PandaMama Privacy Policy

Effective date: [launch date]
Last updated: October 1, 2026

PandaMama is made by Polanco Capital Partners of America, a California corporation ("PandaMama," "we," "us," or "our"), 530 Technology Drive #100, Irvine, California 92618, United States. This Privacy Policy explains what information we collect when you use the PandaMama mobile application and related services (together, the "Service"), how we use and share it, and the choices and rights you have.

Two promises up front, because they shape everything below. We do not sell your personal information, and we do not sell your baby's information. We do not show advertising in PandaMama, and we do not share your information with advertisers. We make money one way: people buy the app, either once (Lifetime) or monthly. That is the whole business model.

Please read this Policy together with our Terms of Service. By using the Service you agree to this Policy. If you do not agree, please do not use the Service.

1. Who this Policy covers

This Policy covers people who use the Service: parents and caregivers who create an account, and caregivers who join a family by invitation. It also describes how we handle information about the babies whose care is logged in the Service, which is provided to us by the adults who care for them.

The Service is intended for adults. You must be at least 18 years old (or the age of majority where you live) to create an account. See Section 9 for how we treat information about children.

2. Information we collect

2.1 Information you give us

Account information. Your email address, and a display name if you provide one. If you sign in with Apple or Google, we receive the name and email (or Apple's private relay email) that you authorize them to share. We never see your Apple or Google password.
Baby profile. The name or nickname you choose for your baby, their date of birth, the nursery color theme you pick, and the feeding method you select. You may add more than one baby.
Care logs. The information you record about your baby's care: breastfeeding sessions (side and duration), bottle feeds (amount and contents), pumping sessions, diaper changes, sleep, and notes you attach to any entry.
Growth information (optional). Weight and length, if you choose to record them. You can use the Service fully without ever entering these.
Family information. The display name, role label (for example "Mom," "Grandma," "Nanny") and language preference of each caregiver you invite, and the invitation you send. Invited caregivers create their own account and are covered by this Policy.
Family codes. When you invite someone, we create a short code. The code record holds your baby's first name and birth date and your first name, so the person you invite can see whose family they are joining before they sign in. Anyone who has the exact code can read those three items until the code is used or expires (within 8 days). Codes cannot be listed or searched. Share a code only with the person you mean to invite.
Voice input. If you use voice logging, what you say is processed as described in Section 3.
Support and correspondence. Anything you send us when you contact us, including through "Say hello" in the app.
Settings. Your language, units, reminder interval, night-mode preference, which buttons you show, and similar preferences.
On your device after you sign out. To let you sign back in with one tap, the app keeps your first name, how you signed in (Apple, Google or email), a partly hidden email address, your baby's first name and your language on that device only. It does not keep your logs. You can remove this from the sign-in screen ("Not you? Remove from this phone") or by deleting the app.

2.2 Information collected automatically

Device and app information. Device model, operating system and version, app version, language and time zone, screen size, and a randomly generated identifier for your installation. We do not collect your device's advertising identifier.
Usage information. Which screens you view and which features you use, when the app is opened, how long actions take, and similar interaction events, collected through Firebase Analytics. We use this to understand how the Service is used and to improve it. It is never used for advertising.
Diagnostics. If the app crashes or encounters an error, we receive a crash report through Firebase Crashlytics containing technical information about the state of the app and device at the time. Crash reports do not include your care logs.
Purchase status. Whether you have a Lifetime purchase, an active trial or a Monthly subscription, the plan, purchase and renewal dates, and whether a purchase was at the Founding price, provided to us by Apple, Google and our purchase service provider (RevenueCat). We do not receive or store your payment card number.
Approximate location. We do not collect precise location. We may infer your country or region from your device settings or app store to show the right price, language and legal terms.

2.3 Information from third parties

We receive account details from Apple or Google when you use their sign-in, and purchase confirmations from Apple's App Store or Google Play when you subscribe. We do not buy data about you from data brokers, and we do not combine your PandaMama information with data from other companies.

3. Voice logging and Siri

Voice logging is designed to keep your words on your device wherever possible.

Speech recognition is performed by the speech features built into iOS or Android, on your device wherever your phone supports it. On some phones the operating system's speech service, provided by Apple or Google, may process the audio under its own privacy terms, which we do not control. We never receive, store or send audio recordings.
The recognized text is first interpreted by a rule-based parser that runs on your device. In most cases this is the end of the process and nothing leaves your phone except the resulting log entry.
If the on-device parser cannot understand a phrase, nothing is sent anywhere. The app tells you it did not understand and you can log the entry by tapping instead.
If you use Siri or Shortcuts, Apple processes your request according to Apple's privacy terms, and the Service receives only the resulting command (for example "start left side"). Apple may send certain Siri requests to Apple servers under its own policies, which we do not control.

The care logs you keep in PandaMama, such as feeding, diaper, sleep and growth entries, relate to the health and bodily functions of your baby. Some laws treat this kind of information as health information or sensitive personal information. We treat it with corresponding care:

We use it only to provide the Service to you and your family, to show your own history and summaries, to generate reports you request, and to keep the Service running securely and reliably.
We do not use it for advertising or marketing, we do not sell it, and we do not share it with anyone outside the family you create except the service providers who store and process it on our behalf under contract (Section 6).
We do not use it to make inferences about you or your baby beyond the totals, averages and reminders you can see in the app.
PandaMama is not a healthcare provider and is not subject to HIPAA. The Service does not provide medical advice. Nothing in the Service replaces the advice of your pediatrician or other healthcare professional.

If you live in Washington, Nevada or Connecticut, please also read Section 15, our Consumer Health Data Privacy Notice.

5. How we use information

We use the information described above to:

create and secure your account and let your family share one log;
record, store, sync and display your care logs across your family's devices;
show summaries, next-side reminders, estimates and the pediatrician report you request;
send the notifications you have turned on (a feed reminder at the interval you choose, a reminder before your free trial converts to a paid subscription, and service messages such as a security alert or a change to these terms). We do not send marketing notifications;
process your purchase or subscription through Apple or Google and know which features to unlock;
respond when you contact us;
understand how the Service is used, fix bugs, and improve it;
detect, investigate and prevent abuse, fraud and security incidents;
comply with law and enforce our Terms of Service.

We may use aggregated or de-identified information, which cannot reasonably be used to identify you or your baby, for any purpose, including understanding typical usage patterns. We commit not to attempt to re-identify such information.

Where laws such as the GDPR or Mexico's Federal Law on the Protection of Personal Data Held by Private Parties apply, our legal bases are performance of our contract with you, your consent (for optional features such as growth tracking), our legitimate interests in operating and improving a secure service, and compliance with legal obligations.

We share information only in these situations:

With your family. Every caregiver you invite sees the same care log, baby profile and summaries, live, and can add, edit and delete entries. Their display name and last activity are visible to the rest of the family. Think carefully before inviting someone; you can remove a caregiver at any time in the Family tab.
With service providers who work for us. Companies that host and process data on our behalf, under contracts that restrict them to our instructions: Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Analytics and Crashlytics) for accounts, storage, sync and diagnostics; RevenueCat for purchase and subscription management; Apple and Google for sign-in and payment; and an email service provider for transactional email. We list the providers in use at pandamama.app/privacy.
With Apple and Google as platforms. Through their app stores, sign-in, notifications, Siri, widgets and Live Activities, subject to their own privacy policies.
For legal reasons. If we believe in good faith that disclosure is required by law, subpoena or court order, or is necessary to protect the rights, property or safety of PandaMama, our users or the public. Where legally permitted, we will try to notify you first.
In a business transfer. If we are involved in a merger, acquisition, financing, reorganization or sale of assets, your information may be transferred as part of that transaction. We will require the recipient to honor this Policy for information collected under it, and we will notify you of any change in ownership or in how your information is used.
With your direction or consent. For example when you export your data or share a report.

We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising as those terms are defined under California law. We have not done either in the preceding twelve months.

7. Your choices and rights

In the app, at any time:

Access and correct. Every entry and profile field can be viewed and edited.
Export. Settings, "Export my data" produces a complete copy of your family's care logs and profile in common formats (CSV and PDF). We built this so your records are always yours.
Delete. Settings, "Delete my account and data" permanently deletes your account and the entries you made, including from your family's shared log, and, if you are the family owner, your family's babies and logs. We will ask you to confirm twice. Deletion is completed within 30 days, and sooner in most cases. Backups are purged on their normal cycle within 90 days.
Notifications. Turn each reminder on or off in Settings, or at the operating system level.
Growth tracking. Simply do not enter it.

By contacting us (Section 14), you may also ask us to: confirm whether we process your personal information; give you a copy; correct it; delete it; restrict or object to certain processing; withdraw consent where processing is based on consent; or, where you have a right to it, receive it in a portable format. If you are in Mexico, these are your ARCO rights (access, rectification, cancellation and opposition). We will respond within the time required by applicable law, and within 45 days for requests under California law. We will verify your identity first, usually by asking you to confirm from the email on your account. You may designate an authorized agent to make a request on your behalf; we will ask for proof of that authorization.

We will never discriminate against you for exercising a privacy right.

If you believe we have not resolved a concern, you may have the right to lodge a complaint with a supervisory authority where you live.

8. Do Not Track and Global Privacy Control

The Service does not track you across other companies' apps or websites, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We honor such signals as an opt-out of any sale or sharing, which we do not do in any case.

9. Children

PandaMama is for adults caring for babies. We do not knowingly allow anyone under 18 to create an account, and we do not knowingly collect personal information directly from children under 13.

The Service does hold information about children, because that is what it is for: parents and caregivers record their baby's name, birth date, feeding, sleep and diaper details. That information is provided by the adult, belongs to the family, is used only to provide the Service to that family, and can be exported or deleted by the family owner at any time. It is never used for advertising and never sold.

If you believe a child under 13 has created an account, or that we have collected information from a child in a way not described here, please contact us and we will delete it promptly.

10. Retention

We keep your account and care logs for as long as your account exists, because a baby's history is the point of the Service. If a subscription or trial ends without a purchase, your history remains readable and exportable. When you delete your account, or ask us to, we delete it as described in Section 7. We may keep limited records where the law requires it (for example purchase records for tax purposes) or where necessary to resolve disputes, prevent abuse or enforce our agreements, and we keep those only as long as needed for that purpose. Analytics and crash data are retained in aggregated form and are deleted or de-identified on a rolling basis.

11. Security

We protect your information with measures appropriate to its sensitivity, including encryption in transit (TLS) and at rest, access controls and audit logging on our systems, authentication through Apple, Google or verified email, security rules that prevent any account from reading another family's data, and regular review of the third parties we rely on. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you and any regulator as required by law, including California Civil Code section 1798.82.

You can help by keeping your device locked, using sign in with Apple or Google, and inviting only people you trust to your family.

12. Where your information is stored

We are based in the United States and our service providers store and process information in the United States. If you use the Service from outside the United States, including from Mexico or elsewhere in Latin America, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live. By using the Service you consent to this transfer. Where required, we use contractual safeguards with our service providers.

13. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will tell you in the app or by email before it takes effect and, where required by law, ask for your consent. The "Last updated" date at the top shows when it last changed. Continued use after the change takes effect means you accept the updated Policy.

14. How to contact us

Polanco Capital Partners of America Attn: PandaMama Privacy 530 Technology Drive #100 Irvine, California 92618 United States Email: hello@pandamama.app

We read every message.

15. Consumer Health Data Privacy Notice (Washington, Nevada and Connecticut residents)

This notice supplements the Policy for residents of Washington, Nevada and Connecticut under those states' consumer health data laws. It is provided with a separate link in the app and at pandamama.app/health-privacy.

Consumer health data we collect. The care logs described in Section 2.1: breastfeeding, bottle, pumping, diaper, sleep and optional growth entries, and notes attached to them, about the baby in your care; and your feeding-method selection.

Sources. You and the caregivers in your family, through the app, including by voice.

Why we collect it. To provide the Service: recording, syncing and displaying your family's care log, calculating summaries and reminders, and generating reports you request. For no other purpose.

How we use it. Only as stated above, and to keep the Service secure and reliable.

Sharing. With the caregivers in your family; with the service providers listed in Section 6 that process it on our behalf under contract; and as required by law. We do not sell consumer health data, and we do not share it with advertisers. A list of the third parties with whom we share consumer health data is available in Section 6 and at pandamama.app/privacy.

Your rights. You may access, withdraw consent for the collection and sharing of, and delete your consumer health data, using the in-app controls in Section 7 or by contacting us at hello@pandamama.app. We will respond within 45 days. If we deny a request, you may appeal by replying to our response; we will respond to appeals within 45 days and tell you how to contact the Washington Attorney General or your state's attorney general if you are not satisfied.

16. Notice to California residents

This section supplements the Policy for California residents. In the preceding twelve months we have collected the following categories of personal information, as defined by the California Consumer Privacy Act: identifiers (email, name, account and device identifiers); personal information described in California Civil Code section 1798.80 (name); commercial information (purchase and subscription status and history, not card numbers); internet or electronic network activity (app usage and diagnostics); sensory information (voice input processed on device and not retained by us); inferences limited to the totals and reminders shown in the app; and sensitive personal information consisting of information about the health of the child in your care, which we use only to provide the Service, as permitted by section 7027(m) of the CCPA regulations. Sources, purposes and sharing are as described in Sections 2, 5 and 6. We do not sell or share personal information and have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16. You have the rights to know, delete, correct, and limit use of sensitive personal information, and the right not to be discriminated against, as described in Section 7. To exercise them, use the in-app controls or contact us as described in Section 14.

Privacy Policy