Privacy Policy

Effective Date: June 1, 2026

Last Updated: July 15, 2026

BabyLens ("App") is intended for parents and guardians (legal representatives) aged 14 or older, who are the data subjects. Baby information is content entered and managed directly by the parent or guardian.

1. Information We Collect

• Account: Google or Apple account email address and name (via OAuth sign-in)

• Service profile: Nickname (auto-generated at sign-up), cumulative diary-writing days, country (only if you choose to set it)

• Baby profile: Name, date of birth, gender, photos

• Diary: Text, photos, mood, keywords

• Growth records: Height, weight, and other entries made by the guardian

• Supplies & inventory: Item details, stock change history

• Support inquiries: Inquiry content and category, plus app info used for reply notices (version, language)

• AI generation records: When you request AI diary generation, an analysis summary (generation status, review reasons, etc.) and your save/discard choice

• Push notifications: Device push token (FCM)

• Advertising identifiers: GAID/IDFA

• Automatically collected: Device information, app usage statistics, error (crash) reports

Your nickname and cumulative diary-writing days may be shown to other users if a participation ranking service is provided (your real name and baby information are never shown).

The App does not collect sensitive information such as biometric data. Baby photos are processed only for storage and display; no facial recognition or biometric identification is performed.

2. Purpose of Collection

• Account management: Identity verification via Google/Apple OAuth and service access

• AI diary generation: AI analyzes uploaded photos to create emotional parenting diaries

• Supply management: Tracking baby supply inventory and providing reminder notifications

• Cloud backup & sync: Restoring data after device changes and retaining data

• Personalized service: Providing personalized reports and summaries

• Advertising: Delivering personalized ads (AdMob)

3. Retention Period

Personal information is destroyed without delay once the purpose of collection and use is fulfilled.

• Account information: Until account deletion

• Diary, baby profile, growth records, supplies & inventory: Until the user deletes them or withdraws membership

• Photos stored in the cloud: Diary photos are retained in the cloud photo storage (R2) only for the last 7 days of creation/edit activity; photos past this window are automatically destroyed from the cloud (baby profile photos are kept for as long as the profile exists; diary text and other records are kept in the cloud until withdrawal; local data on the device, including photos, is kept permanently). However, individual records you delete are permanently destroyed after a 30-day grace period, and when you delete your account, all cloud data is permanently destroyed immediately.

• Support inquiries: Until account deletion

• AI generation records: Kept until account deletion to prevent misuse and preserve evidence (cannot be individually deleted)

• Diary data (local): Stored securely in the app's private storage on device, kept permanently

• Where retention is required by law, for the applicable period

4. Destruction Procedure and Method

• Procedure: When you delete individual records, they are soft-deleted and then permanently destroyed after a 30-day grace period. The grace period allows recovery from accidental deletion and error handling. When you delete your account, all cloud data is permanently destroyed immediately, without a grace period (joint diaries you wrote in another family's workspace are preserved in that workspace with only your author-identifying information removed).

• Method: Electronic files are deleted using technical methods that prevent recovery, including the rows in the cloud database and the photo files in the object storage (R2).

5. Outsourcing of Processing

To provide stable service, the App entrusts the processing of personal information as follows:

[Processor / Task / Retention period]

• SUPABASE PTE. LTD. / Cloud DB operation, authentication, server functions / Until the outsourcing contract ends

• Cloudflare, Inc. / Photo file storage (R2) / Last 7 days of activity (photos auto-destroyed); destroyed immediately upon account deletion

• Google LLC / Advertising (AdMob), authentication (OAuth), analytics, push, crash reporting (Firebase Analytics, FCM, Crashlytics) / Until the outsourcing contract ends

• Google LLC / AI diary generation (Gemini API) / Immediately after request processing (security logs up to 55 days)

• Telegram Messenger Inc. / Delivering real-time inquiry notifications to the operator / Until the inquiry-handling purpose is fulfilled

6. Cross-Border Transfer of Personal Information

While you use the service, the App transfers personal information overseas over the network (HTTPS) as follows (Article 28-8 of the Personal Information Protection Act):

[Recipient / Country / Transferred items / Purpose & retention / How to refuse]

• SUPABASE PTE. LTD. (privacy@supabase.com)

  - Country: Singapore (entity) / Tokyo, Japan (data storage)

  - Items: Account information, service profile (nickname, cumulative diary days), baby profile, diary text, growth records, supplies & inventory, push token

  - Purpose & retention: Cloud DB & sync / destroyed immediately upon account deletion (individual deletions: 30-day grace period)

  - Refuse: Withdraw membership (delete your account in the app)

• Cloudflare, Inc. (privacyquestions@cloudflare.com)

  - Country: United States and other global locations (automatic placement)

  - Items: Diary and profile photos

  - Purpose & retention: Photo storage (R2) / diary photos auto-destroyed after the last 7 days of activity; baby profile photos kept for as long as the profile exists; destroyed immediately upon account deletion

  - Refuse: Withdraw membership (delete your account in the app)

• Telegram Messenger Inc.

  - Country: United Arab Emirates (Dubai) and others

  - Items: Inquiry content and category, nickname, account email, user ID, country, app version and language

  - Purpose & retention: Real-time inquiry notifications to the operator / until the inquiry-handling purpose is fulfilled

  - Refuse: Do not use the in-app inquiry feature

• Google LLC

  - Country: United States

  - Items: Photos used for diary generation (deleted after processing)

  - Purpose & retention: AI diary generation / immediately after processing (security logs up to 55 days)

  - Refuse: Do not create photo diaries

• Google LLC

  - Country: United States

  - Items: Advertising identifiers, app usage logs, account information

  - Purpose & retention: Advertising, analytics, authentication / per Google's policy

  - Refuse: Device ad settings / decline iOS ATT

Timing & method: Transmitted over the network (HTTPS) while you use the service. Due to the global distribution of the photo storage (R2), data may be onward-transferred to other countries.

7. Children Under 14

This service is intended for guardians (parents and legal representatives) aged 14 or older. Baby profiles (name, date of birth, gender, photos) are registered and managed directly by the guardian, and the company processes them solely for the purpose of providing the service. Children under 14 cannot sign up for or use the service directly, and the company does not collect personal information directly from children. For information about children under 14, the legal representative holds the rights to access, correct, delete, suspend processing, and withdraw consent.

8. Security Measures

• Local data protection: Stored in the app's private storage on device (OS sandbox blocks other apps)

• Communication encryption: HTTPS encrypted communication

• Access control: Row-Level Security (RLS) ensures only authenticated users can access their own data

• Auth tokens: Stored in the app's private storage on device (OS sandbox blocks access by other apps)

9. Automatic Collection and Behavioral Information

The App collects advertising identifiers (GAID/IDFA) to deliver personalized ads and may allow a third party (Google AdMob) to collect and use behavioral information.

• How to refuse: On Android, go to Settings > Google > Ads and opt out of ad personalization; on iOS, decline tracking permission (ATT) to block behavioral information collection.

10. Automated Decisions

AI diary generation is an assistive tool; the user edits and confirms the generated result before saving. This feature does not constitute an automated decision affecting the user's rights or obligations.

11. Rights of Data Subjects and Legal Representatives

You (the data subject) and your legal representative may exercise the following rights at any time:

• Request access to your personal information

• Request correction of errors

• Request deletion (via the account removal feature)

• Request processing suspension

• Withdraw consent

You can exercise these rights through app settings or by contacting the data protection officer below.

12. Cloud Backup & Sync and Family Sharing

(a) Cloud storage & overseas transfer

This service stores baby profiles, diary text and photos, growth records, and supplies & inventory data in the cloud so they can be restored after device changes and shared with family. Data is stored on Supabase (Tokyo, Japan) and photos on separate object storage, Cloudflare R2 (United States and other global locations); this constitutes the overseas transfer of personal information described in Section 6. At sign-up, the guardian consent screen together with this Privacy Policy (Section 6) informs you of the transferred items, recipients, countries, purpose, retention period, and your right to refuse, and your consent is obtained. If you do not wish to consent, do not proceed with sign-up; if you have already signed up, you can stop the processing by withdrawing membership (deleting your account).

(b) Sharing with family members (provision to third parties)

When you use the family sharing feature to invite family members (such as a spouse/guardian or a viewer), the diary, photos, growth records, and supplies & inventory data linked to that baby (workspace) are provided to and viewable by the invited family members.

• Recipients: Family members you personally invite

• Items provided: Diary, photos, growth records, supplies & inventory linked to that baby

• Purpose: Joint management and viewing of parenting records among family

• Retention/use period: Until membership withdrawal or family access is removed (photos are auto-destroyed from the cloud after the last 7 days of activity)

You can adjust each family member's permissions (write/read) or remove members; when a member is removed, their server access (further sync, viewing, and writing) is revoked immediately. However, data already downloaded to that member's device before removal (local copies of diaries, photos, etc.) may remain on their device. Additionally, joint diaries written in a family workspace are preserved in that workspace even if the author deletes their account, with only the author's identifying information removed.

(c) Cloud retention & destruction

Diary text and other records are kept in the cloud until withdrawal. Diary photo files are retained in the cloud photo storage (R2) only for the last 7 days of creation/edit activity; photos past this window are automatically destroyed (baby profile photos are kept for as long as the profile exists; local data on the device, including photos, is kept permanently). When you delete individual records, they are soft-deleted and then, after a 30-day grace period, both the rows in the cloud database and the files in the photo storage (R2) are permanently destroyed; when you delete your account, all cloud data is permanently destroyed immediately, without a grace period. You can withdraw consent by deleting your account in the app, and all transmissions are encrypted with TLS (HTTPS).

13. Data Protection Officer & Grievances

For inquiries, complaints, or remedies regarding the processing of personal information, you may contact the data protection officer below.

• Email: bykwon.dev@gmail.com

14. Remedies for Infringement of Rights

To obtain relief for infringement of personal information, you may request assistance from the following Korean authorities:

• Personal Information Infringement Report Center: privacy.kisa.or.kr / 118

• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972

• Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301

• National Police Agency Cyber Investigation Bureau: ecrm.police.go.kr / 182

15. Policy Changes

Any changes to this privacy policy will be announced within the app in advance.