What happens in your family stays in your family.

01Who we are

The PapaKoala app and papakoala.com are run by Samuel Martín, in Spain, who is the data controller. For any privacy question, write to [email protected].

02What you keep in the app

Everything you enter is stored on your device:

• Each child's profile: name, date of birth or due date, weeks of gestation, sex and a photo if you add one.
• The daily log: sleep, feeds (breast, bottle, pumping and solids), diapers or potty, floor play and growth.
• Health: temperature, medicine, teeth, foods tried, allergens and possible reactions, appointments and vaccines.
• Memories: completed activities, milestones, first words and notes.

On iPhone and iPad this data syncs with the private database of your iCloud account (Apple CloudKit), so it comes with you if you change devices. On Android it's included in your Google account backup. Only you have access; we can't see it.

PDF report

The pediatrician report is created on your device. It only leaves it if you choose to share it (by message, email or AirDrop, for example); we don't receive it.

Reminders, widgets and the Lock Screen

Reminders (naps, appointments, vaccines) are local notifications scheduled by your device. Widgets, Control Center and live timers read data from the device itself. Other people can see the Lock Screen; you can turn these off in your phone's Settings.

03Purchases and subscriptions

Payments are handled by Apple (App Store) or Google (Google Play). We use RevenueCat to know whether your subscription or one-time purchase is active, through an anonymous identifier created by the app. We never see or store your payment details. If you found the app through an Apple ad on the App Store, Apple tells us via RevenueCat which campaign the download came from, with no data that identifies you and no cross-app tracking.

04Usage analytics

We use PostHog, hosted in the European Union, to understand how the app is used: which screens and features are opened, for example. Events are sent through our own domain (data.papakoala.com) and are tied to a random identifier, to RevenueCat's anonymous identifier and to your access type (free, subscription, one-time purchase or school).

They never include names, emails, photos or your baby's health data. We don't use them for advertising, don't combine them with other companies' data and don't track you across apps. You can turn analytics off at any time: on iPhone, in Settings › PapaKoala › Share usage data; on Android, in Profile › Usage data.

05Activity ratings

When you finish an activity you can rate it. If you do, we receive the activity, your rating (and the reason, if negative), the baby's age in months, the device language, the platform and the app version. If the rating is negative, you can add a short comment: please leave out names and health details; we delete it after 6 months. It includes no identifier of you or your device. We use it only to improve the activities.

06This website

papakoala.com doesn't use Google Analytics, social media pixels or tracking cookies, and needs no cookie banner. The site is served through Cloudflare, which processes the technical data strictly needed for security (such as the IP address).

07Providers

We work with these providers, which process data only to deliver their service to us:

• Apple iCloud and App Store (iOS): sync and payments. Apple's policy.
• Google Play and Google backup (Android): payments and backup. Google's policy.
• RevenueCat (US): subscription status. RevenueCat's policy.
• Stripe (EU and US): payments from schools and organizations. Stripe's policy.
• Resend (US): emails to schools and organizations. Resend's policy.
• Notion (US) and Google Workspace or Gmail: the list of and emails to business contacts. Notion's policy.
• Zoho Mail (EU): the first email to business contacts. Zoho's policy.
• PostHog (EU): usage analytics. PostHog's policy.
• Cloudflare: hosting of this website, delivery of analytics, activity ratings the center's usage data in School Mode and the redemption of codes from organizations. Cloudflare's policy.

08School Mode

If your childcare center gave you a PapaKoala code, the app sends anonymous usage data to our servers so the center can see aggregated metrics for its families.

When that stage ends, or if the center's license is paused or its code changes, the app stops giving full access and tells you why. It keeps the code in case the center renews, and everything you have logged stays on your phone.

Its processing is part of the service the center contracts with PapaKoala; for questions about its use, you can also contact the center.

09Codes from organizations

If your employer has given you a PapaKoala code, when you redeem it the app sends our servers the code, a random device identifier, the platform (iPhone or Android) and the app version. We also keep the day you redeemed it, the day your access ends and the last day the app checked the code. They're used only so the code works on your phone until its end date.

We don't send what you do in the app, your language or anything about your baby. The organization that gave you the code only knows how many codes in its batch have been redeemed: not who redeemed them or how you use the app.

Twelve months after your access ends, we delete the device identifier, platform, version and last check. If you write to us to free up your code because you've changed phones, we use your email only to reply.

10Organizations that contact us or buy codes

When an organization writes to us through the website form or buys codes from us, we process its contact person's details: name, email, organization, sector, country and whatever they tell us. If it buys, also its billing details and its acceptance of the terms (name, date and IP address).

We use them to reply, prepare the proposal, fulfil the contract and meet our tax obligations. Payments are handled by Stripe and emails are sent with Resend. If there's no purchase, we delete these details 24 months after the organization wrote to us; if there is, we keep them for 6 years after the last order, as commercial law requires.

Business contacts we write to

To introduce PapaKoala to companies as a benefit for their staff, we look up in public sources (the company's website, press releases, published reports and public professional profiles) the name and role of the person in charge of benefits or human resources and, only if it's published, their work email. We note where each piece of data comes from. We don't buy lists or guess email addresses.

We do this on the basis of our legitimate interest in introducing a business service to the person who handles it at work, and only for that conversation. We keep the list in Notion, send the first email from Zoho Mail and continue the conversation in Gmail. If there's no reply, we delete the details after 12 months. If you ask us not to write again, we won't, and we keep only your name, email and the date so we can respect that. You can exercise your rights by writing to [email protected].

11Legal bases and retention

• Purchases. To provide the service you've signed up for. Kept while you have access and for the periods required by law.
• Analytics and ratings. Based on our legitimate interest in improving the app, with minimal data that doesn't identify you. You can turn analytics off (on iPhone, in Settings › PapaKoala; on Android, in Profile › Usage data) or object by writing to us. Kept for as long as needed to analyze usage, then deleted.
• School Mode. To provide the service contracted by the center. Kept while the license is active and for up to 12 months after; then deleted or permanently aggregated.
• Codes from organizations. To give you the access you ask for when you redeem the code. Kept while your access lasts and for 12 months after; then only the redemption and end dates remain, with nothing linking them to you.
• Organizations. To handle their request (pre-contractual steps), fulfil the contract and meet tax obligations. Retention in section 10.
• Business contacts. Legitimate interest in introducing a business service to the person who handles it. 12 months without a reply; opt-outs, for as long as we need to respect them.
• Emails you send us. To reply to you. Kept for the duration of the conversation and the legally required periods.

We don't make automated decisions that affect you or build profiles for advertising.

12International transfers

Some providers, such as RevenueCat, Cloudflare, Stripe, Resend, Notion and Google, may process data outside the European Economic Area, mainly in the US. They do so with the safeguards required by the GDPR: the EU-US Data Privacy Framework or standard contractual clauses.

13Your rights

Because your family's data is on your device and in your cloud, you control it directly:

• Access and portability. Everything is in the app, and you can export the PDF report.
• Correction. Edit or delete any entry in the app.
• Deletion. Delete the app and, if you wish, its iCloud data (Settings › your name › iCloud › Manage Storage) or your Google backup.

For the data we do process (purchases, analytics, School Mode and codes from organizations), you can exercise your rights of access, correction, deletion, objection, restriction and portability by writing to [email protected]. You can also lodge a complaint with the Spanish Data Protection Agency or your local authority.

14Children and health

PapaKoala is meant for parents and guardians, not for children. Information about the baby is entered by their family and stays under its control.

PapaKoala offers information and a personal log. It isn't a medical device, doesn't diagnose and doesn't replace your pediatrician. Health guidance in the app always shows its source.

15Changes

If we change this policy, we'll publish the new version here with its date and, if the change is meaningful, tell you in the app.