Privacy policy

Last updated: 23 October 2026

Lulladay is a baby diary app for parents and caregivers, made by Oded Duek (“we”, “us”). This policy explains what information the Lulladay app and this website handle, where it goes, how long it is kept and the choices you have.

1. Who we are

Lulladay is made by Oded Duek, a computer engineer with a master's degree and about 16 years of experience building software, and a father who uses Lulladay for babies in his own family. Keeping families' records safe and private has guided how Lulladay is built from the start. Read more about who makes Lulladay.

Oded Duek is responsible for (the “controller” of) the personal information described in this policy. For questions, requests or complaints about privacy, write to [email protected]. Oded answers every message himself.

This policy covers the Lulladay app for Android and iPhone and the website lulladayapp.com.

2. What stays on your phone

Everything you record in Lulladay is saved on your phone: your babies' names, birth dates, due dates and sex (if you enter it), and the entries you add, such as feeds, sleep, diapers, pumping and stored milk, solids, temperature, medicines, growth measurements, milestones and notes. The app also keeps your settings and reminders on the phone.

• The Free diary. If you use Lulladay without an account, your records stay on your phone and we never receive them. The app contacts our server only for things you choose: buying or restoring Premium (the app then checks the purchase from time to time), signing in or joining a family, and the AI assistant.
• Phone backups. Your phone's own backup (Google's backup on Android, iCloud on iPhone) can include what Lulladay stores on the phone. Those backups are handled by Google or Apple under their terms.
• Backup files and exports. When you save a backup file, or export a CSV or PDF, the file is made on your phone and goes only where you send it, for example to Google Drive, iCloud Drive or an email. Backup files are not encrypted, so keep them private.
• Reminders are scheduled on your phone. We don't use a push notification service.
• App lock uses your phone's fingerprint, face or screen lock. Lulladay only learns whether unlocking succeeded; it never receives your fingerprint or face data.
• Speech. When you speak to “Say or type”, your phone's speech recognition turns your voice into text: Apple's on iPhone, Google's or your phone maker's on Android. Depending on your phone and its settings, this happens on the phone or on that company's servers, under its own privacy terms. Lulladay doesn't record or keep your voice. You see the text before it is sent (see section 4).
• Permissions. Lulladay asks for notifications and, on Android, alarms (so reminders ring on time), the microphone and speech recognition (only for “Say or type”), and Face ID on iPhone (only for app lock). You can refuse them, or turn them off later in your phone's settings.

3. Family accounts and sharing

To share a diary with other caregivers, you create a family account. Family sharing is part of Premium, including the free trial. We then store, on our server:

• Your account: your email address and password (stored only in a scrambled, hashed form), or, if you sign in with Google or Apple, the email address and name the provider shares with us (Google also shares a link to your profile picture). We also store when you signed up and last signed in.
• Your profile: the name other family members see.
• Your family: its name and time zone, its members and who owns it, invitation codes (stored only in a hashed form; each works once and expires after 48 hours) and the dates that keep Premium and the free trial working, such as when the family used its trial.
• Your family's records: the babies' names, birth dates and due dates, and every entry with its details and note, who added or last changed it, and when. When someone deletes an entry, its details and note are erased from our server; a small marker with only its type and time stays, so the other phones remove it too.
• Technical information needed to sync safely, such as which changes each phone has already sent, and, in our hosting provider's logs, your IP address and basic device and app details.

Some of these records are health information about your baby, such as temperature, medicines and growth. We use them only to show them to you and your family and to provide the features you use.

Who can see it. Everyone in your family can see and change the family's records. The family owner can remove members, and decide whether a removed member's phone keeps its copy. We look at stored information only when we need to: to run, fix or secure the service, to answer a request from you, or when the law requires it.

When Premium ends, every phone keeps the records it has and continues as a Free diary. The family's copy on our server is kept for 30 days, so Premium can be renewed without losing anything, and is then deleted. During those 30 days, the phones of family members may still download the family's records.

4. The AI assistant and OpenAI (United States)

Lulladay's assistant uses an AI model run by OpenAI, a company in the United States. Requests to the assistant are processed by OpenAI in the United States. The assistant has two parts:

• Say or type fills in an entry from a sentence, such as “bottle 120 ml at 3”. Lulladay sends what you typed or said, and your babies' names (so the right baby is chosen), to OpenAI.
• Ask the assistant answers a question about baby care and your records. Lulladay sends your question, your babies' names and a short summary of the baby's records on your phone to OpenAI. The summary has the baby's name, sex (if entered), date of birth and age (and due date, if born early), growth, feeds, sleep, diapers and pumping for today and the last two weeks, the last entry of each kind, any timer that is running, the last 3 notes and your family's time zone.

How it works:

• Only with your OK. The app asks before you use the assistant for the first time. You can turn it off at any time in Settings → Privacy → AI assistant. The assistant comes with Premium and the free trial; a Free diary without Premium never uses it.
• Through our server. Each request passes through our server, which checks your allowance and forwards the request to OpenAI. Your email address and account are not sent to OpenAI.
• What OpenAI does with it. OpenAI uses the data only to answer you. Under OpenAI's terms for business customers, it does not train its models on it and deletes it within 30 days, unless the law requires it to keep it longer; it keeps it that long only to detect misuse.
• What our server keeps. Our server never stores what you typed, said or asked, or the summary. It keeps the answer for one hour, so it can be shown again if your connection drops, and then deletes it. To count allowances and costs, it keeps a usage record for 90 days: the time, the kind of request, its size and cost, and a one-way fingerprint of the request that can't be turned back into text.
• Not medical advice. Answers are general information and can be wrong. If you are worried about your baby, call your doctor; in an emergency, call your local emergency number.

5. Purchases

Premium is a subscription sold through Google Play or the App Store. They handle the payment, and we never see your card or payment details.

To unlock Premium, the app sends the store's purchase information to our server, which checks it with Google or Apple: the store, the purchase token or transaction ID, the product (monthly or yearly), its dates, and whether it is a trial, active and set to renew. A random purchase number links the purchase to your phone or account; you don't need an account to buy Premium on one phone. Google and Apple send our server a notice when a subscription renews, ends or is refunded.

We use this to give you Premium, to let one subscription cover the whole family, to prevent double payments and misuse, and to keep a record of sales.

6. Emails

• Account emails. To confirm your email address or reset your password, we send you an email through Resend, an email delivery service.
• Support. If you write to us, we receive your email address, your message and anything you attach, and use them to answer you.

We don't send newsletters or marketing emails.

7. This website

lulladayapp.com has no cookies, analytics, ads or content from other websites. It is hosted by Cloudflare, which processes your IP address and basic browser details to deliver the pages and protect them from attacks. The invitation page reads the invitation code from the part of the link after “#” on your own device, so the code never reaches the website's server.

8. Who processes your information

We use a few companies to run Lulladay:

Supabase, OpenAI, Resend and Cloudflare process information for us under their data processing terms. When you use Google's or Apple's stores, sign-in or speech recognition, their own privacy policies also apply.

We share information only with these companies, as far as each needs it; with the family members you invite; and when the law requires it. We never sell personal information or share it for advertising.

9. Why we use your information

Where privacy laws such as the EU and UK GDPR apply, we rely on these legal grounds:

• To provide Lulladay and the features you choose (family sharing, sync, Premium and account emails): this is necessary for our agreement with you, the Terms of use.
• To store and share your baby's health information with your family: your explicit consent, which you give by recording it and choosing to share the diary. You can withdraw it by deleting those records, leaving the family or deleting your account.
• The AI assistant: your consent, which you can withdraw at any time in Settings → Privacy → AI assistant.
• Security, preventing misuse and fixing problems: our legitimate interest in a safe service that works.
• Records of sales: our legal obligations, such as tax and accounting rules.

10. How long we keep it

11. Where your information goes

Your family's records are stored in the European Union. The AI assistant sends the data described in section 4 to OpenAI in the United States, and some of our other providers may process information in the United States or other countries. When information leaves the European Economic Area, the United Kingdom or Switzerland for a country without an adequacy decision, the provider protects it with approved safeguards, such as the European Commission's Standard Contractual Clauses.

12. How we protect it

• Connections between the app, our server and our providers are encrypted.
• On your phone, a family's records are kept in an encrypted database, whose key is stored in the phone's secure storage. A Free diary is protected by your phone's own encryption and, if you turn it on, app lock.
• On our server, a family's records can be read only by its members, and our provider encrypts stored data.
• Only we can manage the server.

No system is perfectly secure. If a breach affects your information, we will tell you and the authorities as the law requires.

13. Children

Lulladay is for adults who care for babies, and only adults may create an account. The app holds information about babies that their parents and caregivers choose to record, and we use it only to provide the app to them. If you believe a child has created an account, write to us and we will delete it.

14. Your rights and choices

Depending on where you live, you have the right to:

• know what information we hold about you and get a copy of it;
• correct it: you can edit entries and baby details in the app;
• delete it: delete entries in the app, or delete your account;
• receive your records in a portable format: Reports → Export CSV and backup files give you your records at any time;
• object to or restrict some uses, and withdraw your consent, for example by turning off the AI assistant;
• complain to the data protection authority where you live.

To use these rights, write to [email protected]. We answer within 30 days. To protect your information, we may ask you to confirm that the request is yours, for example by writing from your account's email address.

15. Changes to this policy

We will post any change to this policy on this page with a new date. If a change significantly affects how we use your information, we will also give notice in advance, for example in the app's update notes or by email to account holders.

16. Contact us

Oded Duek, developer of Lulladay
[email protected]