This Privacy Policy explains how Black Eagle Group LLC ("Whispie," "we," "our," or "us") collects, uses, shares and protects information when you use the Whispie mobile app and the whispieapp.com website (together, the "Service").
Whispie is a pregnancy and baby tracking app for parents and guardians. Using the app requires an account (Sign in with Apple, Google Sign-In, or email and password).
2. Information We Collect
2.1 Account information
Email address, name, language, country, time zone and your notification and consent settings. Some older accounts also include a phone number; we no longer ask for one.
2.2 Information you enter about your baby and pregnancy
Baby: name, date of birth and gender.
Logs: sleep, feeding (breast, bottle, solids), diapers, pumping and milk stock, growth (weight, length, head circumference), food reactions and vaccinations.
Health: health events such as temperature and medicine doses, and questions you note for your doctor.
Pregnancy: pregnancy week, kick counts, contractions, checkups, nutrition and well-being entries, notes, and photos of test results if you add them.
Memory book: text, photos and comments.
Family: the family members and invites you add, and emergency contacts you enter (which may include another person's name and phone number — please only add people who agree to it).
Health and pregnancy information is sensitive. We process it only to provide the features you use.
2.3 Information collected automatically
Usage analytics: we record app events (event name, time, platform, app version, your user ID and a random ID created for your device) on our own servers to run and improve the Service. This is part of providing the Service and is not shared with analytics companies.
Technical logs: error and diagnostic information.
Notifications: push notification tokens and notification history.
Subscriptions: subscription status, transaction IDs and history from the App Store or Google Play.
Prediction data: learning samples derived from your logs, used to personalise sleep and feeding estimates.
2.4 Advertising measurement (Meta)
Whispie shows no ads. We use the Meta (Facebook) SDK and Meta's Conversions API only to measure our own advertising, for example whether an install led to sign-up, a trial or a purchase. Events sent include app opens, registration, trial start, purchase, subscription and an activity event on day 3. Server events may include a hashed (SHA-256) user ID, IP address, the Meta SDK install ID, device information (model, operating system, language, time zone) and your tracking-permission status.
iOS: advertising tracking (IDFA) is used only if you allow it in Apple's App Tracking Transparency prompt.
Android, version 4.3.6 and later: advertising measurement is turned on only if you allow it, and you can turn it off at any time in Settings → Ad measurement. In earlier versions it was on by default on Android.
2.5 Website
Our website uses Google Analytics only with your consent, through the cookie banner. See our Cookie Policy.
3. How We Use Information
To provide the app's features: logging, timelines, age-based estimates, reminders, reports and family sharing.
To personalise predictions from your own logs (Premium).
To send notifications and emails you request or that are part of the Service.
To confirm subscriptions and restore purchases.
To run, secure, fix and improve the Service.
To measure our own advertising, as described in section 2.4.
To comply with legal obligations.
We do not sell your personal information and we do not show ads in the app.
Legal bases (EEA, UK and Turkey)
Providing the Service you signed up for: performance of our contract with you.
Health, pregnancy and baby information: your explicit consent. You can withdraw it at any time by deleting the information or your account.
Advertising measurement and website analytics: your consent (iOS tracking permission, the Android prompt in version 4.3.6 and later, and the website cookie banner).
Usage analytics, security and fixing errors: our legitimate interest in running and improving the Service.
Keeping purchase records: our legal obligations.
You can also lodge a complaint with the data protection authority in your country.
4. Service Providers
Supabase — database, sign-in, file storage and server functions. Data is stored in Stockholm, Sweden (EU).
Twilio Verify — text messages, only for two-step sign-in if it is enabled on your account.
Apple App Store / Google Play — payments, receipt validation and subscription notifications.
Google Analytics — website analytics, with consent.
Cloudflare — website hosting and security.
When you invite family members, they can see and log the information you allow. We may also disclose information when required by law, to protect our rights, or as part of a merger or sale of company assets.
5. International Transfers
App data is stored in the European Union (Stockholm, Sweden). Some service providers, such as Meta, Google and Resend, may process data in the United States or other countries, under their own safeguards for international transfers.
6. Data Retention and Deletion
Free plan history: on the free plan, sleep, feeding and diaper logs older than 30 days are removed from your account every night and moved to an anonymised archive (with a key that changes every month). Pregnancy nutrition entries are deleted after 30 days.
Deleting your account (Settings → Danger Zone → Delete Account) immediately deletes your sign-in record, your files and your babies with all their logs. It works for every account: if you are a caregiver on someone else's baby, the logs you entered for that baby stay in the baby's history and belong to the baby's owner, and your family membership and invites are deleted.
Kept after account deletion, without your user ID: usage events, technical logs, subscription history, feedback, coupon use, payment-notification logs and memory book comments. Usage events keep the random device ID, so they are pseudonymous rather than fully anonymous. You can ask us to delete them.
Delete all data (Settings → Danger Zone → Delete All Data) deletes your data but keeps your account.
Password reset requests are deleted after 7 days. We do not currently keep separate backups of the database.
7. Children's Privacy
Whispie is meant for adult parents and guardians. Children do not use the app or have accounts. Information about a baby is entered and controlled by a parent or guardian. We do not knowingly collect personal information directly from children under 13.
8. Security
Data is encrypted in transit. Access to your data is limited to your account and the family members you invite. No method of storage or transmission is completely secure, but we work to protect your information.
9. Your Rights
Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA, KVKK, APPI, PDPL or Federal Law 152-FZ), you may have the right to access, correct, delete, restrict or port your data, to object to processing, and to withdraw consent. You can export or delete your data in the app. To exercise your rights, contact privacy@whispieapp.com. We respond within 30 days.
Turkey (KVKK): Veri sorumlusu: Black Eagle Group LLC. KVKK Madde 11 kapsamındaki haklarınız için privacy@whispieapp.com adresine başvurabilirsiniz.
10. Changes to This Policy
We may update this policy. We will notify you of significant changes in the app or by updating the "Last Updated" date.