Privacy Policy

If you request access to a BabySteps beta, we process a separate and limited set of data to manage that request:

• the email address you will use for Google Play for an Android request;
• the requested platform and the page language;
• creation, update and, where applicable, withdrawal or closure timestamps;
• confirmation that you acknowledged the privacy notice, the acknowledgement timestamp and the notice version;
• the request status, such as received, waitlisted, invited, testing, declined, withdrawn or archived;
• strictly operational internal notes and the status-change history.

The CTA position or source is not retained as operational request data. It may be processed only with your analytics consent under section 2b. Without that consent, the request and its states may be counted only in operational aggregates as unattributed. The initial form does not ask for child data, your Google password, your device model or information for advertising. A beta request is not added to a marketing list; any future commercial communication would require a separate choice.

We use this data only to organize available places, prevent duplicate or abusive requests, manage invitations and the waiting list, handle incidents and keep a minimal operational history.

Legal basis: we handle your request and provide beta access as steps taken at your request under Article 6(1)(b) GDPR. For security, abuse prevention, deduplication and limited operational auditing, we rely on the legitimate interests basis in Article 6(1)(f) GDPR. The form checkbox only confirms that you have read this notice; it is not marketing consent and is not used as the legal basis for these activities.

The following technical providers are involved in this flow:

• Vercel processes the request in transit from the landing page to the backend;
• Supabase stores the request in the BabySteps project configured in the European region eu-west-1;
• Apple TestFlight manages access to the iOS beta and Google Play manages invitations to the Android test, also subject to their own policies;
• Hostinger carries a generic operational alert to the team when a new Android request is created; that alert does not include the applicant's email address or other personal data. If we accept the request, Hostinger also carries the transactional access email: to deliver it, it receives the email address associated with the request as the recipient and the necessary message content, including the invitation link and instructions for accessing the beta.

Internal access is limited to authorized staff registered by authentication identifier (UUID) and using a two-factor AAL2 session. We do not show these requests to family members or combine them with memories, diary entries or child data.

Active, invited or testing requests are reviewed for deletion or anonymization after 12 months without interaction. Declined, withdrawn or archived requests are deleted or anonymized within 90 days. Derived anti-abuse technical signals, without a raw IP address or an additional plaintext copy of the email, are kept for no more than 30 days unless a documented incident or legal obligation requires longer. These periods are applied by a cleanup task scheduled to run once a day. Deletion or anonymization may complete at any point in that daily cycle; we do not promise execution at an exact minute.

You can withdraw your beta request or exercise access, correction or deletion rights by emailing support@babysteps.space. We may ask you to verify that you control the request email address.

This section applies to the public BabySteps landing page and its beta redirects. Website measurement is not used inside the app to observe memories, diary entries, notes, photos, videos, child data or family activity.

Strictly necessary cookies and technologies

• babysteps_locale remembers your chosen language for one year. It is a functional preference.
• babysteps_analytics_consent stores only v1.granted or v1.denied for one year to remember whether you accepted or rejected optional measurement. This functional cookie does not contain a visitor identifier.
• Restricted access to /admin uses strictly necessary Supabase Auth cookies to sign in and verify two-factor authentication/AAL2. The production source-level inventory is: base name sb-emsazfgkobjndjzofeoh-auth-token; when the value exceeds one cookie, Supabase SSR may split it into numbered chunks such as .0, .1 and so on; HttpOnly; Secure on Vercel production; SameSite=Lax; Path=/; and a configured cookie Max-Age of 400 days in the installed Supabase SSR version. The number of active chunks and the actual session or token expiry vary by session and can only be confirmed at runtime; the 400-day cookie setting does not guarantee that a session remains valid for 400 days. These cookies are not used to measure public visitors.

These necessary cookies do not enable analytics measurement and cannot be disabled through the preferences control; you may delete them in your browser, although the corresponding preference or session will be lost.

Vercel and other infrastructure providers may process technical data needed to deliver and protect a request, such as the IP address, headers, date and time, requested URL, the referrer when the browser sends it, and security signals. If the initial URL contains utm_source or utm_medium, those values reach the hosting provider as part of the requested URL when that first request is processed. This hosting processing may occur even if you reject measurement and is not added to Vercel Web Analytics or our own analytics dashboard. The legal basis for this necessary operation is providing the requested service and, where applicable, the legitimate interest in its security and reliability.

Optional analytics measurement

Analytics is disabled by default. Vercel Web Analytics is loaded only after you choose to accept. If you have not made a choice, reject, or your browser sends DNT or GPC, we send no pageviews and record no clicks, detailed events or attribution for analytics purposes. With JavaScript, while your choice is pending, the landing page may locally sanitize allowlisted utm_source and utm_medium values, hold that copy only in the page’s volatile memory, and remove the query from the address bar. Without JavaScript, those values are not used for measurement or attribution; the URL with a sanitized query may remain in the address bar until you navigate to another page or close the page and may be retained in browser history or, if you save it, a bookmark. Before acceptance, the sanitized copy is not forwarded to Vercel Web Analytics or first-party Supabase events, is not shown in the dashboard, BabySteps does not write it to cookies, localStorage, sessionStorage or IndexedDB, and it is not retained for analytics purposes; it is discarded if you reject, DNT or GPC applies, or you close the page. It is used only if you later accept. Pages and redirects continue to work. The Android form requires JavaScript to submit the request and says so without transmitting the data while JavaScript is disabled.

With your acceptance, Vercel may measure the visited path without a sensitive query string, the referrer, approximate country or region, and general browser, operating-system and device characteristics. The results we view are aggregate statistics — such as page views and estimated visitors — rather than a list of identified people. Technical signals processed by Vercel to produce those aggregates are governed by its applicable documentation and terms.

We may also record sanitized first-party data about beta conversion in Supabase. With your acceptance, first-party detail is limited to ios_redirect and android_redirect events when you leave for TestFlight or Google Play. It may include platform, language and date; source (utm_source) and medium (utm_medium) from closed allowlists; and the internal CTA button position/source (cta_source), also selected from a closed list: header, hero, how-it-works section or final section. These events contain no raw IP address, email address, request identifier or family content, and retain no explicit persisted relationship with a beta request. request_received is never retained as a detailed event: with consent it contributes only to an attributed daily rollup using those closed dimensions, without a request identifier or an explicit persisted relationship; without consent it contributes only to an unattributed daily rollup. invited and testing remain only in unattributed daily operational rollups and do not enable later individual tracking of a request.

If you do not accept, reject, or your browser sends DNT or GPC, we create no first-party analytics detail: the redirect generates no analytics click or attribution. A necessary Android request may still process its email and operational status under section 2a; its receipt and necessary states may count only in daily operational rollups as unattributed. The beta form checkbox only confirms that you read the notice: it is not analytics consent.

The legal basis for Vercel Web Analytics, detailed redirect events and the attributed daily request_received rollup is your consent under Article 6(1)(a) GDPR. You may withdraw it at any time through the website’s permanent “Cookies and measurement” control. Withdrawal stops that future measurement and does not affect the lawfulness of earlier processing. The necessary request_received operational rollup without consent and the invited and testing rollups, all as unattributed, rely on the request-handling and security bases under Articles 6(1)(b) and 6(1)(f), described in section 2a, not on analytics consent. Aggregates that can no longer be related to you may not be technically separable.

We retain only detailed redirect events for no more than 90 days. Daily rollups, whether attributed or unattributed, are retained for no more than 12 months without a request identifier or an explicit persisted relationship. The Vercel Pro plan provides a reporting window of up to 12 months; this does not by itself promise provider deletion at the end of that period. The language cookie and the cookie that remembers your choice last for one year.

Vercel acts as hosting provider and, if you accept, measurement provider; Supabase hosts first-party events. Vercel and its subprocessors may process data in the United States or other countries. Optional analytics remains disabled at publication. Activation requires archiving the DPA and current subprocessor list, documenting the transfer assessment and applicable safeguards — including Standard Contractual Clauses where relevant — subscribing to changes, verifying least-privilege technical access, and a separate express operational authorization from BabySteps after those conditions have been completed.

“No tracking for advertising” means that we do not use these data for third-party advertising, cross-site tracking, remarketing or advertising profiles. We do not sell analytics data or combine it with memories, family content or child data. The optional measurement described here does not change that commitment.

For privacy questions, support requests or account deletion help, contact:

Email: support@babysteps.space