Privacy policy
This policy covers the apps Nanna (baby tracking) and Ninna (pregnancy tracking), and this website.
Effective 14 October 2026 · Last updated 14 October 2026
1. Who is responsible
upstairs
380 Beonyeong-ro, Gunpo-si, Gyeonggi-do, 15849, South Korea
[email protected]
upstairs is the data controller under the GDPR and the person in charge of personal information under the Korean Personal Information Protection Act. We have not appointed a Data Protection Officer; please write to the address above with any privacy question.
2. What we collect, and when
2.1 On your phone only — no account needed
Nanna works without an account. Until you link a family, everything you log lives in a database inside the app on your phone: feeds, sleep, diapers, health notes (temperature, medication, symptoms, doctor visits), growth measurements, vaccination and development checklists, custom activities and reminders, photos and video clips you take in the app, your baby's name and birth date, and your settings. We have no copy of it and no way to read it. Uninstalling the app deletes it.
2.2 When you sign in
Signing in is only needed to share with family. We offer Sign in with Google. Google sends us a signed token, and the account stored on our side holds what that token contains: your email address, your Google account identifier, and the display name and profile picture URL Google includes. We never see or receive your Google password.
2.3 When you link a family
Once a family exists, the records below sync to our database so every member sees the same thing:
| What | Details |
|---|---|
| Family | Owner, members and their roles, the display name or role label each member chose, partner flag, simple-mode flag, the app language of each member, time zone, the time your daily film is made, the 6-character invite code (valid 72 hours), subscription unlock state |
| Baby | Name, birth date, due date, sex, avatar, country (used for the vaccination schedule) |
| Records | Every entry: type, start and end time, notes, and the details of that type — amount fed, which breast, sleep length, diaper state, temperature, medication, symptoms, doctor visits, weight, height, head circumference, vaccinations, development answers. Each entry remembers who created it. |
| Clips and photos | Time taken, duration and size, who shot it, the caption and where it sits on the clip, and the sharing scope (whole family / partner only / just me, with specific members excluded) |
| Reactions | Hearts and comments your family leaves on clips |
| Night shifts | Who took which night, and when it started and ended |
| Your own settings | Per-person preferences such as lullaby settings, notification preferences per record type, quiet hours |
2.4 Photos and video clips
Photos are resized on your phone to at most 1,200 pixels and 300 KB; clips are at most five seconds, 720p and 1.5 MB. They are uploaded directly from your phone to a private Cloudflare R2 bucket. There is no public address for any file: every upload and download goes through a one-time signed link that our server issues only after checking that you belong to that family, and that link stops working after five minutes. The daily 30-second film is assembled on your phone and is never uploaded to us.
2.5 Notifications
If you allow notifications, we store the push token your phone's operating system issues, and which platform it is for, so we can reach your device. Delivery runs through Expo's push service and then Google FCM. A notification contains the sender's display name and a short summary of what was logged (for example "Mom · Bottle 120 ml") — it never contains your baby's name, a photo or a video.
2.6 Subscriptions
Payments are handled by Google Play. We never see your card details. We use RevenueCat to check whether a subscription is active; RevenueCat receives the store receipt and your account identifier so a purchase can be restored and shared with your family.
2.7 Crash and error reports
When the app hits an error, a report goes to Sentry so we can fix it. It contains the device model, operating system version, app version and the technical stack trace. Sending personal data with reports is switched off, and we additionally strip any technical trace that mentions an image, video or database file. Baby names, photos, videos and record contents are never sent.
2.8 Voice logging
You can log by speaking. Recognition happens on your phone when it supports on-device recognition; if it does not, your phone's operating system sends the audio to its own speech service (on Android that is Google) under that company's terms. We never store the audio, and only the recognised text is turned into a record.
2.9 Ninna (pregnancy)
Ninna stores, for the pregnancy you record: due-date method and inputs, pre-pregnancy weight and height, status and partner label; the daily log (weight, mood, notes); symptoms with intensity; medications, their times and whether they were taken; appointments, clinic, type, notes, your questions and the answers; kick sessions and counts; contraction sessions and intervals; weekly bump and ultrasound photos; voice notes; letters to the baby; firsts; bucket-list and checklist items; partner and couple missions; name candidates and who liked them; a birth plan; a current status ("presence") and the mood pings partners send each other. These follow exactly the same rules as Nanna's records — same storage, same access rules, same deletion.
3. What we never do
- No advertising SDK, no analytics SDK, no tracking SDK is built into the apps. No tracking prompt, because there is nothing to track.
- We never sell your data, and we never hand it to anyone for their own purposes.
- We never use your records, photos or videos to train AI models.
- No file is ever publicly addressable.
- We do not build profiles about you and we make no automated decisions with legal effect.
4. Who else handles the data
These companies process data on our behalf, only to run the service:
| Service | What for | Where |
|---|---|---|
| Supabase | Accounts, database, live sync, server functions | Seoul, South Korea |
| Cloudflare R2 | Private storage for photos and clips | Asia-Pacific |
| Sign in with Google; Android push delivery; Google Play billing; speech recognition when your phone cannot do it on-device | United States / global | |
| Expo (650 Industries) | Sending push notifications to your device | United States |
| RevenueCat | Subscription receipts and status | United States |
| Sentry | Crash and error reports | United States |
We are based in South Korea, so your data is processed there, and the services above may process it in the United States or elsewhere. For users in the EEA and the UK this means a transfer outside your region; it relies on the standard contractual clauses and data-processing terms each of these providers offers. We may also disclose data if the law requires it.
5. Why we are allowed to (GDPR legal bases)
- To provide what you asked for (Art. 6(1)(b)) — storing your records, syncing them to your family, running your subscription.
- Your consent (Art. 6(1)(a), and Art. 9(2)(a) for health data) — health entries such as temperature, medication, symptoms and doctor visits, all pregnancy records in Ninna, push notifications, and access to your camera, microphone and photo library. You can withdraw consent at any time by turning the feature off, deleting the entries or deleting your account.
- Our legitimate interest (Art. 6(1)(f)) — keeping the service working and secure, which is why we receive crash reports.
- Legal obligation (Art. 6(1)(c)) — keeping purchase records as tax law requires.
6. How long we keep it
- On your phone: until you delete the entry or uninstall the app.
- On our server: for as long as your family exists. Entries you delete are marked deleted so every device can catch up, and they disappear for good when the family is deleted.
- Photos and clips: until you or the person who uploaded them deletes them, or the family is deleted.
- Invite codes: 72 hours.
- Push tokens: removed when you sign out or delete your account.
- Crash reports: kept by Sentry under its own retention period, then deleted.
- Backups: before any change to the database we take our own backup and keep only the ten most recent, deleting older ones automatically. Data you deleted can still exist in one of those until it rotates out. The plan we use with our database host does not include managed backups, so these are the only backups that exist.
7. Deleting your data
You can delete your account from inside the app, or by email if you no longer have it. The full steps, and exactly what is deleted and what stays, are on a separate page.
8. Your rights
You can ask us to show you your data, correct it, delete it, limit what we do with it, object to our processing, or hand your data over in a portable form. In the app you can export every record as a CSV file at any time (Settings → Data → Export as CSV), and edit or delete entries directly.
To exercise a right, write to [email protected]. We answer within 30 days. If you are in the EEA or the UK you may also complain to your local data protection authority. In South Korea you may contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
9. Children's data
These apps are for adults. Children do not create accounts and cannot use the apps themselves. What the apps record is information about a baby, entered by a parent or guardian who is responsible for it. We treat that information as sensitive: it is never used for advertising, never sold, and never used to train models.
10. How we protect it
- Every table in the database enforces row-level security: you can only read rows that belong to your family, and a member excluded from a clip cannot fetch it even by asking for it directly.
- Media files are never public — only short-lived signed links, issued after a membership check.
- All traffic is encrypted in transit; server keys live only on the server and are never shipped inside the app.
- Personal data is kept out of logs and error reports by design.
11. Changes
If we change this policy we will update the date at the top, and we will tell you in the app before anything material takes effect.
12. Contact
upstairs · 380 Beonyeong-ro, Gunpo-si, Gyeonggi-do, 15849, South Korea
[email protected]