Baby Bondly
Privacy Policy

Last updated: 1 November 2026

This policy explains what data the Baby Bondly app, provided by Kadim Studios, processes and why, who can see it, and how you stay in control. It is also our information notice under the EU General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law (KVKK).

In short

• We don't sell your data. There are no ads and no advertising trackers in the app.
• We process pregnancy and baby health details only with your explicit consent.
• Our database is hosted in the European Union (Belgium).
• Only the people in your family space that you choose can see what you share.
• You can delete your account and data at any time.

Who we are

The controller of your personal data is Kadim Studios (“we”). Contact: azadbilek34@gmail.com

What we process and why

• Account: your name, email address and user ID; if you sign in with Apple or Google, the name, email and account ID they share with us. Your password is managed by Firebase Authentication and is never visible to us. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• Family space: your role (mom, dad, partner or relative), your membership of the family space and invite code use. Basis: contract (Art. 6(1)(b)).
• Health data: due date and pregnancy week; your baby's birth date, feeding, sleep, diaper and growth (height, weight) logs; pregnancy notes, mood entries, and craving and baby-movement messages. If you calculate the due date from your last period, that date is only used on your device and is not stored. Basis: your explicit consent (GDPR Art. 9(2)(a), KVKK Art. 6).
• Memories: photos (e.g. ultrasound images), letters, notes and voice notes you add. Basis: contract; explicit consent where they contain health data.
• Consent and preferences: the consents you give, with date and text version, and your notification settings. Basis: our legal obligation to demonstrate consent (Art. 6(1)(c)).
• Technical data: a device token to deliver notifications, app and OS version, and security records such as failed invite-code attempts. Basis: contract and our legitimate interest in keeping the service secure (Art. 6(1)(b), (f)).
• Subscription: plan, subscription status, dates and store transaction ID. We never receive your card details; the App Store or Google Play takes the payment. Basis: contract (Art. 6(1)(b)).
• Marketing: news and offers only if you opt in. Basis: consent (Art. 6(1)(a)).

Who can see your content

• Care logs and notifications: only the parents in the family space.
• Memories: you choose for each one: “Only me”, “With my partner” or “With extended family”. Relatives only see memories shared with extended family.
• Us: only as far as needed to run the service, fix security issues or answer your requests.

Notifications

If you allow it, we send notifications for your partner's cravings, kicks and “I'm here” messages, and for reminders. To do this we store your device's notification token. You can turn notifications off in your phone's settings at any time.

AI features

Voice care logs, suggestions and memory summaries use Google's Gemini API. When you use them, only the content needed for that request (e.g. your voice note) is sent to Google. Transcribing voice notes with AI requires your separate, optional consent. We use the Gemini API under paid terms, under which your content is not used to train Google's models. AI output can be wrong and is not medical advice.

Service providers and locations

• Google Firebase (authentication, database, server functions, file storage, notifications): database and server functions run in the EU (Belgium); authentication and notifications may be processed in other countries.
• Google Gemini API: AI features.
• RevenueCat (USA): subscription validation. It receives an ID linked to your account and the plan, status and dates reported by the store, never your email or health data.
• Apple and Google: sign-in and payments, as independent controllers under their own policies.

Where data leaves the EU/EEA or Turkey, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where applicable, and the standard contracts required under KVKK Art. 9.

Security

Data is encrypted in transit and at rest. Server-side access rules make sure each item can only be read by authorized family members. Family creation and invite codes are handled only on our servers.

Retention and deletion

We keep your data while your account exists. You can delete your account in Settings › Delete my account; your data is deleted within 30 days. Content you added is deleted; content your partner added stays with their account. Your baby's shared profile is kept while at least one parent remains; when the last parent deletes their account, the whole family space is deleted. Uninstalling the app does not delete your data. If you can't access the app, see Delete your account. We keep consent records for as long as needed to prove consent.

Age

Baby Bondly is for users aged 18 and over. Information about the baby is entered by their parents.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time (in Settings › Privacy or by writing to us) without affecting earlier processing. Write to azadbilek34@gmail.com from the email address registered in the app; we reply within one month. You may also complain to your data protection authority, for example the Spanish Agencia Española de Protección de Datos (AEPD) or, in Turkey, the Personal Data Protection Authority (KVKK).

Changes

When this policy changes we update this page and its date, and announce important changes in the app. We ask for your consent again for any new processing that requires it.

Contact

Kadim Studios · azadbilek34@gmail.com