photos and videos you attach | On your device only | Only people with your device |
| The same records, only if Family Sync is on | Our sync server (Cloudflare), end-to-end encrypted | Only devices that know your family passphrase. We cannot decrypt it. |
| Purchase status (subscriptions), when available | Apple App Store and RevenueCat, using an anonymous app identifier | Apple and RevenueCat process payments; we see only whether a subscription is active |
| Your email, only if you join the waitlist on our website | Our website's database (Cloudflare) | Us, to email you about the app |
Your Family Sync passphrase never leaves your device. From it, your device derives (1) a random-looking storage ID and (2) an encryption key. We receive only the storage ID and the encrypted data. Because we never have the passphrase or key, we cannot recover your synced data if you lose the passphrase — the copy on your devices is unaffected.
Optional features that send data elsewhere (off by default)
- Discord notifications. If you paste a Discord webhook URL in Settings, the app sends short messages about entries (for example "Bottle 120 ml at 9:00 AM") directly from your device to that Discord channel. Discord's privacy policy applies to that data. Remove the URL to stop.
- Calendar reminders. The app creates a calendar file on your device; you choose where to save or import it.
- Exports. CSV and backup files are created on your device; you choose where they go.
What we do not do
We do not sell, rent or share your data. We do not use it for advertising or marketing. We do not use analytics, tracking pixels, or third-party SDKs that collect usage data. We do not collect precise location. We do not use your data to train AI models.
Retention and deletion
- Data on your device stays until you delete it or uninstall the app.
- Encrypted Family Sync data is kept while your family uses it and is automatically deleted about 13 months after the last update.
- Settings → Data → Delete all data on this device deletes this device's records, photos and reminders, and lets you also delete the encrypted family copy on our server. Other family devices keep their own copies until they are deleted there too.
- You can also email hello@carecrib.app to ask us to delete synced data; because it is encrypted and tied to your passphrase, we may ask you to delete it from the app instead, which is immediate.
Children
The app is meant for parents and caregivers aged 18 and over. It stores information about a baby that a parent enters; it is not directed to children and we do not knowingly collect information from children.
Security
Family Sync uses PBKDF2-SHA256 key derivation and AES-256-GCM encryption on your device; data is sent over HTTPS. No system is perfectly secure — choose a long passphrase and keep your devices locked.
Your state privacy rights
Residents of Washington, Nevada, Connecticut and other states with consumer health data or privacy laws have rights to know, access, delete, and withdraw consent for their data. See our Consumer Health Data Privacy Policy for details and how to exercise them. Nevada residents: we do not sell consumer health data or covered information. We do not sell personal data in any state.
Not HIPAA
We are not a healthcare provider or a HIPAA-covered entity. HIPAA does not apply to the app, but we protect your data as described here.
Changes
If we change this policy, we will update the effective date and show a notice in the app before the change applies to your data.
Contact
[CareCrib LLC] · hello@carecrib.app · [mailing address]