Privacy Policy

Who we are

BumpTribe (“we”, “us”) provides a free, private pregnancy and parenting platform at bumptribe.co. For UK/EU data protection law, we are the “data controller” of the personal data described here. Our contact point for privacy questions is hello@bumptribe.co.

The data we collect

We keep collection to the minimum a feature genuinely needs.

• Account data: your email address and a password (stored only as a secure hash), or a Google sign-in identifier if you use Google to sign in. An optional display name and profile photo.
• Profile & preferences: your journey stage (trying to conceive, pregnant, or parenting), country, timezone, and your consent and privacy choices.
• Health data (special category): only if you choose to use the relevant features — due date, last-period or conception dates, cycle length, contraction and kick-counter sessions, and any children you add. This now also includes baby-tracking data: feeding, diaper and sleep logs, developmental milestones you mark, and a private journal of written memories and photos (including weekly bump photos and a first-year baby album). See our separate Consumer Health Data Privacy Policy.
• Your child’s data: information you record about a child (name, dates, logs, milestones, journal entries and photos) is your child’s personal data. We collect the minimum a feature needs, use it only to provide the tools you choose, and never sell it or use it for advertising or profiling. You can share it only with people you invite (see below), and delete it at any time.
• Sharing: if you invite a partner or family member, we store the invite (their email, the permission you granted, and its status) so they can access what you shared. You can change or revoke this at any time.
• Content you save: guides and articles you bookmark.
• Technical data: essential cookies for signing in, and — only with your consent — limited analytics. See our Cookie Notice.

We do not require your date of birth beyond confirming you meet our minimum age, and we do not collect precise location.

Why we use it, and our lawful bases (UK GDPR)

Under UK GDPR we must have a “lawful basis” for each use of your data:

• Providing the service (your account, the tracker and tools) — Contract (Art. 6(1)(b)): we can’t provide these features without processing the data you give us.
• Keeping the service secure and working (preventing abuse, fixing problems) — Legitimate interests (Art. 6(1)(f)).
• Health data (pregnancy, fertility, cycle, children) — your explicit consent (Art. 9(2)(a)). We store nothing in this category until you have given explicit, opt-in consent, and you can withdraw it at any time.
• Marketing emails — your consent (Art. 6(1)(a)), which is separate, opt-in, and never required to use BumpTribe.
• Non-essential cookies/analytics — your consent (UK PECR), which you can change any time.

What we will never do

• We never sell your personal information.
• We never share your health data for advertising or third-party profiling.
• We do not use your health data to target ads.
• We do not claim to be “HIPAA compliant” — BumpTribe is a direct-to-consumer service and HIPAA does not apply to it.

Who we share data with

We share personal data only with service providers who help us run BumpTribe, under contracts that require them to protect it and use it only on our instructions:

• Supabase — our database, authentication, and file storage provider.
• Vercel — our hosting and content-delivery provider.

We may disclose data if required by valid legal process. We will require proper legal process, collect as little as possible so there is less to compel, and — where lawful — aim to be transparent about such requests.

International transfers

Our providers may process data in the United States and other countries outside the UK/EEA. Where data is transferred internationally, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses, together with any additional measures needed to protect your data. [The specific transfer mechanisms and provider regions are to be confirmed and documented by counsel — placeholder.]

How long we keep it (retention)

• Account & profile: for as long as your account is open. When you delete your account, we delete it.
• Pregnancy & fertility data (due date, cycle, contraction and kick logs): kept while you use the related feature and while your health-data consent is active. If you withdraw consent we stop processing it and offer to delete it.
• Baby logs & milestones (feeding, diaper and sleep logs; milestones): kept for as long as your account is open, so your history is there when you want to look back — unless you delete them sooner.
• Journal entries & photos: kept for as long as your account is open, or until you delete them. When you delete a photo, an entry, or your account, we remove the entry and delete the photo files from storage — we do not keep them afterwards.
• Consent & rights records: kept as a minimal audit trail to demonstrate compliance. Deleting your account hard-deletes your consent records and revokes any access you shared.

In every case you can delete individual items, or your whole account, at any time in Profile & settings, and we act on it immediately.

Your rights

Depending on where you live, you have some or all of these rights. You can exercise most of them yourself in Profile & settings:

• Access — get a copy of your data (self-serve export).
• Rectification — correct your data by editing your profile.
• Erasure — delete your account and data.
• Portability — download your data in a structured JSON format.
• Restriction & objection — pause certain processing or object to it, and opt out of marketing at any time.
• Withdraw consent — as easily as you gave it.

US residents have additional rights — see our US State Privacy Rights page. You also have the right to complain to a regulator: in the UK, the Information Commissioner’s Office (ICO).

Children

BumpTribe is intended for adults. We do not knowingly collect data from children under 13. Where the service is used by under-18s, we apply high-privacy defaults for everyone. See our Terms of Service for age requirements.

Security

We protect your data with row-level database security (so you can only access your own rows), encrypted connections, and strict server-only handling of sensitive keys. No system is perfectly secure, but we design to minimise what we hold and who can reach it.

Changes to this policy

If we change what we collect or how we use it, we will update this policy (and our Consumer Health Data Privacy Policy) at the same time, and note the change here.

Contact

Questions or requests: hello@bumptribe.co. [UK/EU representative details, if required, to be added.]