Privacy Policy
Last updated: October 28, 2026
What changed on October 28, 2026
- We expanded the list of care and health records covered by this policy, including growth, milestones, and milestone photos shared through Supabase when family health sharing is enabled.
- We added explanations of on-device voice logging, photo permissions, Sign in with Apple, and account-linked push-notification tokens.
- We removed Firebase from the list of service providers.
In plain English
Your baby's data is private and stays yours. We never sell it. We use industry-standard encryption for all data. Audio recordings are analyzed using secure AI services and deleted after processing. You can export everything or delete your account at any time.
What data we collect
- Account info: Email address, display name (optional), and account identifiers. If you choose Sign in with Apple, we use Apple’s sign-in credentials to authenticate with Supabase; Apple may provide a private relay email address instead of your personal email.
- Baby tracking and health information: Feeds, diapers, sleep logs, medication records, growth measurements, developmental milestones, and notes you enter. Growth and milestone records are uploaded to Supabase and shared with your family when you enable family health sharing. These are records you enter, not data read from Apple Health.
- Photos you choose: Photos attached to care events are saved on your device. Photos added to developmental milestones are included in the milestone record uploaded to Supabase when you enable family health sharing.
- Voice logging: With microphone and speech-recognition permission, your device transcribes your speech so you can confirm a care-log entry. This transcription requires on-device recognition; the voice-log audio is not uploaded for transcription. Entries you save follow the same storage and sync rules as other care logs.
- Notifications: When notifications are enabled, we store your device’s push-notification token with your account in Supabase to deliver cross-device notifications through Apple. You can change notification permissions in iOS Settings.
- Audio (opt-in only): Short cry recordings if you use Cry Insights. Audio is encrypted, analyzed using secure AI services, and deleted after processing—we do not store audio permanently.
- Usage analytics: Pseudonymous app analytics and cookie-free website analytics. On ordinary marketing pages, website analytics is on by default unless you turn it off in Analytics preferences or your browser sends a privacy signal.
Why we collect it
To provide the core service: logging, syncing across devices, generating nap predictions, and (optionally) analyzing cry patterns. We use aggregated, anonymized data to improve prediction accuracy—never individual profiles.
Where it's processed
Servers in the United States (AWS/secure cloud infrastructure). Data in transit is encrypted (TLS). Data at rest is encrypted. For international transfers (including EU to US), we rely on appropriate legal mechanisms such as Standard Contractual Clauses (SCCs) approved by the European Commission.
How long we keep it
As long as your account is active. Free plan: 14 days of viewable logs and a 14-day export. Pro plan: unlimited history.
To delete your data: Go to Settings → Account → Delete Account. This permanently removes all logs, audio, and account info within 30 days. Aggregated, anonymized insights (used to improve nap predictions) are retained but cannot be traced back to you.
Microphone permissions
Microphone permission is requested for voice logging or optional Cry Insights. Voice logging also requests speech-recognition permission and transcribes on your device. Cry Insights sends recordings you submit for AI analysis as described above. Recording is on-demand only—we never listen in the background. You initiate every recording.
Photo permissions
You choose which photos to attach through the system photo picker. When you tap “Save to Photos” on a shareable card, we request permission to add that image to your photo library. Saving a card to Photos does not upload it to Nestling; sharing it through another app is your choice.
Child data & parental consent
We do not knowingly collect personal information from children under 13 without verifiable parental consent. By creating an account and logging your baby's data, you (the parent/guardian) consent to this collection on behalf of your child.
Your baby's information. Nestling is used by you, the parent or legal guardian, to log information about your child. We do not knowingly collect personal information directly from children. By logging your child's data you consent, on their behalf, to the processing described here — including by the processors named below. You may export or delete this data at any time, or contact us at privacy@nestling.app to do so on your behalf.
Your rights
- Access: Export all your data as CSV or PDF anytime.
- Correction: Edit or delete individual logs in the app.
- Deletion: Delete your account completely (see "Retention" above).
- Portability: Take your data with you in standard formats.
Who processes your and your baby's data
We share the minimum data necessary with the following processors, each under a data processing agreement:
- Supabase — secure cloud storage and sync of your account and care-log data, including growth and milestone records and milestone photos when family health sharing is enabled, and account-linked push-notification tokens.
- OpenAI — processes audio you submit for optional cry analysis and powers in-app AI guidance. Audio/text is processed to return a result and is not used to train third-party models via the API.
- RevenueCat — manages subscriptions (no payment card data; Apple handles billing).
- PostHog — pseudonymous product analytics in the app and cookie-free, session-free page and App Store click analytics on ordinary website routes, which you can turn off with “Analytics preferences.” Website session replay is disabled.
- Sentry — crash and performance diagnostics.
Apple authenticates Sign in with Apple when you choose it and delivers enabled push notifications through Apple Push Notification service.
We never sell your data or share it for advertising purposes.
Email marketing
If you subscribe to our newsletter or download resources from our website, we collect your email address with your explicit consent. We use this information to:
- Send helpful parenting tips, sleep advice, and product updates
- Notify you about new features or app improvements
- Share relevant content based on your interests
Your choices: Every email includes an unsubscribe link at the bottom. You can opt out anytime, and we'll stop sending marketing emails within 10 business days. Unsubscribing from marketing emails does not affect transactional emails (account confirmations, password resets, etc.) if you have a Nestling account.
Changes to this policy
We'll notify you by email and in-app if we make material changes. Continued use after notification means you accept the updated policy.
Contact us
Questions or concerns? Email us at privacy@nestling.app
Not medical advice: Nestling provides general wellness guidance only and is not a medical device. If you're worried about your baby's health, contact your pediatrician or emergency services.