Bundle of Joy
Privacy Policy
Last updated: September 4, 2026
Who this covers
Bundle of Joy is a baby tracker for parents and caregivers, made by BundleOfJoy LLC (“we”, “our”, “us”). This policy covers the app at app.bundleofjoy.love, the Android app on Google Play, and the website at bundleofjoy.love.
It applies however you reach the app: in a web browser, as an installed PWA, or through an app store.
Your family’s data belongs to you. We do not sell it, share it, or make money from it.
What we collect
Your account
- Email address, to sign you in
- Password, stored hashed, never in plain text
- Display name, if you set one
Your baby’s data
- Baby profiles: name, date of birth, sex, optional photo
- Events you log: feeds, diapers, sleep, bath, tummy time, weight, height, head circumference, body temperature and medicine doses
- Notes and optional photos attached to an event
- When each event happened and which caregiver logged it
Technical data
- Basic server logs (IP address, browser type), for security and debugging
- Product analytics: which screens you open and which actions you take, never the contents of your notes, photos or measurements
- A push notification token for your device, if you turn on reminders
- No advertising identifiers, tracking pixels, fingerprinting or session recording
How we use it
Only to sign you in, store and show your baby’s data, share it with caregivers you explicitly invite to your family, and keep the service running and improving.
Never for advertising or marketing, behavioural profiling, building a picture of you across other sites and apps, AI or machine learning training, or sale to third parties.
Where it lives and who can see it
- Stored in Supabase (PostgreSQL on AWS), encrypted in transit (TLS) and at rest
- Row Level Security in the database keeps each family to its own data
- Only members of your family see your data, and family membership is controlled through secure invite links
- Caregivers can edit or delete only their own events; family owners can manage every event in the family
Services we rely on
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication, file storage | Account data, event data, photos |
| PostHog | Product analytics and error reporting | Pseudonymous user ID, screens viewed, actions taken, error messages |
| RevenueCat | Subscription management | Anonymous app user ID, purchase receipts, device platform, app version |
| Google Play | App distribution and billing | Purchase history, transaction IDs (for subscriptions purchased via Google Play) |
| Stripe | Payment processing for web subscriptions, via RevenueCat | Payment details, which are handled by Stripe and never reach our servers |
| Firebase Cloud Messaging | Delivering reminder notifications, if you enable them | Push token and the notification text |
| Upstash | Rate limiting, to protect the service from abuse | IP address, transiently |
| Vercel | App hosting | Standard web server logs |
RevenueCat’s SDK may collect device-level identifiers (such as vendor ID) solely for subscription management, never advertising identifiers. We use no advertising or social media services and never sell or share your data with data brokers.
App analytics
We use PostHog to see which parts of the app are used and where they fail. Session recording is off, so no page content is ever captured. Analytics uses local storage rather than cookies, respects Do Not Track, and goes through our own domain rather than straight to a third-party host. Events record that something happened, such as a feed logged or a report generated, never what it said. Your baby’s name, notes, photos and measurements are not sent.
The Data Safety section of our Google Play listing summarizes these practices.
Website analytics
bundleofjoy.love uses PostHog in cookieless mode: no cookies, no persistent identifiers, page views and clicks only. We have no identifier that links a website visitor to an app account.
Keeping and deleting your data
- We keep your data while your account is active
- Delete your account in the app under Settings > Data & Privacy > Delete My Account, or email us at the address below
- Within 30 days of deletion, all personal data (account details, baby profiles, event logs) is permanently removed
- If other people are still in your family, the events you logged stay in that family’s record, re-attributed to its owner, and the baby profiles stay with the family; everything else about you is removed
- We may keep anonymized, aggregated data that cannot be linked back to you, to improve the service
Your rights (GDPR)
If you are in the European Economic Area, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Delete your data (“right to be forgotten”)
- Export your data (CSV export is available in the app)
- Object to processing
- Restrict processing
Email us at the address below to use any of them.
Children
Bundle of Joy stores data about babies and children, entered by their parents or legal guardians. The app is for adults (18+) only.
- All data about children is entered and managed by their parent or legal guardian
- We do not knowingly collect personal information directly from children under 13, or the applicable age where you live
- If we learn we have, we will delete it promptly
- If you believe a child has given us personal information, contact us at the address below
Changes to this policy
Changes appear on this page with a new date. Using the app after a change means you accept the updated policy.
Contact
The data controller is BundleOfJoy LLC, a limited liability company registered in the State of Wyoming, United States, with its registered office at 30 N Gould St, Ste N, Sheridan, WY 82801, United States.
For privacy questions or to use your rights:
Email: privacy@bundleofjoy.love
Phone: +1 (307) 306-6916
Postal: BundleOfJoy LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States
General support: hello@bundleofjoy.love
Read the short version on the private baby tracker page, or ask us anything at hello@bundleofjoy.love.