Privacy Policy

1. Information We Collect

a) Account Information

• Email address, display name, and profile photo
• Authentication provider information (Google, Apple, Facebook, or email/password)
• Account creation and last sign-in timestamps

b) Children's Information

• Child name, date of birth, gender, and profile photo
• Health conditions, allergies, and medications
• Over 21 types of tracking events including: feeding (bottle, breast, solid food), sleep, diapers, medication, temperature, vaccinations, symptoms, doctor visits, milestones, growth measurements, tummy time, teething, baths, walks, playtime, and custom events
• Developmental milestone achievements with optional photos
• Vaccination records and medical appointment history

c) Reproductive & Women's Health Data

d) Mental & Physical Health Data

• Mood logs and emotional state tracking
• Gratitude journal entries
• Meditation session usage and preferences
• Weight, water intake, energy levels, and sleep quality

e) Photos & Media

• Profile photos for parents and children
• Milestone and achievement photos
• Photos are stored in Firebase Storage (Google Cloud) in your private account folder

f) Device & Technical Information

• Device platform (iOS/Android), operating system version, and device model
• Firebase Cloud Messaging (FCM) tokens for push notification delivery
• Crash reports and error logs (via Firebase Crashlytics)
• App usage analytics (via Firebase Analytics)

g) Subscription Information

• Subscription status, billing period, and entitlements (managed by RevenueCat)
• We do NOT store credit card numbers — payment processing is handled entirely by Apple App Store or Google Play Store

h) Food Safety Alert Preferences

• Your home country code (ISO 3166-1 alpha-2) for routing relevant food safety alerts
• Optional travel country for extended alert coverage

2. How We Use Your Information

• Core functionality: Tracking feeding, sleep, diapers, growth, milestones, and generating insights and analytics (WHO growth charts, cycle predictions, sleep trends)
• Food safety alerts: Delivering relevant recall notifications based on your country (FDA, EU RASFF)
• Partner sharing: Enabling your partner to view and contribute to shared child data
• Reports: Generating PDF doctor reports and GDPR data exports at your request
• Notifications: Sending feeding reminders, appointment reminders, and re-engagement notifications
• Personalization: Recommending meditations, articles, and content relevant to your lifecycle stage
• Subscription management: Managing your premium subscription and feature access
• App improvement: Analyzing crash reports and anonymized usage patterns to improve stability and features
• Advertising: Displaying non-personalized advertisements on the free tier
• Security: Detecting unauthorized access, preventing abuse, and maintaining audit trails

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your data based on the following legal grounds:

4. Information Sharing & Third Parties

We do NOT sell your personal information to any third party. We share data only with the service providers necessary to operate the App:

We may also disclose your information if required by law, court order, or governmental authority, or to protect our rights, safety, or the rights and safety of others.

5. Family & Partner Sharing

HannaH allows a primary parent to invite one partner (co-parent) to share selected data. Partner sharing is designed with privacy as the default:

• The primary parent controls all sharing preferences and decides which data categories to share (child profiles, tracking events, achievements, pregnancy tracking)
• Private data is NEVER shared by default: Period tracking, weight, mood, symptoms, water intake, and other personal wellness data remain private unless you explicitly enable sharing for each category
• Partners can view shared data and log events (feeds, diapers, sleep) for shared children
• Partners inherit the primary parent's premium subscription benefits while the family link is active
• The primary parent can revoke partner access at any time, immediately removing the partner's ability to view or modify shared data
• Data exports performed by partners are logged in the primary parent's audit trail
• Both family members must independently accept the App's Terms of Service
• All shared data is stored under the primary parent's account in Firebase — it is not duplicated to the partner's account

6. Children's Privacy (COPPA Compliance)

• We collect children's data (name, date of birth, health information) only from verified parents/guardians
• We do not engage in behavioral advertising targeted at children
• We do not create profiles of children for marketing purposes
• Parents can view, export, and delete all of their children's data at any time through the App's Settings

7. Data Storage & Security

We employ multiple layers of security to protect your data:

Cloud Storage

• All cloud data is stored in Firebase (Google Cloud Platform) with encryption in transit (TLS) and at rest
• Firebase Security Rules enforce strict access control — users can only access their own data, and partners can only access data explicitly shared with them
• Photos are stored in Firebase Storage in user-specific private folders

Local Storage

• The App uses an offline-first architecture — your data is stored locally on your device using encrypted Hive databases, enabling full functionality without internet
• All local data is automatically cleared when you sign out
• iOS Home Screen widgets access limited data through a sandboxed App Group container

Security Measures

• Immutable security audit trail logging authentication events and data access
• Multi-layer defense against data leaks between accounts during sign-out/sign-in
• Rate limiting to prevent abuse of tracking features
• Strong password requirements (minimum 12 characters with complexity rules) for email/password accounts

8. Data Retention & Deletion

• Account data: Retained until you delete your account
• Crash reports: Retained for 90 days by Firebase Crashlytics
• Analytics data: Retained per Firebase Analytics default settings (up to 14 months)
• Legal acceptance records: Retained indefinitely as an immutable audit trail for compliance purposes
• Security event logs: Retained indefinitely for fraud prevention and legal compliance

Account Deletion

When you delete your account (Settings > Delete Account), we perform a complete cascade deletion:

• All Firestore documents (profiles, events, achievements, chat history, medical records)
• All Firebase Storage files (photos, media)
• All local Hive databases on your device
• Your Firebase Authentication account
• Image caches and temporary files

You can export all your data in JSON format (GDPR data export) before deleting your account. Individual child profiles can also be deleted separately.

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

To exercise any of these rights, use the in-app settings or contact us at hannah@mv-studio.net. We will respond to GDPR requests within 30 days.

10. International Data Transfers

Your data may be transferred to and processed in the United States by the following services:

• Firebase / Google Cloud — Database, authentication, and storage infrastructure
• RevenueCat — Subscription management

For EU/EEA users, these transfers are protected by Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) with each provider. Where applicable, we rely on the EU-US Data Privacy Framework.

11. Cookies & Local Storage

• HannaH is a native mobile app and does not use web cookies
• We use encrypted local databases (Hive) to store your data on-device for offline functionality
• iOS Home Screen widgets use an App Group shared container to display your data on the lock screen
• We use Firebase Remote Config to manage feature flags and app configuration — no personal data is used in this process
• No cross-app tracking is performed

12. Push Notifications & Food Safety Alerts

Push Notifications

• We store Firebase Cloud Messaging (FCM) tokens to deliver push notifications to your device
• Notifications include feeding reminders, appointment reminders, and re-engagement messages
• You can disable all notifications at any time through your device settings or the App

Food Safety Alerts

• If enabled, we subscribe you to FCM topics based on your country code to deliver relevant food recall alerts
• Alert sources include the US FDA (Food and Drug Administration) and the EU RASFF (Rapid Alert System for Food and Feed)
• Alerts cover infant formula, baby food, and toddler food recalls
• Your country code is stored solely for alert routing and is never shared with advertisers
• You can enable or disable food safety alerts at any time in Settings
• Food safety alerts are provided for informational purposes only and are not a substitute for checking product labels

13. Advertising & Tracking

• The free tier of HannaH displays non-personalized advertisements served by Google AdMob. These ads are not based on your behavior, interests, or health data
• The premium tier is completely ad-free
• On iOS, we request App Tracking Transparency (ATT) consent before accessing the Identifier for Advertisers (IDFA). If you deny this request, no advertising identifier is collected
• We use Firebase Analytics to collect anonymized app usage data (screen views, feature usage). You can opt out of analytics through your device settings
• Firebase Crashlytics collects crash reports to help us maintain app stability. Crash reports may include device information but are not linked to your personal identity
• We do NOT engage in behavioral profiling, cross-app tracking, retargeting, or data broker sharing

14. Social Sharing

• HannaH allows you to share milestone achievements as branded image cards via your device's native share sheet (Messages, Email, Instagram, etc.)
• Sharing is entirely user-initiated — we never automatically post to social media on your behalf
• Shared cards contain the achievement title, date, and HannaH branding. They do not automatically include your child's name or photo unless you choose to include them
• Once shared, the content is governed by the receiving platform's privacy policy

15. Health Platform Integration

• HannaH can optionally connect to Apple HealthKit (iOS) or Google Health Connect (Android) to read health data such as sleep, weight, water intake, and steps
• This integration requires your explicit permission and is available only on the premium tier
• Health platform data is stored locally on your device and synced to your private Firebase account — it is never shared with third parties
• You can disconnect the health platform integration at any time through the App Settings
• We primarily read data from health platforms. Write access (e.g., logging weight entries) is minimal and clearly indicated

16. Changes to This Policy

• We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements
• For material changes, we will notify you via an in-app notification before the changes take effect
• The "Last Updated" date at the top of this page indicates when the policy was last revised
• Your continued use of the App after notification constitutes acceptance of the updated policy
• Previous versions are available upon request by emailing us

17. Contact Us