1. The short version
- We collect only what Sprout needs to work: your account, your baby's logs, photos you add and, if you allow it, your sleep data.
- Your data is shared only with the people in your household and with the providers that run Sprout for us.
- We don't sell your data, show ads or use third-party analytics or tracking.
- You can delete your account and data from inside the app at any time.
2. Who we are
Sprout ("Sprout", "we", "us") is a baby-tracking service made up of the Sprout iOS and Android apps and the servers behind them. It is operated by Sprout, [Registered address].
For the personal data described in this policy, we are the data controller. You can reach us at privacy@example.com.
3. What we collect
Account information
- Your name and email address.
- Your password, which we store only as a one-way hash. We can never see it.
- Sign-in tokens for each device you use, with the time each was last used.
- Password reset requests, if you make one.
Household and baby information
- Your household's name, who belongs to it, and the pairing codes used to join it.
- Each baby's name, date of birth, preferred units (metric or imperial) and preferred feed interval.
Activity logs
- Feeds: type (left or right breast, expressed or formula), time, duration and amount.
- Diapers: type (wet, dirty or both) and time.
- Baby sleep: start and end times.
- Any notes you add, which household member logged each entry, and when.
Photos
Photos you add to the photo journal, along with the day each was taken and its dimensions. Photos are stored privately and can only be downloaded by signed-in members of your household. They are never public.
Parent sleep (optional)
Sleep sessions you log yourself or, if you give permission, import from Apple Health. This includes start and end times, the sleep stage, and the name of the source device (for example, "Alex's Apple Watch"). See Apple Health below.
Notification settings
Your reminder preferences and a push notification token for each device, so we can deliver the notifications you have turned on.
Technical information
Like any internet service, our servers receive your IP address, device and app details, and request times. We use these in short-lived server logs to run, secure and troubleshoot the service.
What we don't collect: we don't use advertising identifiers, third-party analytics or tracking SDKs, and we don't access your location or contacts.
4. How we use it
- To create and secure your account and keep you signed in.
- To sync your logs, photos and settings across your devices and with the other members of your household.
- To calculate summaries and insights, such as time since the last feed, left/right balance and sleep totals.
- To send the reminders and notifications you have turned on.
- To send essential service emails, such as password resets.
- To keep Sprout secure, prevent abuse, and fix problems.
- To meet our legal obligations.
We don't use your data for advertising, and we don't sell it or share it for others' marketing.
5. Legal bases (UK & EU users)
| Purpose | Legal basis |
|---|---|
| Running your account, syncing and sharing within your household | Performance of our contract with you (our Terms) |
| Feeding, diaper and sleep logs, and Apple Health sleep data, which may count as health data | Your explicit consent, given when you choose to record or import it. You can withdraw it at any time by deleting the data or your account. |
| Notifications | Your consent, managed in the app and in your device settings |
| Security, abuse prevention and service logs | Our legitimate interest in keeping Sprout safe and working |
| Keeping records the law requires | Legal obligation |
6. Sharing in your household
Sprout is built to be shared. Everyone in your household can see, add, edit and delete the household's babies, activity logs and photos. Members can also see each other's parent-sleep entries, including the source device name, so you know who needs a rest. Only you can add, edit or delete your own sleep entries. Only invite people you trust with this information.
If you leave a household, the babies, logs and photos stay with that household.
7. Service providers
We use a small number of trusted providers to run Sprout. They handle data only on our instructions and under data processing agreements.
| Provider | What they do |
|---|---|
| Laravel Cloud (Laravel Holdings Inc.) and its infrastructure providers | Hosting for the Sprout API, plus the managed database, cache, queues and private object storage where your account, logs and photos are kept |
| [Transactional email provider] | Sending service emails, such as password resets |
| Apple | App distribution, Apple Push Notification service, and Apple Health on your device |
| App distribution and Firebase Cloud Messaging (Android, once launched) |
We may also disclose information if the law requires it, to protect someone's safety, or as part of a business transfer such as a merger. In a business transfer, this policy would continue to protect your data.
8. Apple Health
If you choose to connect Apple Health, Sprout reads sleep data only and never writes to Apple Health. In line with Apple's rules, data from Apple Health:
- is used only to show you, and your household, your sleep in Sprout;
- is never used for advertising or marketing, and never sold;
- is never shared with third parties other than the service providers that store it for us.
You can turn off access at any time in the Health app or in iOS Settings → Privacy & Security → Health.
9. Where your data is stored
The Sprout API and its databases and storage are hosted on Laravel Cloud in the Europe (London) region. Some of our providers are based in, or may access data from, other countries, including the United States. Where personal data leaves the UK or EEA, we rely on safeguards the law recognises, such as an adequacy decision, the UK–US Data Bridge or EU–US Data Privacy Framework, or Standard Contractual Clauses with the UK Addendum.
10. Retention & deletion
- While your account is open, we keep your data so Sprout can work.
- Individual entries and photos you delete disappear from all devices straight away. They are permanently erased from our systems within 30 days.
- Deleting your account (Settings in the app) immediately deletes your account, devices, notification settings and your parent-sleep data.
- If you're the only member of your household, the household and everything in it, including all babies, logs and photo files, are deleted too.
- If another parent is still in the household, the babies, logs and photos stay with them, and entries you logged are no longer linked to you.
- Backups are kept for a limited period for disaster recovery and are overwritten on a rolling basis. Deleted data may remain in backups until it is overwritten, normally within 30 days.
- Server logs are kept for a short period, normally no more than 30 days.
11. Security
We protect your data with encryption in transit (HTTPS), hashed passwords, per-device sign-in tokens you can revoke by signing out, private photo storage that requires a signed-in household member, and strict separation between households. Our hosting provider encrypts stored data at rest. No system is perfectly secure. If a breach affects you, we will tell you and the relevant authorities as the law requires.
12. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data (most of it you can edit in the app yourself);
- delete your data (you can delete your account from the app);
- export your data in a portable format;
- object to or restrict certain processing;
- withdraw consent at any time, without affecting processing that happened before.
To use any of these rights, email privacy@example.com. We will respond within one month. You can also complain to your data protection authority. In the UK, that is the Information Commissioner's Office. We'd appreciate the chance to help first.
US residents: we don't sell or "share" personal information for cross-context behavioural advertising, as those terms are defined in US state privacy laws.
13. Children's data
Sprout accounts are for adults (18+) only. Information about babies is entered by their parents or carers, who confirm they have the authority to provide it. We don't knowingly let children create accounts. If you think a child has done so, contact us and we will delete the account.
14. This website
This website is informational only. It doesn't use analytics, advertising or tracking cookies. It may set strictly necessary cookies to keep the site secure. It loads fonts from Google Fonts, which means your browser sends your IP address to Google when you visit.
15. Changes to this policy
We may update this policy as Sprout grows. If the changes are significant, we will tell you in the app or by email before they take effect. The date at the top shows when this policy last changed.
16. Contact us
For questions about this policy or your data, contact us:
Sprout
[Registered address]
privacy@example.com