Privacy Policy

Who is responsible for your data

MB "Katobit" (company code 308126840), registered at Biržų r. sav., Širvėnos sen., Javeniškių k. 6, LT-41270, Lithuania, is the data controller for the information described below. You can reach us at hello@beelucy.com about anything in this policy, including a request to exercise your rights.

We are not required to appoint a Data Protection Officer and have not appointed one. Your emails are read by us directly.

What BeeLucy does not do

Some of the clearest things we can tell you are the things that are absent. BeeLucy contains:

• No advertising, and no advertising networks.
• No analytics, product-measurement, or crash-reporting service. We do not know how many screens you opened, or when. The only feedback we hold is what you choose to send us: a feature idea, or the optional note on the way out, both described below.
• No tracking of you across other apps or websites, and no advertising identifier. The app never shows iOS’s tracking prompt because it has nothing to ask for.
• No profiling and no automated decision-making.
• No selling, renting, or sharing of your information for anyone else’s marketing. Not now, and not as a change of mind later — a change of ownership is the only way that could ever happen, and we would tell you before it did.
• No access to your location, contacts, photos, calendar, or microphone. The sleep sounds are either generated mathematically on your device or played from recordings shipped inside the app; either way the microphone is never opened and nothing around you is recorded or listened to.

What we hold

Your account. You sign in with Google or with Apple, so we never see or store a password. Your provider passes us the profile they hold for you — normally your name, your email address, and a link to your profile picture — along with a stable account identifier. If you use Sign in with Apple and choose Hide My Email, the only address we ever receive is Apple’s relay address.

Your caregiver profile. Your display name, which starts as the name your sign-in provider gave us — or the first part of your email address if it gave none — and which you can change in Account, and your notification preferences for each baby record: whether notifications are on, whether you want them when something is logged and when something ends, and any activity types you have muted.

The baby record. Its name, the date of birth if you enter one, the avatar you build for it, its time zone (so that a day in the log is a day where you live), its six-character invite code, and which account created it.

Join requests. When someone enters an invite code, their display name, the email address of the account they signed in with, and the time they asked wait on the record until its owner approves or declines them. Only the owner sees the request, and the email address is there so they can tell who is asking. Either answer removes the request; approving makes them a caregiver.

The log. For each entry: the date and time it happened, an end time if it has one, which activity type it is, an amount if that type measures one (a feed’s volume, say, or a weight), an optional note you type, and which caregiver created it and last changed it. Plus the activity types themselves — their names, icons, colors, and the unit an amount is measured in.

Push tokens. If you turn notifications on, one token per device, and whether that device is iOS or Android. A token identifies the installation, not you.

On your device, and nowhere else: your sign-in session, your chosen sleep sound and timer, and a copy of the most recent entries in a shared container so the home-screen widget can draw itself without launching the app. Signing out clears the session copy.

What you write to us. If you email us, we hold your message and the address you sent it from for as long as it takes to answer you properly. It is joined to nothing else in this list — unless you are asking us to do something to your account, in which case answering you means working out which account you mean.

Feature ideas. If you use Suggest a feature, we store what you write together with your account identifier, whether you were on iOS or Android, and the app version — an idea can describe something a later version already does. Unlike the note on the way out, it is linked to your account, so it is deleted with it.

Premium purchases, if you make one. The app store takes the payment, so we never see your card or other payment details. What reaches us, and our subscription provider RevenueCat, is a record of the purchase linked to your account identifier: which product, its price and currency, the store’s country, when it was bought and renews, whether it is active, canceled, or refunded, and the store’s identifiers for the transaction. The baby record also stores whether Premium is active on it and until when, because Premium covers every caregiver on the record.

Why you left, if you say. On the way out of Delete account the app optionally asks why, as tick-boxes and a free-text note. What you write is stored on its own, with no account identifier, no email address, and no way back to the account it came from — the record is written at the moment that account is deleted, so there is nothing left to attach it to. We store which platform it came from, and nothing else about you. We keep it for up to 24 months and read it only to decide what to fix.

The other side of that: because we cannot connect the note to you, we cannot find it again to remove it if you later ask. That is why the app asks you to leave personal details out of the box, and why every question there is optional — skipping them changes nothing about the deletion itself.

Why we hold it, in law

• To perform our contract with you (GDPR Article 6(1)(b)): your account, the baby record, the log, syncing it between caregivers, invite codes and join requests, and — if you buy Premium — checking the purchase with the store and keeping its status current. Without these the app cannot do what you asked it to.
• To meet a legal obligation (Article 6(1)(c)): keeping the records of Premium sales that accounting and tax law require us to keep.
• With your consent (Article 6(1)(a)): push notifications. You give it through your device’s permission prompt and can withdraw it at any time, in BeeLucy’s Settings or in your device settings, without affecting anything else.
• For our legitimate interests (Article 6(1)(f)): keeping the service running, secure, and free of abuse, answering you when you write to us, and deciding what to build or fix from the feature ideas and the optional note described above. We have weighed this against your interests and it involves no profiling.

Who else can see it

Other caregivers on the same baby record. This is the point of the app rather than a side effect: everyone on a record sees its whole log and history, its activity types, and each caregiver’s display name — including entries logged before they joined. Anyone who has your invite code can ask to join, and gains that access as soon as the record’s owner approves them, so treat the code as you would a key. Asking to join shows the record’s owner your display name and the email address you signed in with, before they have decided anything.

Service providers who process data on our instructions, under contract, and for no purpose of their own:

• Supabase — the database, sign-in, live sync, and the server-side function that deletes accounts. Your data is stored in the European Union.
• Expo (Expo Application Services) — relays push notifications to Apple and Google, and serves over-the-air app updates. Based in the United States.
• Apple Push Notification service and Google Firebase Cloud Messaging — the final delivery of a notification to a device.
• RevenueCat — checks Premium purchases with the app store and keeps their status up to date. It receives the purchase record described above and your account identifier, never your log or your baby’s details. Based in the United States.
• Fastmail — our mailbox. If you write to us, your message and the address you sent it from sit there. Based in the United States.

Google and Apple also act as independent controllers for the sign-in step itself, under their own privacy policies. We tell them nothing about you; they tell us who you are. The same is true of their app stores when you buy Premium: the store handles the payment under its own terms and privacy policy, and tells us only that the purchase happened and what state it is in.

We will also disclose information where the law requires it, but not otherwise, and we would resist a request that looked improper.

A notification carries readable content: the baby record’s name, the display name of whoever logged the entry, and the name of its activity type. That text passes through Expo’s push service and then Apple’s or Google’s, and it can appear on a lock screen. If you would rather it did not, turn notifications off in Settings — everything else keeps working.

Where it is stored, and transfers

The database — everything in “What we hold” apart from what stays on your device — is hosted in the European Union and does not leave it in the ordinary course of running the app.

Four flows reach the United States. Push notifications, because they are relayed by Expo: this covers your push tokens and the notification text described above. Update checks, because the app fetches over-the-air updates from Expo: this involves your IP address, device model, and app version, and no account data. Premium purchases, because RevenueCat checks them: this covers the purchase record and your account identifier, plus the IP address, device model, and app version of the phone asking. And email, because our mailbox is hosted by Fastmail: whatever you write to us is stored there. All four rest on the European Commission’s Standard Contractual Clauses, and on each provider’s own certification where it applies.

Children

BeeLucy is for adults. Accounts are for people aged 18 or over, and the app is neither directed at children nor designed to appeal to them.

A baby’s name and date of birth are information about a child, and we treat them as what they are: entered by a caregiver, about their own child, for their own use. The child has no account, and we never collect anything from a child directly. If you believe a child has created an account, email us and we will delete it.

How long we keep it

• Your account and profile: until you delete your account.
• Log entries and activity types: for as long as the baby record exists. An entry belongs to the record rather than to whoever typed it, so if you leave a record or delete your account, entries stay but stop being attributed to you.
• The baby record: until its owner deletes it, which permanently removes every entry and activity type on it, for every caregiver at once.
• Push tokens: until you sign out, turn notifications off, or Apple or Google tell us the app has been uninstalled.
• Join requests: until the owner answers, or you withdraw the request.
• Feature ideas: until we no longer need them, and never longer than your account.
• Premium purchase records: for as long as your account exists. After that, only what accounting and tax law requires us to keep, for as long as it requires.
• Email you send us: while your question is open, and afterwards only for as long as the thread is still good for something — a bug report until the bug is fixed, say. What no longer has a reason to be there gets deleted.
• Deletion feedback: up to 24 months, unattached to any account.
• Backups: our database provider keeps encrypted backups on a rolling basis, so a copy of deleted data can persist there for up to 30 days before it is overwritten.

Deleting your account

In the app: Settings → Account → Delete my account. It is permanent, it runs immediately, and it removes your sign-in identity, your profile, your caregiver memberships, your notification preferences, your push tokens, your feature ideas, and your purchase record at RevenueCat. Entries you logged remain on the baby record without your name on them, so the other caregivers keep the history they rely on.

Deleting your account does not cancel a Premium subscription: the app store bills it, not us. Cancel it in the store first — on Android, Google Play → Payments & subscriptions → Subscriptions.

If you own a baby record that other caregivers share, deletion asks you to deal with it first — open Baby details and either hand ownership to one of them or delete the record. This is deliberate: deleting a shared record erases everyone’s history, and it should never happen as a side effect of closing your own account. A record only you care for is different: no account would be left that could open it, so it is deleted with your account, along with everything logged on it. The app names each such record before you confirm.

If you have already removed the app, email hello@beelucy.com from the address you signed in with and we will delete the account for you.

Your rights

Under the GDPR you may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent you may withdraw it at any time. Exercising any of these costs nothing and we will answer within one month.

Much of it you can do yourself: Account edits your profile, Baby details edits the record, any entry can be changed or deleted, and Delete my account does what it says. For anything else, email hello@beelucy.com. If you think we have handled your data badly, please tell us first — and you have the right to complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, Vilnius, ada.lt) regardless of what we say.

Security

Everything travels over encrypted connections. The database enforces row-level security, so the credentials in your copy of the app can only ever reach records you are a member of — the rule is applied by the database itself rather than by the app asking nicely. The app carries no administrative key; account deletion runs server-side for exactly that reason.

No service can promise perfect security, and we will not pretend otherwise. If a breach ever puts your rights at risk, we will tell the supervisory authority within 72 hours and tell you without undue delay.

Changes to this policy

If we change it, we update the date at the top. If a change materially affects you — new data, a new recipient, a new purpose — we will tell you in the app before it takes effect, and ask again for consent where consent is what it rests on.