Privacy Policy

1. Who is responsible

The data controller under the GDPR is the person or organization that runs this instance of Baby Tracker and provides the server/database.

For privacy requests, contact the person or organization that operates this larsi instance (the data controller).

2. Scope

This notice covers the web app. The Android app “larsi” works fully offline with no network access; its short policy is in Android Settings.

3. Data we process

• Account data: email, display name, password hash (never a plain-text password), and the time of the latest sign-in.
• Child profile: name, birth date, optional gender.
• Care events: e.g. feeds, sleep, diapers, medicine, tummy time, measurements, timestamps, and which account logged the entry.
• Access: email invitations and roles (parent / caregiver, read / write).
• Technical: a session cookie for sign-in; hosting logs may briefly include IP and timestamps as needed to run the server.

4. Purposes and legal bases

We process data to provide the care-logging service you asked for (contract / steps prior to contract, GDPR Art. 6(1)(b)) and to keep the instance secure (legitimate interests, Art. 6(1)(f)).

Medicine and care notes may include health-related data. They are processed only because you enter them to use the logging service (Art. 9(2)(a) — explicit consent through deliberate entry; you can delete entries at any time).

5. Sharing

We do not sell data and we do not run advertising.

Access is limited to: you; people you invite to a child; and — where needed — the instance’s hosting/database provider acting as a processor for the operator.

The instance operator can see invited emails, whether an account was created, and the latest sign-in. That usage view does not include child care logs.

6. Retention

Accounts, children, and entries stay until you delete them or the operator removes the instance. Deleted children/entries are removed permanently; hosting backups may persist briefly until rotated.

7. Your rights

You have the right to access, rectification, erasure, restriction, portability, and objection where applicable, and to lodge a complaint with a supervisory authority.

In the app you can edit/delete entries, export data (CSV/JSON), and permanently delete a child. For account deletion or other requests, contact the controller.

8. Cookies

We use only an essential session cookie for sign-in. No analytics, advertising, or tracking cookies.

9. Security

Passwords are stored hashed. Access to child data is role-based. Please use a strong password and do not share login credentials.

10. Your responsibility

You remain solely responsible for how you use this app and for every care decision you make. Accepting this notice includes accepting that larsi is not medical care.

11. Changes

This notice may be updated when the app or operations change. The current version is available under Settings → Privacy and on the Privacy Policy page.