Privacy Policy

The Service is operated by Patrick Engelkes (“BabySteps”, “we”, “us”), based in Germany. For the purposes of the EU General Data Protection Regulation (GDPR), we are the controller of the personal data described here. You can reach us about privacy at hello@ourbabysteps.com.

We collect what the app needs to work and nothing more. Your photos and videos are stored in a private bucket and are never publicly linkable — they are served only through links that expire within the hour. We do not sell your data. We do not show you ads. There is no analytics SDK, no advertising SDK, and no third-party tracker anywhere in the app.

Account information. Your name, email address, and — if you sign up with a password — a one-way cryptographic hash of that password. We never store the password itself. If you sign in with Apple or Google instead, we receive and store the identifier and email address they release to us; we do not receive your password. Optionally, a profile photo.

Family and children. Your family's name, who is in it, each member's role and relationship label (“Mom”, “Grandpa”, “Nanny / Caregiver”), the names of your journals, and for each child: their name, their birthday if you provide one, and their photo if you add one. A birthday is optional; it is used to show your child's age and to suggest which developmental firsts are typical around now.

The moments you save. Photos, videos, voice recordings, captions, the date you say a moment happened, an optional free-text place, the tags you apply, the albums it belongs to, whether you marked it a favourite, and whether you marked it a developmental first.

Timelapse series. The photos in each series, their dates, and any note you attach to a shot.

Device and preferences. A push notification token for each device you sign in on (so we can deliver notifications), your language preference, and your notification settings.

Technical data. Our servers process the usual request information — IP address, timestamps, and error diagnostics — in order to operate and secure the Service.

To provide the Service — storing and showing your moments, keeping your family in sync, and delivering notifications. Legal basis: performance of a contract with you (Art. 6(1)(b) GDPR).

To keep it secure and working — authentication, abuse prevention, backups, and diagnosing faults. Legal basis: our legitimate interests in a secure and reliable service (Art. 6(1)(f) GDPR).

To communicate with you — responding when you write to us. Legal basis: performance of a contract, and our legitimate interest in answering you.

We do not use your photos, videos, captions, or your child's information to train machine-learning models, and we do not use them for advertising or profiling.

We do not sell your personal data and we do not share it with advertisers. We use a small number of service providers (processors) who handle data on our instructions in order to run the Service:

• Railway — application hosting and the managed PostgreSQL database that holds your account, family, and moment records.
• Cloudflare R2 — the private object storage that holds your photos, videos, voice recordings, and profile pictures.
• Expo — delivery of push notifications to your device. The notification text (for example, who added a moment and for which child) passes through this service on its way to Apple's or Google's push infrastructure.
• Apple and Google — if you choose to sign in with them, and for delivering push notifications to your device.

We may also disclose data where we are legally required to, or where it is necessary to establish or defend legal claims.

BabySteps is built for sharing within one family of up to six people. It is important to understand what that means for visibility:

• Everyone in your family can read every journal in it. You choose who can add to each journal, not who can read it.
• When you save a moment you choose whether it is visible to everyone in the family, or only to the people on that particular journal.
• Anyone you give an invite code to can join your family and see what is in it. Codes are single-use and expire after seven days — treat them like a key.
• If you remove someone from your family they lose access going forward, but anything they added stays in the journal. The journal belongs to the family, not to the account that created each entry.

BabySteps is a service for adults. It is not directed at children, and children do not hold accounts. The information about a child in BabySteps — their name, birthday, and the photos, videos and recordings of them — is added by the adults in the family, and only ever shown to that family.

By adding a child's information you confirm you have the authority to do so. If you add photos or recordings of someone else's child, please make sure their parent or guardian is happy for you to.

We never make a child's data public, never use it for advertising, and never sell it.

Some things are worth stating plainly, because many apps in this category do them:

• No analytics or tracking SDKs. The app contains no analytics, crash-reporting, attribution, or advertising SDK. We do not track your behaviour in the app.
• No location tracking. The place on a moment is a free-text field you type yourself. The app does not read your GPS location and does not store coordinates.
• No public links. There is no way to publish a moment, an album, or a timelapse to the open web from BabySteps.
• No ads. There is no advertising in the app and no plan to add any.

To be equally plain about what our security is not: your media is stored encrypted at rest by our storage provider and served over encrypted connections, but it is not end-to-end encrypted. We hold the keys, which means we are technically capable of accessing stored files — we access them only when necessary to operate or fix the Service.

Our providers may process and store data outside the European Economic Area, including in the United States. Where that happens, the transfer is covered by the safeguards those providers offer — typically the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can ask us for details at hello@ourbabysteps.com.

We keep your account and the content in your family's journals for as long as your account exists, because the whole point of the Service is that your memories are still there in ten years. Sign-in sessions expire on their own. Invite codes expire after seven days. When you ask us to delete your account, see §12.

Under the GDPR you have the right to access your personal data, to have it corrected, to have it deleted, to restrict or object to its processing, and to receive it in a portable format. You also have the right to lodge a complaint with a supervisory authority in the EU member state where you live or work.

To exercise any of these rights, write to hello@ourbabysteps.com. We will respond within one month.

The app does not yet have a “delete my account” button — we are being upfront about that rather than implying otherwise. In the meantime, email hello@ourbabysteps.com from the address on your account and we will delete your account and your personal data.

One thing to know before you ask: a family's journals are shared. Deleting your account removes you and your personal data, but moments you contributed to a family that other members still use may remain in that family's journals, because they are also those members' memories. Tell us if you want your contributions removed as well and we will do that.

The same address works for a copy of your data if you would like one.

Passwords are stored only as a slow one-way hash. Traffic between the app and our servers is encrypted in transit. Your photos and videos upload directly from your phone into private object storage — the files never sit on our application servers on the way — using upload permissions that expire within minutes. They are read back only through signed links that expire within the hour, so a link that leaks is a link that stops working. The bucket has no public access.

No system is perfectly secure, but we take these measures seriously and will tell you promptly if a breach affects your data.

We may update this Policy as the app changes. When we do, we will change the “last updated” date above, and for significant changes we will let you know in the app.

Questions, requests, or concerns about privacy: hello@ourbabysteps.com. We read every message.