CuddleKeep Privacy Policy

Updated: October 18, 2026

Effective: October 18, 2026

Version: v1.5.0-local-birth-backup-2026-10-18

Version 1.5.0 processes care records, photos, voice and text drafts on your own devices without uploading them to the developer. Apple Watch recordings transfer to your paired iPhone and become formal records only after you confirm them on the phone. This is not developer cloud synchronization. There are no accounts, cloud backup, ads or third-party tracking. StoreKit purchases do not carry care data. You manage exported files and saved photos; feedback emails you choose to send are handled under Section 3.8.

“宝宝工作台” (“CuddleKeep”) is intended for parents, guardians, and other adult caregivers to record and organize a baby’s day-to-day care. It is ready to use when opened, with no registration or login. You can use the basic features expressly retained as free without purchasing full access.

1. Personal Information Handler and Contact Details

2. Scope and Product Boundaries

This Policy applies to version 1.5.0 of the “CuddleKeep” iOS App.

• This version does not include: account registration or login, cloud backup, developer cloud synchronization, family sharing, online customer service,

a developer-operated business server, a push-notification server, advertising, or analytics. Apple StoreKit product, purchase, restore, and entitlement verification form a separate Apple system purchase route and do not send care records, photos, or notes to the developer.

• Medical boundary: the App only records and organizes information. It does not provide diagnosis, treatment, prescriptions, dosage, or medication-timing advice,

and it does not determine whether a baby’s development or health is “normal” or “meeting a standard.” In a small number of places, it may display “seek medical care” under specified conditions (for example, high fever in a very young infant). This is a prompt to find a professional, not a medical conclusion. Sources are listed in the accompanying Medical Information Sources and Simplification Notes.

If a future version adds business-data network features such as cloud backup, we will first update this Policy, separately obtain your consent, and update the App Store privacy disclosures before enabling the features. Refusing consent will not affect your continued use of local features.

3. Information Processed by the App and Where It Is Stored

Formal records and photos remain in the phone App’s private storage. Storage and paired-device transfer of voice and text drafts are explained in Section 3.7. The developer does not receive this content unless you choose to provide it through export or feedback; feedback email handling is explained in Section 3.8. Purchase entitlement is kept only in the current process’s purchase state and is not written to the business Store or AsyncStorage or included in a JSON backup. The native purchase bridge returns to the interface only entitlement status, operation status, and the localized display price supplied by Apple. Transaction identifiers, JWS, Apple ID, and payment credentials do not enter the business Store, JSON backup, or developer logs. A purchase does not cause any business content listed below to be sent to the developer.

3.1 Content You Actively Enter

• Baby profile: nickname, date of birth, sex, whether the baby was born prematurely, and gestational age (used to calculate age in days and match reference content);
• Birth memories (optional): birth time (hours and minutes, with optional seconds), the identifier of the birth city you select, and its automatically matched time zone or a time zone retained from an older profile. The App uses bundled city-centre coordinates locally to display birth memories and estimate the ascendant. It does not access device location or send search terms or baby information to the place-data provider. These optional fields are backed up and deleted with the baby profile. Zodiac descriptions are cultural entertainment, not personality assessments.
• Day-to-day care records: feeding (including a “ready-to-feed” form label for formula), pumping, bottle feeding, urination, bowel movements,

sleep (with an optional sleep-position record), tummy time, outings, interaction, mood (the baby’s needs at the time and the soothing methods you used), care check-ins (including your own custom care-item list), complementary foods and ingredient observations, to-do and shopping lists, and daily notes;

• Health-related records: body measurements (length / weight / head circumference), temperature, jaundice observations, spit-up, symptoms,

free-text medication records, medical-visit records, teething, supplements, screen time, and toilet training;

• Memories and interaction: milestones, early-learning interaction records, and the early-learning plan lists you create and check off each day;
• Developmental observation check-ins: “Observed” marks and observation dates that you check for an “observation example” in the visual/auditory training, fine-motor, or gross-motor sections.

The observation-item text itself is static content bundled with the App; the App does not use it to calculate an achievement rate, determine delay, or generate any reminder;

• Vaccine and well-child completion marks: completion status and completion dates that you manually check for a dose under “Growth & Development → Vaccines” or an item under “Medical & Health → Well-Child Care.”

The reference schedule itself is static content bundled with the App and is not your personal information; only the marks you enter manually are saved;

• Complementary-food kitchen: complementary-food start date, ingredient inventory and reference dates you enter, ingredients to avoid and frequently used ingredients,

and saved weekly menus;

• Mom-module settings and records (off by default and shown only after you enable it in Settings): whether the Mom module is enabled;

a postpartum start date already present in an archive or older backup (if there is no such date, the App uses the most recent baby’s date of birth only on the device to calculate the postpartum timeline and does not separately store the derived date); a completion mark for the 42-day postpartum checkup; lochia category; wound category and status; individual answers to the seven-day emotional-care questions, the questionnaire version, and safety-concern, immediate-safety-concern, low-mood-concern, and support-concern flags generated only on the device from those answers; Mom notes; record and update times; and the time and status of your acknowledgement that a prompt requiring action has been handled. Mom records are stored globally for the mother, are not assigned to a particular baby, and remain viewable when you switch babies;

• Monthly Moments photos: see Section 3.2 below.

The vaccine reference page in this version displays a static reference schedule for the selected region, its source version, and a “not clinically signed off” notice, and allows you to manually mark or unmark completion. It does not calculate vaccination dates, generate vaccine or well-child notification reminders, determine whether anything is overdue, or provide individualized vaccination or medical advice.

If you import data from an older version or backup, the archive may still contain vaccination-reaction, developmental-milestone, or recorder-name fields previously entered. This version retains these fields only for compatibility and export of older data: recorder names can no longer be entered and are not shown in the interface; vaccination reactions and developmental milestones have no corresponding entry interface, scoring, age-based recommendation, or professional interpretation.

The baby-related content above includes personal information and medical or health information relating to children under 14. The Mom module’s lochia, wound, and emotional-care records are medical or health information. Under Chinese law, all of these are sensitive personal information. Even though the information is stored only on the device, please enter only information that you are authorized to process, and do not put unnecessary identity-card numbers, precise home addresses, or other identifying information into free-text fields.

3.2 Monthly Moments Photos

Photos may come from either of two sources, both initiated by you:

• Choose from Photos: tapping “Add Photos” opens the system photo picker.

This is a separate interface provided by iOS, and the App does not read other photos in your library— it receives only the photos you select in the picker. This route therefore does not require photo-library permission.

• Take a Photo: tapping the camera entry point in Monthly Moments invokes the camera. The system will ask for camera permission,

and you can take a photo only after granting it. Photos taken this way follow the same processing route as selected photos (they are transcoded, reduced in size, and stored in the App’s private storage area) and are likewise not uploaded. Refusing camera permission does not affect choosing photos from the photo library or any other App feature; you can withdraw this permission at any time under system “Settings › CuddleKeep.”

• Selected or captured photos are transcoded and reduced to approximately 1,600 pixels on the long edge, and a copy is saved in the App’s private storage area.

This means that a photo here will not disappear if you later delete the original from the system photo library, while the file size is reduced to approximately one-sixth of the original.

• The App displays locally stored original photos and no longer generates transparent foreground cutouts. It does not identify faces or people or infer expressions, emotions, health, or development. Cutouts retained from older versions are kept only for compatibility, are not uploaded, and never replace missing original photos.
• Photos are not uploaded and do not participate in any network activity.
• The Monthly Moments photo directory is configured to be excluded from iCloud / Finder device backups; you must separately preserve photos when moving to another device.
• After you delete a photo in the App, the corresponding file is removed from the App’s storage area the next time the App launches.
• Note: ordinary JSON backups exclude photos. To transfer photos, choose the backup that includes photos and import all parts on the new device. It contains only readable in-app images, excluding recordings, unsaved drafts and undo records.
• When you actively use “Create This Week’s Moments,” the App organizes the current baby’s photos from Monday through Sunday of the selected date’s week. It uses local originals, with placeholders for missing originals rather than old cutouts. Output includes each date, time and non-empty note, the baby’s nickname and age, and that week’s recorded-day, photo and note totals. Long content is split across JPEG images. Only tapping Save writes them to the system photo library with add-only access. The App does not generate or upload them automatically, read, enumerate or analyze other library photos, or share these JPEGs with third parties.

3.3 Reminders (Local Notifications)

• These are used for to-do and day-to-day care reminders that you actively enable.
• The reminders are scheduled and delivered by your phone itself without passing through any server, so we do not learn any information from them.
• “Hide sensitive notification content” is enabled by default. When enabled, a lock-screen notification’s title and body display only a generic care reminder and do not show the baby’s nickname, a specific task, an ingredient, milk amount, or other details; details are available only inside the App. This protective setting is also enabled by default after an upgrade from an older version.
• Notification details appear in system notifications only if you actively turn off “Hide sensitive notification content” under “Settings → Local Reminders.” The details are still generated and scheduled only on the device and are not uploaded, but they may be visible to anyone who can see your lock screen. When protection is turned back on, the App first removes old detailed notifications and then schedules generic wording; reminders are paused if removal cannot be confirmed.
• You decide whether to allow notifications. Refusal does not affect any other App feature; it only means that reminders will not appear at their scheduled times.

3.4 The App’s Own Settings

Settings include appearance preference (System, Light or Night, also cached on-device for startup display), text-size preference, the soothing-audio timer, the last local-backup time, whether the Mom module is enabled, the postpartum start date (if any), and the completion mark for the 42-day postpartum checkup.

Record data is stored by AsyncStorage in the App’s private storage area and is explicitly excluded from iCloud / Finder device backups. You must therefore actively export a JSON backup before changing devices or reinstalling; the backup does not include Monthly Moments photos.

3.5 Use of System APIs

As required by Apple, the App uses the following system interfaces for the stated reasons. Each is necessary to implement an on-device feature and is not used for any form of user identification or tracking:

In addition to these interfaces, the App requests camera permission when you actively tap the camera entry point in Monthly Moments, so that it can take a photo and place it in Monthly Moments. The App does not request or access the camera unless you tap that control.

3.6 Export and Sharing (Initiated by You)

The App has four file-export entry points and one image-generation / save entry point, and nothing happens unless you tap one. The four JSON / HTML / TXT exports still use the iOS system share sheet. A Weekly Moments JPEG is added to the system photo library only when you tap Save, using add-only access; it is not uploaded or shared with a third party.

The Weekly Moments JPEG contains a child’s image and may include information such as nickname and age, so it is sensitive personal information. It is not included in JSON backups and enters the system photo library only when the guardian actively taps Save.

The Raw Recovery Data button appears only when the App cannot read the on-device archive at startup. Its purpose is to rescue the data in its original form when data is damaged, so that reinstalling the App does not permanently destroy the records. It exports the on-device archive’s unprocessed raw content, and is therefore more complete than the backup JSON described above: in addition to all records, settings, and postpartum records in the Mom module (if you enabled it), it contains deletion markers left when you delete records. A marker does not retain the deleted record’s specific content; it retains only the record type, time, and associated baby so that the App can process the deletion correctly. These markers are removed from an ordinary exported backup but are retained in Raw Recovery Data. Raw Recovery Data likewise contains no Monthly Moments photos. This is the most sensitive file. Use it only for self-recovery or troubleshooting under support instructions, and do not casually send it as an ordinary attachment.

The Well-Child Summary is a one-page HTML file prepared for taking a baby to a well-child clinic or other medical visit. All content comes from your own records: the baby’s nickname, sex, and age in days, plus corrected age if the baby was premature; the latest length / weight / head circumference and percentile notes; average daily feeding count, formula amount, breastfeeding duration, wet diapers, and bowel movements over the last 30 days, plus average daily sleep over the last 7 days; symptom records from the last 30 days (up to 12) and medication records (up to 10); medical visits from the last 180 days (up to 8, including institution, chief complaint, diagnosis, and medical advice); complementary-food observations; and the “Questions I want to ask the doctor” that you wrote in Settings. It does not include Monthly Moments photos or postpartum records from the Mom module.

Please understand the following about this route:

• The file is generated on your phone. The entire process is offline, and we receive no copy;
• Once generated, it is handed to the iOS system share sheet. Whether it is saved to the Files app, sent by AirDrop, sent to a doctor or family member, or printed

is entirely your decision at that step. At that point, you—not us—are providing the information to the recipient;

• For a backup JSON, Well-Child Summary HTML, shopping-list TXT, or Raw Recovery Data JSON, the App deletes the temporary file created in its cache for that operation after sharing completes, is canceled, or fails;
• For a Weekly Moments JPEG, the App explicitly releases the temporary ViewShot file after saving succeeds, saving fails, add-only permission is denied, or the preview is closed. The system-library copy is managed by the guardian; the App does not read or enumerate it and cannot delete it for you;
• A Well-Child Summary contains the baby’s medical and health information and, like a backup JSON or Raw Recovery Data, is sensitive personal information.

Weekly Moments JPEGs contain a child’s image. All of these files are unencrypted and can be opened directly by anyone who obtains them. Before sharing, confirm that the recipient has a genuine need to know, and consider risks such as shared devices and retained chat history.

3.7 Voice and Text Drafts and Apple Watch

• On the phone, microphone and speech permissions are requested and capture starts only after you tap Start speaking on the voice-entry screen. If you decline, text entry and the regular record form remain available.
• The App automatically tries on-device Mandarin and English recognition without asking you to select a language. Compatible iOS 26 or later devices prefer Apple’s system models. First use may require downloading Apple-managed language resources over the internet; recognition can then work offline. No approximately 230 MB third-party model is bundled. Older systems use available on-device recognition. If resources or capabilities are unavailable, the App explains this and retains text entry; it does not fall back to server recognition.
• Transcribed speech and directly entered text use the same on-device organization rules to create editable draft cards. Supported types include feeding, elimination, sleep, temperature, spit-up, outings and tasks. You can save or delete cards individually. Times, numbers and corrections may be ambiguous and require review; drafts are not automatically counted as formal records.
• Audio, transcripts, entered text, candidates, unsaved cards, baby association, capture time, playback ranges and processing states remain in protected local draft storage, excluded from automatic device backups. They are not uploaded to the developer or third parties or included in diagnostic logs. Only cards you save enter formal records. Once all cards from an input segment are saved or deleted, its original text and audio are removed. If cards remain pending, the segment remains available for playback. Text-only drafts have no recording.
• Capture lasts at most 45 seconds and can be stopped by tapping. Brief pauses do not automatically stop capture. Closing the screen, entering the background or an audio interruption stops capture while retaining written audio and drafts for later review. Insufficient storage stops new capture. Permissions can be withdrawn in system Settings.
• The Apple Watch companion requests microphone permission and records only after you tap Record. Protected, backup-excluded audio is queued on the watch and transferred through Apple Watch Connectivity to the paired iPhone. You can record while the phone is locked or disconnected; transfer waits until the system allows it, and recognition, editing and confirmation occur when you open the phone App. The phone sends baby nicknames, internal IDs, the selected baby and interface language to the watch to show ownership; it does not send the full care history. The watch does not save formal care records or perform cloud recognition.
• When the phone confirms that an entire segment has been saved or deleted, it sends a completion receipt. The watch removes its audio only after that receipt arrives; a delayed receipt leaves the watch copy in place. Removing a recording on the watch does not delete a draft already received on the phone. If pairing or baby identity cannot be matched, you must select the owner on the phone; the current baby is not silently assigned. See Section 5 for deletion and delayed transfers.
• Minimal recording identifiers, file hashes, terminal states and clear-data cutoffs remain on the devices for deduplication and reliable recovery. They do not contain audio or original text. Drafts, audio and synchronization states are excluded from formal-record JSON backups and Well-Child Summaries.

3.8 Feedback Email

• Feedback in Settings is optional. Tapping Send feedback opens an email draft containing your entered message, App version/build and operating-system name/version. You may review, edit or cancel it in your mail client; it is sent only when you confirm there. Without a mail client, you may copy the content and support address and decide whether to send it.
• The App does not automatically attach baby profiles, care records, draft transcripts, audio, photos, unique device identifiers or diagnostic logs. Do not include unnecessary children’s information, health details or identity documents.
• If you send the email, our support mailbox receives its body, sender email address and sender name if displayed. We use these to reply, investigate the issue and handle your request, not for advertising, tracking or profiling. Mail transmission and storage are also subject to your chosen email service’s rules.
• We retain feedback only for the period needed to handle the request and necessary follow-up, then delete or de-identify it unless retention is required by law. You may request access, correction or deletion through the address in Section 1; we respond within 15 business days. Deleting App records or uninstalling does not automatically delete emails already sent.

4. What We Do Not Do

• No collection of business data: the App does not automatically transmit your care records, photos, notes, or other business data to us or any third party.

The StoreKit purchase route also does not carry this content, Feedback you choose to email is handled under Section 3.8. When you actively use the system share sheet to provide a file to a recipient you choose, you are initiating that disclosure; we are not collecting the file.

• No tracking: there is no advertising identifier (IDFA), analytics instrumentation, or third-party analytics SDK.

The App’s privacy manifest declares “No” for tracking.

• No sharing, transfer, or public disclosure of business data: in this version, we do not initiate any external provision of business data and there is no business-data recipient.

If you tap Export and then give a file to someone through the system share sheet, that is your handling of your own data (see Section 3.6). We do not participate and receive no copy.

• No personalized push notifications or automated decision-making.
• No commercial recommendations: category items in the App, such as “Size S diapers,” are text only

and contain no brand recommendation, purchase link, or redirection.

5. Retention and Deletion

• You manage formal records and may delete them individually. Deleting a baby also clears that baby’s phone-side voice/text drafts, associated audio and processing journals. Clear Data removes business records and all drafts/audio while retaining the profiles and settings stated by the interface. If storage operations fail, a cleanup task is retained for retry.
• Clear Data records a cutoff: older watch recordings awaiting transfer are cleared after reconnection and will not recreate drafts; new recordings made after the cutoff remain eligible for import. Deleting a baby revokes that baby’s internal ID, so late recordings cannot bypass deletion by becoming unassigned drafts. An offline watch copy cannot be remotely deleted immediately. Incorrect device dates can affect cutoff comparisons.
• Only minimal recording IDs, hashes, saved/deleted states and deletion cutoffs remain for deduplication, without processed audio or original text. Saving one card does not delete other pending cards from the same segment.
• Uninstalling the phone App deletes its private storage; uninstalling the watch App deletes the watch’s private storage. Copies on the other device, exported files and JPEGs saved to the system photo library are not automatically removed and must be managed separately.
• Unconfirmed drafts and recordings are not included in JSON backups. Review drafts you wish to keep before clearing or uninstalling; export formal records and preserve photos separately as needed. Feedback retention is covered in Section 3.8.

6. How to Exercise Your Rights

For data held on your phone and watch, you can exercise most rights directly inside the App without contacting us:

If you have questions or complaints about this Policy, contact us at the email address in Section 1. We will respond within 15 business days after receiving your message.

7. Special Notice About Children’s Personal Information

• The App is intended for adult parents and caregivers to record information on behalf of infants and young children. It is not intended for use by children themselves.
• The recorded content includes personal information of children under 14 and is sensitive personal information.

Confirm that you are the child’s guardian or have obtained authorization from the guardian.

• The App does not automatically upload children’s data to the developer. Paired-device transfer is covered in Section 3.7; avoid unnecessary children’s information in feedback.
• See the accompanying Rules for the Protection of Children’s Personal Information for details.

8. Security Measures

• Data resides in private iOS/watchOS App storage, protected by operating-system app isolation and file protection.
• To support reliable transfer and queues while locked, recordings and synchronization queues use Complete Until First User Authentication protection: they are inaccessible before the first unlock after a restart. This does not mean every file becomes inaccessible on every subsequent lock. Audio, drafts and queues are excluded from automatic device backups.
• Use a device passcode, keep the system updated and manage paired devices carefully. Exported JSON/HTML/TXT and JPEGs saved to the photo library are readable files; protect them and share only with intended recipients.

9. Policy Updates

If this Policy changes, we will update the version number and date on this page. If a future version adds business-data network features such as cloud backup, that will be a material change. We will provide prominent notice in the App and separately obtain your consent before enabling it.

10. Contact and Complaints

See Section 1 for contact details. If you believe that our processing infringes your rights and interests, you may also submit a complaint or report to the competent cyberspace, industry and information technology, market-regulation, or other authority.

References

• Personal Information Protection Law of the People’s Republic of China
• Law of the People’s Republic of China on the Protection of Minors
• Provisions on the Cyber Protection of Children’s Personal Information
• Information Security Technology—Personal Information Security Specification (GB/T 35273)
• Provisions on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications
• Apple’s App Privacy Details and Section 5.1 of the App Review Guidelines