NapBuddy Privacy Policy

1. Data controller

The controller of your personal data and of the data about your child that you enter into the app is:

Szymon Grzemski Usługi Informatyczne (a sole proprietorship registered in Poland)
operating under the brand Kiddo Labs
Tax ID (NIP): 5272916885, REGON: 385271077
Address: ul. Krynicka 3/63, 80-393 Gdańsk, Poland
Email: contact@kiddolabs.cloud

In this policy the controller is referred to as "we", "us" or "Kiddo Labs". We have not appointed a Data Protection Officer (we are not required to). You can contact us about any data protection matter at the email address above.

2. Scope and who the app is for

This policy covers the NapBuddy mobile app and its related server-side services (together, the "App"). The App is intended for parents, legal guardians and other caregivers of children (the "Parent" or "you") who are at least 16 years old. The App is not intended to be used by children themselves. It does, however, process data about children entered by the Parent, which is why we treat that data with particular care (see section 5 and section 12).

This policy does not cover third-party services you use independently of us (such as the App Store, Google Play, or your Apple or Google account); their own privacy policies apply.

3. What data we process

3.1. Your account data

• email address,
• first name or display name,
• your date of birth,
• the account identifier assigned by Firebase Authentication and the sign-in method you use (email and password, Google account, or Apple ID); if you sign in with Google we may also receive the URL of your Google profile picture; if you sign in with Apple you may choose to hide your email, in which case we receive an Apple relay address,
• your password – if you sign in with email; it is stored only by Firebase Authentication in a protected (hashed) form and we never have access to it.

3.2. App settings

• app language and theme (light/dark/system),
• notification preferences (e.g. bedtime reminders, sleep-log reminders, AI insights),
• your device's push notification token (Firebase Cloud Messaging).

3.3. Data about your child

• the child's first name, gender and date of birth,
• optionally, a photo of the child – only if you add one.

3.4. Your child's sleep data

• sleep sessions: type (night sleep or nap), start and end time, duration,
• sleep quality rating and mood on waking,
• notes you choose to add to a sleep session,
• statistics and insights calculated from the above (e.g. average bedtime, total sleep time).

3.5. AI chat and AI-generated content

• messages you send to the AI assistant in the chat, and the assistant's replies,
• tips and analyses generated by AI for your child, and your feedback on them (e.g. marking a tip as "helpful"),
• in-app notifications (e.g. reminders, insights, achievements).

3.6. Technical data

• server logs: IP address, date and time of the request, the service endpoint called, response code and account identifier – to keep the App running, secure and protected against abuse (e.g. rate limiting),
• error reports: if something crashes, technical data such as device type and model, operating system and app version, the error stack trace and basic request information may be sent to Sentry. We intentionally do not send data identifying you or your child to Sentry.

We do not collect your location, contacts, microphone or camera data (you pick your child's photo from your photo library), or advertising identifiers.

4. Purposes and legal bases

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). AI tips and analyses are for information only.

5. Your child's sleep data as health data – your consent

Information about your child's sleep (sleep times and duration, quality, mood, your notes and questions to the AI assistant) may reveal information about the child's health. We therefore treat it as a special category of personal data (Art. 9 GDPR) and process it on the basis of your explicit consent, which you give in the App as the child's parent or legal guardian.

• Consent is voluntary, but without it we cannot keep a sleep log or provide AI features – these are the App's core functions.
• You can withdraw consent at any time: by deleting your child's profile or sleep sessions in the App, by deleting your account (Settings → Delete account), or by emailing us at the address in section 18. Once you withdraw consent, we delete the data processed on that basis.
• Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Please do not enter information you don't need to in notes or the chat (e.g. detailed diagnoses, other people's data, ID numbers). The AI assistant is meant only for conversations about your child's sleep.

6. AI-powered features

The App uses Google Gemini language models provided through Google Cloud Vertex AI, running in a European Union region (europe-west1, Belgium). Here is how it works:

• What data is sent to the model: your child's first name, age and gender, sleep data (including calculated statistics), the App language and – in the chat – your messages and earlier messages from the current conversation. When preparing a sleep analysis, your recent chat messages about that child (from the last 7 days) may also be used so that the insights reflect what you told us. We do not send your email address or your child's photo to the model.
• No model training: under Google Cloud's terms, customer data processed in Vertex AI is not used by Google to train its models. We do not train any models on your data either.
• Topic limits: the assistant is configured to talk only about children's sleep; it declines questions outside that scope.
• Not medical advice: AI-generated content is general information, may contain mistakes, and does not replace consulting a doctor, paediatrician or other professional. See the Terms of Service for details.
• Storage: AI analysis results are cached temporarily (about 24 hours) to limit the number of requests; AI tips are kept for up to 90 days; chat messages for up to 180 days (see section 9).

7. Recipients and processors

We do not sell your data or share it for marketing. We entrust it only to trusted providers who process it on our behalf under data processing agreements (Art. 28 GDPR) and only as needed to provide the service:

The following are independent controllers, not our processors:

• Apple Inc. and Google LLC / Google Ireland Limited – as operators of the App Store and Google Play, the mobile operating systems, push delivery services (Apple Push Notification service) and the "Sign in with Apple" and "Sign in with Google" services. They process data under their own privacy policies.

We may also disclose data to public authorities where required by law, and to our advisers (e.g. lawyers) bound by professional secrecy, to the extent necessary to protect our rights.

8. Transfers outside the European Economic Area

The App's main data (account, children, sleep, chat) is stored in the European Union. Some providers (Google, Sentry) may, however, process part of the data – e.g. authentication data, notification tokens or error reports – outside the EEA, in particular in the USA. Such transfers are based on:

• the European Commission's adequacy decision for the EU-US Data Privacy Framework – for certified organisations, or
• Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR), together with supplementary measures such as encryption.

You can obtain a copy of the safeguards used by contacting us.

9. How long we keep data

Account deletion: when you delete your account in the App, we promptly delete all associated data from our live systems – including child profiles, photos, sleep sessions, chat messages, tips and notifications – as well as your Firebase Authentication account. Data may remain for up to 14 days in backups, where it is not actively used, and then expires automatically.

10. Your rights

You have the right to:

• access your data and obtain a copy (Art. 15 GDPR),
• rectification of inaccurate or incomplete data (Art. 16 GDPR),
• erasure ("right to be forgotten", Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability – receiving your data in a structured, commonly used, machine-readable format (Art. 20 GDPR),
• object to processing based on our legitimate interests (Art. 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3) GDPR),
• lodge a complaint with a supervisory authority – in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. If you live in another EU country, you may also complain to the authority in your country.

11. How to exercise your rights

You can exercise most rights yourself, directly in the App:

• Data export (access and portability): Settings → Export data – you receive a JSON file with your account, children, sleep sessions and other stored content.
• Rectification: you can edit your own and your child's details and sleep sessions on the relevant screens.
• Erasure: you can delete individual sleep sessions, notifications, a child's profile (with all its data) or your whole account: Settings → Delete account. If you no longer have access to the App, you can request deletion of your account and all associated data by emailing contact@kiddolabs.cloud from the address linked to your account.

For anything else (e.g. restriction, objection, questions), email us at the address in section 18. We will reply without undue delay and in any case within one month of receiving your request; in exceptional cases this period may be extended by two further months, and we will let you know. We may ask you to confirm your identity – usually it is enough to write from the email address linked to your account. Handling requests is free of charge.

12. Children's data

• The App is intended for adult caregivers (at least 16 years old). We do not create accounts for children and do not knowingly collect data directly from children. If we learn that an account was created by someone under 16, we will delete it.
• By entering a child's data, you confirm that you are the child's parent or legal guardian, or are acting with the consent of the child's parent or legal guardian.
• We collect only the child data needed for the App to work. The child's photo is optional.
• Children's data is not used for advertising, marketing profiling or training AI models.

13. Data security

We use appropriate technical and organisational measures to protect data, including:

• encryption in transit (HTTPS/TLS) between the App and our server,
• encryption at rest within Google Cloud infrastructure,
• authentication of every request with a Firebase token, and checks that you can only access your own data,
• no direct database access from the App – all communication goes through our server,
• private storage of child photos, made available only through time-limited signed links,
• rate limits against abuse and minimal administrative access.

No system is completely immune to threats. If a personal data breach is likely to result in a high risk to your rights, we will inform you and, where required by law, the supervisory authority.

14. Device permissions and notifications

• Photo library: the App asks for access to your photos only when you want to add a photo of your child. Only the photo you select is uploaded.
• Notifications: bedtime and sleep-log reminders are scheduled locally on your device based on predicted sleep times. Push notifications (e.g. insights, alerts) are delivered via Firebase Cloud Messaging and Apple/Google notification services. You can turn notifications off at any time in your system or App settings.
• Local storage: the App stores data needed to function on your device (e.g. your sign-in session, settings, identifiers of scheduled reminders). We do not use cookies or similar tracking technologies.

15. No ads, no tracking, no selling of data

• The App shows no advertising.
• We do not sell or rent personal data.
• We do not use third-party analytics or advertising SDKs and do not track you across other companies' apps or websites (we do not use the IDFA/AAID advertising identifier or App Tracking Transparency).

16. Is providing data mandatory?

Providing data is voluntary but necessary to create an account and use the App. Without an email address (or an Apple/Google account) you cannot create an account, and without your child's data and sleep data you cannot use the sleep log or AI features. The child's photo and notes are entirely optional.

17. Changes to this policy

We may update this policy, for example when we introduce new features or change providers, or when the law changes. We will notify you of material changes in advance in the App or by email. If a change requires your consent (e.g. a new purpose for processing health data), we will ask for it separately. The current version is always available in the App, and the date of the last update is shown at the top of this document.

18. Contact

For any privacy or personal data matter, contact us:

Szymon Grzemski Usługi Informatyczne (Kiddo Labs)
Address: ul. Krynicka 3/63, 80-393 Gdańsk, Poland
Email: contact@kiddolabs.cloud