Rosa ("Rosa", "we", "our", "us") is a baby and feeding tracker app. This policy explains what data we collect, why, and what rights you have over it.
Rosa is developed and operated by an independent developer, Max Page, based in the United Kingdom. If you have questions about this policy or your data, contact us at [SUPPORT EMAIL].
Account information. When you sign in with Apple or Google, we receive your email address and a unique account identifier. We do not offer or store passwords directly — authentication is handled by Apple/Google and our backend provider, Supabase.
Tracking data you enter. Feeds, sleep sessions, nappy changes, pumping sessions, growth measurements, milestones, vaccination records, and any notes you add. This data relates to your child, entered by you or a caregiver you've invited.
Caregiver sharing data. If you invite a partner, family member, or other caregiver to share a baby's tracker, we store the invite relationship and which caregivers have access to which baby's data.
Purchase data. If you subscribe or buy Lifetime access, Apple processes your payment directly — we never see your card details. We receive purchase status and entitlement information from Apple via our payments provider, RevenueCat.
Diagnostic and usage data. We use Firebase Analytics and Firebase Crashlytics to understand how the app is used and to diagnose crashes. This includes device type, app version, crash logs, and anonymised interaction events (e.g. which screens are opened). This data is not linked to your name or email.
We do not use your data for advertising, and we do not sell your data to anyone.
We share data only with the service providers needed to run Rosa:
We do not sell data to third parties, and we do not share it with advertisers or data brokers.
Rosa is designed for use by parents, guardians, and caregivers to track information about their child. Rosa is not directed at children, and children are not expected to create their own accounts or use the app directly. The data we hold about a child (feeds, sleep, growth, vaccinations, etc.) is entered and controlled entirely by the adult account holder and caregivers they invite.
You can delete your account at any time from Settings. Deleting your account removes your profile and — where you are the sole owner of a baby's tracker — that baby's tracking data, subject to a short grace period to prevent accidental data loss for shared trackers with other caregivers. You can also contact us at [SUPPORT EMAIL] to request deletion.
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact [SUPPORT EMAIL].
We use industry-standard measures to protect your data, including encryption in transit and row-level security policies on our database that restrict access to only the caregivers you've explicitly invited to a baby's tracker.
Our service providers (Supabase, Firebase, RevenueCat) may process data outside your home country. Where this happens, it is done under those providers' own data protection safeguards.
We may update this policy from time to time. If we make material changes, we'll notify you in the app or by email.
Questions about this policy or your data: [SUPPORT EMAIL]