DRAFT, NOT LEGAL ADVICE. This policy has not been reviewed by a lawyer yet and items marked [TBD] are still open.

Privacy Policy

Effective date: November 5, 2026 · Last updated: November 5, 2026

1. Who we are and what this covers

Ourlings is a baby tracker that lets a family log feedings, sleep, diapers, growth and more, and share that log between caregivers. It is run by Powell Chee dba Ourlings ("we", "us"). This policy explains what information we handle when you use our website at ourlings.com, the web app, and related emails and notifications (together, the "Service"), and the choices you have.

Two terms we use throughout:

• Account Information means the details we need to give you an account: your email address and your password. We do not ask for your name to create an account. We also keep a record that you confirmed you are 18 or older and accepted the Terms, with the date and Terms version. If you write to support, we will also have whatever you include in that message.
• Family Data means everything you and your caregivers record in the app: feedings, bottles and nursing, sleep and naps, diapers, pumping, growth measurements, foods and reactions, custom trackers, notes, children's names and birth dates, the family name, and Magic Moments (journal notes, photos, videos and voice notes). Family Data is end-to-end encrypted, as described in section 5.

The Service is a logging tool, not a medical service. Nothing in it is medical advice.

2. Information you provide

• Account Information. Your email address and password when you sign up, or just your email address if you sign in with an emailed link. Passwords are handled by our sign-in provider (Supabase Auth) and stored only as a hash.
• Family Data. Everything you log. It is encrypted on your device before it is uploaded, so we receive it only in a form we cannot read.
• Your encryption passphrase and recovery code. These never leave your device in readable form. We store only an encrypted copy of your family key that can be unlocked with them (see section 5). We cannot recover your passphrase for you.
• Family settings you choose. For example who the primary caregiver is, whether AI features are on, and your reminder schedule.
• Payment information. Entered directly with our payment processor, Stripe. We never see your full card number (see section 11).
• Messages to us. If you email support, we keep the email and our reply.

3. Information collected automatically

• A random device ID. The app creates a random identifier on each browser or device you use. We store it with a coarse device type worked out from your browser (for example "iPhone or iPad", "Android", "Mac", "Windows" or "Browser") and the dates the device was first and last seen. We use it to tell your devices apart, to know which device holds the free plan's logging seat, and to let you see and manage the devices linked to your family.
• Service records. When an encrypted entry or file is uploaded, our database records when it was uploaded, which account uploaded it, and how large it is. Section 5 lists exactly what this metadata reveals.
• Server and security logs. Like any website, our hosting, database and sign-in providers automatically log technical details of requests, such as IP address, browser type, time and the page or function requested. We use these to keep the Service running and secure, not to profile you. [TBD: log retention period, set per provider]
• AI usage counts. If your family turns on cloud AI, we count how many AI requests the family made each month and their approximate cost, so we can enforce plan limits. We do not keep the content of those requests.
• No analytics or ad trackers. The Service does not currently use any analytics, advertising pixels, session recording or third-party tracking scripts. If we ever add analytics, it will be a privacy-friendly, cookieless tool that does not track you across sites, and we will update this policy first.

Cookies and browser storage are covered in section 18.

4. Information from other people and partners

• Other caregivers. When a caregiver invites you, they add you to their family, and their entries are shared with you (encrypted end to end).
• Stripe. When you pay, Stripe tells us the result: your customer and subscription identifiers, the plan, its status and renewal date, and, for display in the app, your card brand and last four digits.

5. End-to-end encryption and what our servers can see

Each family has its own secret family key. Your device uses it to encrypt every entry, note, photo, video and voice note (AES-256-GCM) before anything is uploaded. Our servers store only the encrypted result. The family key itself is stored on our servers only in encrypted ("wrapped") form, locked by each member's passphrase, by the family's recovery code, or by a one-time invite secret. Invite links carry that secret in the part of the link after the "#", which browsers never send to any server.

On your device, the app keeps an encrypted copy of your family's log for offline use, and keeps the family key locked with a device key that cannot be exported from the browser.

This means:

• We cannot read Family Data, and neither can our hosting or database providers. That includes the kind of each entry (for example whether it was a feeding or a diaper), your children's names, your family's name, notes, food names and all media.
• We cannot restore access if every caregiver loses both their passphrase and the recovery code. Keep your recovery code somewhere safe.
• Some metadata is visible to us, because the Service needs it to work. Our servers can see:
  • your email address, and when your account was created and last signed in;
  • which families you belong to, your role (owner or caregiver), and who the primary caregiver is;
  • when each encrypted entry or file was uploaded, by which account, and its encrypted size, and so roughly how much and how often a family logs;
  • your devices' random IDs, coarse device types and first and last seen dates;
  • invites (when created, when they expire, and who accepted them);
  • the family's plan, trial dates and billing status;
  • whether AI features are on, who changed that and when, and monthly AI request counts and cost;
  • reminder and notification settings: the schedule, time of day, time zone, whether email digests are on, and the push address your browser gives us;
  • a random identifier (not the name) for the child who stays active on the free plan;
  • IP addresses and browser details in provider logs (section 3).

When you choose to use cloud AI features, the specific details listed in section 6 are decrypted on your device and sent for that one request. That is the only case where readable Family Data leaves your device through us.

6. AI features

AI features are off by default. A family owner has to turn them on, and can turn them off at any time. There are two kinds:

• On-device AI. Runs entirely in your browser. Nothing you ask is sent to us or anyone else. The first time you use it, and only after you agree, your browser downloads the open-source model library and model files (about 420 MB) from public content delivery networks [TBD: confirm hosts, currently jsDelivr and the model host], which will see your IP address like any download.
• Cloud AI (Ourlings AI). Runs on a third-party AI provider, [TBD: AI provider name], through our servers. Each request sends only what that feature needs:
  • Chat, insights and doctor-visit prep: your question, the child's age, daily totals from about the last two weeks (feeds, milk amounts, nursing minutes, diapers, sleep hours, naps, pumping) and the latest growth measurement. Before anything leaves your device, the app swaps children's, caregivers' and the family's names for placeholders such as {child}, and puts the real names back into the answer on your device. Journal text, photos, videos and voice notes are not sent.
  • Daily insight wording: numbers and fixed labels only (for example a count and a time window). No names, notes, dates or food names reach the AI provider.
  • Logging by voice or text: the sentence you type or dictate. If you dictate, speech recognition is done by your browser or operating system under its own privacy terms.
  • Cloud recaps of Magic Moments: only when you press the button, the titles, notes and tags of the moments in that period, counts of photos and videos, "firsts" (which can include food names) and summary stats, with names swapped for placeholders in the same way. If you typed a name in an unusual spelling or a nickname, it may not be recognized, so avoid names in notes you plan to recap. Photos, videos and voice recordings themselves are not sent.

We do not store the content of AI requests or answers on our servers; answers are returned to your device. We only use AI providers whose terms prohibit using our customers' data to train their models, and we do not use your data to train any model ourselves. [TBD: AI provider's own retention period for abuse monitoring, if any.] AI answers are general information, not medical advice.

7. How we use information

• To provide the Service: create your account, sync your family's encrypted log between devices, and apply your plan.
• To handle trials, payments, discount codes, renewals and refunds.
• To send the emails and notifications you ask for, and service messages such as sign-in links, password resets and important changes.
• To answer support requests.
• To run the AI features you turn on, and to enforce their usage limits.
• To keep the Service secure, prevent abuse and fix problems.
• To comply with law and enforce our Terms.

We do not use your information for advertising, and we do not build marketing profiles.

8. Legal bases (EEA, UK and Switzerland)

If these laws apply to you, we rely on: contract (to provide the Service you signed up for); consent (for optional features such as cloud AI, push notifications and email digests, which you can withdraw at any time); legitimate interests (security, fraud prevention and improving reliability, balanced against your rights); and legal obligation (for example tax records). Where Family Data counts as health data, we process it only in encrypted form, and in readable form only when you explicitly ask for a cloud AI feature. [TBD: lawyer to confirm lawful bases and Article 9 position.]

9. How we share information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising. We do not allow advertisers on the Service. We share information only as follows:

• Your family. Caregivers in your family can see the family's log (section 10).
• Service providers that process data for us under contract:
  • Supabase: database, sign-in, file storage and server functions (stores encrypted Family Data, Account Information and the metadata in section 5). United States (West US / us-west-1)
  • Stripe: payments, invoices and the billing portal.
  • Resend: sending sign-in emails and the optional email digest (receives your email address and the message).
  • [TBD: hosting provider, Cloudflare Pages or Vercel]: serving the website and app.
  • [TBD: AI provider name]: only if your family turns on cloud AI, and only the details in section 6.
  • Your browser's push service (for example from Apple, Google or Mozilla): delivers notifications you turn on. It receives only a generic message.
• Legal reasons. If required by law or valid legal process, or to protect the rights, safety or property of our users, the public or us. Because Family Data is end-to-end encrypted, we cannot hand over its readable contents.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, subject to this policy.
• With your consent or at your direction.

10. Caregivers and family sharing

• A family can have several caregivers. Everyone in the family can read and add to the family's log and journal. Any caregiver can invite others. Owners can remove caregivers and change family settings, such as turning AI features on or off.
• Each entry records which caregiver logged it, and that is visible to the family.
• Invite links expire after 7 days. Anyone who has an unused invite link can join, so share it only with people you trust.
• If a caregiver is removed or leaves, they lose access through our servers. Anything they already saw, exported or saved stays with them.
• Each family has one primary caregiver. On the free plan, logging works for one child on the primary caregiver's one device. Other caregivers' devices can read the log for 48 hours and are then locked until the family chooses a plan. Nothing is deleted when this happens.

11. Payments

Payments are processed by Stripe on its own secure checkout page. Your full card number goes directly to Stripe and never reaches our servers. We receive and store your Stripe customer and subscription identifiers, plan, status and renewal dates, and we can show your card brand and last four digits. Stripe uses your payment information under its own privacy policy, including for fraud prevention.

12. How long we keep information, and deleting it

• While your account is open, we keep your Account Information and your family's encrypted data so the Service works. Families on the free plan keep their data; nothing is deleted when a trial or plan ends.
• Delete your account any time from More, then Danger zone, then Delete my account. This deletes your sign-in account and removes you from your families. Any family where you are the only owner is deleted with all its encrypted entries, photos, videos and voice notes, member records, devices, invites, reminders and plan records. Before anything is deleted, its subscriptions are set with Stripe to end at the close of the current billing period, so they will not renew; if that fails, nothing is deleted and you are asked to try again, so you are never charged again for a deleted family. The current period is not refunded or prorated. Your data is still deleted right away; it is not kept until the period ends. Data stored on that device is wiped.
• Families you share with other owners continue to exist for them. Entries you added stay in that family's log, because they are part of the family's shared record.
• Delete a family (owners only) from the same menu. This removes the family's encrypted entries, photos, videos and voice notes, and ends its subscription at the close of the current billing period in the same way, with no renewal and no refund.
• Billing records are kept by Stripe and by us for as long as tax and accounting law requires [TBD: period, typically 7 years].
• Backups of our database are kept for [TBD: backup retention period] and then overwritten, so deleted data can remain in backups until then.
• Support emails are kept for [TBD: period].

13. Exporting your data

On every plan, including free, you can export your family's log from the app as a spreadsheet (CSV) or as a full backup file (JSON) that you can import again. Exports are created on your device and saved directly to it; they are not encrypted, so store them carefully. You can also choose "Export everything (zip)": one zip file with the backup, the spreadsheet and all your family's photos, videos and voice notes, decrypted on your device, named by entry date and entry ID.

14. Security

Besides end-to-end encryption, the Service uses HTTPS for all connections, database access rules so each account can reach only its own families, private file storage, and signed requests from Stripe. No system is perfectly secure, so please use a strong passphrase, keep your recovery code private, and lock your devices. If we learn of a breach affecting your information, we will notify you as the law requires.

15. Children's privacy

The Service is for parents and other adult caregivers. You must be at least 18 to create an account. When you sign up you confirm this and accept the Terms, and we record that you did and when, with your Account Information. The Service is not directed to children, and we do not knowingly collect personal information from children under 13 (or the minimum age in your country). Information about babies and children is entered by their parents or caregivers, who choose what to record. It is end-to-end encrypted, we cannot read it, and we never use it for advertising. If you believe a child has created an account, contact us and we will delete it.

16. Health-related information

Some Family Data, such as feeding, growth or reactions to foods, may count as health information under laws such as Washington's My Health My Data Act. We collect it only to provide the logging you ask for, it stays end-to-end encrypted, we never sell it, and readable details leave your device only when you use a cloud AI feature as described in section 6. You can delete it at any time (section 12). [TBD: lawyer to decide whether a separate consumer health data notice is needed.]

17. Notifications and emails

• Push notifications are off unless you turn them on in the app and your browser asks you to allow them. Because our servers cannot read your log, notification text is generic (for example a nudge to look back at a memory). You can turn them off in the app or in your browser settings.
• Email. We send sign-in links, password resets and service messages. If you turn on the optional email digest, its text is generic and contains no Family Data. We do not send marketing email without your consent, and every marketing email will have an unsubscribe link.

18. Cookies and local storage

We do not use advertising or analytics cookies. The app stores what it needs in your browser's local storage and IndexedDB:

• your sign-in session, saved by our sign-in provider's library (a key starting with "sb-");
• keys starting with "ol_": the random device ID, your family key locked with a device key, an encrypted copy of your family's log, your family's name and plan status for display, and preferences such as theme, units and open tips;
• the device key itself, kept in IndexedDB in a form the browser will not export.

These are strictly necessary for the app to work, so we do not ask for cookie consent for them. Our hosting provider may set a strictly necessary security cookie to block abuse. Clearing your browser's site data removes them and signs you out on that device; your family's data stays safe on our servers in encrypted form.

19. Your rights and choices

Wherever you live, you can access, correct, export and delete your information using the app, or by contacting us. You can turn off AI features, notifications and email digests at any time. We will not treat you differently for using your privacy rights.

• California (CCPA/CPRA). You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of sale or sharing and limit the use of sensitive personal information. We do not sell or share personal information, and we use sensitive personal information only to provide the Service. In the past 12 months we collected the categories described in sections 2 to 4 (identifiers such as email and device ID, commercial information such as plan and purchase history, internet activity such as server logs, and, in encrypted form, Family Data that may include sensitive or health information) for the purposes in section 7, and disclosed them only to the service providers in section 9.
• Other US states (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others with similar laws). You have similar rights to access, correct, delete and port your data, and to opt out of sale, targeted advertising and profiling. We do none of those. If we deny a request, you can appeal by replying to our answer; if we deny the appeal, you can contact your state attorney general.
• EEA, UK and Switzerland (GDPR). You can access, correct, delete, restrict or object to processing of your data, receive it in a portable format, and withdraw consent at any time. You can also complain to your local data protection authority. [TBD: EU and UK representative, if required.]
• Global Privacy Control. We honor the Global Privacy Control (GPC) signal as a request to opt out of sale and sharing. Since we do neither, no further action is needed, and we never override it.

To make a request, email privacy@ourlings.com from the address on your account. We may need to confirm it is you before acting, and an authorized agent will need your signed permission. We answer within the time the law requires (usually 45 days in the US and one month in the EEA and UK).

20. International transfers

We are based in the United States, and our service providers may process information in the US and other countries. When we transfer personal information from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum, or a provider's certification under the Data Privacy Framework. [TBD: confirm mechanism per provider.] Family Data is end-to-end encrypted wherever it is stored.

21. Changes to this policy

We may update this policy as the Service changes. We will change the date at the top, and if a change is significant we will tell you in the app or by email before it takes effect.

22. Contact us

Powell Chee dba Ourlings
75 Firwood, Irvine, CA 92604, United States
Privacy questions and requests: privacy@ourlings.com
General support: support@ourlings.com