Privacy Policy

Moonsleep is built to be as private as possible: your baby's sleep, feeding and care entries belong to you. They are backed up to our EU servers so you don't lose them — you can switch that off in the settings, and they only become visible to another person once you invite them. Usage analytics run solely with your explicit consent. We never sell data. This page explains what we process and why.

1. Controller

Milena Marketing ltd., Alabin Street 33, 1000 Sofia, Bulgaria (VAT ID BG208676776), represented by managing director Milena Barton. For any privacy questions, reach us via our contact form.

2. What data we process

On this website:

  • Server logs — our hosting provider (Render Services, Inc., USA) processes technically necessary data such as IP address, browser type and time of access when you visit the website, in order to deliver and secure the site.
  • Contact form — if you write to us via the contact form, we process your name, e-mail address and the content of your message in order to answer your request. Delivery runs through the form service FormSubmit; the message is delivered to our e-mail inbox.
  • Analytics and advertising services — only with your consent, see section 5.

In the Moonsleep app:

  • Baby profile — name or nickname, date of birth and optionally a photo of your child, used to calculate age-appropriate wake windows.
  • Tracking entries — sleep, nursing, bottle, pumping, solid food, diaper, temperature and medicine, each with a timestamp and optional notes. Moonsleep calculates wake-window predictions, the countdown and statistics from these entries.
  • Account (optional) — your e-mail address and login credentials if you use the care-team sync.
  • Device & usage — basic technical data and crash reports that keep the app stable; usage analytics only with your consent (section 5).

3. Your child's health data (Art. 9 GDPR)

Sleep, feeding, temperature and medicine entries can reveal information about your child's health and therefore belong to the special categories of personal data (Art. 9(1) GDPR). We process them only to give you the sleep schedule, wake windows and statistics — on the basis of your consent (Art. 9(2)(a) GDPR), which you give together with the terms and this policy when you create your account. You stay in control: you can delete your entries and your account completely and export your data at any time (Settings → Data), and switch the cloud sync off at any time. You can withdraw your consent at any time — see section 8. Where the entries are stored is described in section 4.

4. Storage, sync and processors

  • Cloud backup & sync is on by default — so that your entries survive a lost phone and reach your care team. Entries are synced via Google Firebase (Google Ireland Ltd.); we exclusively use EU data centres (region eur3 / europe-west1, Belgium) and transmission is encrypted. You can turn the sync off under Settings → Privacy at any time; from then on your entries stay on your device.
  • Care team — entries only become visible to another person once you invite them with a one-time code and they accept. Sync alone never shares anything with anyone else.
  • Subscription handling — purchases run through the App Store (iOS) or Google Play (Android); we use RevenueCat (RevenueCat, Inc., USA) to manage subscriptions. RevenueCat receives pseudonymous transaction data (e.g. subscription status, an anonymous user ID), never your child's tracking entries. Transfers to third countries are based on EU standard contractual clauses and the EU-U.S. Data Privacy Framework.
  • Crash reports & notifications — Firebase Crashlytics records technical crash data (no name, no entries). If you allow notifications, a device token is stored under your account so we can send care-team notices; it is deleted when you sign out.
  • Contact form — messages you send from the app or this website are delivered by FormSubmit (formsubmit.co, USA) and contain only what you enter there: name, email address and your message.

5. Cookies, analytics & advertising

On the website we use analytics and marketing services to improve our website and measure the impact of our advertising:

  • Google Analytics 4 and Google Ads (Google Ireland Ltd., Ireland)
  • Meta Ads / Meta Pixel (Meta Platforms Ireland Ltd., Ireland)
  • TikTok Pixel / TikTok Ads (TikTok Technology Ltd., Ireland)

These services set cookies and similar technologies and process pseudonymised usage data (e.g. pages visited, device and browser information, advertising IDs, approximate location) to measure reach, build audiences and attribute conversions. Data may be transferred to the parent companies in the USA; this is based on EU standard contractual clauses and the EU-U.S. Data Privacy Framework.

All of these services are only used if you consent via the cookie banner (Art. 6(1)(a) GDPR). Without consent they remain fully disabled. In the app, usage analytics likewise only runs with your consent. You can withdraw or adjust your consent at any time with effect for the future.

6. Purposes and legal bases

We process data to provide the service — calculating wake windows, syncing entries, managing subscriptions, answering requests (Art. 6(1)(b) GDPR), with your consent where required (Art. 6(1)(a), Art. 9(2)(a) GDPR), and based on our legitimate interest in a secure, working product (Art. 6(1)(f) GDPR). Data is never sold.

7. Retention, deletion and export

We store personal data only as long as necessary for the purposes described. In the app you can delete all entries and your account completely at any time (Art. 17 GDPR) and export your data in a common format (Art. 20 GDPR) — Settings → Data. We delete contact-form requests as soon as they have been conclusively answered and no statutory retention obligations apply.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future. You can also lodge a complaint with a data protection supervisory authority — in Bulgaria this is the Commission for Personal Data Protection (CPDP, cpdp.bg).

Simply use our contact form for any of these.

9. Security and children

Transmission is encrypted with HTTPS, and the entries are stored with Google Firebase in EU data centres. No method of transmission or storage is completely secure, but we apply appropriate safeguards. Moonsleep is made for parents and caregivers, not for children: you create the entries about your baby as an adult. We do not knowingly collect data from children themselves.

10. International transfers

We are based in the EU and host data within the EU/EEA where possible — the Firebase sync runs exclusively in europe-west1 (Belgium). Some processors operate outside the EEA: RevenueCat (subscription management), FormSubmit (contact form) and Render (hosting of this website), all in the USA. For those we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

11. Changes

If we update this policy, we revise the date shown at the top of this page.