Lullaby Care
Open the app
Last updated 27 August 2026
Privacy Policy
Lullaby Care is a household baby log created by Sansavision. Core logging on this iPhone does not require an account. A subscription is required after onboarding. This policy explains what stays on the device, what optional services you can turn on, and what we never do.
Privacy at a glance
Data practices matrix
This table is the short version. “Optional” means the information leaves the phone only when an adult caregiver enables or uses the described feature.
| Information | When collected | Purpose and legal basis | Where shared | Retention |
|---|---|---|---|---|
| Child profile and care/health log | Stored locally when an adult enters it. Sent only when household sync or encrypted backup is used. | Provide the care log, sync, sharing, and backup requested by the caregiver; contract. | Household sync service for invited members; encrypted backup bytes to Cloudflare R2. We cannot read encrypted backup contents. | On-device until deleted/reset. Synced household data and backup until the household/account is deleted, subject to active-member needs. |
| Adult name, email, account and household IDs | Only if an adult creates an optional passwordless account or accepts an invitation. | Authenticate, manage household roles, sync, and restore; contract. | Cloudflare account/database services and email delivery infrastructure. | For the account/household life, then deleted or retained only where law requires. |
| Session and security data | On successful sign-in: IP address, time, device/browser details, and IP-derived coarse city/region/country/timezone. | Protect sessions and send sign-in notices; legitimate interests. | Cloudflare as service provider. | Sessions normally expire after 30 days; expired records are normally removed within 24 hours. |
| Email abuse-prevention counters | When a magic link, one-time code, or caregiver invitation is requested. | Prevent repeated or abusive email sending; legitimate interests. | Cloudflare as service provider. Network addresses and recipient addresses are represented only by one-way SHA-256 hashes in these counters. | Sign-in counters reset after 15 minutes; invitation counters after one hour. Expired rows are normally removed by the next daily cleanup. |
| Photos | Only when an adult chooses a child photo and grants Photos or Camera permission. | Display the chosen household profile image; consent/requested feature. | The photo file stays on the device. An encrypted backup may contain its local file reference, but does not upload the photo itself. | Until removed, replaced, or app data is reset. |
| Purchase information | When you buy or restore a subscription. | Verify entitlement, restore access, prevent fraud, and meet legal obligations; contract and legitimate interests. | Apple processes payment; our service receives transaction/product identifiers and active status, not full card details. | For entitlement and legally required accounting/dispute periods. |
| Guest and invitation activity | When an adult creates/accepts an invite or a guest submits a permitted care event. | Provide limited household collaboration and protect access; contract and legitimate interests. | Authorized household members and Cloudflare service infrastructure. | Invitation tokens expire; accepted activity follows the household log’s retention until deleted. |
What the app stores on your phone
Feed, sleep, diaper, pump, growth, temperature, medication, stash, and notes live in a local SQLite database. On iPhone and iPad, Apple’s built-in iOS Data Protection protects the database and its files with complete file protection while the device is locked. Missing sessions stay unknown. They are never invented.
Optional account and cloud services
You can log care on this iPhone without creating an account. An account is required only for household sharing, partner and guest invitations, multi-device sync, and encrypted cloud backup. If you choose to sign in, you use a magic link or one-time code. We store the email address you provide so we can authenticate you. There is no password.
Sign-in security information
When a sign-in succeeds, we store the sign-in time, IP address, device or browser information, and an approximate city, region, country, and timezone supplied by Cloudflare from the network connection. We use this information only to create and protect your account session and to email you a successful-sign-in security notice. Our legal basis is our legitimate interest in preventing and detecting unauthorized account access.
This approximate sign-in location does not use the iPhone's GPS or Apple Location Services. We do not retain precise coordinates or Cloudflare data-centre identifiers. Account sessions normally expire after 30 days. Expired session and verification records are deleted by a daily cleanup, normally within 24 hours after expiry. Deleting your account removes its session security records sooner.
To prevent email abuse, sign-in and invitation requests are rate limited by network address or signed-in sender and by recipient email. Network and recipient addresses are represented by one-way SHA-256 hashes in the rate-limit counters, so those keys contain neither a readable email address nor network address. Sign-in counters reset after 15 minutes, invitation counters after one hour, and expired rows are normally removed by the next daily cleanup.
Cloudflare processes network requests and hosts the account session database on our behalf. Authentication emails are delivered through Cloudflare's email infrastructure. These providers receive only the information needed to deliver and secure these services.
Sync, subscription, and encrypted backup
If you create an account and enable household features, sync sends event records to a Durable Object for that household. The subscription is billed through Apple. Logs are written on the phone first and queued if you are offline. Optional cloud backup is encrypted on the device before it is uploaded. We cannot read the contents of that backup. You can delete the remote account and backup from Settings.
Partners and guests
- A partner invite joins the same household ledger after they sign in.
- A guest link can log feed, sleep, diaper, and a note for a limited time. Guests cannot export, invite others, or read private notes.
What we do not do
- We do not sell care data.
- We do not build advertising profiles from the log.
- We do not diagnose, prescribe, or predict medical outcomes.
- We do not hold your history hostage after you subscribe. You can view, undo, and export CSV from Settings while your subscription is active.
Children
Lullaby Care is used by caregivers to log a child's care. Accounts belong to adults. Do not create an account for a child under 13.
Who we are
Lullaby Care is published under the Sansavision brand. Sansa Group AB, Gothenburg, Sweden, is the legal entity responsible for the service and the controller of personal data described in this policy. Data for optional backup is stored in the EU (Western Europe) when cloud features are used.
GDPR and European privacy rights
If the GDPR, UK GDPR, or similar European law applies, Sansa Group AB is the controller for account and service data. Depending on the processing, we rely on performance of our contract, an adult caregiver’s consent, our legitimate interests in service and household security, or a legal obligation. When consent is the basis, it may be withdrawn at any time without affecting earlier lawful processing.
You may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority. We normally respond within one month, subject to identity verification and lawful exceptions. Cloudflare and other service providers may process data outside the EEA; where required, transfers use recognized safeguards such as contractual protections.
California privacy rights
California residents may request access to the personal information and categories we hold, correction, deletion, and a portable copy, subject to verification and legal exceptions. You may use an authorized agent, and we will not discriminate against you for exercising a privacy right.
We do not sell personal information, share it for cross-context behavioural advertising, offer a financial incentive for personal data, or use sensitive personal information to infer characteristics about a child or caregiver. Care and health information is used only to provide features an adult requests. Because we do not sell or share personal information in the California-law sense, there is no sale/sharing opt-out to action. We normally respond to a verified California request within 45 days.
How to make a privacy request
Delete the remote account and encrypted backup from Settings, or email support@sansavision.com with “Lullaby Care privacy request.” Tell us which right you want to use and the email associated with the optional adult account. We may ask for reasonable verification, but never ask for your one-time code, magic-link token, recovery passphrase, or full payment details.
Contact
Privacy questions and requests: support@sansavision.com.