1. Information stored on your device
The app keeps your baby's name, birthday, due date and profile photo, feed, diaper, sleep, bath, solids and pumping records, temperature, hospital and vaccine visits, stool color and texture, milestones, solid food ingredients, height, weight, head circumference, and app settings on your phone. If you turn on neither caregiver sharing nor cloud backup (called "Linked account" in the app), WaveWorks does not receive this information on a server, cannot see it, and does not use it for ads. Deleting the app deletes the information on the device. A backup file holds the records and your baby's profile photo. You choose where the app saves backup and CSV files and who gets a copy. The app does not upload these files to a server.
2. If you turn on caregiver sharing
Caregiver sharing stays off until you turn it on in Settings. Before it starts, a consent screen shows what information goes to the server and why, where it is stored, how long it is kept, your right to refuse and what changes if you refuse, and how to withdraw. Saving your baby's health-related records (collection) and viewing them with caregivers (sharing) are separate checkboxes, and none is pre-checked. The caregiver who creates the family also checks "I am this baby’s parent or legal guardian and I agree on the baby’s behalf". Sharing starts only after you check every box and tap "Agree and continue". If you do not agree, the features on your device keep working. The app keeps a record of what you agreed to, when, and which wording version, on the device and on the server (as that device's consent record inside the family). Once sharing is on, the caregivers in the same family see and edit the information below.
| Information sent to the server | Used for |
|---|---|
| Baby's name, birthday, due date, name type and sex | Showing the same baby on each caregiver's phone |
| All records (feeds, diapers, sleep, baths, solids, pumping, temperature, hospital and vaccine visits, stool color and texture, milestones, solid food ingredients, notes, height, weight, head circumference) and deletion marks | Keeping the caregivers' records in sync |
| This device's anonymous ID (Firebase anonymous sign-in) | Checking family membership. The server stores, with each baby, record and deletion mark, the anonymous ID of the device that last changed it |
| The device that created the family, when each caregiver joined, the caregiver limit, invite codes and their expiry | Invites, joining and removing a caregiver |
| The last time a device in the family used sharing (updated about once a day) | Deleting families that nobody has used for a year (not families with a member signed in with Apple or Google) |
| Whether the family has the purchase (a one-way hash of the purchase number, the check time, the product ID) | Applying one caregiver's "Remove ads + add babies" purchase to the whole family and reflecting refunds |
| Consent record (what you agreed to, when, and the wording version) | Showing that consent was given, and asking again if the wording changes |
| A device slot for widget updates (push token, device time zone, platform iOS or Android, the ID of the baby shown in the widget, last-updated time) | Updating the home-screen widget with records other caregivers make, without opening the app |
- The app does not send baby photos, app settings or ad consent to the server. With caregiver sharing alone, it does not ask for a name, email address or phone number. Cloud backup sends the email of your sign-in account (see "If you turn on cloud backup" below).
- The app screens do not show who made a record or who bought the purchase. The server keeps the anonymous ID of the device that last changed each item, as listed above. Caregivers in the same family can read that ID, so in a two-caregiver family they can tell who made a change. Caregivers in the same family can see whether the family has the purchase.
- To check a family purchase, the app sends its anonymous RevenueCat user ID to a WaveWorks server function. The function asks RevenueCat whether the purchase exists and does not store the ID or the price, country or transaction details RevenueCat returns. To limit how often a phone can ask, the function stores the phone's anonymous ID and the time of its last check, and the cleanup job deletes that entry after a day.
- Widget updates: on a device with caregiver sharing on, when another caregiver adds a record, the server sends a silent message through Google Firebase Cloud Messaging (FCM) to refresh the home-screen widget. The message has no sound, vibration or visible notification. It carries only the summary values the widget shows (times of the last feed, sleep, diaper and bath, feed amounts, today's totals, a running feed or sleep) and the baby ID. It does not carry notes, photos, or the baby's name or profile. The server works out today's totals in the receiving device's time zone. The app does not ask for notification permission. The device slot (including the push token) exists only in the device documents of a family that uses sharing, and it is deleted when the device ends sharing, leaves the family or the family is closed. The server also deletes a token it finds is no longer valid. This processing uses only Google services (Firestore, Cloud Functions, FCM).
- Google Cloud Firestore stores the data in the Seoul region (asia-northeast3), and the server functions run in the same region. Firebase Authentication manages the anonymous IDs in the United States (see "International transfers" below).
- The caregivers in your family can see this information. Caregivers seeing each other's records is a feature you chose, and WaveWorks does not sell this information or hand it to other companies. WaveWorks can access it with server administrator rights but does not look at it unless you ask, for example in a support request.
- The app encrypts data in transit (TLS), and Google encrypts stored data by default. The app does not use end-to-end encryption.
3. Retention and deletion of shared information
- Shared information stays on the server while at least one caregiver remains in the family.
- When a caregiver taps "Stop sharing", the app removes that phone from the family and deletes its anonymous account. Records that caregiver made stay in the family, and the phone keeps a copy of the records up to that moment.
- If the server refuses to delete the account (for example, an old sign-in), the app signs out instead. The cleanup job deletes that account under the 30-day rule below, because it belongs to no family.
- Only the caregiver who manages the family (the one who created it, or the next earliest member if that caregiver left) can remove another phone. A removed phone stops sharing and deletes its anonymous account the next time it connects. The copy on the phone stays.
- When the last caregiver taps "Stop sharing", the app deletes the baby and records on the server and closes the family. Nobody can open a closed family, and a cleanup job that runs once a day deletes everything left in families closed for more than a day.
- A record you delete in the app stays in "Recently deleted" for 30 days. After that, or when you choose "Delete forever", the app erases the server copy's content. A server cleanup job runs every day even if no phone opens the app. It erases the content of records deleted more than 30 days ago and deletes deleted baby entries whole. A mark holding the record ID, the deletion time and the deleting phone's anonymous ID stays for 365 days so that another phone cannot bring the record back, and then the cleanup job deletes it.
- An invite code stops working 24 hours after it is created, and Firestore's automatic deletion removes expired codes.
- The cleanup job deletes an anonymous account that belongs to no family 30 days after its last use.
- If no phone in a family uses sharing for a year, the cleanup job closes the family and, the next day, deletes its baby, records, deletion marks, invite codes and family information. The members' anonymous accounts follow under the 30-day rule. If a member signed in with Apple or Google (cloud backup), the cleanup job leaves the family open and only updates its last-used time. On a day the cleanup job cannot check the members' accounts, it skips the family and checks again the next day.
- WaveWorks keeps the family purchase record (the purchase number hash, the family ID, the check time) while the purchase is valid, so that one purchase applies to only one family. It also stays after the family information is deleted, so the purchase cannot be reused by another family. If the purchase is refunded or canceled, the family ID is erased and only a refund marker stays (the purchase number hash and the check and refund times). The marker keeps a refunded purchase from being applied again when a refund and a purchase check arrive out of order. The marker does not identify a family or a person.
- If you deleted the app before stopping sharing, or all caregivers lost their phones, you can ask for deletion by email. Without a request, the one-year rule above applies.
4. If you turn on cloud backup
The app screens call cloud backup "Linked account". Cloud backup stays off until you tap "Sign in" under Settings > Backup and sign in with Apple or Google. Before you sign in, a consent screen lists what goes to the server (with Google sign-in, also your name and profile photo link), what stays on the phone, where the data is stored and how to turn backup off. When you restore records with "Sign in to start" on the first screen, the same consent screen appears before you sign in. If the account you signed in with has no backup and you start fresh with it, backup turns on only after you tap "Agree and continue" on the consent screen. With backup on, you can sign in with the same account on a new phone and get your records back.
| Information sent to the server | Used for |
|---|---|
| Baby's name, birthday, due date, name type and sex, all records and notes, and deletion marks | Restoring records on a new phone or another device signed in to the same account |
| The sign-in account (Firebase Authentication): user ID, the email address of the Apple or Google account, for Google sign-in the display name and profile photo URL, and when the account was created and last signed in | Confirming who owns the backup, finding the account for an email deletion request |
| An account entry (for each user ID, the ID of the family that holds the backup and when the entry was created) | Letting devices signed in to the same account find the same backup |
| The family information in the caregiver sharing table above (the account that created the family, the last time it was used, whether the family has the purchase) | Storing the backup as one family, checking the family purchase |
- If you choose "Hide My Email" for Sign in with Apple, the account keeps the forwarding address that Apple creates.
- From Sign in with Apple, the app keeps the email and does not send your name to the server. On iPhone, the Apple sign-in sheet asks whether to share your name as well as your email.
- A user with backup alone also gets a one-caregiver family on the server. If you share with caregivers, that family copy is your backup, and the app does not send the same records twice.
- The app does not send baby photos, app settings or ad consent to the server.
- Turning backup on or off and restoring from it each send an event to Firebase Analytics, and a user property records whether backup is on. Each event carries the sign-in type (Apple or Google) and nothing else. If a backup step fails, the app sends Crashlytics the step name and error code. None of these carry record content, email or user ID.
- Google Cloud Firestore stores the data in the Seoul region (asia-northeast3), and the server functions run in the same region. Firebase Authentication manages the sign-in account.
- You and your other devices signed in to the same account can see the backup. If you turned on caregiver sharing, the caregivers in your family can see it. WaveWorks administrator access works as described for caregiver sharing.
- The app encrypts data in transit (TLS), and Google encrypts stored data by default. The app does not use end-to-end encryption.
- During caregiver sharing or cloud backup, the app uses Firebase App Check to confirm that requests come from the genuine app from the store on an unmodified device. Apple App Attest judges this on iPhone and Google Play Integrity on Android, and the app sends the resulting check token with its requests. Three server functions (family purchase check, account deletion, caregiver seat cleanup) refuse requests without a valid token. The check does not use record content, email or user ID.
5. Retention and deletion of cloud backup information
- WaveWorks keeps the backup copy and the sign-in account until you turn backup off or delete the account.
- "Unlink and delete" under Settings > Backup and "Delete account" at the bottom of Settings do the same thing. After you sign in with Apple or Google again to confirm it is you, the app deletes the backup copy, the account entry and the sign-in account on the spot. Records on your phone stay.
- Settings shows "Delete account" even after you sign out or reinstall the app. Sign in with the account you want to delete, and the app shows its email address and asks once more. "Delete" removes that account's server backup and sign-in account and signs out. "Cancel" only signs out. The app keeps the records on this phone and does not upload them. The app hides this row while you use caregiver sharing without signing in and while you wait to join a family. With cloud backup and caregiver sharing together, the row stays visible.
- If you delete in the iPhone app after signing in with Apple, the app also revokes the Apple sign-in link. Deleting in the Android app or by email does not revoke it, and you can remove the app yourself from the "Sign in with Apple" list in iPhone Settings or on the Apple Account website. If revoking fails, the app still goes on to delete the account. In the rare case that the App Check blocks the server deletion, the app has already revoked the Apple link, and the account stays in "Deleting your backup". When you delete again, Apple asks for your sign-in consent once more.
- If you stop using Sign in with Apple for this app in iPhone Settings or on the Apple Account website, or delete your Apple Account, Apple notifies the WaveWorks server. When Apple reports that you stopped using it, the server signs that account out and keeps the backup copy. Sign in again with the same Apple Account and the backup carries on. When Apple reports a deleted Apple Account, the server deletes the backup copy, the account entry and the sign-in account, the same as "Delete account". If that account also has Google sign-in linked, the server signs it out and removes only the Apple link, and the backup carries on with Google sign-in. For a change to email forwarding, the server records only the notice type.
- If the app cannot pass the App Check, it cannot delete the account in the app and points you to the account deletion section of this privacy policy. You can then ask by email as that section and the account deletion page describe. On a device with backup on, you can also choose "Turn off backup on this phone". That button signs out without contacting the server. After that, it clears only this device's backup and sharing settings and its upload list. The records on the device and the server backup and account stay, so you delete the server side by email.
- If you share with other caregivers, only your account leaves the family, and the records you left there stay for the other caregivers.
- If the connection drops before deletion finishes, the app finishes it the next time you open it and uploads nothing in the meantime.
- "Sign out" stops backup on this device. The server copy and the sign-in account stay.
- If you deleted the app, reinstall it, go in without signing in and use "Delete account" in Settings, or ask by email as described on the account deletion page (
<URL>). We delete within 10 days of an email request and reply with the result. - WaveWorks keeps a recovery copy of the server database (Firestore point-in-time recovery) in case of an operating error. Deleted shared and backup information also stays in that copy for 7 days and then disappears. The copy never appears in the service and is used only to recover from an outage. If the database is rolled back to the copy, WaveWorks deletes again any information that had a deletion request in the meantime and logs that it did so.
- WaveWorks does not delete unused backups on its own. The one-year rule above skips families with a member signed in with Apple or Google, so the backup copy and the sign-in account stay until you delete them, even if no device with backup on opens the app for a long time.
- Family purchase records stay after you delete the account, for the same reason as with caregiver sharing.
6. Information collected by third-party services
The app uses the services below for ads, purchases and error reports. The ad, analytics and crash services do not receive your records.
| Service | Provider | Information collected | Purpose |
|---|---|---|---|
| Google AdMob | Google LLC | Advertising ID, approximate location from IP address, ad views and clicks, device and app performance data | Showing banner ads, ad reporting, preventing invalid clicks |
| Firebase Analytics | Google LLC | App instance ID, advertising ID, approximate location, screen views and session length, purchase events, cloud backup on, off and restore events (sign-in type only) and whether backup is on | App usage statistics |
| Firebase Crashlytics | Google LLC | Crash logs, device model and OS version, installation ID | Finding and fixing app errors |
| Firebase Remote Config | Google LLC | Country and language code, time zone, OS version | Changing settings without an app update |
| RevenueCat | RevenueCat, Inc. | Purchase history, anonymous user ID | Confirming and restoring the one-time purchase |
| Firebase Authentication, Cloud Firestore, Cloud Functions (with caregiver sharing or cloud backup on) | Google LLC | The information in the caregiver sharing and cloud backup tables above | Syncing records between caregivers, backup and restore, account deletion, checking the family purchase |
| Sign in with Apple, Google Sign-In (with cloud backup on) | Apple Inc., Google LLC | Account information each company handles during sign-in | Confirming who you are and signing in to the Firebase account |
| Firebase App Check, Apple App Attest, Google Play Integrity (with caregiver sharing or cloud backup on) | Google LLC, Apple Inc. | Whether the app is genuine and the device's integrity verdict, check token | Keeping modified apps and automated requests away from the server functions |
7. Processors
WaveWorks entrusts the work below to the companies listed. We sign the processing contract through each company's data processing terms. If a processor or the entrusted work changes, WaveWorks announces it in this policy right away. The companies each processor subcontracts to follow that processor's own subprocessor list. Information a processor handles outside Korea is also listed in the "International transfers" table below.
| Processor | Entrusted work |
|---|---|
| Google LLC (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Logging, Firebase Cloud Messaging) | Storing and transmitting caregiver sharing and cloud backup information, managing sign-in accounts, running account deletion and cleanup jobs, keeping server function logs, delivering silent messages that refresh the home-screen widget |
| Google LLC (AdMob, Firebase Analytics, Crashlytics, Remote Config, App Check) | Showing and counting ads, app usage statistics, error reports, delivering settings, confirming the app is genuine |
| RevenueCat, Inc. | Confirming and restoring the one-time purchase, looking up the purchase when a family purchase is checked, passing on refund notices |
8. International transfers
The companies below are in the United States, and while you use the app it sends them the information listed below over the network. The transfers are made by disclosing them in this policy, under Article 28-8(1)3(a) of the Korean Personal Information Protection Act. Caregiver sharing and cloud backup information is stored in the Seoul region, but Google may view it from outside Korea for operational support or security, so it is listed here too.
| Recipient (contact) | Country | Items transferred | When and how | Purpose | Retention and use period |
|---|---|---|---|---|---|
| Google LLC, Firebase Authentication (https://support.google.com/policies/contact/general_privacy_form) | United States | User ID, anonymous ID, the email of the Apple or Google account you sign in with (including Apple's forwarding address), for Google sign-in the display name and profile photo URL, when the account was created and last signed in, the IP address at sign-in | Sent over the network while you use the app, when you turn on caregiver sharing or cloud backup and sign in | Signing in and confirming who you are | Until you turn backup off or delete the account. An anonymous ID until you stop sharing (if you cannot, 30 days after it belongs to no family) |
| Google LLC, Cloud Firestore, Cloud Functions, Cloud Logging and Firebase Cloud Messaging (same contact) | Stored in Seoul. Support access may be from the United States or another country outside Korea. Server function logs and delivery of the widget FCM messages are processed at Google's facilities worldwide (global) | The information in the caregiver sharing and cloud backup tables above. Function logs hold only the first 6 characters of the anonymous ID or user ID and the result, with no record content | Sent over the network while you use sharing or backup | Syncing records, backup and restore, error checking | See the retention sections above. Function logs: Cloud Logging's default retention (30 days) |
| Google LLC, AdMob, Firebase Analytics, Crashlytics, Remote Config and App Check (same contact) | United States | Advertising ID, app instance ID, installation ID, approximate location from IP address, ad views and clicks, screen views and session length, purchase events, crash logs, device model and OS version, country and language code, time zone, app integrity verdict | Sent over the network while you use the app | Ads, statistics, error reports, delivering settings, confirming the app is genuine | Follows Google's policy (https://policies.google.com/privacy) |
| RevenueCat, Inc. (privacy@revenuecat.com) | United States | Purchase history, anonymous user ID | Sent over the network while you use the app and when a family purchase is checked | Confirming and restoring the one-time purchase | Follows RevenueCat's policy (https://www.revenuecat.com/privacy) |
If you do not want these transfers, do not turn on caregiver sharing or cloud backup, or turn them off with "Stop sharing" or "Delete account". To stop the ad and analytics transfers too, delete the app. Without sharing and backup, the records on your device keep working as before. If you turned on caregiver sharing or cloud backup, the server information stays after you delete the app, so tap "Stop sharing" or "Delete account" first, or ask for deletion by email.
9. Consumer health data (United States)
Records sent to the server for caregiver sharing or cloud backup are consumer health data under the Washington My Health My Data Act and similar state laws. The Oh My Baby Consumer Health Data Privacy Policy (https://waveworkscorp.github.io/en/babylog/health-data/) explains how WaveWorks collects, uses and shares that data and how to use your rights.
10. Ads
The app does not request ads based on your interests (personalized ads) and does not ask for tracking permission on iOS. Non-personalized ads still use the advertising ID to limit how often you see the same ad and to count ad views. In regions that require consent, such as the European Economic Area, the app shows Google's consent screen on first launch. You can reset or delete the advertising ID in your device settings. The app does not use baby records, caregiver sharing information, cloud backup information or your sign-in email for ads.
11. Children
Parents and caregivers use this app. It is not directed to children and does not collect information directly from children. Caregivers, meaning parents or legal representatives, enter the baby's information themselves. Caregiver sharing and cloud backup send information about a baby, who is a child under 14, to the server. They turn on only after the caregiver who creates the family checks "I am this baby’s parent or legal guardian and I agree on the baby’s behalf" on the consent screen. The consent record keeps that check, the time and the wording version. The app is not directed to children under 13 and does not knowingly collect personal information directly from children under 13. If we learn that a child provided information directly, we delete it.
12. Legal bases
| Information | Basis |
|---|---|
| Records on your device | WaveWorks does not receive them, so no legal basis is needed |
| Baby information and records in caregiver sharing and cloud backup (including health-related information such as temperature, hospital and vaccine visits, stool, height and weight) | Separate consent on the consent screen (Article 23(1)1 and Article 22-2 of the Korean Personal Information Protection Act) |
| Sign-in account, anonymous ID, family, purchase and consent records | Consent on the consent screen (Article 15(1)1) and processing needed to provide the service (Article 15(1)4) |
| Advertising ID and ad, analytics and crash information | Processing needed to provide the service and show ads (Article 15(1)4). In regions that require consent, Google's consent screen |
| Transfers outside Korea | Disclosure in this policy (Article 28-8(1)3(a)) |
13. Retention and deletion
Records on your device stay until you delete them or delete the app. If you never turn on caregiver sharing or cloud backup, you have no account and WaveWorks holds no server records about you. WaveWorks deletes server information as soon as the criteria below are met. No information is kept separately under other laws.
| Information | How long it is kept | When it is deleted |
|---|---|---|
| Baby information and records in caregiver sharing | While a caregiver remains in the family | A day after the last caregiver stops sharing, or the day after no device has used it for a year |
| Content of deleted records | 30 days after deletion ("Recently deleted") | After 30 days or when you delete forever. The mark with only the record ID, deletion time and anonymous ID goes after 365 days |
| Cloud backup copy and sign-in account | Until you turn backup off or delete the account | When you tap "Unlink and delete" or "Delete account", or within 10 days of an email request |
| Anonymous ID | While it belongs to a family | When you stop sharing, or 30 days after it belongs to no family |
| Invite code | 24 hours after it is created | Deleted automatically after it expires |
| Family purchase record | While the purchase is valid | On refund or cancellation, the family ID is erased and only a refund marker stays |
| Consent record | While that family's information remains | When the family information is deleted |
| Purchase check rate record (anonymous ID, last check time) | One day | Deleted by the cleanup job after a day |
| Recovery copy (point-in-time recovery) | 7 days | Disappears automatically after 7 days |
WaveWorks deletes server information in a way that cannot be undone. Third-party services keep the information they collect under their own policies.
- Google: https://policies.google.com/privacy
- RevenueCat: https://www.revenuecat.com/privacy
14. Your rights and contact
You and your baby's legal representative can ask to see, correct or delete the information on the server, to stop its processing, or to withdraw your consent. In the app you can do this right away with "Stop sharing", "Unlink and delete" or "Delete account". If you cannot use the app, ask at the email below.
- Verifying who is asking: for a cloud backup account, write from the same email address as the account you signed in with. If you used caregiver sharing only, we find the family from the baby's name and birthday and the approximate date sharing started. If your representative is not a legal representative, please send a power of attorney with the request.
- We handle the request within 10 days of receiving it and reply with the result. If we refuse or postpone a request, we also tell you the reason and how to object within 10 days.
- If you disagree with the result, you can ask for help from the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972) or the Personal Information Infringement Report Center (privacy.kisa.or.kr, dial 118 with no area code).
| Item | Details |
|---|---|
| Personal information controller | WaveWorks |
| Privacy officer | Paul Hong (CEO) |
| Contact email | hongp0508@gmail.com |
15. Changes to this policy
If we change this policy, we announce what changed and the effective date on this page. This policy takes effect on November 1, 2026.