Privacy policy

Last updated 28 September 2026

Rosa ("Rosa", "we", "our", "us") is a baby and feeding tracker app. This policy explains what data we collect, why, and what rights you have over it.

1. Who we are

Rosa is developed and operated by an independent developer, Max Page, based in the United Kingdom. If you have questions about this policy or your data, contact us at rosababytracker@gmail.com.

2. Data we collect

Account information. When you sign in with Apple or Google, we receive your email address and a unique account identifier. We do not offer or store passwords. Authentication is handled by Apple or Google and our backend provider, Supabase.

Tracking data you enter. Feeds, sleep sessions, nappy changes, pumping sessions, growth measurements, milestones, vaccination records, foods tried and allergen introductions, sleep training plans, and any notes you add. This data relates to your child, and is entered by you or a caregiver you've invited.

Caregiver sharing data. If you invite a partner, family member or other caregiver to share a baby's tracker, we store the invite and which caregivers have access to which baby's data.

Purchase data. If you subscribe or buy Lifetime access, Apple or Google processes your payment directly, and we never see your card details. We receive purchase status and entitlement information from Apple or Google through our payments provider, RevenueCat.

Push notification data. If you allow notifications, we store a device push token linked to your account so we can deliver reminders (for example feed or nap reminders) through Firebase Cloud Messaging. You can turn reminders off at any time in Settings.

Diagnostic and usage data. We use Firebase Analytics and Firebase Crashlytics to understand how the app is used and to diagnose crashes. This includes device type, app version, crash logs and anonymised interaction events (for example, which screens are opened). This data is not linked to your name or email.

3. How we use your data

We do not use your data for advertising, and we do not sell your data to anyone.

Our legal basis for processing. We process your account and tracking data because it is necessary to provide the service you've signed up for (performance of a contract). We process diagnostic and usage data (crash logs and anonymised interaction events) on the basis of our legitimate interests in keeping Rosa reliable and improving it, balanced against your right to privacy. This data is not linked to your name or email. Where we rely on your consent (for example, optional notifications), you can withdraw it at any time in Settings.

4. Who we share data with

We share data only with the service providers needed to run Rosa:

We do not sell data to third parties, and we do not share it with advertisers or data brokers.

5. Children's data

Rosa is designed for parents, guardians and caregivers to track information about their child. Rosa is not directed at children, and children are not expected to create their own accounts or use the app. The data we hold about a child (feeds, sleep, growth, vaccinations and so on) is entered and controlled entirely by the adult account holder and the caregivers they invite.

US users and COPPA. Rosa is not directed to children under 13 within the meaning of the US Children's Online Privacy Protection Act (COPPA). Account creation requires an adult (verified through Apple or Google sign-in), and a child never interacts with Rosa or creates an account of their own. A parent or caregiver enters and controls all information about the child. We do not knowingly collect personal information directly from a child.

6. Data retention and deletion

You can delete your account at any time from Settings. Deleting your account removes your profile and, where you are the sole owner of a baby's tracker, that baby's tracking data. For trackers shared with other caregivers, a short grace period applies to prevent accidental data loss. You can also email rosababytracker@gmail.com to request deletion.

7. Your rights

Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact rosababytracker@gmail.com.

8. US state privacy rights and health data

If you live in California, Virginia, Colorado, Connecticut, Washington or another US state with its own privacy law, you may have additional rights, including the right to know what personal data we hold about you, the right to delete it, and the right to opt out of the sale or "sharing" of your data. We do not sell your data, and we have never shared it for cross-context behavioural advertising, so there is nothing to opt out of. To exercise any state privacy right, contact rosababytracker@gmail.com.

Some of the information you log in Rosa, such as feeds, sleep, growth and vaccinations, may qualify as "consumer health data" under state laws such as Washington's My Health My Data Act. By creating a Rosa account and using the app to log this information, you consent to our collecting and processing it as described in this policy, solely to provide the tracking and sharing features you use Rosa for. We do not sell consumer health data, share it for advertising, or use geofencing around health facilities.

9. Security

We use industry-standard measures to protect your data, including encryption in transit and row-level security policies on our database that restrict access to the caregivers you've explicitly invited to a baby's tracker.

10. International data transfers

Your account and tracking data is stored on Supabase infrastructure in the European Union (Paris, France). Some of our other service providers, Firebase and RevenueCat, are based in the United States and may process limited data (such as diagnostic logs or purchase status) there. Where that happens, it is protected by appropriate safeguards, such as the EU-US Data Privacy Framework or Standard Contractual Clauses, as applicable to each provider.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll tell you in the app or by email.

12. Contact

Questions about this policy or your data: rosababytracker@gmail.com