This Privacy Policy describes how Punn ("we", "us", or "our") collects, uses, shares, and protects personal information when you use the Punn mobile application ("App"). It is written to comply with the U.S. Children's Online Privacy Protection Act (COPPA, 16 CFR Part 312), the European Union General Data Protection Regulation (GDPR), the United Kingdom GDPR, and the Personal Data Protection Act B.E. 2562 (PDPA) of Thailand.
Punn is directed at parents and legal guardians, not at children. The personal information described in this policy is about a child but is collected from and controlled by the parent or guardian who uses the App. We treat all baby data as personal information of a child under 3 and apply COPPA-grade protections to it regardless of the parent's country of residence.
For the purposes of COPPA, the App operator is:
For the purposes of GDPR, UK GDPR, and Thai PDPA, the same entity acts as the data controller of the personal information collected through the App. For privacy requests, please email us with the subject line "Privacy Request".
When you create an account, we collect your email address, display name, and a Firebase-issued user ID. If you choose to sign in with Apple or Google, we receive only the information you authorize the provider to share (typically email and name). Authentication is provided by Google's Firebase Authentication service.
You provide your baby's name, date of birth, gender, and optionally a profile photo. This data personalizes age-appropriate features such as feeding ranges, sleep guidance, and developmental milestones.
You may upload photos to the in-app family photo feed and to your baby's profile. Photos are stored in Google Firebase Storage. They are visible only to you and to adult family members you have explicitly invited.
When you use the "Ask Punn" assistant, your text prompt and a structured context payload describing your baby are sent to our chat endpoint, which forwards them to OpenAI to generate the reply (see section 4.b). Our server does not store your messages or the context payload; it records technical metadata about each request (timestamp, token counts, the estimated AI processing cost, latency, request status, your user ID, and a hashed IP address) so we can operate the service reliably and keep it sustainable. Your chat history — the 200 most-recent messages per baby — is kept on your device only; older messages are pruned automatically.
You may record temperatures, medications and dosages, vaccines, doctor names, symptom descriptions, and free-text notes. Health data is treated as a special category under GDPR Article 9 and is collected only with your explicit consent (signified by your act of entering it into the corresponding tracking form).
You may record weight, height (length), and head circumference. We compare these to WHO Child Growth Standards for charts and reports.
You may log feeding sessions (including type, amount, duration, content, and food name for solids), sleep periods, diaper changes (including color, consistency, amount, and rash flag), pumping sessions, milk inventory entries, and developmental milestones. All of these fields may include free-text notes.
When you use the cry analysis feature, audio is recorded on your device and analyzed entirely on-device using a bundled ONNX machine-learning model. Only the resulting classification (for example, "hungry"), the confidence score, and an optional audio-quality warning flag are stored. The raw audio recording is not uploaded to our servers. The cry audio is analyzed in memory and is never uploaded as part of cry analysis. The only way a recording ever leaves your device is the opt-in anonymous donation described in section 2.m, which you turn on yourself and can change at any time.
If you invite a partner or family member, we store the family group, member roles, and share-link metadata in Firestore. Family members are adults; we do not invite children to the family share.
If you correct a cry-analysis result, Punn can send anonymous feedback to help improve the model. This is off by default and is controlled by an opt-in toggle in Settings → Privacy; nothing is sent unless you turn it on, and you can turn it off again at any time. When enabled, Punn uploads only metadata — Punn's prediction, your correction, and your baby's age as a coarse bucket (one of 0–3, 3–6, 6–12, 12–24, or 24–36 months). The exact age, your baby's gender, and any identifying information are not included, and no audio is uploaded through feedback. Audio is shared only through the separate, opt-in donation described in section 2.m.
Crash reports and non-fatal error reports are sent to Firebase Crashlytics. These contain stack traces, device model, OS version, and app version. They are configured to exclude user content and baby data. Crash reporting is disabled in debug builds.
If you subscribe to Punn+, RevenueCat (acting as our subscription processor) receives a pseudonymous app user identifier, the purchased product, the entitlement status, and metadata about the purchase. Apple and Google Play process the actual payment; we never receive your full payment-card details. If you redeem a Punn promo code, we store your user ID with the code, its campaign, the Punn+ period it gave and the time you redeemed it. We use this to give you Punn+ and to stop a code being used again, and we keep it until you delete your account.
Punn's cry analysis runs entirely on your device. Separately, you can choose to donate cry recordings to help improve the model. This is opt-in: nothing is ever shared unless you choose it, and you can turn sharing off at any time.
In Settings → Privacy you can set one of four modes:
What is collected when you share a single recording:
What is never collected or sent:
During the roughly 7-second capture the audio is processed on your device and is held in memory; the recording may pass through a temporary file on your device for that brief window, which is deleted immediately after processing. Nothing leaves your device unless you have chosen to share: either that one recording, or every analysed cry if you turned that mode on. When you consent to share, the recording is saved in a protected delivery queue on your device until it finishes uploading (at most 14 days), then removed. The donation is unlinkable by design: it is not tied to your account, name, or device identifier.
Medical-complexity exclusion: A per-baby setting in Settings → Privacy lets you exclude any baby under specialist or NICU care from donation entirely. When excluded, none of that baby's recordings can be shared, even if you change the mode above.
Where it goes and how long we keep it: Donated recordings are processed and stored on Google Cloud servers in the European Union (Belgium, europe-west1), in a dedicated storage location used only for this purpose. They are kept for up to 90 days and then permanently and automatically deleted. They are used only to retrain Punn's cry-classification model. They are not sold and are not shared with advertisers.
Alongside each recording we keep a small anonymous catalogue record (a random file identifier pointing to the stored audio, the predicted cry category, any correction you provided, a coarse age bracket, the audio format, and the month it was received — no account, device, or network identifiers). This catalogue record is stored in our database in the United States; the audio itself never leaves the European Union.
Legal basis and withdrawal: Because your baby's voice is a special category of personal data, we collect donated recordings on the basis of your explicit parental consent under GDPR Article 9(2)(a), given on your child's behalf. The data is anonymized at the point of collection. To withdraw, set the mode in Settings → Privacy to "Never"; this stops all future sharing. Recordings you have already donated are fully anonymous and cannot be retrieved or deleted on request; they are automatically and permanently deleted within 90 days of donation.
To understand which parts of Punn are helpful and which need work, the app records anonymous usage events — for example "a feeding was logged", "a report was generated", or "a screen was opened". These events are mostly feature names and counts, with two exceptions described below. They never include what you actually logged: no baby names or birth dates, no measurements (other than the coarse feed-size range described below) or health details, no notes, no chat messages, and no audio.
The first exception is nap and bedtime predictions. When the app has a nap or bedtime prediction for your baby and your baby's sleep starts, it records how close the prediction was: the difference in minutes (capped at 4 hours), whether it was a nap or bedtime, which nap of the day it was, whether the sleep started inside the predicted time range, your baby's age range (0–3, 3–6, 6–12 or 12+ months), whether predictions were still learning your baby's pattern, whether you have Punn+, and which prediction model made it (the one the app shows, or a newer one it only tests in the background to compare). This event never includes the times, dates, names or the sleep logs themselves, and it is held under the same random installation ID.
The second exception is feeding-time estimates. The app estimates on your phone when your baby is likely to feed next, using only the feeding logs already in the app; nothing extra is sent to make the estimate. When the next feed is logged on your phone, it records how close that estimate was and how close a fixed-interval feeding reminder would have been: each difference in minutes (capped at 4 hours), whether the feed fell inside the estimated half-hour window, your baby's age range (0–3, 3–6, 6–12 or 12+ months), a coarse size range of the previous feed (for a bottle: under 60 ml, 60–120 ml or over 120 ml; for a breastfeed: under 10, 10–20 or over 20 minutes), whether the estimate was still learning your baby's pattern, whether feeding reminders were on, whether you have Punn+, and which estimate model made it. This event never includes the times, dates, exact amounts, names or the feeding logs themselves, and it is held under the same random installation ID.
These events are recorded under a random installation ID created when the app is installed. This ID is not connected to your account, and we have no way to look up which events belong to which person. Deleting the app discards the ID; a reinstall creates a new, unrelated one.
Google LLC processes these events for us through Firebase (Google Analytics), and we analyse them in Google BigQuery on Google Cloud (European Union). We use them only to improve the app — never for advertising, and we never sell them.
You can turn this off at any time in Settings → Privacy → "Share anonymous usage statistics". Turning it off stops collection immediately.
With Data share you can show a summary of your baby's log on someone else's screen, in a web browser, without them installing Punn. You need to be signed in. The other person opens punnbaby.app/s, which shows a QR code and a 6-character code. You scan the QR code or type the code in the Punn app, then decide exactly what to show: which categories (feeding, sleep, diapers, growth, milestones, teeth, health events, medications, or pumping), which dates (any dates from your baby's birth to today), and whether your baby's name is shown. The name is shown by default and you can turn it off before sharing; your baby's age (for example "3 months") is always shown. Nothing is shared until you tap Show on this browser.
The summary contains daily totals and, for feeding, sleep, diapers and medications, each individual entry with its time. Health events show only the type of event, a recorded temperature, and a vaccine name. Medications show only each medicine's name, dose, and the time it was given. Your baby's sex is included only if you share growth, so the measurements can be read against the matching WHO growth chart; growth measurements are shown with your baby's approximate age (to about 3 days), and your baby's date of birth is never sent as a field. The dates of the entries you share are shown, so a share covering a long period can show roughly when your baby was born. Notes, symptom descriptions, and other free text you have written are never included, and neither are photos, chat messages, or who in your family logged an entry.
When you confirm, the app builds the summary on your device and uploads it to our server (Google Cloud Run, Singapore). We store that copy in our Google Cloud Firestore database in the United States (us-central1), together with your user ID, the categories you chose, the language of the summary, when you shared it and when access ends, how many times the page loaded it, and a coarse description of the browser it was shown on, taken from that browser's user-agent (for example "Mac · Chrome"), so you can recognise it in the app. We keep a record of each time you share or end access (your user ID, the categories, and the times — never the shared data itself) so we can show that the sharing was your choice.
Only the one browser that showed the code can open the summary, and only once you confirm on your phone. A code works once and expires after 5 minutes. The summary stays visible on that screen for at most 2 hours; it is not saved on the other person's computer, and closing the browser tab removes it. We do not store the codes or the access key the browser receives, only one-way fingerprints of them. The page is not indexed by search engines, loads nothing from other websites, and does not pass anything on to them. No one can send a request to your phone: a share exists only because you scanned or typed a code yourself. Anyone who can see that screen while it is open can see what you chose to show, so share only with people you trust.
You can see which screens are showing your data, and end access at any time, in the app (Helper → Data share, and Settings → Data & Privacy → Shared screens). Ending access removes the summary from that screen within about a minute and deletes the shared copy immediately. When the 2 hours end, the copy is deleted automatically shortly after (usually within a day). The record of each share is kept until you delete your account. Deleting your account deletes all shared copies and their records. To send your baby's data to someone who is not with you, use a PDF report instead.
We process this data only because you choose to share it: your explicit consent, given by confirming each share (see section 5.b). The person viewing the screen is not asked for any personal information. Like every request to our server, the requests their browser makes are recorded in our server access logs (see section 6).
Every signed-in account has its own invite code (for example PUNN-ABC234) that you can share as a link. We store your code, the times your invites earned a reward in the past year (for the invite reward limit), and the times of any attempts to use your code that did not work in the past year (never who tried or why).
If you accept a friend's invite, we store your first name (the first word of your account name, if you have one), the code you used and whose it is, when you accepted, your device's time-zone offset at that moment (so your days are counted in your local time), and the dates within the following 14 days on which you logged something in Punn. To check that you can accept, our server looks at when your account was created, whether you have ever had Punn+ (through RevenueCat, see section 3.c), and whether you are in a family with the friend who invited you. To count your days it looks only at when your entries were saved and who saved them, never at what they say.
The friend who invited you sees your first name, when you accepted, how many days you have logged (a count, not the dates), and whether the invite worked; they never see your baby's data. If an invite cannot be used, the person who sent it sees only a count of attempts that did not work, never who tried or why. When an invite works, each side's free month of Punn+ is granted through RevenueCat and linked to that person's user ID; if you already have a subscription, we keep a note of the months owed until it ends.
A code from an invite link is kept on your device until you accept or decline it. The record of an accepted invite is deleted 180 days after the invite finishes (it worked and the rewards were settled, or its time ran out), or earlier if the invited friend deletes their account. If you delete your account, we delete your code, your reward history, any months still owed, and any invite you accepted, and we remove your user ID from invites that others accepted from you.
If you turn on Settings → Data & Privacy → "Share anonymous sleep summaries" (off unless you choose it), once a month Punn sends a summary of your baby's sleep for each finished month of age: how many naps and wake windows were logged, the average and spread of the wake window before each nap and before bed, the average bedtime, how many naps per day, and how long naps lasted, in broad ranges. It includes your baby's age in whole months and the major app version. It never includes individual logs, dates, names, your account, or any device or installation identifier. Only the device signed in as the baby's owner sends it.
Our server adds each summary to combined figures from other babies, stored in our United States database, and keeps nothing else from the request; your IP address is used briefly to limit abuse and is not stored with it. We cannot link a summary to you, so we cannot delete a summary once it is sent. Turning the setting off stops future sending and deletes anything not yet sent.
We use the summaries only to improve sleep predictions — never for advertising, and we never sell them. We release them only for groups of at least 50 babies of the same age in months, with statistical noise added, and keep them for up to three years. We maintain this information in de-identified form and will not attempt to re-identify it.
We use the following service providers to operate the App. Each acts as a processor on our behalf, under a written data processing agreement where required by law.
We use the following Google services:
https://api.punnbaby.app, which proxies your prompts to OpenAI.ep1.facebook.com) so we can measure which ads bring
parents to Punn. This is used for advertising measurement only; your
baby's data is never sent to Meta and never used for ad targeting.
Turning analytics off in Settings, or declining the tracking prompt,
stops it.NotoSansJP-Regular.ttf),
which indicates which of these languages your app or report uses, to
Google LLC. No account information, sign-in token, or baby data
is included. The App checks the font against a fingerprint built
into the App and keeps it on your device, so it is not downloaded again.
If the download fails — for example, when you are offline —
the rest of the App keeps working, and when you create a report that
needs the font the App tells you the font could not be downloaded.api.punnbaby.app) — before downloading, the
App asks our server for the short-lived links described above, which
stop working after 15 minutes. With that request the App sends the names
of the files it wants, whether your device reports an active Punn+
subscription, and either your Firebase sign-in token, if you are signed
in, or, if you are not, your anonymous RevenueCat app user ID; our
server also sees your IP address, as it does for any request. Our server
uses the token or ID only to check whether you have Punn+ — a
signed-in account against the subscription status stored with it, an
anonymous ID by asking RevenueCat (section 3.c) — and to limit how
many requests one person can make in an hour. It does not store the
token, the ID, or the list of files you asked for. It keeps only
one-way hashes of your user ID or RevenueCat ID and of your IP address,
in the server's memory, for the Punn+ answer (about ten minutes, or
fifteen seconds when the answer is no) and for the hourly request count
(up to an hour). Like every request to our server, the request is
recorded in our server access logs (see section 6).Data residency for these services: the Cloud Firestore database (user documents, baby profiles, synced tracking data, and family-sharing metadata) is hosted in the United States (us-central1). The default Firebase Storage bucket (photos) and the chat Cloud Run backend run in asia-southeast1 (Singapore). Donated cry audio (section 2.m) is stored in the European Union (europe-west1, Belgium) in its own dedicated bucket.
OpenAI (United States) acts as our processor for generating Ask Punn replies. When you use the Ask Punn assistant, your typed prompt, your recent chat history, and a structured context payload describing your baby are sent from our Cloud Run endpoint to OpenAI's API so OpenAI's language model can generate the reply. The context payload includes your baby's age in days and recent tracking summaries, which can include health entries you have logged (for example medications and dosages, vaccines, symptoms, and notes). Your baby's name is never sent — the app replaces it with a placeholder before the request and substitutes the real name back into the reply on your device. Your baby's date of birth is not sent. We do not send cry audio, photos, or your account email to OpenAI.
Our own server does not keep a copy of your messages or the context payload (section 2.d). OpenAI processes this data under its API terms: it may retain API inputs and outputs for a limited period for abuse monitoring, and it does not use data submitted through its API to train its models.
RevenueCat (United States) manages Punn+ subscription entitlements. It receives a pseudonymous app user identifier and purchase metadata. See revenuecat.com/privacy.
Apple and Google distribute the App through their respective stores and handle in-app purchases. Their privacy practices apply to data they collect during download and purchase.
We show NO ads inside the App and we do NOT sell your personal information. To measure which of our own ads bring new parents to Punn, we use one advertising-measurement SDK (Meta) for attribution only. It is off by default and turns on only if you leave the in-app analytics setting enabled and, on iOS, allow tracking when the system prompt asks. Your baby's data is never used for ad targeting, and we do not allow our processors to use your personal information for their own advertising purposes. Both the analytics and Meta measurement can be switched off in the app at any time.
We use your tracking data, baby profile, and cry analysis results to provide the features of the App: event logging, charts, insights, growth tracking, reports, and on-device cry classification.
We use your prompt and the structured context payload (see section 3.b) to generate a response. The server system prompt instructs the model to refuse medical questions and to redirect you to a pediatrician.
If you sign in, your data syncs to Firestore so it is available across devices and to adult family members you have explicitly invited.
If you opt in to ML feedback uploads, we use that data to improve the cry classification model and, if you turn on sleep summaries, to improve sleep predictions.
We use Crashlytics reports to diagnose bugs and improve reliability. We do not use personal information for behavioural advertising.
Most processing (tracking, sync, family sharing, cry analysis, subscription management) is necessary to provide the App service you have signed up for.
Health information (temperatures, medications, vaccines, symptoms, doctor names), cry-audio uploads, and any data revealing the child's physical or mental health is processed only on the basis of your explicit consent, signified by your active choice to enter or upload it.
We rely on consent for: opt-in ML feedback uploads, partner invitations, anonymous cry donation, and anonymous sleep summaries. For sleep summaries, where sleep data counts as data concerning health, your choice to turn the setting on is also your explicit consent under Article 9(2)(a).
We have a legitimate interest in security monitoring, abuse prevention, Crashlytics-based reliability work, and the anonymous usage statistics described in section 2.n. We have balanced this against your rights and offer the controls described in section 7, including the ability to switch off usage statistics in the app.
Because the personal information is about a child, parental consent is the consent we obtain and rely on. The parent or legal guardian grants consent on the child's behalf.
Under COPPA, GDPR, UK GDPR, and Thai PDPA, as the parent or legal guardian you have the right to:
You can exercise the access, rectification, and erasure rights directly inside the App by viewing, editing, or deleting individual records. For any other request, email admin@punnbaby.app with the subject "Privacy Request" and we will respond within 30 days.
We do not condition your child's participation in any App activity on the disclosure of more personal information than is reasonably necessary to provide that activity (COPPA 16 CFR 312.7).
The data subjects whose information is collected through the App are children under 3 years old. The App is directed at the parent or legal guardian. We do not knowingly allow children to create accounts, enter their own information, contact other users, or post publicly.
Parents and legal guardians grant consent on the child's behalf. By creating an account, entering your baby's profile, or logging tracking data, you confirm that you are a parent or legal guardian of the child and that you consent to the collection, use, and sharing of the child's personal information as described in this policy.
We use the child's personal information only to support the internal operations of the App (providing the tracking features, syncing across the parent's devices, generating reports for the parent, and improving the cry classification model or sleep predictions when the parent opts in). We do not use it for behavioural advertising or third-party marketing.
If you believe we have collected information from a child without the necessary parental consent, or you wish to review or delete your child's data, please email admin@punnbaby.app.
Personal information may be processed outside your country of residence:
For transfers from the EU/EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Addendum) as a transfer mechanism with our U.S. processors. EU users should be aware that synced app data is stored in the United States and photos in Singapore by default. For users in the EU/EEA, donated cry audio stays within the EEA, so no Chapter V transfer applies to that data.
You can delete your account and your child's data from inside the App:
Account deletion removes:
Family-sharing note: if you are the owner of a baby, deleting your account permanently deletes that baby and all of its tracking data for every family member who shared it. If you are a non-owner member, deleting your account removes only your own membership — data you logged into a baby owned by someone else remains with that owner.
Account deletion does not remove immediately, except for the deletion-suppression record described below, which we retain for security:
For any deletion request you cannot complete in the App, or to request a copy of your data, email admin@punnbaby.app and we will respond within 30 days.
In compliance with the Personal Data Protection Act B.E. 2562 (PDPA):
We will notify you of material changes to this policy in-app and by updating the "Last updated" date at the top. Where the change affects the personal information of a child and requires new parental consent under COPPA, we will request that consent before applying the change to existing accounts.
For any privacy question or to exercise your rights:
We will respond to verifiable requests within 30 days.