This policy explains what data the VINULU: Baby Sleep Tracker app (the "app") for iOS and Apple Watch processes, why, who receives it and how long it is kept.
1. Who is responsible
The data controller is Ivan Goriachev.
- Self-employed sole trader registered in Portugal
- Address: Avenida Conde S. Januário, n.º 28, House D, 2770-040 Paço de Arcos (Oeiras), Portugal
- Tax number (NIF): 311595154
- Email for data and privacy questions: hello@vinulu.com
2. What data we process
- Account. Your email address and name. You can sign in with email and password, with Apple or with Google. Sign-in is handled by Firebase Authentication (Google); we never see or store your password.
- Your child's data. What you enter yourself: name, date of birth, gender, and records of sleep, feedings, diaper changes and pumping.
- Family sharing. If you invite a partner or another adult, your family's data becomes visible to them, and we process their account.
- Purchases. Subscription status and purchase history that we receive from Apple and RevenueCat. We do not receive payment details (card and similar) — Apple processes them.
- Device and usage. Device model, system and app version, in-app usage events and crash reports (Firebase Analytics, Firebase Crashlytics).
- Notifications. A device token for push notifications (Firebase Cloud Messaging, Apple Push Notification service).
- Advertising and attribution. To understand which ads bring users, the app uses the Meta SDK and Google Ads (on-device conversion). The device advertising identifier (IDFA) is shared only if you allow tracking in the iOS prompt (App Tracking Transparency). You can withdraw this permission in your iPhone settings.
3. Why, and on what legal basis (GDPR Art. 6)
- To run the app — account, storing and syncing your records, family sharing, subscription: performance of our contract with you (Art. 6(1)(b)).
- Stability, security and improvement — crash reports, usage statistics, abuse prevention: our legitimate interest (Art. 6(1)(f)).
- Advertising attribution with the device identifier, and marketing emails — your consent (Art. 6(1)(a)); you can withdraw it at any time.
- Purchase records and requests from authorities — legal obligation (Art. 6(1)(c)).
4. Predictions and tips
Sleep windows, predictions and tips are calculated on your device from your records. Your data is not sent to artificial intelligence or language model services for this. The app's tips are not medical advice.
5. Who receives your data
We do not sell your data. Your data is processed by providers that help us run the app, only for that purpose and under data processing agreements:
| Provider | Purpose |
|---|---|
| Google (Firebase: Authentication, Firestore, Analytics, Crashlytics, Cloud Messaging, Remote Config, App Check) | sign-in, storing and syncing data, statistics, crash reports, notifications |
| RevenueCat | subscription management |
| Apple | App Store purchases, push notifications, Sign in with Apple |
| Meta Platforms | advertising attribution |
| Google Ads | advertising attribution |
| Amazon Web Services (SES) | sending service emails |
We may use aggregated statistics that cannot identify any individual.
6. Transfers outside the EEA
Some providers process data outside the European Economic Area, including in the United States. Such transfers rely on the standard contractual clauses approved by the European Commission, or on the EU-U.S. Data Privacy Framework where the provider takes part in it.
7. Retention and deletion
We keep your data while you have an account. You can delete your account in the app, in your account settings, or by writing to hello@vinulu.com. When you do, we delete your profile and app data; data that the law requires to be kept longer (for example, purchase records at Apple and RevenueCat) is kept for that period only.
8. Security
We use technical and organisational measures to protect your data: encryption in transit, access control and app integrity checks (Firebase App Check). No method of transmission or storage is completely secure.
9. Your rights
Under the GDPR you can ask to access, correct, delete, restrict or port (in a machine-readable format) your data, object to processing based on legitimate interest, and withdraw your consent. Write to hello@vinulu.com — we reply within one month.
You can complain to a data protection authority: in Portugal this is the CNPD (www.cnpd.pt); authorities in all EEA countries are listed at edpb.europa.eu.
10. Children
The app is used by parents and caregivers. Data about a child is entered by an adult and is used only to run the app. We do not collect data directly from children.
11. Data shared with Apple for refund requests
If you ask Apple for a refund of an in-app purchase, we may share with Apple information about how the purchased content was used — only so that Apple can decide on the request, and only as far as Apple's rules allow.
12. Changes to this policy
If we change this policy, the new version will appear on this page with a new date, and we will tell you about significant changes in the app.