Why your baby’s data stays in the EU

By the time your baby is a month old, a tracking app can be holding several hundred entries about a person who is four weeks old: what went in, what came out, how long they slept, what their temperature was at 2 a.m. It is one of the most detailed records anyone will ever keep about them, and they had no say in any of it.

I think about that more than any other part of building Bunavi. So here is the whole picture — what the record contains, where I keep it, what I will never do with it, and where the promise has limits.

What the record actually contains

It’s easy to picture a baby tracker as a list of feeding times. It isn’t. Put a few weeks of entries together and you have:

• Your child’s name — or the nickname you use — their date of birth, sometimes their sex, sometimes a photo.
• Health entries: growth measurements, temperatures, symptoms, medications, vaccinations.
• Feeding and sleep patterns, which are also a map of when the adults in the house are awake and how long they’ve been up.
• Diaper detail most people wouldn’t discuss outside a pediatrician’s office.

The temperature-and-medication end of that list is data concerning health, which Article 9 of the GDPR places in the special categories the regulation protects most strictly. Recital 38 of the same regulation says children “merit specific protection with regard to their personal data,” and singles out marketing and profiling as the risks that matter. The law is agreeing with something most parents feel the first time they type a child’s name into a form.

Your child will be an adult one day, and none of this was their decision.

Why the servers are in Frankfurt

Your baby’s profile and every record attached to it live in a database inside the European Union, hosted by Supabase in the region Amazon lists as Europe (Frankfurt) — eu-central-1. That’s not decoration on a marketing page. Three practical things follow from it.

• The GDPR applies, not as a favor. I’m an independent developer established in Bulgaria, and Article 3 makes the regulation apply to processing carried out in the context of an establishment in the Union. It isn’t a policy I can quietly soften in a future update.
• Your rights are enforceable. Article 20 gives you a copy of your data in a structured, commonly used and machine-readable format. Article 17 gives you erasure. And if I ever fail you, Article 77 gives you the right to complain to a supervisory authority — in my case Bulgaria’s Commission for Personal Data Protection, or the authority in your own country.
• There is a named person on the other end. The data controller is me, by name, with a country and a working email address in the privacy policy. A complaint has somewhere to land.

Now the honest part: hosting location is not a shield. A server in Frankfurt run carelessly protects your family less than a server anywhere else run properly. Geography only decides which rules can be enforced against me. What actually protects your child’s record is what the software does every day.

What I’ve committed to

• Traffic between your phone and the server is encrypted with TLS.
• Access is enforced row by row in the database, so an account can only ever read or write records for the babies it owns or was invited to. One family’s rows aren’t reachable from another family’s account, and that rule lives in the database rather than in the app’s screens.
• No ads. No advertising identifiers. Nothing sold, rented, or shared with advertisers. No advertising or tracking profile of you or your child.
• Sharing is off until you turn it on. An invite code is single-use, expires after 7 days, and access can be revoked immediately from settings — worth knowing before you hand a partner or a grandparent the code.
• The app is offline-first, so it keeps a small copy of recent entries on your own device to work at 3 a.m. with no signal. That copy is cleared when you sign out.
• Getting your data out and getting it deleted are both buttons in settings, not requests you have to send me.

The “off by default” item is the one I’d defend hardest. Article 25 of the GDPR asks for data protection by default — personal data shouldn’t become accessible to an indefinite number of people without your own intervention. For a child’s health record, a default that leaks is not a small design flaw.

Where the picture isn’t purely European

A one-person app still depends on other companies, and pretending otherwise would be the kind of claim you should distrust. Apple bills subscriptions and I never see your card. RevenueCat, in the US, manages what your plan unlocks and receives an account identifier plus purchase events. Resend delivers email — a password reset, a receipt — and receives your address and the message; it’s a US company, though its sending infrastructure runs in Ireland. Sentry receives technical crash details — device model, OS version, stack trace — from builds that have crash reporting enabled. Where personal data is handled outside the EU, it’s covered by the European Commission’s standard contractual clauses, and each of those companies is named in the privacy policy.

What none of them get is your baby’s record. The feeds, the naps, the growth measurements, the temperatures, the name and the birth date stay in the EU database.

The real test is deletion

Any app can write a warm paragraph about privacy. The promise only means something if leaving actually works — and if it takes three emails and a support queue to erase a child’s health record, the promise was decorative.

So: Settings → Delete account removes your account immediately, along with every baby you own that nobody else was invited to, and all of their records. If you’d rather not do it in the app, email [email protected] from your account address and it’s erased within 30 days, usually much sooner. That’s the right to erasure in Article 17, wired to a button instead of a form.

What to hold any baby app to

You don’t have to take my word for any of this, and you shouldn’t. Four checks, each of which takes about a minute, will tell you more about an app than its landing page will.

That is the standard I’d want applied to me, and the one I’d apply to anyone else asking to hold your baby’s first year. You’re keeping this record on behalf of someone who can’t yet weigh in — the least the software can do is treat it that way. If you want the longer version of how I work, it’s in the privacy policy and on the about page, both written to be read rather than survived.

Questions parents ask

Where is my baby's data stored?

In the European Union — a Supabase database in Amazon's Europe (Frankfurt) region, eu-central-1. Traffic is encrypted with TLS, data is encrypted at rest, and access is enforced row by row, so one family's records are unreachable from another family's account.

Can I really delete everything myself?

Yes. Settings, then Delete account, removes your account, every baby profile you own, and all of their records immediately. You can also email [email protected] from your account address. Copies in encrypted backups age out with the normal rotation, within 30 days.

Does EU hosting mean nothing ever leaves the EU?

No, and claiming otherwise would be misleading. Apple bills subscriptions, RevenueCat manages entitlements, Resend delivers email, and Sentry receives crash details. Those services get identifiers, email addresses, or technical data under standard contractual clauses — never your baby's feeding, sleep, growth, or health records.

Is any of my family's data used for advertising?

No. There are no ads and no advertising identifiers, and nothing is sold, rented, or shared with advertisers. No advertising or tracking profile is built of you or your child, and your entries are never used to train AI models.