Where your baby's data lives
When you track a baby, you’re recording something intimate: how a small person eats, sleeps, and is cared for, shared among the handful of people you trust most. We think you should know exactly where that data lives. Here’s the honest version — the engineering facts, and the places we’re careful not to over-claim.
A note on honesty: our published privacy policy is still under legal review before launch. This post describes decisions already made and where data physically sits — an engineering fact we can state plainly. The precise legal wording is the lawyers’ job, and we’re not going to put words in their mouth here.
Everything that matters is in Zurich
Every server that stores or processes your family’s data runs in Switzerland — specifically Google Cloud’s Zurich region (europe-west6). That’s not a default we happened to land on; it’s a hard requirement we enforce in our infrastructure code, so no one can accidentally deploy your data somewhere else.
Concretely, that one decision covers essentially the whole system:
- Your account and sign-in live in our own database in Zurich. We run authentication in-process against that database rather than handing it to a third-party identity service, so there’s no separate place your login data quietly ends up.
- The shared timeline — every feed, diaper, sleep and note — is in that same Zurich-hosted database.
- Files, when we add them, land in Zurich storage under the same rule.
Identity, the live sync engine, event data, storage: one region, one country.
What leaves Switzerland — and what doesn’t
A hard requirement is only meaningful if you’re honest about where it isn’t fully met. A few services can’t be Swiss-pinned, so we keep that list short and specific — and in every case, your logged health data stays in Switzerland. What crosses a border is metadata, not your baby’s records.
- Push notifications. When push ships, it’ll be delivered through a global Google service that isn’t regionally pinned. It carries only notification metadata — a device token and a short message — never the content of a health event.
- Payments. Subscriptions run through Stripe (on the web) and Apple or Google Play (in-app). Your card details never touch our servers at all; only the transaction metadata those processors need flows through their own systems.
- AI assistants you connect. If you choose to connect an AI assistant to your Home, whichever provider you pick processes what you share on their own infrastructure, outside our control. It’s entirely opt-in, and you decide which Home and what scope you grant. (More on how that works in our MCP guide.)
That’s the complete list. If it grows, this is where you’ll read about it.
No ads, and no exceptions
We make money from subscriptions — not from advertising, and never by selling your data. There are no third-party ad trackers in the app. Your child’s data is not a product, and there’s no asterisk on that sentence.
Your data stays yours
Two rights we treat as non-negotiable, because they are:
- Export, free, any time. You can download your complete history as CSV or JSON on every tier, including Free. Data portability isn’t a premium feature; it’s your right, so it’s never paywalled.
- Erasure that means it. Delete a kid or your whole Home and the underlying records are hard-deleted — not just hidden from view.
We also don’t collect fields “just in case.” A child’s real name isn’t required beyond what the app shows you.
Why we bother
Data residency is genuinely hard — a single Swiss region constrains things like backups and disaster recovery in ways a sprawl-everywhere setup never worries about. We took that on deliberately. Infant health data, shared across caregivers, deserves an answer to “where does it live?” that’s a specific place on a map — Zurich — rather than a shrug. That’s the answer we can give you today, and we’ll keep this page honest as the formal policy is finalized.