Privacy Policy

Last updated: 9 September 2026

1. Who we are

Little Waves ("Little Waves", "the App") is operated by Mimi Studio d.o.o., a limited liability company organized under the laws of the Republic of Slovenia, with its registered office at Ulica Gubčeve brigade 74, 1000 Ljubljana, Slovenia ("Mimi Studio", "we", "us").

This policy explains what Little Waves collects, why, who it is shared with, and what you can do about it. For the purposes of the General Data Protection Regulation (GDPR), Mimi Studio is the data controller. It covers the iOS and Android apps, the website at www.littlewavesapp.com, the operational web application at app.littlewavesapp.com, our emails, and support.

Little Waves is a baby development companion for the first two years. It is designed so that the whole core experience works from the due date alone: what you log about your baby only sharpens what you see, and refusing to log anything costs you nothing.

2. The short version

• Most of what Little Waves holds is information about your child, and it is health data in the eyes of the law. Every part of it is collected only with your separate, explicit consent, and withdrawing that consent erases it. Section 4 is the most important part of this document.
• Nothing about your child's state ever reaches analytics or advertising services. Not what you logged, not which wave is open, not a measurement, not a date. Section 14.
• You do not need an account to use Little Waves. One is created only after a purchase, so that your family can share one baby's records and recover them on a new phone.
• Little Waves sends no push notifications and holds no push token. Every reminder is scheduled by your own phone.
• Your diary, your history and the Book of Firsts are yours: readable and exportable from inside the app whatever your subscription status.
• You can delete your account, and everything attached to it, from inside the app.

3. What we collect

3.1 About you, the parent

• Account details — your email address, if you create an account. We use a one-time confirmation code rather than an app password. An account can be created only after a purchase is confirmed.
• Family membership — the invitation code you share with a partner, and who is linked to which family (section 7).
• Marketing preference — whether you asked for our newsletter. It is a separate, initially unticked choice, never bundled with anything else.
• Support correspondence, if you write to us.

3.2 About your child

• Profile — a first name and gender if you choose to give it. A child photo, if you add one, stays on your device in v1. We do not upload it, back it up, or share it with a partner.
• Due date and birth date — the one input the app cannot run without. Read together they tell the app whether your child was born early and by how much, which is why the early waves count from the due date. The birth date can be refused; the app then uses the due date for everything.
• Signals — the days you log crying more than usual, holding on tight, broken sleep, feeding changes or big feelings, or "nothing unusual", with the date and which parent logged it.
• Firsts — the milestones you tick (first smile, first steps and so on), with the date you observed them, and any Firsts you add yourself.
• Measurements and diary logs — weight, length, head circumference, sleep and feeding logs, if you enter them.
• Diary entries — the stories and notes you write. Photos attached to a diary entry stay on your device in v1 and are not part of the shared record.
• What the app works out from all of this — which wave is open, whether a rough stretch has been detected and when it started, the answers Why today? gives you, and the recap after each wave. An inference about your child is health data as much as its inputs are, and it is treated the same way.

3.3 Collected automatically

• Install and device identifiers — an install identifier, your device's vendor identifier, and on iOS the advertising identifier only if you allow tracking when iOS asks.
• A coarse age band for your child (for example "6–9 months"), derived from the due date, used to key the weekly activity and as an analytics axis. Never the dates themselves.
• Usage — which screens you open, which cards you read, that a log was saved (never what it contained), which activities you completed.
• Network connection — services the app connects to necessarily receive the internet address used for that connection. Little Waves tells Mixpanel not to use that address for location enrichment (ip: false) and does not request a city, region or country. The app requests no location permission and never reads your device's location.
• Diagnostics — crash and error reports, scrubbed of anything about your child before they leave the phone.

3.4 From third parties

• Subscription state from Apple, Google or Stripe through RevenueCat: the transaction identifier, which plan, whether it is active, and its dates. We never receive your card details, and we cannot see them.

4. Your child's data, and your consent

Signals, Firsts, measurements, the due and birth dates and everything the app infers from them are data concerning health under Article 9 of the GDPR. That has four consequences, all of which are built into the app:

1. Each of them is collected only with your explicit consent, asked for on a screen of its own, in plain language, initially unselected. It is never bundled with the Terms or with creating an account.
2. Refusing costs you the personal layer, not the app. With nothing but the due date the app still tells you which wave is open, what tends to appear, when most babies are through it and what opens next. It simply cannot say anything about your baby's days, because you have not told it.
3. None of it ever reaches an analytics, attribution, advertising or marketing service. Section 14 says exactly what those services receive.
4. Withdrawing consent erases, rather than merely stops. Your logs, Firsts, measurements and the history the app built from them are deleted; the recap that survives is the generic "what typically happens in this wave" one.

You can withdraw any of these consents at any time in Settings → Privacy & data.

The due date is the one health-related input the app cannot run without. Refusing it ends setup, because there is no product without it. We process the due date with your explicit consent under Article 9(2)(a) GDPR.

Your child is a data subject who is not a user. You, the parent or legal guardian, act for them. Deleting your account deletes your child's records with it; a partner you invite reads and writes the same records under section 7.

5. How we use your information

6. What the app does not do

• It does not send your child's data to any analytics or advertising company.
• It does not read or write Apple Health or Health Connect.
• It does not use a machine-learning model of any kind. Every answer the app gives is a rule applied to what you entered and to a fixed, authored catalogue of cards. No text you write is sent to any model.
• It does not request your location, contacts or microphone. It may ask for the camera or photo library only when you add a local photo.
• It does not show advertising.
• It does not sell personal data.

7. Sharing with your partner

One family, one set of records. The parent who set up the family can invite one partner with a code; the partner sees and can log the same child. The inviting parent can revoke the invitation at any time. Both of you log; entries merge rather than overwrite, so nothing one of you wrote is lost to the other.

A partner who leaves the family, or deletes their own account, removes their link to it; the family and the child's records stay with the parent who owns them. Entries about the child that the leaving partner authored stay with the child's record.

8. Legal bases (GDPR Article 6, and Article 9 where noted)

• Explicit consent (Article 9) — the due and birth dates, signals, Firsts, measurements and diary health logs, and everything inferred from them. Separate, refusable, withdrawable; withdrawal erases.
• Contract — account details, the child's profile, diary text and photos, family membership, subscription state. We cannot provide the service without them.
• Consent — the advertising identifier (through iOS tracking permission), marketing email.
• Legitimate interests — product analytics, crash diagnostics and fraud prevention, balanced against your rights. You may object.
• Legal obligation — transaction records we must keep for tax and accounting purposes.

9. Who we share it with

We share personal data with the following processors, each under a data processing agreement. None of the first four services in the second table ever receives your child's data.

DeepL translates our authored product copy and receives no personal data. If we add a processor, this list changes before the processing does.

10. International transfers

Your child's account and family records are stored in the European Union in Supabase's eu-central-1 region. Child photos are not uploaded in v1.

Several processors in section 9 are in the United States. Those transfers are made under the Standard Contractual Clauses approved by the European Commission, or under the EU–US Data Privacy Framework where the processor is certified, together with the additional safeguards their agreements require. We review the applicable safeguard for each provider before enabling it.

11. How long we keep it

Child photos stay only on your device in v1. Removing the app, clearing its local data, or losing the device may remove them; keep originals in your own photo library if you want another copy.

12. Your rights, and the buttons that exercise them

Under the GDPR you may: access your data; correct it; have it deleted; restrict or object to processing; receive it in a portable form; and withdraw consent at any time without affecting what was done before.

Export is built into the app, and it is also the product's own promise. The Book of Firsts — the diary, every First, every recap — can be exported from Settings → Privacy & data at any time, whatever your subscription status. The same export is your portable copy under the GDPR.

Deletion is built into the app. Settings → Privacy & data → Delete account removes your account and, if you own the family, every child profile and its records, immediately and permanently. A partner's deletion removes their own account and their link to the family; the child's records stay with the owner. Deletion propagates to the processors in section 9 within the periods in section 11.

Two things deletion does not do, and both are outside our control:

1. It does not cancel your subscription. Only Apple or Google can do that, and you must cancel in your store account or you will continue to be charged.
2. It does not delete transaction records we are legally required to keep.

For anything else, write to [email protected]. You may also complain to your national supervisory authority; in Slovenia that is the Information Commissioner (Informacijski pooblaščenec).

13. Children

Little Waves is for parents. You must be at least 16 to use it. The app is not designed for children and is never presented to them; your child is the subject of the records, not a user. If you believe someone under 16 has created an account, write to us and we will delete it.

14. Analytics, tracking, and what never leaves the app

Little Waves shows no advertising.

What analytics receives is the fact that a screen was opened, a card read, a log saved or an activity completed, together with the coarse age band and the identifiers in section 3.3. What it never receives is anything about your child's state: no signal kind or count, no First, no measurement, no date, no wave, no rough-stretch detection, no answer, no corrected-age flag, and no text you typed anywhere. The app is built so that these values have no path to an analytics or advertising destination.

On iOS, before any attribution service starts, Little Waves asks for permission through Apple's App Tracking Transparency prompt. If you decline, or never answer, no advertising identifier is collected and no attribution or advertising service receives anything about you. Declining changes nothing about how the app works. You can change this at any time in iOS Settings → Privacy & Security → Tracking.

15. The website

www.littlewavesapp.com is a public legal site. It uses no cookies, local storage, analytics, advertising pixels, forms or accounts. Optional tracking will not be added unless this policy is updated and any required consent design exists first. The public site does not sell in-app digital goods or handle account data.

16. Email

• Account email (confirmation codes, password reset) is sent by Supabase and cannot be turned off while you have an account.
• The weekly digest is a service email sent to account holders with a one-click unsubscribe that stops only the digest. It carries generic content keyed to your child's age band — what is typical now, one activity — and a link into the app. It never contains your child's own logs, Firsts, measurements or wave state, because those never leave our systems for an email service.
• Newsletters are sent only if you opted in, separately, and stop when you unsubscribe. Unsubscribing from the newsletter does not affect the digest or account email, and the other way round.

17. Notifications

Little Waves sends no push notifications and holds no push token. Every notification — a wave opening, a rough stretch detected or settled, a recap ready, the weekly digest — is computed on your phone from the due date and your own logs, and scheduled by your phone. If you deny notification permission, the app works normally; you will just not be told.

18. Security

Every table holding your data enforces row-level security scoped to your family: the database itself refuses to return one family's rows to another, and this is enforced by the database, not merely by our code. Elevated credentials exist only on our servers and never inside the app. No system is perfectly secure, and we do not claim otherwise.

19. Changes

We will post any change here and update the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.

20. Contact

Mimi Studio d.o.o. Ulica Gubčeve brigade 74 1000 Ljubljana, Slovenia

[email protected]