Rosa ("Rosa", "we", "our", "us") is a baby and feeding tracker app. This policy explains what data we collect, why, and what rights you have over it.
Rosa is developed and operated by an independent developer, Max Page, based in the United Kingdom. If you have questions about this policy or your data, contact us at rosababytracker@gmail.com.
Account information. When you sign in with Apple or Google, we receive your email address and a unique account identifier. We do not offer or store passwords directly — authentication is handled by Apple/Google and our backend provider, Supabase.
Tracking data you enter. Feeds, sleep sessions, nappy changes, pumping sessions, growth measurements, milestones, vaccination records, foods tried and allergen introductions, sleep training plans, and any notes you add. This data relates to your child, entered by you or a caregiver you've invited.
Caregiver sharing data. If you invite a partner, family member, or other caregiver to share a baby's tracker, we store the invite relationship and which caregivers have access to which baby's data.
Purchase data. If you subscribe or buy Lifetime access, Apple processes your payment directly — we never see your card details. We receive purchase status and entitlement information from Apple via our payments provider, RevenueCat.
Push notification data. If you allow notifications, we store a device push token linked to your account so we can deliver reminders (e.g. feed or nap reminders) via Firebase Cloud Messaging. You can turn reminders off at any time in Settings.
Diagnostic and usage data. We use Firebase Analytics and Firebase Crashlytics to understand how the app is used and to diagnose crashes. This includes device type, app version, crash logs, and anonymised interaction events (e.g. which screens are opened). This data is not linked to your name or email.
We do not use your data for advertising, and we do not sell your data to anyone.
Our legal basis for processing. We process your account and tracking data because it is necessary to provide the service you've signed up for (performance of a contract). We process diagnostic and usage data (crash logs, anonymised interaction events) on the basis of our legitimate interests in keeping Rosa reliable and improving it, balanced against your right to privacy — this data is not linked to your name or email. Where we ever rely on your consent (for example, optional notifications), you may withdraw it at any time in Settings.
We share data only with the service providers needed to run Rosa:
We do not sell data to third parties, and we do not share it with advertisers or data brokers.
Rosa is designed for use by parents, guardians, and caregivers to track information about their child. Rosa is not directed at children, and children are not expected to create their own accounts or use the app directly. The data we hold about a child (feeds, sleep, growth, vaccinations, etc.) is entered and controlled entirely by the adult account holder and caregivers they invite.
US users — COPPA. Rosa is not directed to children under 13 within the meaning of the US Children's Online Privacy Protection Act (COPPA). Account creation requires an adult (verified via Apple or Google sign-in), and a child never interacts with Rosa or creates an account of their own — a parent or caregiver enters and controls all information about the child. We do not knowingly collect personal information directly from a child.
You can delete your account at any time from Settings. Deleting your account removes your profile and — where you are the sole owner of a baby's tracker — that baby's tracking data, subject to a short grace period to prevent accidental data loss for shared trackers with other caregivers. You can also contact us at rosababytracker@gmail.com to request deletion.
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact rosababytracker@gmail.com.
If you live in California, Virginia, Colorado, Connecticut, Washington, or another US state with its own privacy law, you may have additional rights, including the right to know what personal data we hold about you, the right to delete it, and the right to opt out of the sale or "sharing" of your data. We do not sell your data, and we have never shared it for cross-context behavioural advertising — so there is nothing to opt out of. To exercise any state privacy right, contact rosababytracker@gmail.com.
Some of the information you log in Rosa — feeds, sleep, growth, vaccinations — may qualify as "consumer health data" under state laws such as Washington's My Health My Data Act. By creating a Rosa account and using the app to log this information, you consent to our collection and processing of it as described in this policy, solely to provide the tracking and sharing features you're using Rosa for. We do not sell consumer health data, share it for advertising, or use geofencing around health facilities.
We use industry-standard measures to protect your data, including encryption in transit and row-level security policies on our database that restrict access to only the caregivers you've explicitly invited to a baby's tracker.
Your account and tracking data is stored on Supabase infrastructure located in the European Union (Paris, France). Some of our other service providers — Firebase and RevenueCat — are based in the United States and may process limited data (such as diagnostic logs or purchase status) there. Where that happens, it is protected by appropriate safeguards, such as the EU-US Data Privacy Framework or Standard Contractual Clauses, as applicable to each provider.
We may update this policy from time to time. If we make material changes, we'll notify you in the app or by email.
Questions about this policy or your data: rosababytracker@gmail.com