PapaKoala ES · EN Back to home
Privacy

What happens in your family stays in your family.

PapaKoala is designed so you don't have to trust us with your baby's data: it lives on your device and in your own cloud, not on our servers.

Last updated: October 6, 20268-minute read

No accountWe don't ask for an email, a password or your name.
In your cloudYour iPhone and your iCloud, or your Android and your Google backup.
We don't sell dataEver. No ads in the app or on this website.
Minimal analyticsWhich features are used, with a random identifier. No health or personal data.

01Who we are

The PapaKoala app and papakoala.com are run by Samuel Martín, in Spain, who is the data controller. For any privacy question, write to [email protected].

02What you keep in the app

Everything you enter is stored on your device:

  • Each child's profile: name, date of birth or due date, weeks of gestation, sex and a photo if you add one.
  • The daily log: sleep, feeds (breast, bottle, pumping and solids), diapers or potty, floor play and growth.
  • Health: temperature, medicine, teeth, foods tried, allergens and possible reactions, appointments and vaccines.
  • Memories: completed activities, milestones, first words and notes.

On iPhone and iPad this data syncs with the private database of your iCloud account (Apple CloudKit), so it comes with you if you change devices. On Android it's included in your Google account backup. Only you have access; we can't see it.

Health data. Your baby's sleep, feeds, temperature, medicine, allergens or growth are never sent to our servers or our analytics tools. We don't process them: you keep them, on your device and in your cloud.

PDF report

The pediatrician report is created on your device. It only leaves it if you choose to share it (by message, email or AirDrop, for example); we don't receive it.

Reminders, widgets and the Lock Screen

Reminders (naps, appointments, vaccines) are local notifications scheduled by your device. Widgets, Control Center and live timers read data from the device itself. Other people can see the Lock Screen; you can turn these off in your phone's Settings.

03Purchases and subscriptions

Payments are handled by Apple (App Store) or Google (Google Play). We use RevenueCat to know whether your subscription or one-time purchase is active, through an anonymous identifier created by the app. We never see or store your payment details. If you found the app through an Apple ad on the App Store, Apple tells us via RevenueCat which campaign the download came from, with no data that identifies you and no cross-app tracking.

04Usage analytics

We use PostHog, hosted in the European Union, to understand how the app is used: which screens and features are opened, for example. Events are sent through our own domain (data.papakoala.com) and are tied to a random identifier, to RevenueCat's anonymous identifier and to your access type (free, subscription, one-time purchase or school).

They never include names, emails, photos or your baby's health data. We don't use them for advertising, don't combine them with other companies' data and don't track you across apps. You can turn analytics off at any time: on iPhone, in Settings › PapaKoala › Share usage data; on Android, in Profile › Usage data.

05Activity ratings

When you finish an activity you can rate it. If you do, we receive the activity, your rating (and the reason, if negative), the baby's age in months, the device language, the platform and the app version. It includes no identifier of you or your device. We use it only to improve the activities.

06This website

papakoala.com doesn't use Google Analytics, social media pixels or tracking cookies, and needs no cookie banner. The site is served through Cloudflare, which processes the technical data strictly needed for security (such as the IP address).

07Providers

We work with these providers, which process data only to deliver their service to us:

08School Mode

If your childcare center gave you a PapaKoala code, the app sends anonymous usage data to our servers so the center can see aggregated metrics for its families.

What is sent

  • A random device identifier, created when the app is installed.
  • The center's code.
  • The date your youngest child's stage at the center ends: the day before the school year starts in the year they turn 3. Your phone works it out; their date of birth never leaves it.
  • When you open the app in School Mode.
  • Which activities you complete: their identifier and stage.
  • The app version, the operating system and its version, and the phone's language.

What is never sent

  • Your name, email or anything that identifies you.
  • Your baby's name, photo or date of birth.
  • Their daily log or health data.
  • Your location or your notes.

When that stage ends, or if the center's license is paused or its code changes, the app stops giving full access and tells you why. It keeps the code in case the center renews, and everything you have logged stays on your phone.

Its processing is part of the service the center contracts with PapaKoala; for questions about its use, you can also contact the center.

09Legal bases and retention

  • Purchases. To provide the service you've signed up for. Kept while you have access and for the periods required by law.
  • Analytics and ratings. Based on our legitimate interest in improving the app, with minimal data that doesn't identify you. You can turn analytics off (on iPhone, in Settings › PapaKoala; on Android, in Profile › Usage data) or object by writing to us. Kept for as long as needed to analyze usage, then deleted.
  • School Mode. To provide the service contracted by the center. Kept while the license is active and for up to 12 months after; then deleted or permanently aggregated.
  • Emails you send us. To reply to you. Kept for the duration of the conversation and the legally required periods.

We don't make automated decisions that affect you or build profiles for advertising.

10International transfers

Some providers, such as RevenueCat and Cloudflare, may process data outside the European Economic Area, mainly in the US. They do so with the safeguards required by the GDPR: the EU-US Data Privacy Framework or standard contractual clauses.

11Your rights

Because your family's data is on your device and in your cloud, you control it directly:

  • Access and portability. Everything is in the app, and you can export the PDF report.
  • Correction. Edit or delete any entry in the app.
  • Deletion. Delete the app and, if you wish, its iCloud data (Settings › your name › iCloud › Manage Storage) or your Google backup.

For the data we do process (purchases, analytics and School Mode), you can exercise your rights of access, correction, deletion, objection, restriction and portability by writing to [email protected]. You can also lodge a complaint with the Spanish Data Protection Agency or your local authority.

12Children and health

PapaKoala is meant for parents and guardians, not for children. Information about the baby is entered by their family and stays under its control.

PapaKoala offers information and a personal log. It isn't a medical device, doesn't diagnose and doesn't replace your pediatrician. Health guidance in the app always shows its source.

13Changes

If we change this policy, we'll publish the new version here with its date and, if the change is meaningful, tell you in the app.