Privacy Policy

• Your baby's data is stored on your device and, if you use iCloud, in your own iCloud database through Apple's CloudKit.
• Baton has no accounts, and no server receives the data you log. We have no access to it. The only thing that reaches us is feedback you choose to send (see “Feedback you send us”).
• Baton has no ads and no tracking. It sends anonymous usage statistics and crash reports to Google Firebase — never anything about your child (see “Usage statistics and crash reports”).
• RevenueCat processes Baton Plus purchases and receives no data about your child. Feedback you choose to send is stored with Supabase and forwarded to the developer's Telegram; nothing from your baby log is attached.
• Health and routine data about your child is never sold or shared.

You may enter: your baby's name or nickname, birth date and sex (optional); entries such as feeds (side, duration, amount, milk type), pumping, solids, sleep, diapers, weight, length, head circumference, vaccine doses and notes; and your settings and reminders.

Baton does not ask for your real name, email (except optionally, so we can reply to feedback you send), phone number or location, and does not access your camera, contacts or Apple Health. Baton never reads your photo library: when you add a photo to a Moment or a birth announcement card, you pick it with the iOS photo picker and only that photo is used, on your device. Baton saves to Photos only when you tap Save to Photos.

On your device: every entry is stored in Baton's private storage on your iPhone or iPad (shared only with Baton's own widgets and Live Activity).

In your iCloud: if you are signed in to iCloud, Baton syncs through CloudKit into the private database of your Apple ID. This data lives in your iCloud account, is governed by Apple's privacy policy and counts toward your iCloud storage.

Encryption: your baby's name and birth date, notes and the details of each entry are stored in CloudKit's end-to-end encrypted fields (encryptedValues) — only devices signed in to your iCloud, or to the iCloud of someone you invited, can decrypt them. The type of entry, its start and end times, the child's sex, the chosen vaccine schedule and the display name of the person who logged it are stored as standard iCloud fields, which Apple encrypts in transit and at rest.

No server of ours receives the data you log, and we have no access to any user's iCloud private or shared database.

When you invite your partner or a caregiver, Baton uses CloudKit sharing: your family's log is shared with their Apple ID, and they read and write it through the shared database in their iCloud. The person you invite can see and edit the whole shared log, including the display name of whoever logged each entry.

You can stop sharing or remove a participant at any time in More › Partner & sync; an invited person can also leave on their own. Share only with people you trust.

Baton uses RevenueCat, Inc. to manage Baton Plus purchases. When the app starts and when you buy or restore, the RevenueCat SDK sends to its servers:

• An anonymous app user ID generated by RevenueCat — not your name, email or Apple ID.
• Your Baton Plus purchase history and subscription status, from the App Store receipt.
• Technical details needed to validate purchases, such as the app version, iOS version and App Store country.

This data is used only to determine whether you have unlocked Plus. RevenueCat receives no data about your child. Payment is handled by Apple; we never see your card details.

Baton contains no advertising SDK and does not track you across other apps or websites. It does use two Google services to find bugs and see which features are used. Neither receives anything about your child.

• Anonymous usage statistics (Google Analytics for Firebase): which onboarding steps were completed, that an entry was saved and its broad kind (such as “bottle”, “diaper” or “health” — never the entry itself), whether the paywall was opened or closed, whether a purchase succeeded, was cancelled or failed (and for which product, and whether it began a free trial), whether a restore succeeded, the update card and the one-time offer being shown or tapped, that a partner or caregiver invitation was opened or accepted and with which access, plus whether Baton Plus is active and the app language. These are fixed categories enforced by the app; contractions are never counted.
• Along with these events, the Firebase SDK itself sends a random app-instance identifier, your device model, iOS and app version, language, and an approximate country or region that Google derives from your IP address. Baton does not collect the advertising identifier (IDFA): it is built without Apple's AdSupport framework, never shows the tracking prompt, and turns off Firebase's ad and vendor-identifier (IDFV) settings.
• Crash reports (Firebase Crashlytics): when Baton crashes, a technical report — where in the code it happened, the error message, device model, iOS and app version and a random Crashlytics installation identifier. Baton adds nothing to these reports: no user ID, no custom fields, no logs.

Never sent: your baby's name or nickname, birth or due date, sex, weight, length or head circumference, temperatures, amounts, durations, entry times, notes, medicine or vaccine names, photos, or anything else you type or measure. Not your name, email or Apple ID either.

Usage statistics and crash reports are on in every App Store build of Baton from version 1.1.2; there is no in-app switch to turn them off. They are used only, in aggregate, to fix bugs and decide what to improve — never for advertising, never sold, and never linked to your identity. Google LLC processes them as our service provider under the Google Analytics for Firebase and Firebase Crashlytics terms; Google may process this data outside your country.

Apple may also give developers aggregate, anonymous statistics (such as download counts) through App Store Connect, and crash reports if you turned on “Share with App Developers” in iOS settings. These do not contain the data you log in Baton.

To offer you an update, Baton asks the App Store at most once a day which version is current. That request goes to Apple and carries only Baton's app identifier and your App Store country — nothing about you or your child.

If what Baton sends ever changes, this policy and the App Store privacy label will be updated before that build ships.

We do not sell, rent, trade or share health or routine data about your child with anyone — advertisers, data brokers, insurers or researchers — and we do not use it for advertising or to train AI models. In fact, we never receive it — the feedback form attaches nothing from your baby log.

Reminders (the next nap window, vaccine doses, your own reminders) are local notifications scheduled on the device. iCloud may send silent notifications to signal that there are changes to sync; they are sent by Apple and contain none of your data.

When you export a CSV or a PDF report, the file is created on the device and goes wherever you choose in the iOS share sheet. If you email support, the email goes through your own mail app.

Baton has an optional “Feedback & bug report” form. Nothing is sent unless you open it and tap Send — the app never sends feedback on its own. Nothing from your baby log is attached, and the form reminds you not to include your baby's name or health details.

When you tap Send, we receive:

• The message you type.
• Your email address, only if you enter one — used only to reply to you.
• A screenshot, only if you attach one.
• Your app version, iOS version, device type (iPhone or iPad) and app language.
• A random install identifier generated by the app. It is not linked to your Apple ID or any account, and is used only to limit spam.

Feedback is stored on our own backend, hosted by Supabase in Singapore (ap-southeast-1), and a notification with your message is forwarded to the developer's private Telegram chat. Your network IP address is kept only as a one-way hash, for at most one hour, to rate-limit submissions.

Feedback is never used for tracking, advertising or analytics, never sold or shared, and not linked to your identity.

We keep feedback until the issue is handled, then delete it; any screenshot is deleted along with the message. To have anything you sent deleted, email vanthuong.dao2004@gmail.com with roughly when you sent it and what it said (or the email address you used).

Baton is made for parents and caregivers. It is not directed at children, is not intended to be used by children and is not in the App Store's Kids category. We do not knowingly collect personal information from children under 13 (or the equivalent age where you live).

Information about a child is entered by their parent or caregiver, is stored on that adult's devices and in their iCloud, and is never sent to us — the feedback form attaches nothing from the log and reminds you not to include your baby's name or health details. We follow data minimization: a nickname is enough, no full name is needed. If you believe we have received personal information about a child, email us and we will delete it.

Data is kept until you delete it (feedback you send is the exception: see “Feedback you send us”). You can delete a single entry or a child, or use Settings › Delete all data, which wipes the data on the device, deletes Baton's data zone in iCloud and stops sharing. You can also manage Baton's iCloud data in Settings › [your name] › iCloud.

Deleting the app removes only the copy on that device; the iCloud copy remains until you delete it as described above.

Because there are no accounts and we hold none of the data you log, there is no record of it on our side to access, correct or erase — you have direct control in the app and in iCloud, and you can export everything to CSV at any time. This applies wherever you live, including under the GDPR, the CCPA and Vietnam's personal data protection rules. The only thing we may hold is feedback you chose to send; email vanthuong.dao2004@gmail.com to have it deleted. If you want RevenueCat to delete the anonymous ID linked to your purchases, email us. Usage statistics and crash reports are not linked to your name, email or Apple ID, so we cannot look up one person's data in them.

When this policy changes, the date at the top of this page changes with it. Material changes will be mentioned in the App Store release notes.

This website, not the app, uses Google Analytics 4 to count visits and to see which pages and links are used, so the site can be improved. Google processes this data on our behalf as a service provider.

What is collected: the pages you open, the site you came from, clicks on links that leave this site (such as the App Store button), and coarse device, browser, language and country or region information. Google Analytics sets first-party cookies in your browser to tell one visit from another.

What is never collected: your name, your email address, or anything you type on this site. This data is not used for advertising and is not shared with data brokers.

Google Analytics keeps this event data for 2 months (its default retention) and then deletes it. To opt out, block Google Analytics with a browser extension or turn off cookies for this site; the website and the app keep working. This section covers the website only; the app is covered in the sections above.

Google's own privacy policy: https://policies.google.com/privacy