Privacy Policy
Bunavi is a mobile app that helps parents record their baby's feedings, sleep, and growth. This policy explains what data the app handles, where it is stored, who can see it, and the choices you have. The short version: your data exists so the app can work for you, it stays in the EU, it is never sold, and you can delete all of it yourself at any time.
Who is responsible
The data controller is the app's developer:
Rostislav Antonovich · Bulgaria
Contact: support@bunavi.app
What we collect
| Account | Your email address, a password (stored only as a cryptographic hash — we can never read it), and an optional display name. If you sign in with Apple or Google instead, we receive the email address (or Apple's private relay address) and name that provider returns. |
|---|---|
| Baby profile | The name, date of birth, and optionally the sex of each baby you add, and an optional profile photo if you choose to add one. You choose what to enter; a nickname works just as well as a real name. |
| Tracking records | Feedings (type, time, amount or duration, optional notes), pumping sessions, sleep sessions, diaper changes (including optional stool detail), growth measurements (weight, height, head circumference), milestones, and health events such as temperature, symptoms, medications, and vaccinations. Some of these are health-related; you enter them and may delete them at any time. |
| Baby photos | If you add a profile photo for a baby, the image is stored in our EU hosting bucket and shown to you and anyone you invite to that baby. Photos are deleted when you remove them or delete the baby. The diaper stool-photo feature, when you turn it on, takes a photo only to analyze it and does not keep it on our servers. |
| Crash reports | If a build has crash reporting enabled, technical details of a crash (device model, OS version, app version, stack trace) are sent to Sentry. Crash reporting is configured to exclude personal data, and we use no advertising identifiers. |
We do not collect your location, your contacts, your photo library (we only use the specific images you pick), or any advertising or analytics profile. The app shows no ads.
Why we process it
Account, profile, and tracking data are processed to provide the service you signed up for (GDPR Art. 6(1)(b)). Records about your baby — including health-related ones such as growth measurements — are entered by you as the parent or guardian, and by saving them you explicitly consent to their processing for this purpose (Art. 9(2)(a)). You can withdraw that consent at any time by deleting individual records or your whole account. Crash reports rest on our legitimate interest in keeping the app working (Art. 6(1)(f)).
Where your data lives
Data is stored in a database operated by Supabase, our hosting processor, in the European Union (AWS eu-central-1, Frankfurt, Germany). All traffic between the app and the server is encrypted (TLS). Access is enforced row-by-row in the database, so an account can only ever read or write the records of babies it owns or has been invited to. The app also keeps a small read-only copy of your recent data on your own device so it works offline; that cache is cleared when you sign out.
Who can see your data
- People you invite. Sharing is off by default. If you generate an invite code and give it to your partner, their account gains access to that baby's profile and tracking records. Invite codes are single-use and expire after 7 days. To revoke a partner's access, open Settings → Manage access and remove them; a caregiver can also leave a shared baby from there.
- Our processors. Supabase (database, authentication, and the emails that deliver sign-up confirmations and password resets); Apple and Google, only if you choose to sign in with them, to verify your identity; and — only when crash reporting is enabled — Sentry (crash data). Processors act under data-processing agreements and only on our instructions.
- Nobody else. We do not sell, rent, or share your data with advertisers or any other third party.
How long we keep it
Your data is kept for as long as you keep it: records stay until you delete them, and your account stays until you delete it. Settings → Delete account permanently removes your account, every baby profile you own, and all of their records, immediately. Residual copies in encrypted backups expire with the normal backup rotation, within 30 days.
Your rights
Under the GDPR you can ask us to access, correct, export, restrict, or erase your personal data, and you can object to processing based on legitimate interest. Most of this you can do directly in the app — records can be edited or deleted, and account deletion is built in. For a machine-readable copy of your data (or anything else), email us and we will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection (cpdp.bg), or the authority of your own EU country.
Children
Bunavi accounts are for adults — parents and guardians. We do not knowingly let children open accounts. Information about your baby is entered by you, stays under your control, and is used for nothing beyond showing it back to you and the caregivers you invite.
Not medical advice
Growth charts in the app display World Health Organization reference data for visual context only. The app is not a medical device and does not provide medical advice — always discuss your baby's growth and health with your pediatrician.
Changes to this policy
If this policy changes in a way that matters, we will update this page and note the new effective date at the top. Significant changes will also be announced in the app.