Privacy Policy

Baby Gains B.V. ("Baby Gains", "we", "us", "our") operates BabyGains Play ("the App"), a gamified daily-movement app for children aged 0–8. The parent or guardian ("you") creates and manages the account; children interact with the movement routines under your supervision.

This Privacy Policy applies to:

• The iOS and Android app (BabyGains Play)
• The web preview at babygains-play.vercel.app
• All associated services

We comply with the EU General Data Protection Regulation (GDPR), the Dutch Uitvoeringswet AVG (UAVG), the US Children's Online Privacy Protection Act (COPPA), and California's CCPA/CPRA where applicable.

Data Controller: Baby Gains B.V.
Address: Roordastraat 41, 2035SB Haarlem, Netherlands
KvK: 95567380
Contact: privacy@babygains.nl

Primary user: the parent or guardian aged 18+ who creates the account.
Child users: children aged 0–8 who use the app under your direct supervision.

Under Dutch law (UAVG / GDPR Article 8), children under 16 cannot give valid consent for data processing. We require a parent or guardian to accept this policy and create the account on behalf of the family.

Under US law (COPPA), we do not knowingly collect personal information directly from children under 13. All data is collected from and attributed to the parent account.

Account data (parent / guardian):

• Email address (required for account creation)
• Display name (optional)
• Password (hashed by Supabase Auth — bcrypt; never seen by us)
• Country / region (inferred from store; not explicitly collected)

Child-profile data (created by the parent):

• Child's first name or nickname (optional)
• Child's age range (bucket only — not full date of birth)
• Avatar selection (emoji/icon)

Usage data:

• Routine completion records (exercises completed, date, duration)
• Streak count, badges, milestone history
• App theme preference (Parent / Day / Kids)
• Push notification consent status

Technical data:

• Device type and OS version (Sentry crash reporter)
• App version, session identifiers (non-advertising)
• Crash reports and performance logs (Sentry)

AI Coach & AI Plan data (optional feature):

• The text messages you type to the AI Coach
• A short context summary built on our server from your child's profile: first name, age group, the latest height and weight you have logged (if any), and progress stats (current streak, total sessions, GAINS points, badges earned)
• All of the above is transmitted to Anthropic, Inc. (USA) via our coach Supabase Edge Function to generate the response. The Anthropic API key never leaves our servers.
• Explicit consent required before first use (see Section 8)
• Disable at any time in Settings → AI Coach

Community & Family Circle data (optional feature):

• Community Wins: short, text-only milestone posts shown in a public feed (no photos)
• Family Circle: text and photos you share privately with the family members you invite
• Reactions and comments you add to posts

Analytics data (PostHog):

• Product-usage events only — which screens and features are used, counts and durations
• Tied to a non-advertising account identifier; never your child's name, birthdate, or photos
• Processed by PostHog on EU servers (eu.i.posthog.com); no cross-app tracking, no advertising ID
• You can switch analytics off at any time in Settings → Privacy

Payment data:

• We do not process payment-card data directly
• Purchases handled by Apple App Store or Google Play Store (or Stripe on web)
• RevenueCat receives a purchase token to verify subscription status
• We store only: purchase status (Premium / Free), purchase date, platform

We do not use your data for advertising. We do not sell your data. We do notuse advertising SDKs. Our only analytics is privacy-friendly, EU-hosted product analytics (PostHog) that you can switch off in Settings; it never includes your child's name, birthdate, or photos.

We do not share data with advertising networks, data brokers, or any third party for their own commercial purposes. Our analytics provider (PostHog) processes usage events on EU servers solely on our behalf as a processor, never for its own purposes.

Baby Gains B.V. is based in the Netherlands (EU). Our service providers are predominantly US-based. We rely on the EU-US Data Privacy Framework certification where the processor is certified (Anthropic and Supabase are certified at the time of writing) and on Standard Contractual Clauses (SCCs) approved by the European Commission for any uncertified transfers, as required by GDPR Chapter V.

• Account / child profile / usage: until account deletion + 30 days
• Crash reports: 90 days (Sentry default)
• AI Coach messages: not stored by us after response; Anthropic per their policy
• Tribe posts: until deleted by you or until account deletion
• Purchase records: 7 years (Dutch tax-law obligation)

The AI Coach (and AI Plan) feature sends your typed messages and a short summary of your child's profile (first name, age group, latest logged height/weight, and progress stats) to Anthropic, Inc. to generate responses. This is a third-party AI service. See Section 3 for the exact fields.

Before you use the AI Coach for the first time, we show a consent screen explaining:

• That your messages and your child's profile summary go to Anthropic
• What Anthropic may do with that data
• You're chatting with AI, not a human
• How to disable the feature

You can withdraw consent and disable the AI Coach at any time: Settings → AI Coach → Disable.

Anthropic's privacy policy: anthropic.com/privacy

As a data subject (and on behalf of your child) you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — delete your account and all associated data
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format (Settings → Export my data)
• Object — object to processing based on legitimate interest
• Withdraw consent — for any consent-based processing

To exercise any of these rights: privacy@babygains.nl. We respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl.

COPPA (parents of children under 13).You may review the personal information we have collected from your child's profile, request deletion, and refuse further collection or use. Contact: privacy@babygains.nl.

CCPA / CPRA (California residents). We do notsell your personal information. You have the right to access, correct, delete, and limit the use of your personal information. We will not discriminate against you for exercising your rights. We don't run a "Do Not Sell or Share My Personal Information" link because we don't sell or share for cross-context behavioural advertising — if that changes, this section will be updated.

You can delete your account and all associated data at any time: Profile → Delete Account in the app.

This permanently removes:

• Your email address and password
• All child profiles
• All progress, streaks, and badges
• All Tribe posts you created

Deletion completes within 30 days. Purchase records are retained for 7 years per Dutch tax law.

• Supabase Row Level Security (RLS) — your data is only accessible by you
• TLS / HTTPS for all data in transit
• Hashed passwords (Supabase Auth — bcrypt)
• Anthropic API key never leaves our servers — Coach calls go through a Supabase Edge Function that requires your authenticated session
• Sentry data is transmitted over HTTPS

• The account is created by and controlled by a parent or guardian
• We collect only what is necessary to run the app
• We do not show advertising to children
• We do not use advertising SDKs
• We do not collect precise location data
• We do not collect biometric data
• Children's data is not shared with third parties for commercial purposes
• Parents can delete all data at any time

We send optional push notifications for:

• Daily routine reminders ("Time for your 5 minutes!")
• Streak milestones

You can enable or disable notifications at any time in Settings → Notifications, or via the iOS / Android system settings.

The app does not use advertising cookies or tracking pixels. The web preview (babygains-play.vercel.app) uses no third-party tracking. We do not participate in cross-app tracking (NSPrivacyTracking = false).

We notify you of material changes via in-app notification or email. The date at the top of this document shows the last update. Continued use of the app after changes constitutes acceptance.

Baby Gains B.V.
Roordastraat 41, 2035SB Haarlem, Netherlands
KvK: 95567380
Email: privacy@babygains.nl

Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl · +31 88 1805 250