Privacy policy

The short version

• We keep what you type into Burp Baby about your baby and your household, plus the few technical details needed to run the service safely.
• If you sign in with a username, we also keep your email address and your username, and your password only as a one-way hash, never the password itself. We use your email address to run your login and to write to you about it (and, rarely, about an important change to this service or these policies), never for marketing.
• We do not sell your information. We do not share it for advertising. Burp Baby has no ads and no advertising or analytics trackers.
• The people in your household can see your household’s records. Nobody else can, except us when it is truly needed to run, secure or support the service.
• You can remove any entry from view yourself, and you can ask us to delete your whole household or to erase an entry for good.
• Burp Baby is a record-keeping tool. It is not a health care provider and it does not give medical advice.

Who we are and who this is for

Burp Baby is operated from Texas, United States, by Burp Baby (“we”, “us”). You can reach us at hello@burp.baby.

Burp Baby is for adults. To create or hold an account you must be at least 18 years old. The information about a baby in Burp Baby is entered by a parent, guardian or other adult caregiver. It is not meant for children to use.

What we collect

What you give us

• Household and people. A household name, and for each person a first name or nickname, a role (admin or caregiver) and a language choice. A household that signs in with the keypad also has a sign-in code, and each of its people a four-digit PIN. We store a PIN only as a one-way hash, never as the digits themselves. When everyone in a household has moved to their own login and PIN sign-in ends, we keep the old PIN hashes for 30 days, so PIN sign-in can be turned back on, and may then erase them. We also keep the time each person last signed in; admins can see it on the People screen.
• Your login, if you sign in with a username and password instead of a household code and PIN: your email address, the username you choose, the name you want shown (a first name or nickname is enough) and your password. We keep the password only as a one-way hash, made with Argon2id (or bcrypt, on a server that cannot run Argon2id) and a secret key that is kept outside the database. We never keep the password itself, so we cannot see it or tell you what it is. With your login we also keep the language you chose, when you confirmed your email address, when you last changed your password or username, when you last signed in, and which version of the terms you agreed to when you created the login, and when. If you change your username, we hold your old one for you for 30 days, so that nobody else can take it straight away.
• A sign-up that is not finished. When you sign up with a username, nothing is created until you confirm your email address. Until then, your answers (about your baby, your household and your login, with the password already turned into its hash) wait with the confirmation link we email you, for about 24 hours.
• An invitation by email. When an admin of a household invites someone by email, we keep the address they typed, the role and the language they chose for the invitation, which household it is for and who sent it, so that we can send the invitation and recognise it when it is opened. Its link is kept only as a one-way hash. The person invited chooses their own username and password when they accept.
• Your baby. A name, a birth date or due date, and optionally the baby’s sex.
• Entries you log. Feeds, diapers, sleep, medicines and doses, temperature readings and illness episodes, weight, length and head measurements, baths, vaccine records, contractions and hospital-bag checklists, with the time, who logged it, and any notes you type.
• Photos of vaccine records. Only if you choose to add them. A photo is stored exactly as your phone sends it, so it keeps whatever your phone embedded in it, such as the date it was taken, the phone model and, if your camera saves it, where it was taken. Only signed-in members of your household can open it.
• A pediatrician’s phone number, only if you add one. It is used for the call button on an urgent temperature warning and nothing else.
• Settings and a change log. Your choices (units, reminders, language, theme, colour) and a short log of who added, changed or removed what, and when each person signs in or out. The app uses it to keep everyone’s phone up to date and to show who added each entry.

What is collected as you use it

• Sign-in details. A session cookie and, if you choose to stay signed in (the box is ticked by default), a “remember me” cookie with a random token (we store only a hash of it), and a short label for the device, such as “iPhone · Safari”.
• Sign-in attempts. The network (IP) address and time of sign-in attempts, so we can stop people guessing PINs.
• Attempt counts for the username forms. To stop people guessing passwords or flooding the sign-up, sign-in, password and email forms, we count recent attempts. Each count keeps only the time and a keyed one-way fingerprint of the network address, email address, username or login it is about, not the address or name itself.
• Emails we send. A record of each email: which kind of email it was, its language, when it was sent, whether it was delivered, and a keyed one-way fingerprint of the address. If an email to an address bounces for good, or its reader marks it as spam, we keep that address on a do-not-email list.
• Notification details. The reminders and alerts we queue for the people in your household, whether or not phone notifications are on, and, if you turn on notifications on a device, an address for that device issued by Apple, Google or Mozilla (web), or by Apple (the iPhone app).
• On your iPhone. The iPhone app keeps a device token in your phone’s Keychain. In storage on your phone it keeps your babies’ names (so Siri and the buttons can ask which baby), the button presses that are waiting to be sent, and any it could not save (which button and when), the last button you pressed (so you can undo it), and the last answer about whether the baby is asleep. The buttons, Siri and notification actions run only on an unlocked iPhone: from a locked iPhone they ask for Face ID or your passcode first. We keep a record of each phone signed in to the iPhone app: its name, which baby it shows, the notification addresses Apple issued for it, which features of the app it supports, and when it was last used. For each button press we keep which phone, which person, which baby, which button, what came of it and when, for about 90 days. A clean-up that runs when your household next uses the buttons removes older ones, so some can stay for longer.
• Server logs. Our hosting provider’s servers record routine technical details of each request (such as IP address, browser type, page and time) for security and troubleshooting.

What we do not collect

We do not ask for or use your location, and we do not collect your contacts or advertising identifiers. To create a login we do not ask for your phone number, your own date of birth, your home address or any payment details, and we never keep your password itself. We do not use advertising or analytics trackers, and the public pages of this website (the home page, this policy, the terms and the support page) load nothing from other companies and add no cookies of their own.

How we use it

• To run Burp Baby: to show your log to the people in your household, keep their phones in sync, work out times and reminders, and send the notifications you turn on.
• To run your login, if you have one: to sign you in, to find your login when you ask to reset your password, and to email you what it needs. That is a link to confirm your email address, a welcome, a link to reset your password (which also reminds you of your username), a link to confirm a new email address, and a notice when your password or your username changes, or when someone asks to move your login to a new email address (that notice goes to your current address). If someone tries to sign up with an address that already has a login, we email that address to say so. Rarely, we may also write to you about an important change to this service or to these policies (see “Changes to this policy”). We do not send newsletters or marketing email.
• To keep it secure: to limit PIN and password guessing, prevent abuse and fix faults.
• To help you: to answer support messages and, at your request, export or delete your information.
• To meet legal obligations.

We do not use your information for advertising, we do not sell it, and we do not use it to make automated decisions about you.

Who can see it

• Your household. Everyone with an account in your household can see and change the household’s records. Admins can add and switch off people.
• Us. We run the service and can technically reach the data. We do not look at a household’s records unless it is needed to run, secure or support the service, to do what you asked, or to meet a legal duty.
• Companies that help us run it (“service providers”), who may handle data only for us and only for that purpose:
  • Hosting and storage: GoDaddy
  • Email delivery, for the emails described above: Resend. It receives the address and the content of each email, including its link and, where the email shows it, your username, so that it can deliver it. Our emails never carry your password or your baby’s details.
  • Payments, if and when paid plans begin: [TBD: payment provider]
  • Notifications: for the iPhone app, the text of each reminder is sent through Apple’s push notification service to your phone, so Apple can technically read it. That text can include a medicine’s name and dose, a temperature reading, a vaccine’s name, your baby’s name if you have more than one baby, and the first name of a caregiver who added an entry. The quiet updates that tell you another caregiver logged something say only who logged what (for example “Alex logged a wet diaper”): never an amount, a time, a medicine or a temperature. Web notifications carry no text: your browser’s push service (Apple, Google or Mozilla) only learns that a notification was sent, and the words are fetched from our server by your browser.
  • Icons and fonts for the sign-in screen and the app: both load their icon font from Cloudflare’s cdnjs service. If you use the optional vaccine-card reader, it loads a text-recognition library from jsDelivr. These services can see your IP address and browser details when your device fetches those files. The photo itself is read on your own device and is not sent to them.
• Legal and safety. We may disclose information if the law requires it, or if it is needed to protect someone’s safety or our rights. If the service is ever transferred to someone else, your information would move with it, and we would tell you first.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

Where it is kept and how it is protected

Your information is kept on servers run by our hosting provider (GoDaddy). It travels between your device and the service over an encrypted connection (HTTPS).

What we do to protect it:

• PINs and “remember me” tokens are stored only as one-way hashes. Passwords are stored only as slow one-way hashes made with a secret key that is kept outside the database.
• Every household’s records are kept separate, and every request is checked against the household you are signed in to.
• Repeated wrong PINs are slowed and then paused. Repeated wrong passwords, and repeated use of the sign-up, password and email forms, are refused for a while.
• The links in our emails that confirm an email address or reset a password work once, and only for a limited time: 24 hours to confirm an address, 60 minutes to reset a password.
• Vaccine record photos are kept in a folder that cannot be opened by a web address, and are shown only to signed-in members of your household.

No system is perfectly secure. A four-digit PIN is convenient, especially at 3am, but it is not strong. Please keep your devices locked, share your PIN only with people in your household, and use Settings to switch off anyone who should no longer have access. If you sign in with a username, use a password you do not use anywhere else, and keep it, and your email account, to yourself. If we learn of a breach that affects your information, we will tell the people affected and the authorities as the law requires.

How long we keep it

• Your household’s records stay until you ask us to delete your household. When you delete an entry it disappears from your screens, but we keep the removed entry, and a short note of who removed it and what it was, until your household is deleted. A baby you archive is hidden, not deleted: its history is kept the same way. To have a single entry erased permanently, email us.
• If you ask us to delete your household, we delete it, the records and photos in it, and the logins of its people, within 30 days of confirming the request is yours. Copies in our provider’s backups roll off on the provider’s schedule ([TBD: backup retention period]).
• If your household’s owner deletes it in the app (Settings, under Your data, once that is available), the owner chooses when: in 14 days, during which any admin can keep the household, or right away. Then its records, photos and downloads are deleted, and so are the logins of its people who belong to no other household. We keep only a short record that the deletion happened (dates and numbers, no names) and the household’s old code, so that code is never given to another family.
• Your login (your username, email address, password hash and the details kept with them) stays until you ask us to delete it or your household. After you change your username, your old one stays held for you for 30 days, and is then released.
• A sign-up that is not finished is kept for about 24 hours. Your answers, your email address and the password hash are cleared the moment you confirm your email address. If you never confirm, they are cleared when the link expires, 24 hours after you send us your answers, by a clean-up that runs every few minutes. Asking for the email again does not make that time longer.
• Email links (to confirm a sign-up or a new email address, or to reset a password): what a link carries is cleared when it is used or expires. A record of the link, holding only a keyed fingerprint of the address, is deleted 7 days after the link expires.
• Invitations by email: the address typed for an invitation is erased the moment the invitation is used or cancelled, or when it expires, 7 days after it was last sent. An invitation nobody used is then deleted a week after it expired; one that was used is kept, without the address, as the record of who joined the household through it.
• Attempt counts for the username forms are kept for 2 days, and the count of username changes for 31 days, because the limit on username changes is counted over 30 days.
• Emails wait in our queue until they are sent, for at most a day. Once an email is sent, or we give up on it, its address and content are erased from the queue, and the short record described above is kept for about 30 days. An address on the do-not-email list stays there until we remove it by hand, also after its household is deleted, because that list is what stops us writing to it again. Our email provider keeps its own delivery logs for as long as its policy says.
• Sign-in attempt records (the network address and time): the failed attempts from an address are deleted the next time someone signs in successfully from that same address. Any record that is not cleared that way, such as a successful sign-in or a failed attempt from an address that never signs in, is kept for at least 30 days. An occasional clean-up removes the ones older than that, so some can stay for longer.
• Notifications we have sent are kept until you have received and seen them, then for about 30 days.
• The change log is kept for about 13 months, except the notes about removed entries described above, which are kept until your household is deleted.
• “Remember me” sign-ins last about a year, and the year starts again each time the app uses one to sign you back in. They end sooner if you sign out of that device or an admin removes or switches off that person.
• Notification registrations stay until you turn notifications off, remove the device, or the service tells us the device is gone.
• Button-press records (which phone, which person, which baby, which button, what came of it, when) are kept for about 90 days. A clean-up that runs when your household next uses the buttons removes older ones, so some can stay for longer.
• Server logs are kept by our hosting provider for as long as its policy says ([TBD: log retention period]).

Your choices and rights

• You can edit or delete any entry in the app, archive a baby (the history is kept until you ask us to delete it), remove a person (their name stays on the change-log lines they wrote), change your PIN, and turn notifications off. If you sign in with a username, you can change your password, your email address and your username in Settings, under Account.
• Once it is available, Settings, under Your data, also lets an admin download everything the household recorded as one file, and lets you delete your login (or, if you sign in with a PIN, leave the household). Each asks for your password or PIN again first.
• You can ask us for a copy of your household’s information, ask us to correct it, or ask us to delete it. Email us and tell us your household’s name. We will confirm that the request comes from someone in the household, usually by checking with an admin, before we act. If you sign in with a username, you can also ask us to delete your login: write from the email address on your login, or tell us your username, and we will confirm by writing to that address. If you are the only person in your household, deleting your login also deletes your household and everything in it, as described under “How long we keep it”.
• We will answer within 45 days. If we cannot do what you ask, we will tell you why. You may reply to ask us to reconsider, and Texas residents may also contact the Texas Attorney General.
• We offer these choices to everyone, wherever you live, and we will not treat you differently for using them.

Children’s information

Burp Baby holds information about babies, but it is a service for adults. A baby’s information is entered by a parent, guardian or caregiver who is at least 18. We do not direct Burp Baby to children, we do not knowingly collect information from a child under 13, and accounts are for adults. If you think a child has given us information, tell us and we will delete it.

A parent or guardian can review, correct and delete their child’s entries in the app, and can ask us to delete the child’s profile and everything else by writing to us.

Health information and medical advice

What you record about a baby can be health information, and we treat it with care. Burp Baby is not a doctor, a hospital or a health plan, and is not covered by HIPAA. It does not give medical advice, does not suggest medicines or doses, and does not diagnose an illness. If you are worried about your baby, call your pediatrician. In an emergency, call your local emergency number.

Notifications

Push notifications to your phone are off until you turn them on. Reminders for your household, such as a dose that is due, are also kept in each person’s in-app notification list whether or not push is on. Notifications are reminders and alerts such as a dose that is due, a temperature to retake, a long gap since the last feed, or an entry another caregiver added. They can include your baby’s name and a short summary, and your phone may show them on the lock screen unless you hide previews. Quiet updates (no sound, no screen wake) tell you that another caregiver logged a feed, a diaper or a sleep; you can turn them off in Settings. More generally, you can turn notifications off in Burp Baby’s Settings or in your phone’s settings at any time.

Cookies and storage on your device

• This website’s public pages add no cookies of their own and load nothing from other companies. If you are already signed in, they only keep the sign-in cookies described below up to date.
• Signing in sets a session cookie, and “keep me signed in” sets a longer “remember me” cookie. Both are needed to keep you signed in and are not used for tracking. The page where you sign in or sign up with a username also sets a security cookie that lasts an hour, to check that each form was sent from that page.
• On your device the app keeps a few preferences and conveniences so it opens quickly: your household code and name, your theme and colour, and the last medicine you used. The contraction timer also keeps the contractions you time on your device. Those are cleared after about two days (longer if they could not be sent to us), and signing out does not clear them. If you sign in with a username, the app also notes that on your device, so that it can offer you the username form. While you sign up, the page keeps your answers and your sign-up link in that browser tab, never your password, so that reloading the page does not lose them; they go when you finish, start over or close the tab. If you open a link to confirm a new email address, the page keeps that link in that browser tab too, so that you can sign in first and then confirm.
• There are no advertising or analytics cookies.

Changes to this policy

If we change this policy we will update the date at the top. If a change matters to you, for example a new way we use your information, we will tell you in the app or by email before it takes effect.

Contact us

Questions, requests and complaints: hello@burp.baby.

Mailing address: [TBD: mailing address]