Privacy Policy

Our privacy policy and how we use your data

Last updated: September 3, 2026

This Privacy Policy explains how CradleNote collects, uses, shares, and protects information when you use the CradleNote website, iPhone app, and related services (collectively, the “Service”). The Service is operated by Vinchy Company, a Delaware company (“Vinchy Company,” “we,” “us,” or “our”). CradleNote is designed for private collaboration among caregivers. It is not an emergency service or a substitute for professional medical advice.

Information we collect

  • Account information: email address, user ID, authentication details, profile name, and care-circle membership.
  • Baby and care information: baby profiles, sleep, feeding, pumping, diaper, medication, activity, growth, milestone, reminder, note, and other care records you choose to add.
  • Content: photos, short videos, comments, notes, and other content shared with a care circle.
  • Safety information: content or comments you report, the reason selected, blocked-caregiver choices, and the identifiers needed to investigate abuse and enforce your choice.
  • Audio:when you choose AI Quick Add dictation, the iPhone app provides microphone audio to Apple's Speech recognition technology to produce an editable transcript. On the website, the optional voice-note feature uploads the short recording to CradleNote, and our production service sends it to Cloudflare Workers AI for transcription. The iPhone app does not continue recording in the background.
  • Device and technical information: app version, device installation identifier, notification token, locale, time zone, security logs, crash information, and limited usage data needed to operate and improve the Service.
  • Required operational activity analytics:when a signed-in caregiver uses the website or iPhone app, CradleNote records the account email address and internal user ID, access time, platform, and time since the caregiver's previous recorded activity. CradleNote also sends this limited activity summary for the first recorded authenticated activity and when a caregiver returns after at least one hour without a recorded authenticated request. The operations channel is hosted by a communications service provider. The summary contains the account email, internal user ID, platform, access time, and time since the previous recorded activity. By default, delivery requires a verified private room. An owner-approved exception may send the same limited summary to the configured operations room while that room remains publicly discoverable through its Telegram username. The summary does not include baby or care records, photos, videos, notes, audio, transcripts, or care-circle content. This operational analytics is a required part of the current Service and is not controlled by the optional analytics setting.
  • Required iPhone app analytics: after an authenticated server request confirms the signed-in caregiver, CradleNote uses PostHog to send app lifecycle events, privacy-safe screen names so we can understand feature use and keep the iPhone experience reliable. These events use your internal user ID and apply to every signed-in caregiver. They do not intentionally include baby, care-circle, media, Growth, or care-record identifiers. Automatic element interaction and native crash capture are disabled.
  • Optional iPhone session replay: you can separately choose to share masked session replay so CradleNote can diagnose interface problems. You can decline or later revoke this choice from Profile. Replay is configured to mask all text, text inputs, images, system picker views, onboarding content, sensitive detail flows, and the signed-in care, Growth, Memories, and Profile content viewports. Console logs and network telemetry are excluded. Navigation chrome and nonsensitive control interactions may appear while protected content remains masked. Turning replay off deletes locally queued native analytics and replay before required app-event analytics resumes without replay.
  • Billing information: subscription status and transaction references. Payment providers process payment-card details; CradleNote does not store full card numbers.

How we use information

We use information to:

  • provide, secure, synchronize, and support the Service;
  • show care history, sleep guidance, reminders, milestones, and caregiver updates;
  • transcribe optional AI Quick Add dictation and use recognized or typed text to prepare editable care-record drafts for your review;
  • send account, security, care-circle, and notification messages that you request or enable;
  • prevent fraud and abuse, diagnose failures, and improve reliability and accessibility;
  • understand daily adoption and return activity, prioritize product improvements, and support the early development of the Service;
  • review shared captions, comments, and photos for seriously objectionable content before posting, honor caregiver blocks, investigate reports, and enforce our community-safety rules; and
  • comply with legal obligations and enforce our terms.

We do not sell personal information or use baby-care information, photos, videos, notes, transcripts, or audio for targeted advertising.

How information is shared

Information you add to a care circle is visible to the caregivers authorized for that circle. We also disclose information to service providers that help us operate the Service, such as hosting, database, authentication, storage, realtime communication, email, payment, analytics, internal communications, customer-support, and AI-processing providers. We limit disclosures to information needed for those roles. Provider handling is governed by applicable terms and law, and processing locations and retention may differ by service.

When you enable notifications, Apple Push Notification service or the applicable browser push provider receives the device token, trusted routing identifiers, and event-specific notification text. That text may include caregiver and baby display names, structured care summaries, reminder titles, and bounded excerpts from memory captions or comments so the alert is useful at a glance. Your device may display this text on the Lock Screen according to your operating system notification settings.

In the iPhone app, Apple's Speech recognition technology may process microphone audio when you use optional AI Quick Add dictation. CradleNote then sends the recognized text—not the microphone audio—or text you enter yourself, together with the minimum relevant baby and recent-care context, to our configured Azure OpenAI service to prepare editable drafts.

On the website, an optional AI Quick Add voice note is uploaded to CradleNote's authenticated voice route. In production, that route sends the audio to Cloudflare Workers AI, currently using its Whisper large v3 turbo transcription model. The resulting transcript is then processed through the server-side AI draft workflow. We do not use audio, transcripts, or care content for advertising. Provider processing and retention are governed by our service configuration and provider agreements.

In CradleNote's moderated website sharing flows, submitted captions, comments, and still photos are sent to Cloudflare Workers AI solely for automated safety classification. That safety gate does not use the content for advertising or model training, and the submission is published only after an explicit safe result. Direct iPhone Memories uploads of supported photos and short videos do not use this automated content-classification gate; they are shared only within the authenticated care circle after authorization and technical media validation. CradleNote does not inspect every video frame.

Before the iPhone app sends recognized or typed Quick Add text and care context to Microsoft Azure OpenAI, it names the provider, describes the data and purpose, and asks for explicit consent. Consent is stored separately for each signed-in caregiver and care circle on that iPhone and can be reviewed or revoked from AI Quick Add. Revocation prevents later AI parsing requests unless that caregiver agrees again.

We may disclose information when required by law, to protect users or the Service, or as part of a business transaction with appropriate confidentiality protections. We do not make private care-circle content public.

Retention and deletion

We retain account and care-circle information while your account is active and as needed to provide the Service. Temporary protected media caches on the iPhone are bounded and are cleared during normal lifecycle events such as sign-out. Security, transaction, backup, and legal records may be retained for a limited period when reasonably necessary or legally required.

You can initiate permanent account deletion from Account Settings on the website or from Profile in the iPhone app. Deletion removes the account and associated personal data from CradleNote's active application systems. Limited security, transaction, operational, legal, backup, or service-provider records may remain for the period reasonably necessary for those purposes. CradleNote also queues deletion of the linked PostHog person, analytics events, and session recordings and retries that provider request if it is temporarily unavailable. Because care circles are collaborative, deleting an account may affect records shared with other authorized caregivers.

Your choices and rights

You can update many profile and care-circle settings, choose which notifications to receive, deny or revoke camera, microphone, and notification permission in device settings, decline or revoke AI data-sharing consent, decline or revoke iPhone session replay from Profile, report content, block another caregiver's Memories content, leave a care circle where supported, and request access, correction, export, or deletion of personal information. Blocking someone from your Memories experience does not revoke that person's care-circle access; a care-circle owner can remove the caregiver separately. Depending on where you live, you may have additional privacy rights and the right to appeal a decision.

Declining optional iPhone session replay does not disable the required iPhone app events or the limited required operational activity analytics described above. You may stop required collection by signing out and not using the Service, or by deleting your account.

Security and international processing

We use access controls, encrypted network connections, protected storage, and other administrative and technical safeguards. However, no system can guarantee absolute security. Service providers may process information in countries other than your own, with safeguards required by applicable law.

Children

CradleNote is intended for adult caregivers, not for children to create or manage accounts. Baby information is entered by an adult caregiver. If you believe a child has created an account without appropriate authorization, contact us so we can investigate.

Changes to this policy

We may update this policy as the Service changes. We will post the updated date and provide additional notice when required by law.

Contact us

For privacy questions or requests to Vinchy Company, use the CradleNote contact form or email support@cradlenote.com. Please do not include sensitive baby-care details in the initial message.