Privacy Policy

1. Information We Collect

Account & Identity

• Email address — used for account creation, sign-in, and transactional communications.
• Authentication method — whether you sign in with email/password, Apple Sign-In, or Google Sign-In. Multiple sign-in methods may be linked to a single account if they share a verified email address.
• Internal user ID — a UUID assigned at account creation. This is our primary identifier across all internal systems; it is never your email address.

Baby Profile Data

• Baby's birth month and year (never full date of birth)
• Known or suspected allergens (dairy, eggs, peanuts, tree nuts, soy, wheat/gluten, fish/shellfish)
• Feeding stage (e.g., exclusively breastfeeding, Stage 1, Stage 2/3)
• Baby's name (optional; used only for personalizing in-app notifications)

Baby profile data is stored against your internal user ID and is used solely to score product safety for your baby's specific age band (0–12 months or 12–24 months) and allergen profile.

Scan & Product Data

• Barcode scans: The barcode value is sent to our servers to look up product information. Barcodes are not stored in analytics systems.
• AI label scans: A cropped image of the product label is sent to our AI engine for ingredient extraction. Images are processed and then discarded — we do not retain raw label images after the scan is complete.
• Scan history: The result of each scan (product ID, safety score, timestamp) is stored for 12 months to power your Saved Products list and scan history features. Scan history is only available to active subscribers.
• Symptom Log entries: If you use the Symptom Log, the symptoms and notes you record are stored against your baby profile and can be exported as CSV (active subscribers only).

Subscription & Payment

• Your subscription tier: never_subscribed, subscription_expired, active_monthly, or active_lifetime.
• Payment processing is handled entirely by RevenueCat, Apple App Store, or Google Play. We do not store or process payment card data.

Device & Technical Data

• Device platform (iOS or Android), OS version, and app version
• Session identifiers and app open events
• Crash reports and error logs

Analytics Data

We collect structured, anonymized event data to understand how the app is used and to improve it. See Section 4 for the full list of analytics providers and what each receives. We never send raw ingredient text, allergen arrays, baby names, birth dates, email addresses, or free-text user input to any analytics system.

2. How We Use Your Data

Ingredient Safety Assessment

Baby profile data (birth month/year and allergen profile) is used exclusively at scan time to evaluate each product ingredient against age-specific safety criteria. The assessment produces one of three tiers: Avoid, Caution, or Low Concern. We never use overall_status for scoring — all evaluations are age-specific.

AI-Powered Label Analysis

When you perform an AI label scan, the label image is sent to our AI processing provider (GPT-5 nano vision) to extract and classify ingredients. Only the structured result (ingredient names, categories, safety flags) is stored — not the image. AI assessments are cached permanently once confirmed, reducing future processing.

Safe Alternatives

On Caution and Avoid results, you can tap a "Give me alternatives" button to request safe alternative products. Alternatives are never auto-generated — AI is only invoked when you explicitly tap the button. Suggestions use your baby's allergen profile and are cached for 60 days. Safe Alternatives are available to active subscribers only.

AI Recipes & Food Prep Guidance

LabelBaby generates age-appropriate AI recipes and food preparation guidance using your baby's age band and allergen profile. Generated guidance is cached in a shared database containing only recipe and preparation text — never user-entered personal data.

FDA Recall Alerts

We poll the FDA openFDA API every 6 hours. If a product you have saved is recalled, we send you a push notification immediately. Recall alerts are delivered to all users regardless of subscription status and are exempt from all push throttle limits.

Push Notifications

We may send the following notification types:

• FDA Recall Alerts — all users, safety-critical, always delivered, exempt from throttle
• Child Milestone Notifications — all users, based on your baby's birth month/year
• Ingredient Classification Change Notifications — when an ingredient previously associated with one of your scans is re-classified (e.g., Low Concern → Caution or Avoid), we notify you so you can re-evaluate any saved products containing it
• Scan Tip Notifications — active subscribers only, max 1 per day, only when an actual flag was detected
• Lifecycle Notifications — trial nurture, win-back, annual upsell (subject to opt-out and throttle)

You may opt out of non-safety notifications at any time in your device notification settings. FDA Recall Alerts cannot be disabled as they are safety-critical.

Analytics & App Improvement

We use anonymized, structured event data to analyze funnels, improve scan accuracy, and optimize the subscription experience. No PII is included in any analytics event. See Section 4 for details on each provider.

Crash Monitoring

We monitor the app for crashes and errors using Sentry. Crash reports include your hashed internal user ID, app version, platform, and subscription tier — never email, birth dates, allergen arrays, or ingredient text.

In-App Review Prompts

LabelBaby uses a dual app rating system. Monthly and annual subscribers may see a pre-screen modal inviting feedback; tapping "Leave a Review" surfaces the native iOS SKStoreReviewController or Android Play In-App Review dialog. A community rating card may also appear in the home feed for all users. We do not know whether you actually submitted a review — Apple and Google do not provide this information. Pre-screen and native prompts are mutually exclusive within a session and respect platform limits (typically up to 3 times per 365-day period, separated by at least 120 days).

3. Data Storage & Retention

• Scan history is retained for 12 months.
• Push throttle logs are purged after 30 days.
• Raw label images are discarded immediately after AI processing — we never store them.
• AI-assessed safe (Low Concern) ingredients are cached permanently in a shared database to reduce future AI calls. These caches contain ingredient names from our product catalogue — never user-entered text.
• Safe Alternatives are cached for 60 days.
• Food preparation guidance is cached permanently.
• All data is hosted on AWS infrastructure (US region) with TLS 1.2+ in transit and AES-256 encryption at rest.
• On account deletion (self-serve, available to all users regardless of subscription), all personal data and baby profile data is fully removed within 30 days in compliance with GDPR and CCPA.

4. Third-Party Services & Data Sharing

LabelBaby integrates with the following third-party providers. Each receives only the minimum data needed for its function.

We do not sell your personal data. We do not share your baby's profile information with advertisers. We do not allow any third party to use your data for purposes beyond those listed above.

5. Analytics Data — What We Never Send

Across all analytics and attribution providers (Firebase Analytics, Google Analytics, PostHog, TikTok Ads, Meta Ads, Google Ads, AppsFlyer, instally.io, Sentry), we enforce the following hard restrictions:

• No email addresses, phone numbers, or real names
• No free-text user input of any kind
• No personal health conditions or raw symptom descriptions
• No full ingredient lists as raw text
• No full birth dates (we use baby age in whole months only)
• No allergen profile arrays
• No barcode strings in analytics events

Allowed structured analytics parameters are limited to: ingredient category codes, risk level (low/medium/high), scan type, internal product IDs, subscription tier, export type, row counts, and app/device metadata.

6. Account Linking & Multi-Provider Sign-In

LabelBaby supports sign-in via email/password, Apple Sign-In, and Google Sign-In. If you use multiple sign-in methods with the same verified email address, we automatically link them to a single account so your baby profile, saved products, and subscription status remain consistent across all sign-in methods.

• Account linking based on email is only performed if the email address is verified by the identity provider (Apple, Google, or our email system).
• We never overwrite existing profile data during account linking.
• If providers return different or unverified email addresses, accounts are not automatically linked — manual linking or separate account creation is required.
• Your internal user ID (Firebase UID) is the single source of truth used across all systems including subscription management and analytics.

7. Children's Privacy

LabelBaby is designed exclusively for parents and caregivers of babies aged 0–24 months. We do not knowingly collect data directly from children. All account creation, baby profile data entry, and app usage is performed by the parent or caregiver.

Baby profile data (birth month/year, allergen flags) is used solely to deliver age-appropriate safety assessments within the app. It is never shared with third parties for advertising purposes.

If you believe a child under 13 has created an account directly, please contact us at privacy@sothesllc.com and we will delete the account promptly.

8. Your Rights

• Access & export: You can export your scan history data at any time (active subscribers).
• Correction: You can edit your baby's age, name, and allergen profile at any time, including on the free tier.
• Deletion: You can request full account deletion at any time from Profile → Account → Delete Account. All personal data is removed within 30 days.
• Push opt-out: You can opt out of non-safety notifications in your device settings. FDA Recall alerts cannot be disabled.
• Analytics opt-out: If you revoke analytics consent in your device settings, we disable Firebase Analytics collection immediately.
• GDPR/CCPA: Users in the EU/EEA and California have additional rights including access, portability, and restriction of processing. Contact privacy@sothesllc.com to exercise these rights.

9. Security

• All API communication uses HTTPS with TLS 1.2 or higher.
• Data at rest is encrypted with AES-256.
• All API endpoints require a valid Firebase JWT token.
• We monitor critical scan and scoring pipelines for anomalies. Any crash rate exceeding 1% within a 1-hour window triggers an immediate alert to our engineering team.

10. Changes to This Policy

We may update this Privacy Policy when we add new features or integrate new services. Material changes will be communicated through the app. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the app after the effective date constitutes acceptance of the updated policy.

11. Contact

For privacy questions, data requests, or to exercise your rights, contact us at privacy@sothesllc.com.

For general support, contact support@sothesllc.com.

Sothes LLC · LabelBaby · New Jersey, United States