Baby Bothie Privacy Policy

1. Who the service is for

Baby Bothie is a general-audience app directed to adults (18+) — parents and legal guardians. Children never operate the app, have no accounts, and we never knowingly collect personal information from a child. Children appear only as subjects of photos their own parent or guardian chooses to submit, with that adult's explicit consent (see §6).

Photos we can't accept. Everyone in a photo must be dressed: onesies, swaddles and pajamas are perfect, but bath-time, nude, or partly undressed photos of anyone aren't supported. Before your photos reach an image model, our server sends them to OpenAI's moderation service, which checks for nudity. If either photo looks unclothed, we decline it and nothing more is sent. This protects your family's photos and keeps the service available to everyone, because image providers refuse such photos and may suspend services that send them.

2. Information we collect

What we do not collect: contacts, location/GPS, microphone audio (the app has no microphone permission), health data, advertising identifiers, browsing history. We do not track you across other companies' apps or websites, and there are no third-party ad or tracking SDKs in the app.

During the beta, usage analytics run from first launch so we can diagnose crashes and drop-offs. If you do not accept the consent screen, your events stay pseudonymous — recorded under a random installation ID, never linked to an account or identity. You can stop analytics at any time with Settings → Share usage analytics (this also deletes any events queued on your device), and deleting your account additionally starts deletion of your analytics data on our side.

3. Your photos' exact journey

1. Capture, on your iPhone. Both photos are taken in the app. Before anything leaves your device, the app strips photo metadata (no location, no device serial data — pixels only) and normalizes the images.
2. Both originals are saved to your on-device library first (see §5). If that fails, nothing is sent.
3. Close-ups of each face, made on your iPhone. So the result looks like you both even when a face is small in its photo, the app uses Apple's on-device face detection to cut a close-up of the face from each of the two photos. They are made on your iPhone, sent only with that request, and never saved to your library or our servers.
4. Encrypted upload to our server. The two photos (and the face close-ups) travel over an encrypted connection to our processing function on Google Cloud (US). The function holds image bytes in memory only — it never writes your photos to our storage, logs, or databases.
5. Automatic photo check. The function sends the photos and the close-ups to OpenAI's moderation service, which checks for nudity (OpenAI's terms in §4 apply). If either photo looks unclothed, the request stops here and nothing else is sent.
6. Sent to the enabled AI provider(s). The function forwards the two photos and the face close-ups to each provider currently enabled in the app (§4) to create the combined image(s).
7. Returned to your iPhone. Combined images stream back to your device and are stored in your on-device library. Our server keeps no copy of any image — not the originals, not the results.
8. What remains server-side is metadata about the request (status, timing, error category, cost) with no image content, deleted no later than 45 days after the request completes.

The app asks you to keep it open during combining; some versions can take up to 3 minutes.

4. The AI providers we use (our processors)

We name every processor and disclose the retention and training posture we currently rely on, including unresolved beta risks. Our internal, dated processor checklist records the evidence and any narrow founder-approved exception. The in-app consent screen always lists the providers currently enabled and their current windows; if the list or the terms materially change, the app asks for your consent again before any further processing.

Things we deliberately do not use with these providers: no grounding/search features, no provider file-storage APIs, no context caching — each would carry its own retention.

All providers process data in the United States. If you use the beta from outside the US, your photos and data are transferred to and processed in the US.

5. Your on-device library

• Your Baby Bothie library (originals and combined images) is stored only on your iPhone, in the app's protected storage, encrypted at rest by iOS.
• The library is excluded from device backups — so "on-device only" stays literally true; it does not sync to iCloud through us.
• Saving an image to Apple Photos is always your explicit choice (the app requests add-only Photos access). Once exported, that copy is governed by your Apple settings and may sync via iCloud Photos — see §7.
• If you added Sign in with Apple, signing out hides your library on that device. An account without Sign in with Apple has no sign-out, because it could not be opened again. Deleting your account removes the library (§7).

6. Guardian consent — the gate in front of everything

Before your first combination, the app requires three explicit acknowledgements:

1. You are 18 or older and the parent or legal guardian of every child whose photo you submit;
2. You permit Baby Bothie to send the two selected photos to the processors listed on the consent screen (the enabled rows of §4, with their retention windows shown);
3. You understand the combined output is AI-generated and that usage analytics are collected.

We record a consent receipt (consent version, processor configuration version, timestamp, app build). If the processor list or any disclosure materially changes, you must re-consent before further processing. You can withdraw at any time: turn off Settings → Share usage analytics to stop analytics on your device (this also purges locally queued events, while keeping your account and on-device library intact), and use Settings → Delete account to withdraw processing consent entirely — deletion blocks further combining and starts deletion of your analytics data.

7. Deletion

Delete your account in Settings. If you added Sign in with Apple, the flow first re-confirms your identity with Apple and revokes your Apple sign-in token. Then analytics stop, and all server-side data (account, consent records, request metadata) and your analytics identity are deleted. Your local library is removed from the device. If a combination is in progress, it is stopped as soon as technically possible; work already sent to a provider may briefly complete but its output is not delivered or kept.

Service levels: data on our servers (Firebase) is deleted within 24 hours; analytics data (PostHog) within 30 days. The app shows "deletion pending" until confirmed, and you receive a receipt code to check status without an account.

What deletion cannot reach — said plainly:

• Copies you saved to Apple Photos. Those live in your Apple account and may have synced through iCloud Photos; delete them there.
• Provider safety-retention windows described in §4 (e.g., Google's up-to-55-day abuse-monitoring logs age out on Google's schedule; any CSAM-flagged material at a provider is retained under that provider's legal obligations).
• A minimal, non-identifying deletion record (not linked to you) kept up to 30 days so we can prove the deletion completed.
• The per-iPhone usage record (§2): a hashed device identifier and the times of that iPhone's photos from the last 24 hours. It is not linked to your account, and it is deleted automatically within two days of the last photo.

Other retention limits, regardless of deletion: server request metadata ≤45 days after each request; raw analytics no later than 90 days after the beta ends (after which only aggregate statistics, with free-text feedback excluded, are kept for research write-ups).

8. Children's privacy

COPPA governs data collected online from children. Baby Bothie is not directed to children, provides no child accounts, and collects no data from children; the user is always the parent or guardian, who provides the photos and the consent (§6). We honor the spirit of COPPA anyway: minimal data, short retention, verified processor terms, and parental deletion rights over everything we hold. If we learn a child has created an account, we will delete it.

9. What we never do

• No advertising, and no advertising SDKs.
• No sale of personal data; no sharing beyond the named processors above (plus our infrastructure providers, Google Firebase and PostHog, named in §2).
• No tracking across apps or websites; no data broker anything.
• No face-recognition or identification databases — we do not identify people; we combine two photos you chose into one image for you alone.
• We do not train on your photos; each provider's current training posture, including fal's pending written confirmation, is disclosed in §4.

10. Security

Encryption in transit everywhere; on-device files protected by iOS encryption with backup exclusion; server functions verified by Apple App Check; image bytes confined to function memory; access to production systems restricted to the founder; provider requests authenticated and never logged with image content. No system is perfectly secure — if a breach affects your data, we will notify you promptly — by email if you added Sign in with Apple, and otherwise in the app and on this page.

11. Your rights

Depending on your state or country, you may have rights to access, correct, delete, or export your personal data, and to non-discrimination for exercising them. The app provides analytics opt-out, account deletion, and on-device data controls. For anything else, contact hello@babybothie.com. We respond within 30 days.

12. Changes to this policy

We will post changes here with a new effective date. Material changes — especially anything touching §4 — additionally require fresh in-app consent before further processing (§6).