Privacy policy

Version 2026-10-06 · In effect from 6 October 2026

Who we are

Proactive Parent is provided by Right Stack Ltd, which decides how and why your personal data is used — the “controller” under data protection law. In this policy, “we” and “us” mean Right Stack Ltd.

What this policy covers

This policy covers the Proactive Parent app, this website (proactiveparent.app), and emails you send us. A Turkish version, written as a notice under Turkey’s personal data law (KVKK), is at /tr/privacy.

What we collect

If you use the app without an account

You can start without giving us your name or email address. Once you agree to the health-data notice, the app creates a guest account for you on our servers when it next connects. It holds no name and no contact details; it is opened only by a key kept on your phone.

If you sign in

You can sign in with Apple or with Google. From them we receive your name and email address (and, from Google, a link to your profile picture), an identifier for your account with them, and the sign-in tokens they issue. Other members of your family see your name.

Your family

• Who is in your family, when each person joined, the role each person has (owner, parent, caregiver or viewer), and, if you choose to say, how each is related to the children (for example mother or grandparent).
• Invitations you create. An invitation is a link; we store a hash of its code (never the code itself), the role, relationship and children it gives, who created it and who accepted it, and when it expires.
• The name you give the assistant, if you change it.
• The units you read: metric or imperial, °C or °F, and a 12- or 24-hour clock. They are set from the country you pick when you start, and kept with your account so your other phones and the assistant use them too.
• The country you live in now, and the language your phone uses for the app, kept with your account so the assistant speaks your language and knows where you are. The country starts as your phone’s region setting and you can change it in Settings. It is never your phone’s location, and it never changes which guidance a child or a pregnancy gets.

Photos

If you add a photo of a child, it becomes the child’s picture in the app. Before it leaves your phone, the app makes it a small square and removes everything stored with it — where and when it was taken, and the camera. We keep one photo per child, encrypted, on our storage in Ireland, and only the people in your family who can see that child can see it. It is used for nothing else.

Pregnancy and child records — health data

• For a pregnancy: the due date and how it was worked out, how many babies, where you are cared for (the guidance region — the UK, the US, Turkey, or general guidance for anywhere else — and, in the UK, England, Wales or Scotland), who added it to the app and whom they shared its records with, and how the pregnancy ended, including a loss, if you record it.
• For a child: their name if you give one, date of birth, how many weeks pregnant their mother was at birth (so the app can correct ages for prematurity), their guidance region, the colour you pick for them and, only if you say, whether they are a girl or a boy — which the growth chart needs to draw the WHO’s centile lines, and nothing else uses.
• What you record: feeds, sleep, nappies, pumping, growth (weight, length, head circumference), routines, firsts, and health records — symptoms, temperatures, medicines, vaccinations and appointments — with any notes you write. In pregnancy: baby’s movements, contractions, and your own weight and blood pressure.
• Who logged each record, and whether it was logged by hand or through Daphne.

Pregnancy and child records are health data, which data protection law treats as “special category” data. We hold it only with your explicit consent (see Your health-data consent).

Reminders and your phone

• The timeline the app works out from your due date or your baby’s birth date, and the reminders it plans from it, including which were sent, held back or cancelled.
• Your reminder settings: on or off, quiet hours, a weekly limit, and your time zone.
• For each phone: a random identifier the phone creates (we store only a hash of it), when it was first and last seen, and, if you allow notifications, its Apple or Google push token.

Daphne

For each conversation with Daphne we record when it started and ended, how long it lasted, whether it was spoken or typed, and which provider and model handled it — enough to count your monthly minutes. Your phone also reports how long each of her answers took to begin and how much processing OpenAI counted for the conversation, so we can keep her quick and know what she costs: numbers only, never what was said. We keep no recording of your voice and no transcript of the conversation. What is sent to OpenAI is described in Daphne, and OpenAI.

Proactive Plus

Plus is a subscription bought in the app from the App Store or Google Play, and only by a signed-in account. Apple or Google takes the payment: we never see your card or payment details. For the account that pays, we keep its subscription as RevenueCat last reported it: the plan, which store sold it, whether it was a test purchase, whether it is in its free week, when it ends, whether it will renew, whether the store could not take a payment, and when we last checked.

While you are signed in, the app gives RevenueCat your account’s identifier, whether or not you subscribe, so that a purchase on any of your phones is known to be yours. What RevenueCat receives is described in Who else handles your data.

Complimentary Plus. Our staff can give a signed-in account Plus free of charge — for example to an app store’s reviewers, a partner or the press — for a number of days or with no end date. We keep a record of each grant: why it was given, which member of our staff gave it, when, when it ends, and, if it was ended early, when and by which member of staff. Apple, Google and RevenueCat are not told about it.

Discount codes. If you enter a discount code in the app, the app sends the code you typed to our servers, with your sign-in, and our servers reply with what the code means on your phone. We do not store which codes you, or anyone, tried: our server logs note only that a code was checked, when, and whether that worked — never the code itself or who checked it. Using the code is then a purchase or a redemption at the App Store or Google Play, under their terms.

Consent records and sign-in sessions

When you agree to a notice, your phone sends your agreement to our servers when it next connects. We record it with the version of the notice, the time it arrived, and the IP address and device details (user agent) your phone sent. If you decline, nothing is sent and nothing is recorded. When you withdraw a consent, we record that in the same way. Each sign-in session — a guest’s too — records the same two details. We keep consent records so that we can show what you agreed to, and when.

What we do not collect

The app contains no analytics, advertising or tracking software and no crash-reporting service. We ask for your child’s sex only for the growth chart, and you need not answer. We do not use your phone’s location services. (We do store your IP address and time zone, as described above.)

What you must give us

No law requires you to give us any data. To use the app you must give a due date or a birth date, choose where you are cared for, and agree to the health-data notice; everything else is optional.

Why we use it, and on what legal basis

We use your data only for these purposes, each on the legal basis shown (UK GDPR).

Providing the app: your account, your family, sync between phones, reminders

Necessary to perform our contract with you (Article 6(1)(b)).

Proactive Plus: offering it in the app, checking a discount code you enter, knowing whether your family has it — bought, or given by us — and showing who pays or who it was given to

Necessary to perform our contract with you (Article 6(1)(b)).

Keeping a record of complimentary Plus: why it was given, and which member of our staff gave or ended it

Our legitimate interest in being able to account for what our staff do, including Plus given free of charge (Article 6(1)(f)).

Storing and using your pregnancy and child records, and showing guidance for your stage

Your explicit consent (Article 9(2)(a)), together with our contract with you (Article 6(1)(b)).

Daphne: sending what you say or type to OpenAI

Your explicit consent, given separately the first time you use Daphne (Articles 6(1)(a) and 9(2)(a)).

Keeping a record of your consent choices

Our legal obligation to be able to show that consent was given (Articles 6(1)(c) and 7(1)). Because a consent record shows that someone uses a pregnancy and baby app, we also rely on Article 9(2)(f): establishing, exercising or defending legal claims.

Keeping the service secure and working: sign-in sessions, server logs, telling your other phones that an account was deleted

Our legitimate interest in running a secure service that keeps its promises about deletion (Article 6(1)(f)).

Answering email you send us

Our contract with you, when it is about your use of the app (Article 6(1)(b)); otherwise our legitimate interest in answering the people who write to us (Article 6(1)(f)).

Delivering this website to you

Our legitimate interest in showing the site to the people who visit it (Article 6(1)(f)).

We do not use your data for advertising or profiling, and we make no decision about you based solely on automated processing that has a legal or similarly significant effect on you. (The app does work out automatically which reminders to send, and when.) We do not use analytics and we send no marketing; if we ever want to, we will ask you first, separately, and the app will work fully without it.

Your right to object. Where we rely on our legitimate interests — security, server logs, our record of complimentary Plus, delivering this website, answering general emails — you have the right to object at any time, on grounds relating to your particular situation. Write to us at support@proactiveparent.app. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.

Your health-data consent

Before the app stores any of your pregnancy or baby details — on your phone or on our servers — it shows you a health-data notice and asks you to choose. The notice says that, with your explicit consent, we will store your due date or your baby’s birth date and what you record in the app on your phone, use them to provide personal guidance, and sync them to your account when you are online. Refusing is as easy as agreeing. Without this consent the app cannot be used, because everything it does involves health data.

The notice has a version number, which the app shows (the current one is 2026-09-25.1). Our servers refuse health data unless your consent to the current version is on record. When we change the notice, the app asks you again.

Withdrawing consent. You can withdraw your consent at any time, as easily as you gave it: in the app, go to Family → Your account and data → Your consents and tap Withdraw. From then on the app stops using your health data: nothing more is stored, synced or shown, our servers neither accept nor return your health data, and reminders stop. Other phones signed in to the same account stop when they next connect. Your records are not deleted — on your phone or in your account — and you can still download or delete them; deleting is separate (see Deleting your account). To carry on using the app, agree again. Withdrawing does not affect what we did with your consent before you withdrew it.

Your consent to Daphne is separate, and you withdraw it in the same place. Nothing more you say or type is then sent to OpenAI, and the app asks for your consent again before any new conversation; the rest of the app carries on. You can also withdraw either consent by writing to us at support@proactiveparent.app: we will record the withdrawal, and the app will respect it.

Daphne, and OpenAI

Daphne is the app’s assistant. She does what you could do by tapping: she logs and corrects records, changes family settings, creates invitations, and records a birth or a loss, asking you to confirm first where something is hard to undo. She also answers questions about what has been recorded. She does not give health advice. The speech and language processing behind her is done by OpenAI, not by us: “Daphne” is only our name for it. The first time you use her, the app asks for your separate consent and names OpenAI.

During a conversation, these go from your phone or our server to OpenAI:

• your voice, as you speak — and anything else the microphone picks up, such as a child’s voice — or the words you type;
• the names of the children you can see in the family, the pregnancies you can see (as identifiers, not names), the name you gave the assistant, the date and time where you are and your time zone, your language, and the emergency number for your guidance region;
• when you ask about your family, the names, roles and relationships of its members, and whether the family has Plus and who pays for it;
• the details of any records Daphne logs, changes or looks up for you — for example, when the last feed was;
• your phone’s IP address, because your phone connects to OpenAI directly.

OpenAI turns your speech into text, decides what to record, and speaks or writes the reply. The app shows you what it heard, and every record Daphne makes is marked as hers so you can check it. We keep no recording of your voice and no transcript, on our servers or on your phone, and we never use a voice to identify anyone.

OpenAI is based in the United States. We have not yet confirmed with OpenAI an arrangement under which it keeps none of this data and does not use it to train its models. Until we have, what OpenAI keeps, and for how long, is governed by OpenAI’s own terms for its business API customers. We will update this policy when that changes.

Daphne is optional. Everything she does can also be done by tapping, and nothing is sent to OpenAI unless you open a conversation with her.

Who in your family sees what

A family is shared by invitation only. What each member can see is checked by our servers on every request, and a phone receives only the records its owner may see.

• Owner and parents see every child in the family and their records, and each pregnancy’s due date, region, number of babies, its timeline, and how it ended, including a loss. Only the owner can change roles and which children a caregiver or viewer is given.
• Caregivers see only the children they were given, and can log for them if they were allowed to. Viewers see only the children they were given, and cannot log. Neither ever sees a pregnancy.
• Records about the pregnancy itself — baby’s movements, contractions, the pregnant person’s weight and blood pressure — are seen only by the person who added the pregnancy to the app (the app treats them as the person who is pregnant) and anyone they share them with. Being in the family is not enough.
• Members see each other’s names, roles and relationships to the children, and who logged each record. An invitation shows the person invited who sent it, the role and relationship it gives, and how many children it covers — never a child’s name or anything recorded.
• Proactive Plus — everyone in the family sees that the family has Plus and the name of the member who pays for it. Their phones also receive when it ends, whether it will renew, whether it is in its free week and whether a payment failed, but the app shows these only to the person who pays, who alone can manage or cancel it. Plus goes with the person who pays: if they leave the family or are removed, the family no longer has it through them.
• Complimentary Plus — if our staff have given a member Plus, everyone in the family sees that the family has Plus and the name of that member, in the same way. Their phones also receive that it was given by us rather than bought, and when it ends, if it does — never why it was given or who on our staff gave it. It goes with that member in the same way.

When someone is removed from a family, their phone deletes the family’s records the next time it connects to our servers. Until it connects, the records already on that phone stay there, and we cannot reach them.

When our staff can see your data

Our staff have a console, separate from the app, for answering your requests to us and keeping the service running. It cannot show what you recorded: nothing about a pregnancy or a child, no record of any kind, and nothing said to Daphne. It shows staff:

• One account at a time, found only by its exact email address or its id — there is no list of users, and nothing finds an account from part of an address. For that account it shows the email address, when the account was created and whether it is a guest; its time zone; which families it belongs to (by a reference, never a family’s or child’s name), its role in each, when it joined and whether Plus covers that family; each consent, whether it stands, its version and when it was recorded; its phones — when each was added, when it last connected, and whether it is registered for notifications and with which service; if the account pays for Plus, its subscription — the plan, the store, whether it was a test purchase, whether it is in its free week, when it ends, whether it will renew, whether a payment failed and when we last checked; any complimentary Plus given to it — why, which member of staff gave it, when, when it ends, and whether and by whom it was ended early; and how many sign-ins are open and when one was last used.
• Giving Plus — staff can give that account Plus free of charge, for a number of days or with no end date, stating why, and can end it early. They cannot give it to a guest account. They also set up discount codes: what a code means at the App Store and Google Play, and the dates it runs. A code holds nothing about anyone who uses it.
• Deletions not yet finished — when a signed-in account is deleted, one last step runs after the rest: asking RevenueCat to erase what it holds about the account. Until RevenueCat confirms, staff see the account’s id, when the deletion was asked for and how many times that step has been tried, so that they can try it again.
• Daily totals that are about no one in particular — new accounts, active families, how many pregnancies and children are at each stage and in each region, Daphne’s minutes, reminders sent and the reasons others were not.
• Our background work — how many jobs are waiting or have failed, and why they failed, but not what any job carries.

Only staff given the console’s administrator role can sign in; no one can sign up for it, in the console or the app. They sign in with a password and a one-time code from an authenticator app, every time, and are signed out after eight hours. That role gives no access to any family through the app. Before the console shows or changes anything — including giving or ending Plus — it records who asked, what they asked for, which account (by its id, never the email address searched for), when, from which network address and browser, and the reason they gave, if they gave one. The database refuses any edit to these records. We keep them without a time limit, and deleting your account does not delete them: a record that your account was looked at keeps the account’s id. We do not tell you when your account is looked at.

The people who run the service can also reach the production systems, including the database, to keep the service working, fix faults and carry out requests you make to us. That access goes through Amazon Web Services, and every time it starts, who started it is recorded. A session that runs commands on our servers is recorded in full — what was typed and what was shown, which can include your records. A connection to the database is recorded as opened, but not the queries made through it. These records are encrypted, kept for one year and then deleted; deleting your account does not shorten that year. We do not look at your records for any other reason.

Who else handles your data

We do not sell your data, we do not show advertising, and we do not share your data with anyone for their own marketing. This is a commitment, not a setting.

These companies process data for us, each only to provide their part of the service:

• Amazon Web Services — hosts our servers, our database and children’s photos in Ireland, and this website.
• OpenAI — the speech and language processing behind Daphne, when you use her (see above).
• Apple — Sign in with Apple, if you use it; delivery of push notifications to your iPhone; and the App Store, if you subscribe to Plus on an iPhone. A push carries only a general message such as a reminder that something is due, never your records.
• Google — Sign in with Google, if you use it; delivery of push notifications to your Android phone through Firebase Cloud Messaging, which, as on an iPhone, carry only a general message; Google Play, if you subscribe to Plus on an Android phone; and Google Workspace, which holds the email you send to support@proactiveparent.app and our replies.
• RevenueCat (RevenueCat, Inc.) — tells us whether a subscription to Plus is active. While you are signed in, it receives your account’s identifier — a random code that our servers also use, not your name or email address — and the purchases you make, with their receipts from the App Store or Google Play. Apple and Google also tell it when a subscription renews, ends or cannot be paid. Your phone connects to it directly, so it also receives your phone’s IP address, the country of your store and technical details such as the app’s version. It receives no name, email address or health data, and no advertising identifier.

When you subscribe to Plus you buy it from Apple or Google, not from us. They take the payment and keep their own records of it, under their own terms and privacy policies; we never see your card or payment details. The same is true of a discount code: you redeem it, or buy the offer it names, at Apple or Google, at the price they show and under their terms.

We may also disclose data where the law requires us to, for example to comply with a court order.

Where your data is stored

Our servers and database are on Amazon Web Services in Ireland (the EU region “eu-west-1”), and your account and records are stored there, encrypted at rest. UK law recognises Ireland, as part of the European Economic Area, as giving adequate protection to personal data, so no further safeguard is needed for data stored there.

Apple, Google, RevenueCat and OpenAI are based in the United States, so data handled by them — sign-in, push notifications to iPhones and Android phones, Plus purchases, Daphne and the email you send us — may be processed there. We have not yet confirmed the safeguard that covers these transfers. We will name it here, with how to get a copy, once it is in place.

Replies to email you send us go through Google Workspace. The app sends you no email at present. If it ever does, the email will be sent through Amazon’s email service in London and will contain no health data.

On your phone

The app keeps your family’s records in a database on your phone so it works without a connection. That database is encrypted. On an iPhone its key is held in the Keychain; on an Android phone it is sealed with a key held in the Android Keystore. Signing out removes your records from the phone (they stay in your account); deleting your account removes them from that phone at once and from your other phones the next time each connects.

How long we keep it

• Your account and records — until you delete your account, however long ago you last used it, unless it is a guest account (below).
• Guest accounts — if you use the app without signing in and it stops connecting to our servers, the guest account can no longer be opened once its sign-in expires. It becomes due for deletion 90 days after the app last used it, and a daily job then deletes it, with its copy of your records, from our servers. The records on your phone are not deleted: when the app connects again, it can move them to a new guest account.
• A single record you delete disappears from every phone in the family. As soon as the deletion reaches our servers, what the record said is erased — what was recorded, its times, any note, and who logged it. What remains is an empty marker of which kind of record it was and when it was deleted, so that phones which have not yet synced learn to remove it; the marker is erased when the family it belongs to is deleted.
• A child’s photo — until you remove or replace it, or the family is deleted. We then delete it at once; if our storage cannot be reached, we try again every 15 minutes until it is gone. Photos are not backed up, so a deleted photo cannot come back.
• Invitations — until the family is deleted, including ones that were used or have expired.
• Consent records — for as long as your account exists, then deleted with it.
• Our record of your Plus subscription — while it gives your family Plus. When RevenueCat reports that it has ended we delete the record, and it is deleted with your account. We ask RevenueCat to erase what it holds about your account when you delete the account.
• Our record of complimentary Plus — for as long as your account exists, including after the Plus has ended, then deleted with it. The records of our staff giving or ending it are kept as described in When our staff can see your data.
• Server logs — what kind of request reached our servers (for example “add a record”), when, and whether it worked; and, when something fails, which part of our code failed and how. They never contain what you recorded or which record it was. Kept for up to 30 days.
• Backups — automated database backups are kept for seven days; a record you delete can remain in them until they expire.
• Deleted phones — when an account is deleted we keep a hash of each of its phones’ random identifiers, linked to no person or account, so that a phone left switched off for a long time still deletes its records when it next connects. We keep these without a time limit.
• Records of staff looking at your account — without a time limit, including after the account is deleted; see When our staff can see your data.
• Emails to us — for as long as we need them to deal with what you asked.

Deleting your account

Delete your account in the app: Family → Your account and data → Delete everything. It works for guest accounts too, and needs no email address. Before you confirm, the app tells you what will happen to any family you share.

• Your account, sign-in details, sessions, consent records, reminder settings, phones, Daphne usage, our record of any Plus subscription and our record of any complimentary Plus given to you are deleted from our servers. If you had complimentary Plus, your family no longer has it through you.
• If you are signed in, we then ask RevenueCat to erase what it holds about your account, and ask again every 15 minutes until it confirms.
• If you pay for Plus, your family no longer has it through you. Deleting your account does not cancel the subscription: Apple or Google bills it, so cancel it in the App Store or Google Play first, or you will keep being charged. If it is set to renew, the app tells you this before you delete.
• If you are the only member of your family, the family is deleted with every pregnancy, child, child’s photo and record in it.
• If you share the family with others, the children’s records stay with them, no longer linked to you: where it said you logged a record, it no longer says who did.
• A pregnancy you added — its due date, its timeline and how it ended — stays with the family while an owner or parent remains in it to see it; if none does, it is deleted with its timeline.
• Records about a pregnancy you added — movements, contractions, your weight and blood pressure, including any someone you shared them with logged for you — are deleted from our servers with your account, and leave the phones of the people you shared them with the next time each connects.
• If you were the owner, the parent who joined the family earliest becomes the owner. If no parent remains, no one does: a caregiver or viewer never gains anything by your leaving. They keep seeing — and, if they were allowed, logging for — only the children they were given; nobody can invite anyone or change anyone’s role, and the invitations you sent stop working. When the last of them leaves the family or deletes their account, the family is deleted with everything in it.
• The records leave your phone at once, and your other phones the next time each connects. Automated backups keep them for up to seven days.

To delete one record, open it in the app. Deleting your account does not delete anything OpenAI may hold; see Daphne, and OpenAI. It does not delete the records of staff looking at your account; see When our staff can see your data. Nor does it delete the records Apple or Google keep of what you bought from them. It does unlink the app from your Apple or Google account: we ask Apple to revoke the app’s Sign in with Apple, and the app asks Google to revoke its access from your phone. If either fails, you can remove Proactive Parent yourself from the apps using Sign in with Apple in your iPhone’s Apple Account settings, or from the third-party connections in your Google Account.

Your rights

Under UK data protection law you have the right to:

• get a copy of your data, in a format you can take elsewhere — in the app, Family → Your account and data → Download your data gives you a JSON file of your account, sign-ins, consents, reminder settings and notifications, phones, your Plus subscription if you pay for one, any complimentary Plus given to you (why, when and until when — not which member of our staff gave it), and the pregnancies, children (with their photos) and records in your family that you can see (not deleted records). It does not include your Daphne usage or the invitations you created; ask us for those;
• have it corrected — you can edit or delete records in the app;
• have it deleted — see Deleting your account;
• restrict how we use it, or object to our using it — by writing to us;
• withdraw your consent at any time — see above.

For anything the app does not do for you, write to support@proactiveparent.app. We will reply within one month; for a complex request we may extend that by up to two more months, and if so we will tell you within the first month. We may need to confirm that the account is yours first. If you hid your email address with Sign in with Apple, write from any address and we will agree another way to confirm it. A guest account has no name or email address we could check, so for a guest account the app’s own download and delete are the surest routes; for anything else, write to us and we will agree with you how to confirm that the account is yours.

If you live in Washington state, or in another US state with a consumer health data law, ourconsumer health data privacy policy sets out the same in that law’s terms, with how to appeal a decision of ours.

If you are unhappy with how we have handled your data, please tell us; we will acknowledge a complaint within 30 days. You also have the right to complain to the UK’s Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113. If you live in the EU or Turkey, you can also complain to the data protection authority where you live; for Turkey, see the Turkish version of this policy.

Children’s data

Proactive Parent is for parents and the people who help them. Children do not use it: what is recorded about a child is entered by an adult in the family. We never use a child’s data for advertising or profiling, and never share it outside your family except with the companies above, which provide the service.

This website

This website sets no cookies, runs no analytics and loads nothing from any other company: every page, image and stylesheet comes from this site. It is served through Amazon CloudFront, which receives your IP address in order to deliver the page, as any website’s host does. We have not turned on CloudFront’s access logs, so we keep no record of your visit.

Changes to this policy

When we change this policy we will publish the new version here with its date. If a change affects the health-data notice in the app, the app will ask for your consent again.

Contact us

Questions about this policy or your data: support@proactiveparent.app, or by post to Right Stack Ltd, 86–90 Paul Street, London, EC2A 4NE, United Kingdom.