This Privacy Policy explains how personal data is handled in Esti, a mobile app that lets parents and caregivers track a baby's daily life (feeding, sleep, diapers, health, growth and development). We designed Esti to collect only what is needed to provide the app, and we do not sell your data or use advertising or third-party analytics.
1. Who is responsible for your data
The data controller is Stanislav Solovskyi, an individual based in Poland ("we", "us"). For any privacy question or request, contact us at support@estibaby.com.
2. What data we collect
Account data
- Your email address and name, provided when you sign in with Apple or Google.
Baby profile data (entered by you)
- Baby's name, date of birth, sex, gestational weeks (optional) and an optional photo.
Activity and health records (entered by you)
- Feeding (including solid foods), sleep, diapers, walks, baths, temperature, medication, illnesses, vaccinations, doctor visits, growth measurements (weight, height, head circumference), mood, milestones, food reactions and allergy notes (which foods your baby reacted to, the symptoms you observed, and any allergy or risk factors you mark), your notes and any photos you attach.
Preferences and sharing
- App settings such as units and favorites.
- If you invite someone to a baby, the email address you enter for that invitation.
Assistant conversations
- If you use the Esti assistant (a premium feature), the messages you send it and the answers you receive, including any photo you attach to a message and any voice message you record (the audio is transcribed to text — see section 6).
Subscription status
- Whether you have an active premium subscription. Payments are processed entirely by the store you purchased through — Apple (App Store) or Google (Google Play) — we never receive your payment card details.
3. What we do not collect
Esti contains no advertising and no advertising identifiers. We do not track how you use the app, we do not build profiles of you, and we do not sell or rent your data.
One third-party tool does receive something, and we would rather name it than leave the sentence above sounding broader than it is: crash reporting. When the app fails, a technical description of the failure is sent so that we can fix it. It contains no records about your baby and nothing you have typed — see section 5.
4. Why we use your data (legal bases)
- To provide the service (performance of a contract): storing, syncing and displaying your records, sharing data with people you invite, and account management.
- Your consent, where required — for example when you choose to add health-related records or attach photos. You can withdraw consent at any time by deleting the relevant data or your account.
5. Who processes your data on our behalf
- Supabase — authentication, database and file storage (hosting of your account, records and photos). Data is hosted on Supabase servers located in the EU (Frankfurt, Germany — AWS region eu-central-1). See Supabase's privacy policy.
- Apple and Google — to authenticate your sign-in; they also process subscription payments (App Store / Google Play respectively).
- RevenueCat — subscription management: keeps track of whether your subscription is active. Receives your account identifier, your email address (so that if you write to support we can find your subscription) and purchase state from the app store — never your payment details. See RevenueCat's privacy policy.
- Google (Gemini API) — only when you use the AI assistant, to generate answers and to transcribe voice messages (including any photo or audio you send it; see section 6).
- Sentry — crash and error reporting, so that failures in the app reach us instead of only happening to you. It receives technical diagnostics: the version of the app, the model of the device and its operating system, and the technical description of what went wrong. It also receives a random identifier generated on your device when the app is installed, which lets repeated failures be recognised as the same device — it is not your account, your name or your email, and we never send those. It receives none of your baby's records and nothing you have typed. This data is processed on Sentry's servers in the European Union (Germany). See Sentry's privacy policy.
We do not share your data with anyone else, except where required by law.
6. AI assistant (Esti)
Esti includes an optional AI assistant that answers questions grounded in your baby's tracked data and can help you record events. When you send the assistant a message, we transmit to Google's Gemini API: your message, the recent conversation in that chat, and a summary of the baby's tracked records (and, when needed to answer, records for the period you ask about — including solid foods and any food reactions you have logged). Google processes this data on our behalf to generate the answer.
- If you attach a photo to a message, that image is sent to Google's Gemini API to answer your question about it. The photo is also stored with your chat (on Supabase, in your own private folder) so it can be shown again in your history.
- If you send a voice message, the audio recording is sent to Google's Gemini API only to transcribe it into text; we keep the resulting transcript with your chat, but we do not store the audio recording itself.
- Under the paid Gemini API terms we use, Google does not use this data (including photos and audio) to train its models. See Google's Gemini API terms.
- Processing may take place on Google servers outside the EU; such transfers are covered by Google's standard contractual safeguards.
- Your conversations are stored with your other records so you can revisit them; you can delete any chat in the app at any time.
- The assistant provides general guidance only — it is not medical advice; always consult your pediatrician for medical concerns.
7. Sharing with people you invite
If you invite a partner or caregiver to a baby, the records for that baby become visible to them according to the access level you grant (full or view-only). You control invitations and can revoke access at any time in the app.
8. How long we keep your data
We keep your data for as long as your account exists. You can delete individual records, a baby profile, or your entire account at any time in the app. Deleting your account removes your account and associated data from our systems.
9. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy (the app also offers a CSV/PDF export);
- correct inaccurate data;
- erase your data ("right to be forgotten") — e.g. by deleting your account;
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time;
- lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO — Urząd Ochrony Danych Osobowych, uodo.gov.pl).
To exercise any of these rights, email support@estibaby.com.
10. Children
Esti is intended for use by adults (parents and caregivers) to record information about their own children. It is not directed at, or intended to be used by, children. The data about a child is entered and controlled by the responsible adult.
11. Security
Data is transmitted over encrypted connections (HTTPS/TLS) and access is restricted so that you (and people you explicitly invite) can reach only your own data. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.
12. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by a notice in the app.
13. Contact
Questions or requests: support@estibaby.com.