Privacy

Privacy policy

Last updated: 24 October 2026.

What stays on your device

Everything that defines your use of MiBB lives on the phone in your hand:

• Your baby's profile (or several) — name, sex, date of birth, gestational weeks and an optional photo. Stored in a local Hive database inside the private (sandboxed) storage the operating system assigns to the app, accessible only to MiBB.
• The daily diary — feeds and nursing, diapers and poops, sleep, baths, supplements, symptoms and cord care, with their times.
• Growth & health — weight, height and head circumference (and the WHO percentiles computed from them), vaccines and appointments, first foods with allergens, the tooth map and any associated photos.
• Preferences — language, theme (light/dark), text size and density, active modules. Local.
• Premium subscription receipts — cached locally to confirm your subscription is active (see next section).

Purchases, free trial and subscription

MiBB comes with a 30-day trial and, afterwards, an annual subscription (Premium). Billing is handled exclusively by Apple App Store or Google Play: MiBB never sees your card, IBAN, bank details or any financial data.

To confirm that your trial or subscription is still valid, the app talks to a service of ours at iap.sggyamg.com: when you open it, when you buy or restore, and from time to time to check that the subscription is still active. What travels in that exchange is:

• The receipt or purchase identifier issued by the store, so the server can verify with Apple or Google that it is genuine.
• A device identifier that acts as the anchor for the trial period, your purchases and your invitations. It is a technical identifier, not an advertising identifier, and it is not tied to your name or your email: the server does not know who you are. It is a random code (UUID) created by the app itself; anyone who already used MiBB keeps theirs. Depending on the app version, it may also be kept in the iOS keychain so it survives a reinstall and, on new Android installs, computed on the phone from the system identifier (ANDROID_ID) with a hash function (SHA-256): the ANDROID_ID itself never leaves the device. It is used to make the trial, the subscription and invitations work and to prevent fraud with the trial period.
• That same identifier travels to Apple or Google with each purchase (as appAccountToken on iOS and obfuscatedAccountId on Android) so the store can tie it to your subscription. That is how Apple and Google notify iap.sggyamg.com of changes to your subscription (start, renewal, cancellation, refund).

The server keeps what all this needs, tied to that identifier: the start date of your trial, the notices from Apple or Google about your subscription and the status of the MiBB licences linked to it. On top of that come the invitation code and the technical access logs explained below. It does not receive or store any of your baby's data: not the profile, the diary, growth data or photos.

Like any web service, iap.sggyamg.com also writes a technical log entry for every request it receives: the IP address, the date and time, and the request (method and address), which for some requests includes the device identifier. These logs rotate automatically: at most 5 files of 50 MB are kept and the oldest are overwritten. The server's entry proxy also keeps an access log (IP, date and request), retained solely for security and abuse prevention.

Inviting friends

Invitations are optional, but your code exists from the start: the first time you open the app, iap.sggyamg.com assigns you an invitation code and stores it tied to the device identifier above, together with the date it was created, so it is ready whenever you want to share it. If you use invitations, it also keeps who invited whom and when the invitation was accepted, and whether the invited person subscribed or asked for a refund (as notified by Apple or Google). It uses that to count your valid invitations and, once you reach the goal, to prepare the discount offer that the store applies. It keeps no names, emails or contacts: you share the code however you like.

QR code reader

You can scan with the camera the QR code of an invitation, or the one your other phone shows when you move your MiBB data to a new phone. It is optional: an invitation can also be typed by hand and the data can be moved with a file.

• On Android, the reader uses ML Kit, Google's recognition library, which reads the QR code on the device: the image is not sent to any server.
• ML Kit sends Google, on its own, diagnostic data about the SDK itself (performance, API usage and technical information about the app and the device), encrypted in transit, so that Google can maintain and improve the library. It does not include the image, the QR content or any of your baby's data. Details in the ML Kit data disclosure.
• On iOS the reader uses Apple's built-in on-device recognition, without ML Kit.

What we don't do

• No analytics SDK — no Firebase, Google Analytics, Mixpanel, Amplitude, Sentry, Crashlytics, TelemetryDeck or equivalents. The only exception is the QR reader on Android, whose Google library (ML Kit) sends its own diagnostic data, as explained above.
• No advertising identifier — we don't read or transmit IDFA on iOS or AAID on Android.
• No third-party tracking SDKs of any kind.
• No MiBB server storing your baby's data. We don't keep the profile, the diary, growth data or photos. The only backend we run validates the trial and the subscription and keeps count of invitations, as described above.
• No account. There's no sign-up: you download the app, open it and use it.
• No advertising inside the app or in notifications.
• No Health Connect or Apple Health in this version. MiBB neither reads from nor writes to the system health apps.

Optional backup (iCloud / Google)

Your phone's operating system may include MiBB's data in your iCloud (iPhone, iPad) or Google (Android) backup, per your device's standard settings. That's an Apple/Google feature, not ours. When enabled, your data goes to your iCloud or Google account — never to a MiBB server, because we don't run one for baby data. Apple or Google manage that backup under their own policies.

Permissions

• Notifications — for the reminders you set (feeds, medication, vaccines, appointments, new foods…). They are local notifications (scheduled by the phone's own system); there is no remote push.
• Battery optimisation (Android) — optional. While setting up the app you can exclude MiBB from battery optimisation so reminders go off on time. It gives no access to any data.
• Camera — optional. To take a photo of your baby, of a tooth coming through or of an appointment referral, and to scan a QR code (an invitation, or moving your data to another phone). Photos are stored only in the app's local storage and the QR code is read on the device.
• Photos — optional. To pick photos from your gallery and attach them to your baby's records, and to save to it the images you choose. We don't upload or process them on any server.
• Microphone — optional. Only if you choose to record your baby's voice when saving one of their words. The audio is stored only in the app's local storage. We don't upload or process it on any server.
• Calendar — optional. Only when you tap "Add to calendar" on an appointment or a vaccine; the app creates the event in your phone's calendar with your permission.

Baby data and sensitive data

Information about your baby's health, growth, feeding and routines is sensitive data under the GDPR (special category of health data, art. 9) and also concerns a minor. That's why MiBB is designed never to send it to any server: the best-protected special category is the one that never leaves the device. WHO percentiles are computed on the phone itself from the measurements you enter; no external service is queried.

Data Safety / App Privacy summary

• Health and child information — baby profile, diary, growth, feeding, teeth, optional photos and recordings. Collected: yes, exclusively on the device. Shared: no. Transmitted: no — it never leaves the phone. Storage: local Hive database in the app's private storage.
• Device identifier (random UUID or, depending on the app version, SHA-256 hash on new Android installs). Used: yes, sent to iap.sggyamg.com and to Apple or Google to validate the purchase, anchor the 30-day trial and count invitations. Advertising: NO. Tied to your name or email: NO.
• Subscription history (start, renewals, cancellation and refunds notified by Apple or Google) and, if you use invitations, who invited whom. Collected: yes, on iap.sggyamg.com, tied to the device identifier. Shared with third parties: NO. Tracking: NO.
• Invitation code (assigned the first time you open the app). Collected: yes, on iap.sggyamg.com, tied to the device identifier. Shared with third parties: NO. Tracking: NO.
• Technical access logs (IP address, date and request, sometimes with the device identifier). Collected: yes, on the server, for its operation and security. Shared with third parties: NO. Tracking: NO.
• ML Kit diagnostics (Android only, only if you scan a QR code). Collected: yes, by Google, to maintain the SDK. Image or QR content: NO.
• Payment data — card, IBAN, any bank details. Collected: NO. Billing is done by Apple or Google; MiBB never sees that data.
• Advertising identifiers (IDFA, AAID). Collected / read: NO.
• Account identifiers (email, phone, username). Collected: NO. The app has no account system.
• Precise location (GPS). Collected / requested: NO.
• Contacts, SMS, calls, clipboard. Accessed: NO.
• Camera, photos and microphone. Used: only if you add a photo, record a voice or scan a QR code. Transmitted: NO.
• Health Connect / Apple Health. Used: NO in this version.
• Crash reports / analytics / telemetry. Sent to a third party: NO. Exception: the ML Kit SDK diagnostics on Android, described above.

All of the app's network traffic travels over HTTPS with TLS 1.2 or higher.

Your rights (GDPR)

You have the right to know what personal data is processed about you. MiBB runs no server that stores your baby's data. What leaves your device is described above: on iap.sggyamg.com, tied to the technical identifier, the start date of your trial, the notices from Apple or Google about your subscription, the status of your licences, the invitation code assigned to you the first time you open the app and, if you use invitations, the invitation data; plus the technical access logs. In addition, Apple or Google process the data of your purchase and, on Android, ML Kit sends its diagnostics to Google if you scan a QR code.

To access or delete what is on your phone, just clear the app's data or uninstall it: that removes the local database, the associated photos and recordings, the history and the cached subscription information. Depending on the app version, on iPhone some system keychain entries survive uninstalling: the device identifier and a random technical key that protects the subscription information stored on the phone; on Android, the identifier may be computed the same way again when you reinstall. That is how the trial and the subscription are recognised after a reinstall. For the data that iap.sggyamg.com keeps tied to your identifier (including a request to delete it) or anything about your purchase or subscription, write to us. Apple and Google keep their own subscription records under their policies. Remember to cancel the subscription with Apple or Google before uninstalling if you don't want it to renew.

For privacy questions or to exercise your rights of access, rectification, objection, erasure or portability: apps.sggyamg [at] gmail [dot] com. You may also lodge a complaint with your local data protection authority.

Children

MiBB is designed for an adult (parent or carer) to keep a baby's diary. The baby's data is entered by the adult and stays on their device: none of it reaches our server. What the server does keep is explained above, in the purchases and invitations sections. The app is not intended for use by children.

About this website

This site (mibb.sggyamg.com) uses no cookies; its visit statistics, which work without cookies, are explained in the next paragraph. It stores only two things in your browser: the language you choose, in localStorage, to remember it next time, and, for the length of your visit, a flag in sessionStorage so the automatic redirect to your browser's language does not repeat. None of that is sent to any server or shared. The video on the home page does not load until you tap it: then the YouTube player (youtube-nocookie.com) opens, which receives your connection like any website you visit, under Google's policy. Like any web server, the one serving this site keeps a technical access log (IP address, date and page requested), retained solely for security and abuse prevention.

Visit statistics. To know how many people visit this website and what interests them, we count visits with Umami, a statistics program installed on our own server: the data does not go through any third party. It records the page you visit (its address, without parameters, and its title), the website you came from, your country, region and city, your language, your browser and operating system, the type of device and the screen size, plus clicks on the download and purchase buttons. It uses no cookies and stores nothing in your browser to recognise you. It does not store your IP address: it uses it at that moment to work out your country, region and city, and to calculate, together with your browser details, a code (a hash) that groups the pages of a single visit and lets us count distinct visitors; that code changes every month and is different on each website, so it cannot be used to follow you from one month to the next or from one website to another. It respects your browser’s “Do Not Track” setting: if it is on, your visit is not counted. These statistics belong to the website: the app does not include them.

Changes to this policy

If we change this policy, we'll update the "Last updated" date above and publish the new version at this URL. Any substantial change will be announced in the relevant app release notes beforehand.

Contact

apps.sggyamg [at] gmail [dot] com

This policy is published by sggyamg, developer of MiBB, based in Madrid, Spain.

Language

The original and binding version of this Privacy Policy is the Spanish one. Versions in other languages are translations provided solely for your convenience; in the event of any discrepancy or conflict of interpretation, the Spanish version shall prevail.