Privacy and consumer health data
The short version
- Only you and the people you invite can see a child’s record. Records are never public and never indexed by search engines.
- We don’t sell, rent or share personal or health information. There are no ads, no advertising or social-media pixels and no third-party trackers.
- You can export everything as CSV and JSON, and deleting a child or your account removes the data from our database.
- Charts and checklist explanations come from written rules, not from AI models run on your child’s data.
What we collect
From you, when you create an account
Your name (or what you’d like to be called), your email address and a password, which we store only as a salted hash. You confirm that you are 18 or older.
What you add to a child’s record
The child’s name or nickname, the sex used on growth charts, birth date, gestational age at birth and a multiples flag; measurements (weight, length or height, head circumference) with dates, where they were taken and any notes; milestone checklist answers; visit questions; checkup reports; products you register for Recall Watch; and the people you invite to the family circle, with their role.
From people you invite
Their account details (as above), and whatever they add to a record you shared with them as an editor. Every change to the circle is logged and visible to the record’s owner.
When you use the site
A session cookie keeps you signed in (it holds a random token; we store only a fingerprint of it) and expires after 60 days. Our own first-party analytics count page views and feature use without cookies: they record the page, the referring site, device type, browser, operating system and country, an anonymous visitor ID kept in your browser’s local storage and a session ID kept in session storage. Your IP address is not stored; a daily-rotating salted hash of it is used to rate-limit and count unique visits. Analytics never include your email, a child’s name, birth date, measurements or any record identifier. We also log visits by search-engine crawlers.
If you contact us
What you write in the contact form, your email address and a hashed network identifier used to stop spam.
How we use it
Only to run the service you asked for: to show the record back to you and your circle, compute percentiles and checkpoint dates, prepare checkup reports, match registered products against CPSC and NHTSA recalls, send the emails you opted into (the weekly email is off unless you turn it on; recall alerts can be turned off), keep accounts secure, answer your messages and understand, in aggregate, which features are used. We do not use your child’s data to train AI models, to target advertising or to build profiles about you.
Sharing
We share a record only with the people you invite, at the level you choose (editor or viewer), for the children you pick. You can revoke an invite or remove a person at any time.
We do not sell personal information or consumer health data, and we do not share it with advertisers, data brokers, analytics companies or lead-generation partners. Like any website, we rely on service providers to run it: the company that hosts our servers and, when email delivery is switched on, an email-sending service that receives the recipient address and the message. They process data only to provide those services to us.
We will disclose information if the law requires it, for example under a valid court order, and we will tell you if we are allowed to.
Consumer health data policy (Washington and other states)
This section is our consumer health data privacy policy under Washington’s My Health My Data Act (RCW 19.373) and similar state laws. It applies to everyone, wherever they live.
Categories of consumer health data we collect
- Body measurements of a child: weight, length or height, head circumference, with dates.
- Gestational age at birth (which shows whether a child was born early) and birth date.
- Developmental information: answers to CDC milestone checklists (Yes, Not yet, Not sure).
- Health-related notes and questions you write for doctor visits, and checkup reports built from the above.
- Products registered for safety-recall alerts, which can reveal a child’s age or stage.
Sources
All of it comes from you or from someone you invited as an editor. We do not buy or receive health data from anyone else.
Purposes
To provide the record features described above. We ask for your consent to collect this data before you save the first entry, separately from creating an account, and we store when you gave it.
Sharing and selling
We do not sell consumer health data and will not do so. We share it only with people you invite to a child’s circle and with the service providers described above, which process it on our behalf. We have no affiliates that receive it.
Your rights
You can confirm whether we hold your consumer health data and see it (it is all in the app, and in the Export download), get a list of the people and service providers we have shared it with, withdraw your consent (Settings), and have it deleted (delete a child, or your whole account). If we decline a request, you can appeal by replying through the contact form with the word “appeal”; we will answer within 45 days, and Washington residents may contact the Washington State Attorney General if they disagree with our decision.
Your rights, wherever you live
- Access and portability: Export downloads everything you own as CSV and JSON.
- Correction: edit or delete any entry in the record.
- Deletion: delete a child from that child’s Settings tab, or your account from Account settings.
- Withdraw consent: in Settings. Existing records stay until you delete them, and you can’t add new health data until you consent again.
- Email: every email has a pause link and an unsubscribe link, and you can change preferences in Settings.
For anything else, use the contact form. We answer requests within 45 days and don’t charge for them.
Keeping and deleting
We keep a record for as long as your account exists. When you delete a child, we delete that child’s measurements, answers, questions, reports, registered products, circle memberships and activity log from our database at once. When you delete your account, we delete your account and every record you own the same way; records other people own that you were invited to are not affected, but your access ends. Server backups may hold a copy for a limited time until they are overwritten; we never restore deleted records from them except to recover from a system failure. Contact-form messages are kept until the request is resolved.
Children
Accounts are for adults: you must be 18 or older to create one. Children do not use childow themselves, and we do not knowingly collect personal information directly from children under 13. Information about a child is entered by a parent, guardian or someone they invited. If you believe a child has created an account, tell us and we will delete it.
Security
Connections are encrypted. Passwords are stored as salted hashes, sign-in sessions as fingerprints of random tokens, and invite links as fingerprints of 256-bit random tokens that expire and can be revoked. Every page and request that touches a record checks that you are allowed to see it. The admin console runs on a separate address and administrators see counts, not the contents of records. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.
Changes and contact
If we change this policy in a way that affects how health data is used or shared, we will ask for your consent again before the change applies to your data. Questions or requests: use the contact form. See also our pledge and terms.