Privacy Policy

1. Data Controller

Sema Medryk, operating as Twinkle Baby (“we,” “our,” “us”), is the data controller responsible for your personal data. Sema Medryk is a sole-proprietorship company registered in Türkiye. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our mobile application and related services.

By using Twinkle Baby, you acknowledge that you have read and understood this Privacy Policy. We are committed to protecting your privacy and your baby’s data with the highest standards of care.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address (required)
• Name (optional)
• Password (securely hashed — we never store it in plain text)
• Authentication provider (email, Apple Sign-In, or Google Sign-In)

If you sign in with Apple or Google, we receive a limited profile (email address and, optionally, your name) from those services. We also receive a provider-specific user identifier. We do not receive or store your Apple or Google password.

2.2 Baby Profile Data

You provide the following about your child:

• Baby’s name, gender, and date of birth
• Due date and expecting status (for pregnancy tracking)
• Premature birth indicator and birth week (for corrected-age calculations)
• Blood type
• Known allergies, food likes, and dislikes
• Health conditions (free-text notes)

2.3 Health & Growth Data

Measurements and health observations you enter, including:

• Weight, length/height, and head circumference
• Body temperature, heart rate, and respiratory rate
• Symptoms and medical alerts
• Allergy introduction tracking and reaction status

2.4 Daily Routine Logs

• Feeding: breast, bottle, and solid food sessions (amounts, duration, food items)
• Sleep: nap and night sleep duration, interruptions, restlessness
• Diaper: change frequency, consistency, color, rash observations
• Medicine: name, dosage, and timing
• Emotions & Activities: mood tracking, tummy time, play activities

2.5 Vaccine & Supplement Records

• Immunization schedules and completed vaccines
• Supplement names, dosages, and schedules

2.6 Notes & Task Checklists

Personal notes, journal entries, and daily task checklists you create within the app.

2.7 Device & Technical Information

• Device type and operating system version
• App version
• A device-level subscription identifier (for managing your subscription status)

We do not collect your location, contacts, photos (unless you attach them), or browsing history.

2.8 Family Sync Data

If you use the Family Sync feature, we store the sharing invitation codes, the roles assigned (parent or caregiver), and the email addresses of invited users to facilitate access management.

3. How We Use Your Data

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases under GDPR Article 6(1):

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw consent by deleting your account or contacting us at privacy@twinkle.baby.

5. AI-Powered Features

Twinkle Baby offers optional AI-powered summaries (feeding insights, sleep analysis, and doctor visit preparation reports) as a premium feature. When you use these features:

• What is sent: Aggregated, statistical summaries of your baby’s feeding, sleep, diaper, health, growth, emotion, activity, and vaccine data for the selected time period. Your baby’s first name, age, and gender may also be included for context.
• Service provider: We use the Google Gemini API to process these summaries.
• Data retention by the AI provider: Requests are processed in real time and are not used by Google to train or improve their AI models. No baby data is persistently stored by the AI provider beyond transient processing.
• No raw data is sent: We send computed statistics (averages, counts, percentages), not individual log entries.

6. Data Sharing & Third Parties

We share data only in the following limited circumstances:

6.1 Family Members (Your Choice)

Baby data is shared only with caregivers you explicitly invite through the Family Sync feature. You control who has access and can revoke it at any time.

6.2 Service Providers

We use trusted third-party service providers who process data on our behalf:

These providers process data under strict contractual obligations (data processing agreements) and do not have independent rights to use your data.

6.3 Legal Requirements

We may disclose information if required by law, such as in response to a court order, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

7. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States. Our service providers (Google, RevenueCat, MongoDB) operate infrastructure globally.

For EEA/UK users: When we transfer personal data outside the EEA/UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The EU-US Data Privacy Framework, where applicable
• Adequacy decisions by the European Commission for transfers to countries with recognized data protection standards

You may request a copy of the safeguards we use by contacting us at privacy@twinkle.baby.

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in Transit: All communication between your device and our servers uses TLS (Transport Layer Security) encryption.
• Password Security: Passwords are hashed using bcrypt with a high work factor. We never store passwords in plain text.
• Authentication: We use JSON Web Tokens (JWT) with expiration and OAuth 2.0 for social login.
• Access Controls: Role-based access ensures users can only access baby data they have been authorized to view (admin, parent, or caregiver roles).
• Rate Limiting: API endpoints are protected by rate limiting to prevent abuse.
• Input Validation: User input is validated and sanitized using schema validation.
• Secure Local Storage: Authentication tokens on your device are stored using platform-secure mechanisms (iOS Keychain / Android Keystore).

While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Data Retention

When you delete your account, all personal data, baby profiles, health records, logs, and notes are permanently deleted from our servers. Backup copies are purged within 90 days. If you remove a baby profile, all data associated with that profile is permanently deleted.

10. Your Privacy Rights — EEA / UK (GDPR)

If you are in the European Economic Area or the United Kingdom, you have the following rights:

• Right of Access (Art. 15) — Obtain confirmation of whether we process your data and request a copy.
• Right to Rectification (Art. 16) — Correct inaccurate or incomplete data. You can edit your data directly in the app at any time.
• Right to Erasure (Art. 17) — Request deletion of your personal data. You can delete your account from the app settings, which triggers full cascading deletion.
• Right to Restrict Processing (Art. 18) — Request that we limit how we use your data in certain circumstances.
• Right to Data Portability (Art. 20) — Receive your data in a structured, commonly used, machine-readable format. You can export baby health reports as PDF from the app.
• Right to Object (Art. 21) — Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3)) — Withdraw your consent at any time without affecting the lawfulness of prior processing.
• Right Not to Be Subject to Automated Decision-Making (Art. 22) — Our AI features provide informational summaries only; no automated decisions with legal or similarly significant effects are made about you.
• Right to Lodge a Complaint — You have the right to lodge a complaint with your local supervisory authority if you believe your data protection rights have been violated.

To exercise any of these rights, contact us at privacy@twinkle.baby. We will respond within 30 days (extendable by 60 days for complex requests).

11. Your Privacy Rights — United States

Depending on your state of residence, you may have additional privacy rights under laws such as the California Consumer Privacy Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and other state privacy laws.

Your Rights May Include:

• Right to Know / Access — Request the categories and specific pieces of personal information we have collected about you in the preceding 12 months.
• Right to Delete — Request deletion of personal information we have collected. You can also delete your account directly from the app settings.
• Right to Correct — Request correction of inaccurate personal information.
• Right to Opt-Out of Sale / Sharing — We do not sell or share your personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Information — We use sensitive personal information (health data) only to provide the core service you requested.
• Right to Non-Discrimination — We will not discriminate against you for exercising your privacy rights.
• Right to Appeal — If we deny your request, you have the right to appeal. Contact us and we will review your request.

Categories of Personal Information Collected (Preceding 12 Months)

To exercise your rights, contact us at privacy@twinkle.baby. We will verify your identity and respond within 45 days (extendable by an additional 45 days for complex requests).

12. Children’s Privacy

Twinkle Baby is designed for parents and caregivers, not for children to use directly. Our app is not directed at children under 13 (or under 16 in the EEA), and we do not knowingly collect personal information from children.

The baby data entered in the app is provided by the parent or authorized caregiver acting on behalf of the child. This data is used solely for the purpose of tracking the child’s development and health, at the direction of the parent.

If you believe we have inadvertently collected information from a child, please contact us at privacy@twinkle.baby and we will promptly delete it.

13. Subscriptions & Payments

Payments are processed entirely by Apple (App Store) or Google (Google Play). We do not collect, store, or have access to your credit card numbers, bank account details, or other financial information.

We receive subscription status information (active/expired, expiry date) through RevenueCat, our subscription management partner. RevenueCat does not receive your baby’s health data.

Subscription management (cancellation, renewal) is handled through your Apple ID or Google Play account settings.

14. Do Not Sell or Share My Personal Information

Because we do not sell or share personal information as defined by the CCPA/CPRA, there is no need for an opt-out mechanism for sales. However, if you believe your data is being used in a manner inconsistent with this policy, please contact us immediately.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you through the app or via email before the changes take effect.

We encourage you to review this page periodically. The “Last updated” date at the top indicates when this policy was most recently revised.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.