Privacy

Who operates Cami#

Cami is built and operated by Ricardo Canales, an independent developer. For anything on this page, write to hello@camibaby.com.

Under data protection law, including the GDPR in the European Union and the UK GDPR, Ricardo is the controller of your personal data: the person who decides how it is used and answers for it. The same address reaches him for any question about your data or your rights.

What is stored, and why#

Only what the app needs to work:

• Your account — your email address, the name you choose, an optional photo, and how you sign in. This identifies you and lets you sign in on more than one device.
• Your family — the family name, who belongs to it and in which role, and the invite code used to join.
• Your baby's profile — the name you give and the birth date, or the due date if you add a baby before the birth. Optional: sex, birth details such as the time, weight, length, head circumference and place of birth, the schedule settings you choose, and a photo, emoji and colour.
• What you log — nursing sessions, bottles, solid foods, sleep, diapers, pumping, growth measurements, temperature, medicine, vaccines and, before a birth, contractions. Each entry keeps its time, its details, any note you add, and which member logged it.
• Your phones — a token from Apple for each phone, so the service can update Live Activities, and the app version each phone runs.
• What you choose to send — feedback reports and the replies on them (see Feedback and email), answers to surveys in the app, votes on the app's roadmap, and, for Founding Family, your referral code and the families that joined with it.
• Requests to rate Cami — whether the app has asked you to rate Cami, which version of the request you get, when each one appeared, what you tapped, and the number of stars you picked, if you picked any. Cami never sees your App Store rating or review: Apple's rating prompt tells the app nothing.

All of it exists to run Cami, and above all to show your family the same timeline on every phone.

To work, Cami needs an email address for your account and, for each child, a name and a birth or due date. Everything else you add is your choice.

The legal basis for each use#

Data protection law in the EU and the UK asks for a legal basis for each use of personal data. These are Cami's:

• Running the service you signed up for — your account, your family and its members, signing in, your phones' tokens, keeping every phone in sync, the codes Cami emails you, and Founding Family referrals. Cami needs these to give you the app you asked for, so the basis is the contract with you.
• Your child's log and birth details — feeds, sleep, diapers, pumping, growth, temperature, medicine, vaccines and, before a birth, the due date and contractions can all reveal health. Cami treats them as health data and uses them only with your explicit consent, as the adult responsible for the child. You can withdraw it at any time by deleting entries, a child or your account (see Your rights). Withdrawing does not undo use that was lawful before it.
• What you choose to send — feedback reports, diagnostic logs, survey answers and roadmap votes are used with your consent, which you give each time you send one. The app asks before it sends its first diagnostic log, and you can turn the log off for any report.
• Counting and security — the usage counts, the technical logs and the limits on sign-in attempts. These rest on Cami's legitimate interest in a service that works, stays secure and is not abused. The counts contain no names, notes or entries, and you can object to these uses.
• Requests to rate Cami — the record of each request rests on Cami's legitimate interest in asking for ratings in the way that bothers people least, and in not asking too often. It is linked to your account so that every phone you use counts the same requests. You can object to this use.
• When the law requires it — keeping data, or giving it to an authority, when a law obliges Cami to.

What Cami does not do#

• No analytics or tracking software. The app contains no analytics, crash-reporting, advertising or tracking software. It uses GRDB for its local database and AppAuth for Google sign-in. Neither library collects telemetry. The app does not read your advertising identifier, and nothing follows you across other apps or websites.
• Counting, not tracking. The service counts how it is used, on Cami's own Cloudflare account: for example, how many entries of each kind are saved, sign-ins and errors, how many people have the app open, which app versions are in use, and the country a request comes from. These counts contain no names, email addresses, notes or entries. A family appears in them only as a code that cannot be turned back into the family.
• No selling. Your data is never sold or rented, and never given to advertisers or data brokers. It goes only to the service providers named on this page, who handle it for Cami and for nothing else, or to an authority when the law requires it.
• No advertising. There are no ads, and nothing is profiled to target you.
• No automated decisions. Nothing about you is decided by software alone in a way that has a legal or similarly significant effect on you.
• No reading your data. It is not read for any purpose beyond running the service, answering you, and fixing a fault you report.

Your baby's information#

Most of what Cami holds describes a child who cannot consent for themselves. It is treated as sensitive throughout, and in the app it is only ever visible to the members of your family. A due date and the contractions you time before a birth are pregnancy information, and they are treated the same way.

Cami is a tool for parents and caregivers. It is not directed at children, and children do not use it or create accounts in it. Everything about a child is entered by the adults in the family, and Cami uses it only with your explicit consent (see The legal basis for each use). As the child's parent or guardian, you can use the rights in Your rights on their behalf.

Signing in#

You can sign in with Apple, Google, or an email address and a password. When you use Sign in with Apple, Apple confirms who you are and passes back an identifier and, if you allow it, your email address and name. Your Apple password is never seen or stored by Cami. If you use Apple's Hide My Email, Cami only ever sees the relay address.

When you choose Google, a secure browser sheet opens Google's sign-in page. Google confirms your identity and gives Cami your account identifier, email address, and name. Cami requests no access to Gmail, Drive, contacts, or your other Google data. Your Google password stays with Google, and your baby's information and family logs are not sent to Google. Google receives the network information needed to handle sign-in, such as your IP address, under Google's privacy policy.

When you use an email address and a password, the password is stored only as a salted hash, never as the password itself. Codes that Cami emails you, for example to reset a password, are sent through Cloudflare.

Where the data lives#

Cami runs on Cloudflare, which stores the database, the photos you upload and a daily backup copy of each family's log, carries traffic between your phone and the service, and sends Cami's emails. Cloudflare processes this data on Cami's behalf and under contract, and does not use it for its own purposes.

A copy also lives on each phone that is signed in, so the app keeps working without a connection.

Unless you turn it off, the app also saves a readable copy of your family's log to your own iCloud Drive, about once a day (or once a week, if you choose), and keeps the 14 most recent unless you choose another number. Apple holds that copy under your iCloud account, and Cami cannot see it. To turn it off or change those settings:More ▸ Your Family ▸ Data & Privacy ▸ iCloud Backup.

Apple's push notification service carries Live Activity updates to your family's phones when you use them. Those messages contain what the card shows: the child's name, what is running, its timer and, for nursing, the side.

Cloudflare keeps the database of accounts, families and children, the photos, the report files and the daily backups in the United States. Each family's log is kept in a Cloudflare data center near where the family was first used, which may be inside or outside the EU or the UK. Apple, GitHub, Google, Anthropic and OpenAI, named on this page, are based in the United States and can process data there.

So if you live in the EU or the UK, some of your data leaves it. Cloudflare, GitHub and Google are certified under the EU-US Data Privacy Framework and its UK Extension, which the EU and the UK accept as protecting data sent to certified companies. Apple states that its transfers of data from the EU and the UK are covered by standard contractual clauses. To ask what protects a transfer, or for a copy of those safeguards, write to hello@camibaby.com.

This website, camibaby.com, sets no cookies, stores nothing in your browser and loads nothing from other companies. Cloudflare serves it. When you tap a download button, the site counts the tap on its way to the App Store: which button, which page, your country and the page's language. Nothing in that count identifies you.

Feedback and email#

Feedback is only sent when you send it: More ▸ Help Center ▸ Get Help or Share Feedback, or by shaking the phone. Each report becomes an issue in a private GitHub repository that Cami uses to track and fix problems. GitHub, a Microsoft company, stores it on Cami's behalf. A report holds:

• what you write, the type you choose, and any screenshots you attach;
• your name, the first characters of your account and family IDs, your phone model, iOS version and app version, and whether you are happy to get a reply. Your email address is not put in the report;
• if Include diagnostic logs is on, that phone's diagnostic log and the service's record of the family's notifications from the last two days. The log holds entry types, activity times, errors, and family and device IDs from every family used on that phone. It is written to leave out names, notes and photos.

The diagnostic log is on by default, and the app asks you to confirm before it first sends one. You can turn it off for any report. Screenshots and log files are stored with Cloudflare at links that cannot be guessed, and the report links to them.

Answers to surveys in the app are filed in the same GitHub repository, with the first characters of your account or device ID.

A report also starts a conversation with Ricardo, which you can read and answer in More ▸ Help Center ▸ Your Reports. Your report and every reply, yours and his, are stored in Cami's database with Cloudflare, linked to your account. They are not end-to-end encrypted. Each reply is also added to the report's GitHub issue. When you send a report, you choose whether Ricardo can reply with questions. If you allow it, you get a notification that shows the start of each reply, and if a reply stays unread for 24 hours, one email tells you that it is there. The email never contains the reply. If you choose updates only, no email is sent, and you get one notification when the report is marked fixed or closed.

Ricardo reads and answers reports in a private web console. It runs on a server rented from exe.dev, which also runs the private dashboards that show the usage counts.

To sort and fix reports, Cami uses AI tools from Anthropic and OpenAI. Those companies process the text of a report and its replies and, when a fix needs them, its screenshots and logs.

Email you send to hello@camibaby.com is forwarded by Cloudflare to a Gmail inbox, whichGoogle stores.

Reports and email are kept while they help to answer you or to fix Cami. Diagnostic log files are deleted after 90 days. Deleting your account deletes the conversation, its screenshots and log files, your survey answers and your roadmap votes, but not the GitHub issues and their replies, or your email, which may be retained. To have them deleted, write to hello@camibaby.com.

How long it is kept#

Your data is kept while your account exists, because a baby log is only useful as a record over time. When you delete your account or a family, it is removed from the live service at once.

Backups take longer to go. The daily copies of a family's log are kept by date for 90 days, and all of them are deleted when the family is deleted. Cloudflare's own recovery systems can hold earlier versions of the data for up to 30 days.

Technical logs, which the service keeps to find faults, are deleted after 7 days. The record of each family's notifications is kept for about 3 days. The usage counts contain nothing that identifies you and are kept as a record. Copies in your iCloud Drive stay there until you delete them.

The record of requests to rate Cami is kept while your account exists and is deleted with it. Each night Cami also saves the public App Store rating count and average for each country. That number says nothing about any one person.

Getting your data out, or deleted#

You can export a child's log as a CSV file from inside the app — More ▸ Children ▸ your child ▸ Manage Data ▸ Export Data. The file holds that child's entries plus the family's pumping; any member can run it, once every 24 hours for each child. The iCloud Drive copy described above is a second way out: a complete, readable file that the Files app can open.

You can delete your account from inside the app.More ▸ Settings ▸ your name ▸ Delete Account. It removes your account and everything held on that phone. A family in which you are the only member is deleted with you, children and history included; a family with other members is kept, and ownership passes to the longest-standing member if it was yours. The entries you logged stay in a family that others still use, because they are part of that family's record. It cannot be undone.

The family's owner can also delete every entry for a child, for the whole family, and keep the child's profile: More ▸ Children ▸ your child ▸ Manage Data ▸ Delete All Entries. Delete followed by the child's name, at the foot of the child's page, removes the child and their history for everyone.

For anything else, such as a copy of what is held about you, a correction, or the deletion of a feedback report, see Your rights. Anything on this page, and anything about using the app, is also covered in the help center.

Your rights#

Data protection law, including the GDPR and the UK GDPR, gives you these rights over your personal data:

• Access — to know what Cami holds about you, and to get a copy.
• Correction — to have wrong data put right. Much of it can be edited in the app.
• Erasure — to have your data deleted, in the app as described above, or by asking.
• Portability — the CSV export gives you a child's log in a common format. On request, you get the rest of your data in a machine-readable form.
• Restriction — to have the use of your data paused while a correction or an objection is settled.
• Objection — to the uses that rest on Cami's legitimate interests, such as the usage counts.
• Withdrawing consent — at any time, for every use that rests on it.

To use any of them, write to hello@camibaby.com. To protect your data, Cami may first ask you to show that the account is yours. It is free, and you get an answer within one month.

If you think Cami has handled your data wrongly, please write first, so it can be put right. You also have the right to complain to a data protection authority, in particular where you live or work:

• Spain — Agencia Española de Protección de Datos (AEPD), aepd.es
• Ireland — Data Protection Commission (DPC), dataprotection.ie
• United Kingdom — Information Commissioner's Office (ICO), ico.org.uk

Security#

Traffic between your phone and the service is encrypted in transit. Sign-in tokens are held in the iOS keychain. Photos are stored at web addresses that cannot be guessed, and only your family's phones are given them.

Anyone who has your invite link or code can see your family's name and join it, so share it only with the people you mean to invite. The family's owner can make a new link at any time, which stops the old link and code working, or turn invites off.

No service can promise perfect security, and this one does not. If something goes wrong that affects your data, you will be told.

Changes#

If this policy changes in a way that matters, the date at the top changes and the change is described in the app. Cami is in active development, and this page will be kept accurate as it grows.

Contact#

Questions, requests, or anything that looks wrong: hello@camibaby.com.