Privacy Policy

Last updated: March 6, 2026

RHH LLC ("we", "us", "our") operates the What's Up, Baby? mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

By using What's Up, Baby?, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

This policy applies to all users worldwide, including those protected under the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the UK Data Protection Act 2018, Brazil's Lei Geral de Proteção de Dados (LGPD), and other applicable privacy laws.

1. Data Controller

RHH LLC is the data controller responsible for your personal data.

Email: [email protected]

2. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), UK, or Switzerland, we process your personal data under the following legal bases:

• Consent — You provide explicit consent when creating an account and entering pregnancy data
• Contract Performance — Processing necessary to provide the App's services to you
• Legitimate Interest — Improving the App, fixing bugs, and ensuring security, where these interests are not overridden by your rights

You may withdraw consent at any time by deleting your account or contacting us. Withdrawal does not affect the lawfulness of prior processing.

3. Information We Collect

Account Information

When you create an account, we collect:

• Name (or display name you choose)
• Email address
• Authentication credentials (encrypted, managed by Firebase Auth)
• Profile photo (if you upload one)

Pregnancy & Health-Related Data

To provide our services, we collect pregnancy-related information you voluntarily enter, including:

• Due date and pregnancy week
• Symptom logs and severity ratings
• Weight entries
• Kick counter and contraction timer sessions
• Sleep tracking entries
• Food cravings and food safety lookups
• Baby gender and name preferences

Personal Content

• Journal entries and mood ratings
• Letters to baby
• Bump photos
• Baby name preferences and partner name matches
• Birth plan details
• Hospital bag checklist progress
• Baby shower guest information (imported from your contacts with your permission)
• Shopping list and expense entries
• Appointment records

Usage Data

• Feature usage for milestone and garden gamification tracking
• App preferences (language, units, theme, notification settings)
• AI chat messages and conversation history

Data We Do NOT Collect

4. How We Use Your Information

We use the information we collect to:

1. Provide, operate, and maintain the App's pregnancy tracking features
2. Personalize your experience (weekly content, baby size comparisons, milestones)
3. Calculate pregnancy progress and provide week-appropriate educational content
4. Enable partner sharing when you choose to invite a partner
5. Power the AI assistant with pregnancy-relevant context
6. Sync your data across your devices via Firebase
7. Unlock gamification features (garden creatures, milestones) based on feature usage
8. Display widgets on your home screen and lock screen

5. AI Assistant & Third-Party AI Processing

What's Up, Baby? includes an AI-powered pregnancy assistant. When you use this feature:

1. Your messages are sent to OpenAI's API for processing via our secure Firebase Cloud Function.
2. We include limited pregnancy context (current week, trimester, baby gender if set, partner status) to provide relevant answers.
3. Your recent conversation history (up to 6 message exchanges) is included for conversational continuity.
4. OpenAI processes this data under their API Data Usage Policy — API data is NOT used to train their models.
5. We do NOT send your name, email, journal entries, photos, weight, symptoms, or other personal content to OpenAI — only chat messages and basic pregnancy context.
6. Chat messages are rate-limited to 50 per day per user.

6. Partner Sharing

What's Up, Baby? allows you to share selected pregnancy data with a partner through a unique sharing code. When you enable partner sharing:

1. You control which features your partner can view or contribute to through 27 view and 3 write granular permissions.
2. Your partner can see only the data categories you explicitly allow.
3. Partners may contribute to shared features (writing letters, swiping baby names, watching kick sessions) when you grant write permissions.
4. You can disconnect your partner or modify permissions at any time, with immediate effect.
5. Partner data is synced in real-time via Firebase Firestore.

7. Data Storage & Security

Your data is stored using Google Firebase infrastructure with the following security measures:

• Encryption in transit (TLS 1.2+/SSL for all connections)
• Encryption at rest on Google Cloud servers
• Firebase Authentication with secure token management
• Per-user data isolation enforced by Firestore Security Rules
• Single-device session enforcement to prevent unauthorized concurrent access
• Photos stored in Firebase Storage with authenticated-only access controls

While we implement industry-standard safeguards, no method of electronic storage is 100% secure. We cannot guarantee absolute security of your data.

8. International Data Transfers

Your data may be transferred to and processed in the United States, where our service providers (Google Firebase, OpenAI) operate. For users in the EEA, UK, or Switzerland, these transfers are protected by:

• Standard Contractual Clauses (SCCs) as part of Google's data processing terms
• OpenAI's compliance with applicable data protection requirements for API usage
• Our commitment to ensuring an adequate level of data protection regardless of where data is processed

9. Data Retention

We retain your personal data for as long as your account is active. When you delete your account through the App's settings, we permanently and immediately remove:

• Your user profile and all associated data across all 23 Firestore collections
• All photos stored in Firebase Storage (bump photos, profile photo)
• All chat messages and AI conversation history
• Your Firebase Authentication account
• Partner connections (your partner is unlinked)

Deletion is immediate and irreversible. We do not retain backups of deleted user data. Locally cached data on your device is also cleared upon account deletion.

10. Third-Party Services

What's Up, Baby? uses the following third-party services, each operating under their own privacy policies:

• Google Firebase — Authentication, database, file storage, cloud functions (Google Privacy Policy)
• Google Sign-In — Optional authentication method (Google Privacy Policy)
• Apple Sign-In — Optional authentication method (Apple Privacy Policy)
• OpenAI API — AI assistant chat feature only; API data is not used for model training (OpenAI API Data Usage Policy)

We do not use any analytics SDKs, advertising networks, crash reporting tools, or social media tracking pixels.

11. Cookies & Tracking

The What's Up, Baby? mobile app does not use cookies, web beacons, or tracking pixels. We do not track you across other apps or websites. We do not participate in any advertising networks or data broker arrangements.

12. Children's Privacy

What's Up, Baby? is not intended for use by children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will delete it immediately. If you believe a child has provided us with data, please contact us.

13. Your Rights

All Users

• Access — View your personal data at any time within the App
• Rectification — Modify your personal information in your profile settings
• Deletion — Delete your account and all associated data through Settings
• Data Portability — Your data is accessible in-app; contact us for a machine-readable export
• Withdraw Consent — Stop using the App or delete your account at any time
• Disconnect Partner — Remove partner access instantly through partner settings

European Economic Area, UK & Switzerland (GDPR / UK GDPR)

• Right to access — Obtain a copy of your personal data
• Right to rectification — Correct inaccurate personal data
• Right to erasure ("right to be forgotten") — Request deletion of your data
• Right to restrict processing — Limit how we use your data
• Right to object — Object to processing based on legitimate interests
• Right to data portability — Receive your data in a structured, commonly used format
• Right to lodge a complaint — File a complaint with your local Data Protection Authority (DPA)
• Right not to be subject to automated decision-making — We do not make automated decisions that produce legal effects concerning you

California Residents (CCPA / CPRA)

• Right to know — What personal information is collected, used, and shared
• Right to delete — Request deletion of your personal information
• Right to opt-out of sale — We do NOT sell your personal information to any third party
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights
• Right to correct — Request correction of inaccurate personal information
• Right to limit use of sensitive personal information — Your pregnancy and health data is used only to provide the App's services

Brazil (LGPD)

• Right to confirmation and access — Confirm whether your data is processed and access it
• Right to correction — Request correction of incomplete or inaccurate data
• Right to anonymization, blocking, or deletion — Of unnecessary or excessive data
• Right to data portability — To another service provider
• Right to revoke consent — At any time, by deleting your account

14. We Do Not

• Sell your personal data to any third party
• Share your personal data for targeted advertising
• Share your health data with insurance companies, employers, or data brokers
• Track you across other apps or websites
• Use advertising IDs or device fingerprinting
• Profile you for purposes unrelated to the App's pregnancy tracking features
• Make automated decisions that produce legal effects concerning you

15. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours (as required by GDPR)
• Notify affected users without undue delay if the breach poses a high risk
• Provide details about the nature of the breach, data affected, and remedial measures taken

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy within the App and updating the "Last updated" date. For significant changes, we may also notify you via in-app notification. Your continued use of the App after changes constitutes acceptance of the updated policy.

17. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to lodge a complaint, contact us at:

RHH LLC

Email: [email protected]

Website: https://whatsupbaby.app

For EU/UK users: You also have the right to lodge a complaint with your local Data Protection Authority.