Bubu — Privacy Policy

Last updated: 3 August 2026

This Privacy Policy explains how Bubu ("we", "us", the "App") collects, uses, stores, and protects your information, and the rights you have under the EU General Data Protection Regulation (GDPR) and similar laws.

1. Who is responsible for your data (Data Controller)

The data controller is:

Yair Ben Hamo — an individual app developer
Based in: Romania
Contact email: bubu.support@gmail.com

If you have any questions about this policy or your data, contact us at the email above.

2. What data we collect

Account information (about you, the parent/caregiver):

First and last name
Email address
Phone number (optional)
Caregiver role

Baby tracking information (entered by you, about your child):

Feeding (bottle, breast, solids), diapers, sleep
Temperature, symptoms, and medications
Growth measurements (weight, height, head circumference) and WHO percentile data
Milestones and notes
Photos you add to the album
Documents you scan and store (e.g. prescriptions, medical records)

Technical information:

A Firebase authentication identifier
Basic diagnostic/error information needed to run the service
Usage and analytics data — screen views and in-app events (for example, when a log is saved), collected via Google Analytics for Firebase to understand how the App is used so we can improve it. We do not use advertising identifiers (no IDFA) and do not use this data for advertising.

We do not sell your data, and we do not use your or your child's data for advertising.

3. Children's data

Bubu is designed for adults (18+) to record information about their own children. Children do not create accounts or use the App themselves. By creating an account you confirm you are at least 18 years old and are the parent or authorised caregiver of the child whose data you enter.

Because this data concerns a child's health, we treat it as a special category of personal data under GDPR and apply heightened protection. Our legal basis for processing it is your explicit consent, given when you create your account and enter data.

4. Why we process your data (legal bases)

Purpose	Legal basis (GDPR Art. 6 / 9)
Creating and securing your account	Performance of a contract
Storing and syncing your tracking data	Your explicit consent
Sharing data with family members you invite	Your explicit consent
Keeping the service running and fixing errors	Legitimate interests
Product analytics — screen views and in-app feature events (e.g. "log saved"), via Google Analytics for Firebase; no health-data values are sent, and no advertising	Legitimate interests (Art. 6(1)(f)) — to understand usage and improve the App. You can opt out at any time in Settings → Data & Backup
Processing payments for Premium	Performance of a contract

You can withdraw consent at any time by deleting your data or your account (see Section 8).

Family members you invite. When you share a family, the caregivers you invite can see the baby data in that family. You control who is invited and can remove them.
Service providers (processors):
- Google Firebase (Authentication, Firestore database, Cloud Storage, Cloud Functions, and Google Analytics for Firebase) — hosts your account and data and provides in-app usage analytics on our behalf. See Google's privacy terms.
- Apple — processes Premium subscription payments via the App Store. We never see your card details.
Legal requirements. We may disclose data if required by law.

We do not share your data with any other third parties.

6. Where your data is stored and international transfers

Your data is stored on Google Firebase infrastructure. Your logged records — feeding, sleep, diapers, growth measurements, medications, milestones, and family information — are stored in the European Union (Google Cloud's Frankfurt, Germany region). The photos and scanned documents you add, and certain background processing, currently take place on Google Cloud servers in the United States. Any processing that occurs outside the EU/EEA is protected by appropriate safeguards, namely Google's Standard Contractual Clauses and the EU–US Data Privacy Framework.

7. How long we keep your data

We keep your data for as long as your account is active. When you delete your data or account, it is removed from our live systems promptly. Backups, if any, are purged on a rolling basis.

8. Your rights

Under GDPR you have the right to:

Access your data — view it in the App at any time.
Portability / export — export your data as CSV/PDF from Settings → Data & Backup.
Rectification — edit or correct any entry directly in the App.
Erasure ("right to be forgotten") — delete your account and all associated data from Settings → Account → Delete Account. This permanently removes your account, your baby data, and the families you solely own.
Withdraw consent — by deleting data or your account.
Object / restrict — contact us at the email in Section 1.
Complain to your local data protection authority.

We respond to rights requests within 30 days.

9. Security

We protect your data with:

Encrypted connections (TLS) between the App and our servers.
Firebase Authentication for access control.
Access rules restricting data to you and the family members you invite.

No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of children's health data.

10. Changes to this policy

We may update this policy. Material changes will be notified in the App. The "Last updated" date at the top shows the latest revision.

11. Contact

Questions or requests: bubu.support@gmail.com