Privacy Policy

Status: FIRST DRAFT. This policy is served with the live web product. Consent capture and self-serve export/delete are built, but ICO registration, legal review and the marked operational items remain outstanding. It is not a completed compliance assessment.

Last updated: 2026-09-19

Who we are

feed·tracker is provided by Phil Smith, trading as feed·tracker, a sole trader (70 Pattingham Drive, Tamworth, B77 4RR, United Kingdom). For data protection purposes, this makes Phil Smith the data controller for the personal data described below.

ICO registration number: [ICO registration number — pending].

What we collect

Account data, for the adult who creates the family account:

Email address
Password — stored only as a salted cryptographic hash, never in plain text, and never visible to us in a form we could read back

Feeding and growth data, logged by either parent/carer on a shared family account:

Bottle feed timestamps and amounts (ml)
Weight readings and their dates
Any optional free-text notes attached to a feed
An optional child profile name and date of birth, entered by caregivers to identify the shared log

Technical data, generated automatically to keep the service secure and functional:

Server and access logs, which include IP addresses, timestamps, and the page or API route requested. These exist to run the service securely — spotting abuse, rate-limit enforcement, troubleshooting faults — not to build a profile of you. Retained for 3 days then discarded (Cloudflare's fixed retention on our current plan; if we ever upgrade to a plan with configurable log retention, this window may extend, and this policy will be updated to match before that happens rather than after).

If you are signed in and the connection drops while you save a feed, sleep session, diaper event, or pumping entry, the app may keep that pending entry (timestamp, amount or activity kind, optional note and timer details) in the browser or native WebView's on-device storage until the server confirms it. This is normally IndexedDB, with local storage as a compatibility fallback. It is kept under the signed-in account's local namespace, is not a backup or a second copy of your history, and is removed after successful synchronisation. Do not use this recovery feature on a shared or public device. If on-device storage is cleared before reconnection, the pending entry cannot be recovered.

Support correspondence, if you email us: whatever you send us, kept for 12 months.

We do not collect advertising identifiers and there is no tracking SDK anywhere in the app itself. Our public marketing page (before you sign in) uses Cloudflare Web Analytics — cookieless, with no cross-site or cross-device identifiers, measuring only that a visit happened and roughly where from. It is not present anywhere past sign-in: nothing about your use of the app, your baby's data, or your account is ever measured by it.

About the baby's data, specifically

The account holder is an adult parent or carer. The feed and weight data logged on the account is about your baby, who is not the account holder and never logs in themself. They are nonetheless a real, identifiable person about whom this service holds health-adjacent information — and we treat it with the same care and the same consent standard as UK GDPR Article 9 special-category health data, whether or not that classification turns out to apply precisely as the account is structured. (There's a genuine, unresolved legal nuance here — covered in the DPIA — about whether data that identifies a family's baby, on an account held by their parent, counts as special-category data about the parent or a different classification about the baby. We are not asserting a firm legal conclusion; we are choosing to meet the higher bar regardless.)

Concretely, that means:

We ask for your explicit, freestanding consent to store feed and weight information about your baby before any of it is collected — a separate, specific choice at account setup, not bundled into accepting the Terms of Service.
That consent is evidenced (we record that it was given, and when) and withdrawable at any time — withdrawing it means deleting the account and its data, since the service cannot function for a family without logging its feeds.
The consenting adult is the parent or carer creating the account, consenting on behalf of their baby, who cannot consent for themself.

The app presents a separate, unticked data-consent checkbox at account creation:

I consent to this app storing feeding and weight data about my child.

The app also presents its not-a-medical-device statement alongside account creation. The final legal wording remains subject to review.

Why we process it (lawful basis)

Account data — necessary to perform our contract with you (Art. 6(1)(b)): we can't run a login without an email and a password.
Feed and weight data — your explicit consent (Art. 9(2)(a)-standard, per above), which you can withdraw at any time by deleting your account.
Technical/server logs — our legitimate interest in keeping the service secure and working (Art. 6(1)(f)), limited to what's needed for that and kept only briefly.
Support correspondence — legitimate interest in resolving your query, or contract performance where the query concerns the service you've bought.

Where it's stored

Data is stored in Cloudflare D1, provisioned in Cloudflare's WEUR (Western Europe) region. Cloudflare acts as our data processor for hosting — it stores the data on our behalf and under our instructions, not its own.

Cloudflare's Data Processing Addendum has been accepted for this account, covering the international transfer safeguards (Standard Contractual Clauses) needed for any processing that occurs outside the UK/EEA as part of Cloudflare's global network.

Payment is handled entirely by Stripe — we never receive or store your card details.

Cookies

The service uses a single session cookie to keep you signed in (a random token, HttpOnly, Secure, SameSite=None; only a hash of it is stored on our side). This is strictly necessary for the service to work at all, so under UK PECR rules it doesn't need a cookie-consent banner, and we don't show one. There are no advertising or analytics cookies.

Who else sees it

Nobody, beyond:

Cloudflare, as our hosting processor (above), and for the cookieless visit analytics described above on the public marketing page only.
Stripe, as merchant of record for payment (Stripe Managed Payments) — they handle your card details and the applicable sales tax/VAT directly; we never see or store your card details, only that a payment was made.
Resend, to send the password-reset email if you request one — they see the email address a reset was requested for, nothing else about your account or your baby's data.

We do not sell data and do not share it for advertising.

Retention

While your account is active: feed and weight data is kept for as long as your family account exists, so you can see your baby's history.
On deletion: your account and its primary data record are deleted from the live database immediately.
Backups: this service is backed up nightly so a system fault doesn't lose your log. That means a deleted account's data can persist in a backup for a limited window after deletion before it is purged in turn. Production backup retention is configured as a 90-day R2 lifecycle rule; the release is held until that rule has been applied and verified.

Shared family accounts

An account is shared between two adults (e.g. both parents). Both can see, add to, and edit the same log. Practically, that means:

Either account holder can export the full shared log.
Either account holder can delete the account — doing so deletes the data for both, since it is one shared record, not two.
There's no way to remove one partner's access while keeping the other's; the account is a single shared unit by design (mirroring how the live app already works for its own two users).

Your rights

Under UK GDPR, you can:

Access the data we hold about your account — in practice, everything you've logged is already visible to you in the app.
Export your data yourself, at any time, from within the app, in a portable format.
Delete your account and its data yourself, at any time, from within the app (subject to the backup window above). If you cannot sign in, use the account deletion instructions.
Rectify anything wrong — edit any feed, weight, or note directly.
Withdraw consent for the health-adjacent data described above, which in practice means deleting the account, since the app can't function without it.
Object to processing based on legitimate interest (the technical logs above), or ask us to restrict it.
Complain to the ICO if you're unhappy with how we've handled your data — see ico.org.uk. We'd appreciate the chance to sort it out directly first, at the contact below.

Children

This service is for adults to log data about their baby. Account holders must be adults; the service is not directed at children as users. Babies are data subjects whose data is processed here, but never users of the app themselves. See the DPIA (dpia-draft.md) for the open question about how the ICO's Children's Code and the US FTC's COPPA framework apply to this specific pattern — parent-operated, child as data subject — which remains genuinely unresolved and needs legal input before this draft is finalised or a native store release is made.

Changes to this policy

We'll post updates here with a new "last updated" date. Material changes — anything that changes what we collect or why — will be flagged in-app, not just posted quietly.

Contact us

For any question about your data, or to exercise a right listed above: feedtracker@outlook.com