Privacy at a glance (a summary; the full policy below is what applies)
- Stored in the EU. Your baby's records (profiles, logs, health entries and photos) are stored in Frankfurt, Germany, encrypted in transit and at rest.
- Never sold, no ads. We don't sell your data or share it with advertisers. The app shows no ads and uses no advertising identifiers.
- No chatbot, no cloud AI. Nothing from your baby's log is sent to an AI service or used to train AI. A few optional writing touches run on your iPhone.
- Only the people you invite. Sharing is off until you invite someone; the baby's owner can remove anyone in Settings. The services named below process data for us.
- You stay in control. Export everything (CSV, JSON and a summary PDF in English) and delete your account yourself, in the app. A baby you share passes, with its history, to the caregiver who has been on it longest.
- A few services outside the EU. Purchases, crash reports, email, push notifications and website hosting are run by companies outside the EU; each is named below with what it receives.
- Who is responsible. Rostislav Antonovich, an independent developer in Bulgaria (EU). Your rights under the GDPR, and how to use them, are below. support@bunavi.app
Privacy Policy
Bunavi is a mobile app that helps parents record their baby's feedings, sleep, and growth. This policy explains what data the app handles, where it is stored, who can see it, and the choices you have. The short version: your baby's profile, health and tracking data are stored in the EU, your data is never sold, and you can delete your account yourself at any time; a baby you share passes, with its history, to another caregiver. A few limited services we rely on — payments, email delivery, crash reporting, notification delivery and website hosting — are run by companies based outside the EU; we name them below.
Who is responsible
The data controller is the app's developer:
Rostislav Antonovich · Bulgaria
Contact: support@bunavi.app
We are a small enough operation that the GDPR does not require us to appoint a Data Protection Officer, and we have not designated one; any question about your data goes straight to the developer at the address above.
What we collect
| Account | Your email address, a password (stored only as a cryptographic hash — we can never read it), and a display name, which is required when you sign up with email. If you sign in with Apple or Google instead, we receive the email address (or Apple's private relay address) and name that provider returns. You can also use Bunavi as a guest, without an email address; the account then has only a random identifier, plus a display name if you choose to add one. Supabase, which runs sign-in for us, logs each sign-in with the IP address and the app or browser version it came from, to keep accounts secure. |
|---|---|
| Baby profile | The name and date of birth of each baby you add, and optionally their sex, their gestational age and weight at birth, and a profile photo. You choose what to enter; a nickname works just as well as a real name. |
| Tracking records | Feedings (type, time, amount or duration, optional notes; for a meal of solid food, also the foods offered, how much your baby ate, and foods not taken this time), pumping sessions, sleep sessions, diaper changes (including optional stool detail and an optional dark-urine mark), growth measurements (weight, height, head circumference), milestones, and health events such as temperature, symptoms, medications, and vaccinations. Some of these are health-related; you enter them and may delete them at any time. The app's food list knows which foods carry common allergens, such as egg and peanut, so the meals you log are also a record of your baby's allergen exposures: which of those foods were offered, and when. Bunavi records what a baby was offered and what caregivers noticed, so families can share it with a clinician. It does not diagnose, predict or prevent allergy. If you leave a day out of the app's comparisons, Bunavi stores that day and the reason you picked (someone else was caring for your baby, or you were away). |
| Baby photos | If you add a profile photo for a baby, the image is stored in our EU hosting bucket and shown to you and anyone you invite to that baby. Photos are deleted when you remove them or delete the baby. |
| Cry detection | Optional. If you turn on cry detection, Bunavi listens through your device's microphone only to notice when your baby is crying; the likely reason it then suggests comes from your recent feeds, naps and diapers, not from the sound. This happens entirely on your device — the audio is analyzed in the moment and is never recorded, saved, or sent to us or anyone else. If you log a cry, its time and the suggested reason are saved like any other record; beyond that, only the anonymous usage counts described under Crash reports and diagnostics leave the device, among them a loudness level and the detector's confidence as single numbers. You can switch the microphone permission off at any time in your device settings. |
| Subscription | If you buy Bunavi Plus, the store you buy it from processes the payment — Apple (the App Store) on iPhone, Google (Google Play) on Android. We never see your card details. That store reports your subscription status, and to manage what your plan unlocks, your Bunavi account identifier and the resulting purchase and renewal events are sent to RevenueCat, which manages them for us. |
| One Plus for a shared baby | While anyone who shares a baby — its owner or someone they invited — has Bunavi Plus, everyone on that baby can use its Plus features, and its owner can invite more than 3 people to it. For this, our server looks at the Plus status it holds for each person on the baby and tells each of their apps only whether the baby is covered: a yes or no for each baby they share, nothing more. It never tells them who has Plus, which plan or store, its price, or when it renews or ends, though they may be able to work out who has it: when only two people share a baby, for example, or when the cover stops just as someone leaves or is removed. Without a connection, the app goes on using the last answer for up to 7 days. The cover stops when that Plus ends, or when the person who has it leaves the baby, is removed from it or deletes their account; everyone already on the baby stays. |
| Notifications | Feeding reminders are scheduled on your phone and send nothing to us. The app registers a push token for your phone, with Apple on iPhone and with Google's Firebase Cloud Messaging (Google LLC, USA) on Android, and stores it, with your phone's language, in our database, so that when a partner logs something for a baby you share, a short notice such as “Ana logged a feed” reaches you through Apple's push notification service or Firebase Cloud Messaging. That service receives your phone's push token, the notice's text (the first name of the partner who logged the entry and the kind of entry), an internal code for the baby and a link that opens the right page when you tap the notice. It never receives amounts, notes or any other detail of the entry. On Android, Google's messaging software in the app also creates a random identifier for this installation, which Google uses to issue the token, and a notice that has not reached your phone within an hour is dropped, so a phone that was off or offline does not get a pile of old ones. The token is removed from our database when you sign out or delete your account. |
| Crash reports and diagnostics | Crash and error reports, app-health and performance data, and anonymous usage counts, sent to Sentry — see Crash reports and diagnostics below. They are tied to a random identifier for this installation of the app, never to your account, and are designed to contain none of your records. |
| Waitlist email | If you joined the launch waitlist on our website, we store the email address you gave to send you a confirmation and occasional launch news. A waitlist entry is separate from any app account, and you can unsubscribe at any time. |
We do not collect your location, your contacts, your photo library or camera (we only use the photo you pick or take for a baby's profile, and an invite QR code is read on your phone), microphone audio (cry detection runs on your device and keeps nothing), or any advertising identifier, and we build no advertising or analytics profile of you. The app shows no ads, and we never use your baby's photos, health records, cry audio, or any of your entries to train artificial-intelligence or machine-learning models. Your family's data is used to run the app for you and, only as totals across all accounts, to see whether the app is working (see Why we process it) — nothing else.
Crash reports and diagnostics
The store versions of Bunavi, on iPhone and on Android, report crashes and app health to Sentry (Functional Software, Inc., USA), our crash-reporting processor. There is no setting to switch this off in the app. Three kinds of data are sent:
- Crash and error reports. When the app crashes, freezes or hits an unexpected error: what went wrong and where in the app's code, the app version, the last few screens and app events before it happened (such as going to the background or losing the network), and device details such as the model and manufacturer, the operating system and its version, language, time zone, free memory and storage, and battery level. When our server refuses to save an entry, the report names the kind of record and the rule it broke; the values you entered are removed on your phone before the report is sent.
- App health and performance. Whether each session of using the app ended in a crash, so we can see how stable a version is; how long the app took to start; and, for a random one in five app starts and screen loads, how long the screen took to appear and whether it stuttered.
- Anonymous usage counts. Tallies that tell us whether key
features work. They carry no account or device identifier, and none of the
details you enter. These are all of them, and each records only what is
named here:
- Signing in: each attempt to sign in, sign up or turn a guest account into a full one, with the method used (email, Apple, Google or guest), whether it went through, was cancelled or failed (with an error code if it failed; for a sign-in that goes on in the browser, only whether its page opened) and how long it took; each sign-in that took effect, with its method; and whether Sign in with Apple had to try a second time, why, and whether that worked.
- Syncing: how many entries saved offline were waiting, whether each reached the server and which kind of entry it was (a feeding or a sleep, for example), how long sending them took and whether it finished or stopped (the phone went offline, our server was too busy to answer, or you were signed out or switched accounts), and how often our server was briefly unavailable (with its error code).
- Bunavi Plus: whether the store's Bunavi Plus prices loaded and whether they included a free trial for you; how often the Bunavi Plus paywall was shown, recording which part of the app opened it; how often a suggestion of a Bunavi Plus feature was shown, opened or closed (recording only which suggestion it was); each purchase started, with its plan, where in the app it was started and whether it began with a free trial; how each purchase or restore ended (it went through, was cancelled, is waiting for the payment, found nothing to restore, or failed), where a restore was started (including the app's own check on a purchase that has not unlocked Plus yet, and that this check gave up after 14 days without Plus), and how long the store's purchase sheet was open; and that the app could not read when your account was made, which decides whether cry insights are free for you.
- Cry detection: whether listening started, was refused the microphone or failed, how each cry-listening session ended and how long it lasted, with its loudness level or the detector's confidence as a single number between 0 and 1, and which of the app's two ways of hearing a cry was used.
- First-run setup and notifications: which steps of the first-run setup were reached, recording only the step's name; and each answer to a request to allow notifications, recording only whether it was allowed, declined or failed and what it was for (the first-run setup, a reminder, badge notifications, or partner notifications).
- Sharing a baby: each partner invite created, recording only whether it was made in Settings or from a card on the app's Home tab; for that card, that it was shown (counted at most once a day for each baby), which of its buttons was tapped, or that it was closed; how the share sheet for an invite link closed (a destination picked, dismissed, or not known) or that it failed to open, but never where the link went; and each invite accepted, recording only whether its code arrived as a link, through the app's QR scanner, or typed or pasted.
- Rating prompt: each time the app asked your phone to show a rating prompt, recording only the moment that led to it (a badge, a growth report, a milestone, joining a partner's baby, sharing the weekly recap, or a seventh day with entries you logged).
Crash reports and app-health data are tied to a random identifier that Sentry creates when the app is installed. It is not your account identifier, email address or name, not your phone's advertising ID or any hardware identifier, and a reinstall replaces it. Reports are designed to contain none of your baby's details, records, notes or photos, and never any sound. The app does not ask Sentry to store your IP address with a report (Sentry, like any server, sees the address a report comes from). We use all of this only to find and fix problems, and Sentry deletes it after 30 days on our current plan.
Scanning an invite code. On Android, a partner's invite QR code is read on your phone by Google's ML Kit barcode scanner, which is built into the app; the camera image never leaves your phone. When the scanner runs, ML Kit sends Google information about its use and performance — device model, Android version, the app's name and version, a per-installation identifier, timings and error codes — which Google uses to maintain and improve the scanner. It does not include the camera image or the code you scanned. On iPhone the code is read by Apple's on-device Vision framework, and nothing is sent.
Why we process it
Account, profile, and tracking data are processed to provide the service you signed up for (GDPR Art. 6(1)(b)). Records about your baby — including health-related ones such as growth measurements — are entered by you as the parent or guardian, and by saving them you explicitly consent to their processing for this purpose (Art. 9(2)(a)). You can withdraw that consent at any time by deleting individual records or your whole account. If you buy Bunavi Plus, we process your subscription status to give you what you paid for, including Plus for everyone who shares a baby with you (Art. 6(1)(b)). Crash reports, diagnostics and usage counts rest on our legitimate interest in finding and fixing problems and keeping the app working (Art. 6(1)(f)); they are not linked to your account. We also work out totals from our database to learn whether the app is helping families, for example how many new accounts add a baby, how many babies are shared and how many new accounts are still logging a week later. This rests on our legitimate interest in knowing whether the app works and improving it (Art. 6(1)(f)). The totals use only dates and times — when accounts, babies and entries were created, when invites were made and used, and when someone joined a baby — and a few account details: whether it is a guest account, how it signs in, whether an iPhone or Android phone is registered for its notifications, and its Bunavi Plus plan and status. They never use what an entry says, and leave out health, growth, milestone and cry entries entirely. The working-out happens inside the database, account by account, and only totals come out, for groups such as all accounts that signed up in the same week: we look at no one's activity, keep no result for any one account and build no profile of anyone. If you object, email us and we will leave your account out. If you joined our website waitlist, we send you launch emails on the basis of your consent (Art. 6(1)(a)), which you can withdraw at any time.
Sensitive health data
Some of what you record — temperature, symptoms, medications, vaccinations and allergen exposures — is special-category health data under GDPR Art. 9, which the law protects most strictly. We treat it that way: you enter it yourself and by saving it give your explicit consent (Art. 9(2)(a)); it lives in the EU under the same row-by-row access rules as everything else; it is shown only to you and the caregivers you invite; and it is never used to profile you, target ads, or for anything beyond showing it back to you. Delete any record, or your whole account, to withdraw that consent at any time.
Where your data lives
Data is stored in a database operated by Supabase, our hosting processor, in the European Union (AWS eu-central-1, Frankfurt, Germany). All traffic between the app and the server is encrypted (TLS). Access is enforced row-by-row in the database, so an account can only ever read or write the records of babies it owns or has been invited to. The app also keeps a small read-only copy of your recent data on your own device so it works offline; that cache is cleared when you sign out.
International transfers
Your baby's profile, health and tracking records — the heart of the app — stay in the EU with Supabase. A few limited services we rely on are run by companies based in the United States: RevenueCat (manages Bunavi Plus subscription entitlements — receives your account identifier and App Store or Google Play purchase and renewal events), Resend (delivers our emails — receives your email address and the message content; its sending infrastructure runs in the EU, in Ireland), Sentry (crash reports and diagnostics — receives the technical data described above, tied to a random installation identifier and never to your account), Google (usage data from the ML Kit scanner in the Android app; and Google LLC's Firebase Cloud Messaging, which delivers partner notifications on Android — receives your phone's push token, each notice's text, an internal code for the baby and the link the notice opens), Apple (its push notification service delivers partner notifications on iPhone) and Cloudflare (hosts our website, including the pages that partner invite links and the links in our emails open — receives your IP address and the details of each request to the site; see Our website below). Where personal data is handled outside the EU/EEA, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses. Ask us at support@bunavi.app for more detail.
How we keep it safe
Traffic between the app and our server is encrypted with TLS, and your data is encrypted at rest in our EU database. Your password is stored only as a cryptographic hash we can never read. Access is enforced row-by-row, so an account can only ever reach the babies it owns or was invited to, and our processors work under data-processing agreements on a least-privilege basis. No safeguard is ever perfect, but we take security seriously and keep it under review.
No automated decisions about you
Bunavi never makes a decision about you or your baby by purely automated means, and does no profiling. Features like optional cry detection and the patterns you see are there to give you information only — cry detection runs on your own device — and never produce a legal or similarly significant effect. What you do with what the app shows you is always your call.
If something goes wrong
If a breach ever affects your personal data, we will notify the Bulgarian Commission for Personal Data Protection within 72 hours of becoming aware of it, as the GDPR requires. Where a breach is likely to put your rights at risk, we will also tell you directly, without undue delay, explaining what happened and what you can do.
Who can see your data
- People you invite. Sharing is off by default. If you generate an invite code and give it to your partner, their account gains access to that baby's profile and tracking records — including sensitive health entries such as temperatures, symptoms and medications, and meals with the allergen exposures they record — so you choose carefully who you invite. They also see whether that baby is covered by someone's Bunavi Plus, though it does not say whose (see One Plus for a shared baby, above). Invite codes are single-use and expire after 7 days. To revoke a partner's access, open Settings → Family sharing → Manage access and remove them; a caregiver can also leave a shared baby from there. Removing a caregiver takes effect immediately. When you invite someone you are choosing to share within your own family circle; we run the platform as a single controller and are not a joint controller with the caregivers you add, and each account stays responsible for how it uses the records it can see.
- Our processors. Supabase (database and authentication); Resend (delivers our emails — sign-up confirmation, password reset, magic sign-in link, subscription and billing notices, win-back, account-deletion confirmation, and waitlist launch news — receiving your email address and the message content); RevenueCat (Bunavi Plus subscription and entitlement management); Apple and Google, only if you choose to sign in with them, to verify your identity; the store you buy Bunavi Plus from (Apple's App Store on iPhone, Google Play on Android), which bills it and receives your purchase details; Sentry (crash reports, app-health and performance data, and anonymous usage counts); Google, for the usage data of the ML Kit QR-code scanner built into the Android app; Google's Firebase Cloud Messaging, which delivers partner notifications on Android; Apple's push notification service, which delivers partner notifications on iPhone; and Cloudflare, which hosts our website. Processors act under data-processing agreements and only on our instructions; the app stores handle your payment under their own terms and privacy policies.
- Nobody else. We do not sell, rent, or share your data with advertisers or any other third party.
How long we keep it
Your data is kept for as long as you keep it: records stay until you delete them, and your account stays until you delete it. Settings → Account & profile → Delete account permanently removes your account immediately, together with every baby profile you own that isn't shared with anyone else, and all of its records and photos. A baby you own that still has another caregiver is not deleted: it passes, with its whole history and photos, to the caregiver who has been on it longest, so the family keeps the record. Entries you wrote on a shared baby — one you passed on, or one someone else shared with you — stay on it without your name. Invite codes you created that nobody has used stop working. You don't need the app to delete your account: email support@bunavi.app from your account's email address and we will delete it in the same way within 30 days, usually much sooner. Residual copies in encrypted backups expire with the normal backup rotation, within 30 days.
A few things are kept outside your account, so deleting it does not remove them: your website waitlist entry, if you joined; RevenueCat's record of any Bunavi Plus purchase, filed under your account's random identifier (the App Store or Google Play keeps its own record of the purchase under its own privacy policy); and crash and diagnostic reports, which are not linked to you and which Sentry deletes after 30 days. Email support@bunavi.app to have the waitlist entry or the RevenueCat record removed. If you use Bunavi as a guest and sign out without creating an account, your records stay on our servers where no one can reach them; to erase them, choose Delete my data and sign out instead.
When you delete an entry, Undo brings it back from the copy still on your phone. For a pumping session, our server also keeps two of its times, if they were recorded — when the milk was thawed and when it expired — for 7 days after you delete it, so that Undo, even from an older version of the app, gives the bag back exactly as it was. They are kept with the entry's ID, the baby it belongs to and the time it was deleted; nothing else from the entry is kept, and deleting the baby erases these times at once. After 7 days they are never given back, and they are erased no later than the next time anyone logs a pumping session in Bunavi. As with anything else you delete, residual copies in our encrypted backups expire with the normal backup rotation, within 30 days.
Your rights
Under the GDPR you can ask us to access, correct, export, restrict, or erase your personal data, and you can object to processing based on legitimate interest. Most of this you can do directly in the app — records can be edited or deleted, and account deletion is built in. For a machine-readable copy of your data (or anything else), email us and we will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection (cpdp.bg), or the authority of your own EU country.
Our website
Our website, bunavi.app, is hosted by Cloudflare (Cloudflare, Inc., USA). Every visit goes through Cloudflare, which handles your IP address and the details of each request, such as the page asked for and your browser and device type, to deliver the pages and protect the site from abuse; if a page fails to load, your browser may also send Cloudflare a short error report. Cloudflare shows us summaries of this traffic, such as views per page and visits by country or kind of device; we keep no log of visits ourselves. Its pages also load Cloudflare Web Analytics, which counts page views and how fast pages load, the page you came from, and your browser, device type and country, without cookies and without identifying you; the invite and sign-in link pages block it, so the codes in their addresses never reach it. We rely on our legitimate interest in running a working, secure website and in knowing how it is used (Art. 6(1)(f)). To choose which language to show you, the home page uses your browser's language setting or, failing that, the country your IP address points to, and the invite and sign-in link pages use your browser's language setting; none of this is stored. The site sets one cookie, bunavi-lang, when you open one of its home pages or pick a language from its menu. It holds only that language, so your next visit opens in it, and it expires a year after it was last set. If you switch between light and dark, your browser remembers that choice, and the sign-in link page notes in the open tab that you have tapped its button; neither leaves your browser. The website runs no advertising or tracking scripts. Its App Store buttons carry a campaign label, so Apple can show us, as totals, how many downloads began on our website.
Waitlist and launch emails
If you joined our launch waitlist on bunavi.app, we store the email address you gave (with Supabase, in the EU) and use it — with your consent (GDPR Art. 6(1)(a)) — to send a confirmation and the occasional launch update, delivered through Resend. We never sell it and use it for nothing else. You can withdraw consent and unsubscribe at any time from the link in any email or by writing to support@bunavi.app, which also removes your waitlist entry.
Children
Bunavi accounts are for parents and guardians aged 18 or older. We do not knowingly let children open accounts. Information about your baby is entered by you, stays under your control, and is used for nothing beyond showing it back to you and the caregivers you invite, apart from the totals described under Why we process it.
Not medical advice
Growth charts in the app display World Health Organization reference data for visual context only. The app is not a medical device and does not provide medical advice — always discuss your baby's growth and health with your pediatrician.
Changes to this policy
If this policy changes in a way that matters, we will update this page and note the new effective date at the top. Significant changes will also be announced in the app.