1. Who we are
BabySteps is a private family memories and care app operated by its developer, Miguel Ángel Batista Ruiz.
For privacy or support questions, contact us at support@babysteps.space.
2. Data we collect
Depending on how you use BabySteps, we may collect and process:
- Account data: email address, authentication identifiers, display name, language preference and profile avatar.
- Family and child data: family spaces, roles, invitations, child names or nicknames, birth or pregnancy dates, child avatars and access permissions.
- User content: memories, milestones, photos, videos, audio, album items, diary entries, private notes, reactions and related metadata.
- Private care records: growth, feeding, sleep, teeth and vaccine records entered by family administrators.
- Notification data: push notification tokens, notification preferences and delivery status where notifications are enabled.
- Technical data: device/app information, security logs, error information and operational records needed to keep the service reliable and secure.
- Support communications: information you send when requesting help.
2a. Beta access requests
If you request access to a BabySteps beta, we process a separate and limited set of data to manage that request:
- the email address you will use for Google Play for an Android request;
- the requested platform, the page language and the part of the website where you started the request;
- creation, update and, where applicable, withdrawal or closure timestamps;
- confirmation that you acknowledged the privacy notice, the acknowledgement timestamp and the notice version;
- the request status, such as received, waitlisted, invited, testing, declined, withdrawn or archived;
- strictly operational internal notes and the status-change history.
The initial form does not ask for child data, your Google password, your device model or information for advertising. A beta request is not added to a marketing list; any future commercial communication would require a separate choice.
We use this data only to organize available places, prevent duplicate or abusive requests, manage invitations and the waiting list, handle incidents and keep a minimal operational history.
Legal basis: we handle your request and provide beta access as steps taken at your request under Article 6(1)(b) GDPR. For security, abuse prevention, deduplication and limited operational auditing, we rely on the legitimate interests basis in Article 6(1)(f) GDPR. The form checkbox only confirms that you have read this notice; it is not marketing consent and is not used as the legal basis for these activities.
The following technical providers are involved in this flow:
- Vercel processes the request in transit from the landing page to the backend;
- Supabase stores the request in the BabySteps project configured in the European region eu-west-1;
- Apple TestFlight manages access to the iOS beta and Google Play manages invitations to the Android test, also subject to their own policies;
- Hostinger carries a generic operational alert to the team when a new Android request is created; that alert does not include the applicant's email address or other personal data.
Internal access is limited to authorized staff registered by authentication identifier (UUID) and using a two-factor AAL2 session. We do not show these requests to family members or combine them with memories, diary entries or child data.
Active, invited or testing requests are reviewed for deletion or anonymization after 12 months without interaction. Declined, withdrawn or archived requests are deleted or anonymized within 90 days. Derived anti-abuse technical signals, without a raw IP address or an additional plaintext copy of the email, are kept for no more than 30 days unless a documented incident or legal obligation requires longer. These periods are applied by a cleanup task scheduled to run once a day. Deletion or anonymization may complete at any point in that daily cycle; we do not promise execution at an exact minute.
You can withdraw your beta request or exercise access, correction or deletion rights by emailing support@babysteps.space. We may ask you to verify that you control the request email address.
3. How we use data
We use data to:
- create and secure user accounts;
- sync private family memories and care records across devices;
- manage invitations, roles and access permissions;
- store and display photos, videos, audio and other family content;
- send optional service notifications;
- provide support and troubleshoot technical issues;
- prevent misuse, protect accounts and comply with legal obligations.
We do not use BabySteps content for third-party advertising, and we do not sell personal data.
5. Children and family data
BabySteps may contain information about children because parents or responsible adults choose to create a private family space. Children do not need to create accounts to use BabySteps.
Parents and family administrators are responsible for choosing what information they add, which relatives they invite and what content is visible to each person.
6. Retention and account deletion
We keep data while your account or family space is active, or as long as needed to provide the service, maintain security, resolve disputes or comply with legal obligations.
You can request deletion directly in the app from Settings → Privacy and session → Delete my account. BabySteps requires your current password and a confirmation phrase to prevent accidental deletion.
- If you are the only active administrator of a family, deleting your account deletes the family space and its associated children, memories, album, diary, care records, notes, reactions and media.
- If other active administrators remain, BabySteps keeps the shared family space and removes your own account, profile, membership and content you created or uploaded.
- If you are a guest, BabySteps removes your account, profile, access, private notes and reactions without deleting the administrator's family content.
Some limited technical logs or backups may remain for a short period as part of provider security and operational systems, but they are not used as active app content.
7. Your privacy rights
Depending on your location, you may have the right to access, correct, delete, export or object to the processing of your personal data, and to withdraw consent where processing is based on consent.
To exercise these rights, contact us at support@babysteps.space. We may need to verify your identity before acting on a request.
8. Security
BabySteps uses authentication, private storage, database access rules and role-based permissions to protect family content. We design the app around private family sharing rather than public discovery.
No online service can guarantee absolute security. If you believe your account or family content has been exposed, contact us as soon as possible.
9. Changes to this policy
We may update this policy as BabySteps evolves. The latest version will always be available on this page, with the update date shown at the top.
10. Contact
For privacy questions, support requests or account deletion help, contact:
Email: support@babysteps.space