Privacy Policy
Bunavi is a mobile app that helps parents record their baby's feedings, sleep, and growth. This policy explains what data the app handles, where it is stored, who can see it, and the choices you have. The short version: your baby's profile, health and tracking data are stored in the EU, your data is never sold, and you can delete your account yourself at any time; a baby you share passes, with its history, to another caregiver. A few limited services we rely on — payments, email delivery, crash reporting and notification delivery — are run by companies based outside the EU; we name them below.
Who is responsible
The data controller is the app's developer:
Rostislav Antonovich · Bulgaria
Contact: support@bunavi.app
We are a small enough operation that the GDPR does not require us to appoint a Data Protection Officer, and we have not designated one; any question about your data goes straight to the developer at the address above.
What we collect
| Account | Your email address, a password (stored only as a cryptographic hash — we can never read it), and a display name, which is required when you sign up with email. If you sign in with Apple or Google instead, we receive the email address (or Apple's private relay address) and name that provider returns. You can also use Bunavi as a guest, without an email address; the account then has only a random identifier, plus a display name if you choose to add one. Supabase, which runs sign-in for us, logs each sign-in with the IP address and the app or browser version it came from, to keep accounts secure. |
|---|---|
| Baby profile | The name and date of birth of each baby you add, and optionally their sex, their gestational age and weight at birth, and a profile photo. You choose what to enter; a nickname works just as well as a real name. |
| Tracking records | Feedings (type, time, amount or duration, optional notes; for a meal of solid food, also the foods offered, how much your baby ate, and foods not taken this time), pumping sessions, sleep sessions, diaper changes (including optional stool detail), growth measurements (weight, height, head circumference), milestones, and health events such as temperature, symptoms, medications, and vaccinations. Some of these are health-related; you enter them and may delete them at any time. The app's food list knows which foods carry common allergens, such as egg and peanut, so the meals you log are also a record of your baby's allergen exposures: which of those foods were offered, and when. Bunavi records what a baby was offered and what caregivers noticed, so families can share it with a clinician. It does not diagnose, predict or prevent allergy. |
| Baby photos | If you add a profile photo for a baby, the image is stored in our EU hosting bucket and shown to you and anyone you invite to that baby. Photos are deleted when you remove them or delete the baby. |
| Cry detection | Optional. If you turn on cry detection, Bunavi listens through your device's microphone only to notice when your baby is crying; the likely reason it then suggests comes from your recent feeds, naps and diapers, not from the sound. This happens entirely on your device — the audio is analyzed in the moment and is never recorded, saved, or sent to us or anyone else. If you log a cry, its time and the suggested reason are saved like any other record; beyond that, only a loudness level and the detector's confidence, as single numbers, leave the device, in the anonymous usage counts described under Crash reports and diagnostics. You can switch the microphone permission off at any time in your device settings. |
| Subscription | If you buy Bunavi Plus, the store you buy it from processes the payment — Apple (the App Store) on iPhone, Google (Google Play) on Android. We never see your card details. That store reports your subscription status, and to manage what your plan unlocks, your Bunavi account identifier and the resulting purchase and renewal events are sent to RevenueCat, which manages them for us. |
| Notifications | Feeding reminders are scheduled on your phone and send nothing to us. On iPhone, the app registers a push token with Apple and stores it, with your phone's language, in our database, so that when a partner logs something for a baby you share, a short notice such as “Ana logged a feed” reaches you through Apple's push notification service. The Android app receives no push notifications from our server and stores no push token. |
| Crash reports and diagnostics | Crash and error reports, app-health and performance data, and anonymous usage counts, sent to Sentry — see Crash reports and diagnostics below. They are tied to a random identifier for this installation of the app, never to your account, and are designed to contain none of your records. |
| Waitlist email | If you joined the launch waitlist on our website, we store the email address you gave to send you a confirmation and occasional launch news. A waitlist entry is separate from any app account, and you can unsubscribe at any time. |
We do not collect your location, your contacts, your photo library or camera (we only use the photo you pick or take for a baby's profile, and an invite QR code is read on your phone), microphone audio (cry detection runs on your device and keeps nothing), or any advertising identifier, and we build no advertising or analytics profile of you. The app shows no ads, and we never use your baby's photos, health records, cry audio, or any of your entries to train artificial-intelligence or machine-learning models. Your family's data is used to run the app for you — nothing else.
Crash reports and diagnostics
The store versions of Bunavi, on iPhone and on Android, report crashes and app health to Sentry (Functional Software, Inc., USA), our crash-reporting processor. There is no setting to switch this off in the app. Three kinds of data are sent:
- Crash and error reports. When the app crashes, freezes or hits an unexpected error: what went wrong and where in the app's code, the app version, the last few screens and app events before it happened (such as going to the background or losing the network), and device details such as the model and manufacturer, the operating system and its version, language, time zone, free memory and storage, and battery level. When our server refuses to save an entry, the report names the kind of record and the rule it broke; the values you entered are removed on your phone before the report is sent.
- App health and performance. Whether each session of using the app ended in a crash, so we can see how stable a version is; how long the app took to start; and, for a random one in five app starts and screen loads, how long the screen took to appear and whether it stuttered.
- Anonymous usage counts. Tallies that tell us whether key features work: sign-in attempts and the method used, how many entries saved offline were waiting and whether they reached the server, how often our server was briefly unavailable (with its error code), whether the store's Bunavi Plus prices loaded, how often the Bunavi Plus paywall was shown and whether a purchase or a restore went through, was cancelled or failed, and how a cry-listening session ended, with its loudness level or the detector's confidence as a single number between 0 and 1. Some also record how long something lasted: a sign-in, the store's purchase sheet, sending saved entries, or a listening session. The app also counts which steps of the first-run setup were reached, recording only the step's name; each answer to a request to allow notifications, recording only whether it was allowed, declined or failed and what it was for (the first-run setup, a reminder, badge notifications, or partner notifications); each partner invite created, with nothing else recorded; how the share sheet for an invite link closed (a destination picked, dismissed, or not known) or that it failed to open, but never where the link went; each invite accepted, recording only whether its code arrived as a link, through the app's QR scanner, or typed or pasted; and each time the app asked your phone to show a rating prompt, recording only the moment that led to it (a badge, a growth report, a milestone, or joining a partner's baby). They carry no account or device identifier, and none of the details you enter.
Crash reports and app-health data are tied to a random identifier that Sentry creates when the app is installed. It is not your account identifier, email address or name, not your phone's advertising ID or any hardware identifier, and a reinstall replaces it. Reports are designed to contain none of your baby's details, records, notes or photos, and never any sound. The app does not ask Sentry to store your IP address with a report (Sentry, like any server, sees the address a report comes from). We use all of this only to find and fix problems, and Sentry deletes it after 30 days on our current plan.
Scanning an invite code. On Android, a partner's invite QR code is read on your phone by Google's ML Kit barcode scanner, which is built into the app; the camera image never leaves your phone. When the scanner runs, ML Kit sends Google information about its use and performance — device model, Android version, the app's name and version, a per-installation identifier, timings and error codes — which Google uses to maintain and improve the scanner. It does not include the camera image or the code you scanned. On iPhone the code is read by Apple's on-device Vision framework, and nothing is sent.
Why we process it
Account, profile, and tracking data are processed to provide the service you signed up for (GDPR Art. 6(1)(b)). Records about your baby — including health-related ones such as growth measurements — are entered by you as the parent or guardian, and by saving them you explicitly consent to their processing for this purpose (Art. 9(2)(a)). You can withdraw that consent at any time by deleting individual records or your whole account. If you buy Bunavi Plus, we process your subscription status to give you what you paid for (Art. 6(1)(b)). Crash reports, diagnostics and usage counts rest on our legitimate interest in finding and fixing problems and keeping the app working (Art. 6(1)(f)); they are not linked to your account. If you joined our website waitlist, we send you launch emails on the basis of your consent (Art. 6(1)(a)), which you can withdraw at any time.
Sensitive health data
Some of what you record — temperature, symptoms, medications, vaccinations and allergen exposures — is special-category health data under GDPR Art. 9, which the law protects most strictly. We treat it that way: you enter it yourself and by saving it give your explicit consent (Art. 9(2)(a)); it lives in the EU under the same row-by-row access rules as everything else; it is shown only to you and the caregivers you invite; and it is never used to profile you, target ads, or for anything beyond showing it back to you. Delete any record, or your whole account, to withdraw that consent at any time.
Where your data lives
Data is stored in a database operated by Supabase, our hosting processor, in the European Union (AWS eu-central-1, Frankfurt, Germany). All traffic between the app and the server is encrypted (TLS). Access is enforced row-by-row in the database, so an account can only ever read or write the records of babies it owns or has been invited to. The app also keeps a small read-only copy of your recent data on your own device so it works offline; that cache is cleared when you sign out.
International transfers
Your baby's profile, health and tracking records — the heart of the app — stay in the EU with Supabase. A few limited services we rely on are run by companies based in the United States: RevenueCat (manages Bunavi Plus subscription entitlements — receives your account identifier and App Store or Google Play purchase and renewal events), Resend (delivers our emails — receives your email address and the message content; its sending infrastructure runs in the EU, in Ireland), Sentry (crash reports and diagnostics — receives the technical data described above, tied to a random installation identifier and never to your account), Google (usage data from the ML Kit scanner in the Android app) and Apple (its push notification service delivers partner notifications on iPhone). Where personal data is handled outside the EU/EEA, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses. Ask us at support@bunavi.app for more detail.
How we keep it safe
Traffic between the app and our server is encrypted with TLS, and your data is encrypted at rest in our EU database. Your password is stored only as a cryptographic hash we can never read. Access is enforced row-by-row, so an account can only ever reach the babies it owns or was invited to, and our processors work under data-processing agreements on a least-privilege basis. No safeguard is ever perfect, but we take security seriously and keep it under review.
No automated decisions about you
Bunavi never makes a decision about you or your baby by purely automated means, and does no profiling. Features like optional cry detection and the patterns you see are there to give you information only — cry detection runs on your own device — and never produce a legal or similarly significant effect. What you do with what the app shows you is always your call.
If something goes wrong
If a breach ever affects your personal data, we will notify the Bulgarian Commission for Personal Data Protection within 72 hours of becoming aware of it, as the GDPR requires. Where a breach is likely to put your rights at risk, we will also tell you directly, without undue delay, explaining what happened and what you can do.
Who can see your data
- People you invite. Sharing is off by default. If you generate an invite code and give it to your partner, their account gains access to that baby's profile and tracking records — including sensitive health entries such as temperatures, symptoms and medications, and meals with the allergen exposures they record — so you choose carefully who you invite. Invite codes are single-use and expire after 7 days. To revoke a partner's access, open Settings → Family sharing → Manage access and remove them; a caregiver can also leave a shared baby from there. Removing a caregiver takes effect immediately. When you invite someone you are choosing to share within your own family circle; we run the platform as a single controller and are not a joint controller with the caregivers you add, and each account stays responsible for how it uses the records it can see.
- Our processors. Supabase (database and authentication); Resend (delivers our emails — sign-up confirmation, password reset, magic sign-in link, subscription and billing notices, win-back, account-deletion confirmation, and waitlist launch news — receiving your email address and the message content); RevenueCat (Bunavi Plus subscription and entitlement management); Apple and Google, only if you choose to sign in with them, to verify your identity; the store you buy Bunavi Plus from (Apple's App Store on iPhone, Google Play on Android), which bills it and receives your purchase details; Sentry (crash reports, app-health and performance data, and anonymous usage counts); Google, for the usage data of the ML Kit QR-code scanner built into the Android app; and Apple's push notification service, which delivers partner notifications on iPhone. Processors act under data-processing agreements and only on our instructions; the app stores handle your payment under their own terms and privacy policies.
- Nobody else. We do not sell, rent, or share your data with advertisers or any other third party.
How long we keep it
Your data is kept for as long as you keep it: records stay until you delete them, and your account stays until you delete it. Settings → Account & profile → Delete account permanently removes your account immediately, together with every baby profile you own that isn't shared with anyone else, and all of its records and photos. A baby you own that still has another caregiver is not deleted: it passes, with its whole history and photos, to the caregiver who has been on it longest, so the family keeps the record. Entries you wrote on a shared baby — one you passed on, or one someone else shared with you — stay on it without your name. Invite codes you created that nobody has used stop working. You don't need the app to delete your account: email support@bunavi.app from your account's email address and we will delete it in the same way within 30 days, usually much sooner. Residual copies in encrypted backups expire with the normal backup rotation, within 30 days.
A few things are kept outside your account, so deleting it does not remove them: your website waitlist entry, if you joined; RevenueCat's record of any Bunavi Plus purchase, filed under your account's random identifier (the App Store or Google Play keeps its own record of the purchase under its own privacy policy); and crash and diagnostic reports, which are not linked to you and which Sentry deletes after 30 days. Email support@bunavi.app to have the waitlist entry or the RevenueCat record removed. If you use Bunavi as a guest and sign out without creating an account, your records stay on our servers where no one can reach them; to erase them, choose Delete my data and sign out instead.
When you delete an entry, Undo brings it back from the copy still on your phone. For a pumping session, our server also keeps two of its times, if they were recorded — when the milk was thawed and when it expired — for 7 days after you delete it, so that Undo, even from an older version of the app, gives the bag back exactly as it was. They are kept with the entry's ID, the baby it belongs to and the time it was deleted; nothing else from the entry is kept, and deleting the baby erases these times at once. After 7 days they are never given back, and they are erased no later than the next time anyone logs a pumping session in Bunavi. As with anything else you delete, residual copies in our encrypted backups expire with the normal backup rotation, within 30 days.
Your rights
Under the GDPR you can ask us to access, correct, export, restrict, or erase your personal data, and you can object to processing based on legitimate interest. Most of this you can do directly in the app — records can be edited or deleted, and account deletion is built in. For a machine-readable copy of your data (or anything else), email us and we will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection (cpdp.bg), or the authority of your own EU country.
Waitlist and launch emails
If you joined our launch waitlist on bunavi.app, we store the email address you gave (with Supabase, in the EU) and use it — with your consent (GDPR Art. 6(1)(a)) — to send a confirmation and the occasional launch update, delivered through Resend. We never sell it and use it for nothing else. You can withdraw consent and unsubscribe at any time from the link in any email or by writing to support@bunavi.app, which also removes your waitlist entry.
Children
Bunavi accounts are for parents and guardians aged 18 or older. We do not knowingly let children open accounts. Information about your baby is entered by you, stays under your control, and is used for nothing beyond showing it back to you and the caregivers you invite.
Not medical advice
Growth charts in the app display World Health Organization reference data for visual context only. The app is not a medical device and does not provide medical advice — always discuss your baby's growth and health with your pediatrician.
Changes to this policy
If this policy changes in a way that matters, we will update this page and note the new effective date at the top. Significant changes will also be announced in the app.