Privacy Notice

Last updated: 20 October 2026

Pre-launch draft: the operator’s legal name and postal address, production provider settings, retention schedule, and legal review are not complete.

Pibbow is an account-based first-words and phrases journal for families. This notice explains what personal data the service uses, why it is used, and the choices available to account holders. Pibbow is operated from Slovenia. Privacy questions and rights requests can be sent to support@pibbow.app.

1. Data Pibbow uses

An account is required. Depending on the features you choose, Pibbow may process:

• Account and profile data: account identifier, email address, display name, app language, family role, and family membership.
• Child and family data: a child’s name or nickname, date of birth, optional sex, languages, notes, avatar settings, and optional profile photo.
• Journal data: words and phrases, dates, language, category, status, notes, context, who heard an entry, optional journal photos, archived entries, and developmental events or milestones.
• Sharing data: family and friend invitations and their status. An invitation is a link you share yourself; older invitations may also hold the email address or phone number they were sent to. The app does not read your contacts.
• Subscription data: product, entitlement, renewal, trial, and expiry status, together with identifiers needed to connect a purchase to the correct family. Payment-card details are handled by Apple or Google, not Pibbow.
• Support data: messages, optional screenshots, and diagnostics shown before sending, such as app version, platform, operating-system version, locale, and subscription status.
• Error reports: when the app runs into an error, it records the error’s description and where in the app’s code it happened, the app version and update it was running, and the device model and operating-system version. The report is stored with your account in Pibbow’s own database, so we can match it to a support request and fix the problem. You can turn error reports off in Settings → Permissions; that also deletes the ones already sent. It contains no child data, journal entries, names, or invitation links. If the app crashes outright, Google Play or Apple may also receive a crash report from your device, as they do for any app.
• Device-only data: session credentials, cached app data, language and reminder preferences. The device schedules daily reminders itself. They do not come from a server.
• Notification data: if you allow notifications, a push token for that device, the device platform, the app language, and the time the app was last opened on it. The token identifies the device to the push service; the language selects the message’s wording; the last-opened time is what keeps a single unread notice from becoming several. No notification names a child. One kind — a recap of what your family added, which you can switch off in Settings → Notifications — names the family member who added the entries by their family label and quotes up to three of the words or phrases. Every other notification says only that something happened, never what. Signing out removes that device’s token, and a token the push service reports as no longer valid is deleted.

Optional microphone, photo-library, camera, and notification access is requested only when you choose a feature that needs it. Speech recognition may use the speech service provided by the device platform; Pibbow receives the recognised text and stores it only if you save it as an entry.

Voice entry is operated by the adult account holder. It is not restricted to on-device recognition: audio may be sent to Apple or the speech provider selected on Android (often Google). Pibbow does not save an audio recording. The speech provider’s processing and retention depend on its service and your device settings.

Pibbow does not include advertising SDKs and does not sell personal or child data. The website source includes no optional analytics, advertising cookies, or session replay. Hosting settings and deployed behavior must be verified before launch; a cookie-free source is not proof of a cookie-free deployment.

The public website’s language routing reads the browser language without storing a language cookie. Invitation links contain a short-lived access token: share them only with the intended person. The app does not read your address book or learn which contact you select in another app’s share sheet.

2. Why the data is used

Data is used to create and secure accounts, maintain a family’s cloud journal, show progress and milestones, provide sharing and support, enforce subscription entitlements, process purchases, prevent misuse, and meet legal obligations. Account, journal and purchase administration support performance of the service contract; security, support and error reports rely on legitimate interests in protecting users, keeping the app working and answering requests; mandatory record keeping relies on legal obligations. Where consent is the applicable basis, it can be withdrawn without affecting earlier lawful processing. A device permission enables a feature; it does not by itself establish a lawful basis for every use of personal data.

Children are not contracting parties. Before launch, the operator must confirm the lawful basis for their information and any additional condition needed for health-related notes or developmental information. Do not submit medical records or diagnoses through voice entry or support.

3. Who can access or receive data

• Members of the same family can access the child and journal data available to their role.
• Invite recipients can access only the invitation they received, and after accepting it, only the family data their role allows.
• Authorised Pibbow staff may access account or support data when needed to answer a request, investigate a problem, protect the service, or complete a verified deletion request.
• Supabase provides authentication, database, storage, and server functions.
• Apple and Google provide the sign-in methods you choose, receiving the authentication request and returning account identifiers and available profile information. Apple’s private relay may provide a masked email address.
• Apple or your Android speech provider processes voice entry as described above; this is separate from Pibbow’s journal storage.
• Expo / EAS Update delivers app updates. Update requests disclose network information such as an IP address and app/platform/runtime information needed to select an update. Expo also provides the push service described below.
• Expo operates the push notification service that delivers notifications to your device, and passes them to Google Firebase Cloud Messaging on Android or Apple Push Notification service on iOS. These receive the device’s push token and the notification’s title and body, which are described under Notification data above, including word or phrase excerpts in activity recaps. They do not receive the full journal or a child’s name.
• RevenueCat manages subscription status. Apple App Store and Google Play process store purchases when those listings become available.
• Discord currently receives a limited notification when an in-app support message is sent. It may include a support-ticket reference and technical diagnostics, but support screenshots remain in private Supabase storage.
• Cloudflare Pages hosts the website and may process ordinary network and security logs needed to deliver and protect it.

These providers process data under their own terms and applicable data-processing commitments. Exact production regions, subprocessors, and any international transfer safeguards must be confirmed in the final processor register before public launch.

4. Children’s data

Pibbow is for parents, guardians, and other authorised adults; it is not designed for a child to create or operate an account independently. The account holder is responsible for having authority to add a child’s information and to invite other people to the family. Child data is used only to provide the family journal and features described above, not for advertising or automated decisions about the child.

Family access is private to invited members, not a public feed. Use family membership controls to remove access and contact support about misuse.

5. Retention and deletion

Account and family data is kept while the account is active and as needed to provide the service. Entries moved to the in-app Archive remain available until they are permanently deleted. Support and transaction records may be kept for a reasonable period for support, security, accounting, dispute, or legal purposes.

Screenshots you attach to a support message are deleted 30 days after you send it. The message text stays, because the conversation is the record; the picture is not. Nothing is kept waiting for the thread to be marked resolved.

Error reports are deleted 90 days after they are made, and with the account when it is deleted.

A device’s push token is kept while that device stays signed in and notifications stay allowed. It is removed when you sign out on that device, when the push service reports it is no longer valid, and when the account is deleted.

You can delete your account and its data from inside the app, under Settings → Account → Danger zone, after signing in again. A successful deletion removes the account from the active service and cannot be undone. An owner’s deletion also removes their owned families and journals; membership deletion does not erase contributions retained in someone else’s family journal. Contact us for a request concerning those contributions. If media cleanup fails, deletion reports failure so it can be retried; some media may already have been removed. If you cannot sign in, use the account deletion page or contact us from the email address connected to the account; after identity and family ownership are verified, Pibbow will delete or anonymise associated personal data unless a legal obligation requires limited information to be kept. Store transaction records, RevenueCat records, support-notification references in Discord, email correspondence, provider logs, and backups are not all erased by the in-app database deletion. A verified request must also be assessed against those providers and any legal retention obligation. Backup expiry and the exact retention periods are launch blockers until the operator verifies and publishes them. Deleted data must not be restored into active use from a backup.

Deleting the Pibbow account does not automatically cancel a subscription managed by Apple or Google. Store subscriptions must also be cancelled in the relevant store account.

6. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal data, and to withdraw consent. Send a request to support@pibbow.app. You may also lodge a complaint with your local data-protection authority; in Slovenia, this is the Informacijski pooblaščenec.

Pibbow can create a printable or shareable Word Journal PDF from selected journal words, dates, existing notes, and attached photos. This keepsake is not a complete portability export. Settings → Account → Export family data also creates a machine-readable JSON copy of the active family’s data, without a paid subscription. It includes family information and media references rather than a download of every original photo. For other personal data, original media, or a request concerning another family’s retained contributions, contact us. Files you export or share are outside the app’s deletion control.

7. Security

Pibbow uses authenticated sessions, encrypted network connections, family-scoped database access controls, and private storage policies. No online service can promise absolute security. Please protect your account and contact us if you suspect unauthorised access.

8. Changes

This notice will be updated when the product, processors, retention rules, or legal details change. Material changes will be communicated through an appropriate channel before they take effect when required by law.

9. Contact

Privacy and data-rights requests: support@pibbow.app

Current controller identification: Pibbow, Slovenia. The controller’s final legal name and postal address must be inserted and legally reviewed before public launch.