BabySir · Privacy
Privacy Policy
Effective: July 16, 2026
Lift Innovations (the “Company,” “we,” or “us”) respects your privacy. This Policy explains which information stays on your device and which limited technical information may be processed by third-party SDKs when you use the BabySir mobile application (the “Service”).
1. Controller and scope
Lift Innovations is responsible for the processing described in this Policy. This Policy applies to the BabySir app for iOS and Android. Other products, websites, or third-party services may have separate privacy terms.
Core logging works without registration and stores baby profiles and care records on your device. If you sign in with Apple or Google and finish connecting the account, profile, record, setting, and downsized-photo data from this device is uploaded to Supabase and subsequent changes are synchronized.
2. Information processed, purpose, and retention
2.1 Local-first information
| Category | Information | Purpose | Storage and retention |
|---|---|---|---|
| Baby profile | Name or nickname, date of birth, and optional weight and sex | Show age in days and months, personalize the interface, and provide general age-based growth and feeding references | Stored in the app's local device storage until you edit or reset it, clear app data, or uninstall the app |
| Care records | Feeding type, amount, time, duration and nursing side; solids; bath; wet or dirty diaper; play; sleep; custom record types; quick-slot names; notes; and record timestamps | Quick logging, daily summaries, history, filters, charts, and pattern views | Stored locally until you delete the record or app data |
| App settings | Language, ml/fl oz unit, haptics, photo reminder time, and the missed-day batch reminder setting | Remember preferences and schedule local notifications | Stored locally until changed, app data is cleared, or the app is uninstalled |
| Photo text recognition | A note photo you take or select, and recognized text | Create draft care records for your review | Used on the device during processing. BabySir does not keep the photo. Temporary files created by the operating system or picker may be removed under the platform's rules. Only records you review and save remain locally. |
This information is not automatically sent to our servers while you use core logging without sign-in. Connecting an Apple or Google account sends profile, record, growth, quick-slot, and downsized-photo data required for sync to Supabase. Your operating system may also include local app data in an Apple or Google device backup under your platform settings and policies.
2.2 Information third-party SDKs may process
| Processor and feature | Information that may be processed | Purpose | Retention |
|---|---|---|---|
| Google ML Kit On-device text recognition |
Device manufacturer, model, OS and accelerator information; app package and version; per-install identifier; performance metrics; API configuration; input/output size; feature version; events; and error codes | Diagnostics, performance measurement, maintenance, abuse and error detection, and improvement | Under Google's applicable policies |
| Google Analytics for Firebase App analytics |
App instance and installation identifiers; device, OS, language, and app version; approximate IP-based location; app opens, sessions, screens, feature events; and advertising identifier where allowed by the platform and settings | Usage statistics, interface and feature improvement, and pre-crash journey analysis | Under Google Analytics retention settings and policies |
| Firebase Crashlytics Crash and error diagnostics |
Firebase/Crashlytics installation identifiers and session ID; crash time, stack trace, exception class/message; app ID/version; device model, OS, CPU, RAM, disk, root/jailbreak status, and app state | Diagnose crashes, abnormal termination, and errors; improve stability and support | Google states crash information and associated identifiers enter deletion after 90 days; other information follows Google's policies |
| Supabase Auth, Database, and Storage Optional account sync and sharing |
Social sign-in provider and account email; authentication/session, account, and family identifiers; baby profiles; care and growth records; quick slots; downsized photos and file metadata | Sign-in, multi-device sync, family invites/sharing, and account deletion | While the account is connected, until you delete the data or account, subject to the exceptions on the deletion page |
| Unity LevelPlay and advertising partners Banner ads |
IP address and approximate location; device, OS, language, and app information; installation identifier; device or advertising identifiers where permitted; and ad request, impression, click, interaction, and campaign logs | Serve ads; provide contextual or personalized ads where allowed; frequency capping; measurement; reporting; fraud prevention; and service improvement | Under Unity's and each advertising partner's policies |
| Customer support | Your email address, inquiry, and any optional device/app details or attachments you send us | Respond to inquiries, troubleshoot, and handle disputes | One year after an inquiry closes, or longer where required by law or necessary for an active dispute |
Google states that ML Kit's image/text input and recognition output are processed fully on-device and are not sent to Google servers. The SDK may connect to Google for updates, compatibility information, and the diagnostic and performance data described above.
We do not place a baby's name, care-record text, or note content in Firebase Analytics events or Crashlytics user identifiers. Record and photo transfer to Supabase occurs only after you connect an Apple or Google account. Photos are downsized to JPEG copies of at most 1600px and 512KB rather than uploaded as the originals.
3. Local and account storage, deletion, and recovery
- You can delete individual records from the history screen.
- The clear-records setting deletes saved care records while leaving the baby profile and quick slots in place.
- You can edit the profile, quick slots, and settings in the app.
- To remove all information used in local mode without an account, clear BabySir's app data in operating-system settings or uninstall.
- We do not hold unconnected local data and cannot restore it after device loss, failure, app-data deletion, or uninstallation.
- Delete a connected account and cloud data in Settings → Account and sync → Delete account, or use the web account-deletion page. Signing out clears account data from the device but does not delete cloud data.
- Support email information is securely deleted when its retention period ends, unless a legal exception applies.
4. Third-party disclosures and SDKs
We do not sell or disclose your baby profile, care history, custom notes, note photos, or recognition results to advertisers or other third parties. The following SDK providers may independently process SDK data under their own legal roles and policies:
- Google LLC · ML Kit — on-device text recognition, diagnostics, and maintenance (ML Kit terms and privacy, Google Privacy Policy)
- Google LLC · Firebase — usage analytics, crash/error diagnostics, and caregiver notification delivery (Firebase Privacy and Security)
- Supabase, Inc. — social account authentication, PostgreSQL database, file storage, Realtime synchronization, and account deletion (Supabase Privacy Policy)
- Unity Technologies and LevelPlay advertising partners — advertising, measurement, and fraud prevention (Unity Game Player and App User Privacy Policy)
Advertising partners may vary by country, device, ad inventory, and LevelPlay configuration. You may adjust personalized-ad choices through your operating-system advertising settings or an ad's privacy icon. Contextual or non-personalized ads may still be shown.
5. International processing
SDK-related technical information may be processed in countries other than your own. Data-center locations and subprocessors may change with each provider's infrastructure.
| Recipient | Locations | Information and method | Purpose and retention |
|---|---|---|---|
| Google LLC | United States and countries where Google operates facilities | Encrypted automatic transfer of ML Kit device/app, installation, performance, configuration, event, and error data when the photo analysis feature is used. Note photos and recognized text are excluded. | Diagnostics, updates, maintenance, and improvement for the period required under Google's policies |
| Google LLC · Firebase | United States and countries where Google operates facilities | Analytics app/installation identifiers, device/app/session/screen/ event and approximate-location data; Crashlytics installation/ session identifiers and crash/exception/device diagnostics | Automatically transferred when the app is used or an error occurs. Used for analytics, diagnostics, security, and service administration. Google states Crashlytics crash data enters deletion after 90 days; Analytics follows our settings and applicable Google policies. |
| Supabase, Inc. | United States and countries where Supabase uses processing facilities | Encrypted transfer of social provider and account email; authentication/session, account and family identifiers; baby profiles; care and growth records; quick slots; downsized photos and metadata during registration, sign-in, synchronization, and sharing | Authentication, synchronization, sharing, and security. Retained until individual deletion or account deletion, with Supabase backup and deletion procedures also applying. |
|
Unity Technologies, ironSource affiliates, and advertising
partners [email protected] |
United States, Israel, and countries where Unity, its affiliates, or service providers operate facilities | Encrypted automatic transfer of IP, approximate location, device/OS/app data, permitted installation/device/ad identifiers, and ad request, impression, click, and interaction logs when the app or ad is used | Ad serving, measurement, reporting, fraud prevention, and improvement for the period in provider policies |
You may avoid photo analysis by not granting camera/photo access or by not using that feature. You may limit ad personalization through device or in-ad privacy settings. To prevent SDK network processing entirely, stop using and uninstall the Service; BabySir will then be unavailable.
6. Device permissions and similar technologies
- Camera: used only when you choose to photograph a handwritten note.
- Photo library: used only when you choose a note photo for analysis.
- Notifications: used to schedule the selected daily baby-photo reminder and an 8:00 PM missed-day batch-log reminder on your device. If you connect an account and enable caregiver activity notifications, we store the FCM token, installation ID, platform, language, and app version in a private Supabase area to deliver new- record notifications from other caregivers. Signing out or disabling these notifications disables the token and requests its removal.
- Internet: used for advertising, ML Kit updates and diagnostics, Firebase analytics, crash diagnostics, optional sharing, and opening external links such as these legal documents.
The Service does not request contacts, microphone, or precise-location access. It does not use web cookies to collect baby records. Advertising SDKs may use advertising identifiers or similar technologies as described in Sections 4 and 5.
7. Children and baby information
BabySir is designed for parents, legal guardians, and adult caregivers to record a baby's routine; it is not directed to children. You must have authority to enter information about the baby.
Core logging works without registration and remains on the device. An adult who sends baby information through sharing/backup must have authority and responsibility to do so. A minor should use the Service only under a parent or legal guardian's direction and consent. Contact us if you believe a child's information was mistakenly sent to us.
8. Your choices and rights
- You can view, edit, and delete local records and change profile/settings in the app.
- To request access, correction, deletion, restriction, or other rights for support information or optional sharing/backup data held by us, email [email protected]. We may verify your identity and respond as required by applicable law.
- Delete a connected account and its data directly in the app or request deletion through the web account-deletion page.
- For Google Analytics/Crashlytics identifiers or information Unity processes independently, use provider privacy tools, device settings, or the ad privacy icon as applicable.
- You can withdraw camera, photo, and notification permissions at any time in device settings; only the related optional feature will stop.
Depending on your location, you may also have the right to object, complain to a privacy regulator, or appeal a privacy decision.
9. Security
We use a local-first architecture, encrypted transport, and Supabase Row Level Security to limit access by family space, along with operating-system permission controls. You are responsible for protecting your device with appropriate security controls and for keeping any backups secure. No storage or transmission method is completely secure.
10. Changes to this Policy
We may update this Policy to reflect feature, SDK, legal, or operational changes. We will post the new effective date on this page and, when required, provide a more prominent notice or obtain consent. Material changes generally will be announced at least seven days in advance, or at least thirty days in advance if they materially disadvantage users, unless urgent legal or security reasons require otherwise.
11. Privacy contact
- Company
- Lift Innovations
- Representative
- Kang Seongchan
- Business registration no.
- 664-24-01885
- Privacy and support email
- [email protected]
Users in Korea may also contact the Personal Information Infringement Report Center (118), the Personal Information Dispute Mediation Committee (1833-6972), the Supreme Prosecutors' Office (1301), or the National Police Agency (182).
This Policy reflects BabySir as implemented on July 16, 2026. This English version is provided for convenience. If it conflicts with the Korean version, the Korean version controls to the extent permitted by law.