CuddleKeep Rules for the Protection of Children’s Personal Information

Updated: October 18, 2026

Version: v1.5.0-local-birth-backup-2026-10-18

Effective: October 18, 2026

Applicable age: children under 14

These Rules are formulated in accordance with the Provisions on the Cyber Protection of Children’s Personal Information and the Personal Information Protection Law, and form part of the CuddleKeep Privacy Policy. If there is a conflict, the provision that is more protective of children and provides more specific notice will prevail.

One-Sentence Summary for Guardians

Formal records, photos and pending drafts stay on your own devices and are not automatically uploaded to the developer. Apple Watch recordings can be queued on the watch and transferred to the paired iPhone for review; only cards confirmed on the phone enter formal records. The App has no accounts or developer cloud backup. StoreKit purchases do not carry children’s care data. You control exported files and saved photos. We receive feedback emails only after you choose to send them; avoid including unnecessary children’s information.

Personal information handler: 上海齿臻源医疗科技有限公司 (Shanghai Cizhenyuan Medical Technology Co., Ltd.); children’s personal information protection contact: 朱金山 (Zhu Jinshan; person responsible for personal information protection); email: jensen_0312@qq.com.

1. Who Uses the App and Whose Information Is Recorded

The user is an adult guardian or caregiver. A child does not use the App independently and does not need to register.
The recorded information concerns your baby and is entered by you on the baby’s behalf.
Before entering information, confirm that you are the child’s guardian or have obtained authorization from the guardian.

Because this version has no registration, its business features do not connect to a developer server, and it does not provide children’s information to anyone, we do not collect proof of guardianship (we do not ask you to upload an identity card, household register, or medical certificate of birth). Under the principle of minimum necessity, collecting such materials would instead constitute excessive collection.

2. Children’s Information That May Be Recorded

Category	Specific content	Sensitivity
Basic identity information	Nickname, date of birth, sex, whether the child was born prematurely, and gestational age	Child’s personal information
Birth memories (optional)	Birth time, the identifier of the birth city you select, and its matched or retained time zone; city-centre coordinates are used locally for birth-memory estimates without accessing device location	Child’s personal information
Physiology and health	Length, weight, head circumference, temperature, jaundice observations, symptoms, medication text, medical-visit records, and teething	Sensitive personal information
Vaccination and well-child completion marks	Dose / well-child completion status and completion date that you manually check on the vaccine reference page	Sensitive personal information
Day-to-day care	Feeding, elimination, sleep (including sleep position), tummy time, outings, mood and soothing, care (including custom items), complementary foods and ingredient observations, developmental-observation check-ins, and early-learning-plan check-ins	Child’s personal information
Complementary-food kitchen	Complementary-food start date, ingredient inventory and reference dates, ingredients to avoid and frequently used ingredients, and saved weekly menus	Child’s personal information
Memories and interaction	Milestones and early-learning interactions	Child’s personal information
Voice and text drafts	Audio, transcribed or entered text, candidate cards, baby association, capture times, playback ranges and processing states; baby nicknames/internal IDs on Watch	May contain sensitive children’s and health information
Images	Original photos you select or take and store locally; transparent foreground cutouts retained from older versions; and weekly JPEG images you actively generate	Sensitive personal information

Under Chinese law, children’s personal information and medical or health information are both sensitive personal information. This information is processed on your devices. Watch audio transfers only to the paired phone, not to a developer recognition server.

The vaccine reference page displays a static reference schedule and source version bundled with the App and labels it “not clinically signed off.” It accepts only completion marks entered manually by you; it does not calculate vaccination dates, generate reminder notifications, determine whether anything is overdue, or provide individualized advice.

Archives imported from an older version or backup may still retain vaccination-reaction or developmental-milestone fields that were entered in the past. This version retains those two types of fields only for compatibility and export of older data and provides no corresponding entry interface, scoring, or age-based recommendation.

3. Why the Information Is Processed and the Extent of Processing

Purpose: to help you record and review the baby’s day-to-day care, and to remind you when a time you selected arrives.

Method of processing: on-device storage, display, speech transcription, text organization and statistics, followed by individual confirmation before saving. There is no profiling, automated medical decision-making, personalized push notification or commercial use.

What the App does not do: it does not diagnose, determine whether development is normal, or determine whether an ingredient is suitable for your baby. See Section 5 of the User Agreement for the medical boundaries.

4. Where the Information Is Stored and for How Long

Formal records and photos reside in phone App private storage. Watch audio is first queued in watch private storage, then transferred to the paired iPhone. The phone shares baby nicknames, internal IDs, current selection and interface language with the watch to identify recording ownership, without the full care history.
Voice/text drafts and audio support review, editing and playback. Original text and audio are cleared after every card in the segment is saved or deleted. The watch removes its copy after receiving the phone’s completion receipt; it retains the copy while disconnected. Drafts, audio, records and photos are excluded from automatic device backups. JSON backups do not contain photos or pending drafts.
Deleting a baby also clears its phone-side drafts/audio. Clear Data clears business records and all drafts/audio, retaining the profiles/settings described by the interface. Watch recordings begun before the clear-data cutoff are rejected and cleared after reconnection; later recordings remain eligible. Deleted baby IDs cannot be imported again. Offline devices cannot be remotely cleared immediately. Minimal IDs, hashes, terminal states and cutoff values remain without original text or audio.
Uninstalling on one device clears only that App’s private data on that device. Exported files, system Photos JPEGs, the other device’s copies and sent feedback emails are managed separately. See Privacy Policy Section 3.8 for email requests.

5. Export and Sharing Initiated by You

The App has a “Generate Well-Child Summary” feature under “Settings → Visit Summary.” It organizes the baby’s records into a one-page HTML file to help you communicate with a doctor at a well-child clinic or other medical visit. It contains the most sensitive portion of the child’s personal information: the baby’s nickname, sex, age in days, and corrected age; the latest length / weight / head circumference and percentile notes; average daily feeding and elimination values over the last 30 days and average daily sleep over the last 7 days; symptom and medication records from the last 30 days; medical visits from the last 180 days (institution, chief complaint, diagnosis, and medical advice); complementary-food observations; and questions that you wrote in advance to ask the doctor. The summary does not include Monthly Moments photos.

A guardian may actively generate and save JPEG images for the selected week; long content is split across images:

This Week’s Moments：Photo records for the current baby from Monday through Sunday of the selected date’s week, using available local originals and placeholders for missing originals; each record’s date, time and non-empty note, the baby’s nickname and age, and that week’s recorded-day, photo and note totals

It is generated only on the device and is never generated or uploaded automatically. Only when you tap “Save to Photos” does the App add it to the system photo library using add-only access. The App does not read or enumerate other library photos and does not share this JPEG with a third party.

Please understand the nature of this route:

The file is generated only when you tap the control. The App does not generate it automatically or on a schedule;
The file is generated on your phone. The entire process is offline, and we receive no copy;
The Weekly Moments JPEG does not use the system share sheet. It is added to the system photo library only after the guardian actively taps Save, using add-only access;
A backup JSON, Well-Child Summary HTML, or Raw Recovery Data JSON is deleted from the App’s cache by the App after the share operation completes, is canceled, or fails;
A Weekly Moments JPEG is explicitly released from its temporary ViewShot file after saving succeeds, saving fails, add-only permission is denied, or the preview is closed. The system-library copy is managed by the guardian; the App does not read or enumerate it and cannot delete it for you;
Backups and Raw Recovery Data are unencrypted JSON, a Well-Child Summary is unencrypted HTML, and Monthly Moments is an unencrypted JPEG containing a child’s image. Anyone who obtains a file can open it directly. Send it only to someone who has a genuine need to know,

and consider risks such as shared devices and retained chat history.

Export Backup (JSON) follows the same route, likewise contains only the records you entered, and likewise contains no photos.

One more entry point appears only in an unexpected situation: if the App cannot read the on-device archive at startup, the “Couldn’t Start” page displays an “Export Raw Data” button. It exports the archive unchanged as JSON so that records can be rescued when data is damaged and are not permanently lost by reinstalling the App. Its contents are more complete than a backup—they include all records, settings, Mom-module records, and markers left when records were deleted (only the type, time, and associated baby remain; the deleted record’s content is not retained), but still do not include photos. This is the most sensitive file. Use it only for self-recovery and do not forward it casually.

6. Processing Stages That Do Not Exist in This Version

The following stages do not exist in version 1.5.0:

There is no account. The StoreKit purchase process does not write Apple ID to the business Store;
Product lookup, purchase, restoration, and entitlement verification communicate only with Apple through Apple StoreKit, and the developer has no proprietary payment server;

this purchase route does not carry children’s information, and children’s information is not transmitted because of a purchase (see Section 5 for exports and sharing that you perform yourself);

StoreKit transaction identifiers, JWS, and Apple ID do not enter the business Store, JSON backups, or developer logs;
No third-party SDK receives children’s information (there is no analytics, advertising, or crash reporting);
There is no entrusted processor, joint processor, or data recipient that receives children’s information;
The developer does not provide children’s information outside China;
Family sharing is not provided.

7. Security Protection

The iOS application sandbox provides isolation, so other apps cannot read this App’s data.
System file protection is used. Recordings and synchronization queues are protected before the first unlock after restart, while allowing later locked-device transfers; they are not inaccessible on every subsequent lock.
Exported backup files and Raw Recovery Data are unencrypted JSON, a Well-Child Summary is unencrypted HTML,

and Monthly Moments is an unencrypted JPEG containing a child’s image. Store these files securely and do not share them casually.

8. Guardians’ Rights

Because the data is in your hands, you can exercise these rights directly inside the App without contacting us or waiting for approval:

Right	How to exercise it
Access	View it directly in the App; export a backup to obtain the complete data
Correction	Tap any record to edit it
Copy / transfer	Settings → Export Backup (general-purpose JSON format)
Deletion	Delete individually / by baby / clear all / uninstall
Refusal	Do not enter the information; notification permission can be disabled at any time in system Settings

9. If You Change Your Mind

The App does not upload drafts or care records to the developer. If you separately sent feedback email, you may request deletion under Privacy Policy Section 3.8. See Section 4 for paired-device copies and exported files.

10. Updates and Contact

If these Rules change, we will update the version number and date. If a future version adds business-data network features such as cloud backup, that will be a material change. Before enabling it, we will separately and prominently seek the guardian’s consent. Refusing consent will not affect local features.

See the summary above and Section 1 of the CuddleKeep Privacy Policy for contact details.