Last updated: 3 November 2026 · Back to Better Baby Book
Better Baby Book stores child records on your device. Optional family sync encrypts child content before upload. Account and family metadata are separate from that encryption. This notice explains these differences and the limits of deletion.
1. Controller and scope
The controller for Better Baby Book is Cyril Blum, contact: apps@cblum.ch, cblum.ch. This notice covers the app and its default family-sync service. A server you configure yourself, your email service and destinations you choose for exports may process information under their own policies.
2. Local records and permissions
The app stores child profiles, names, dates, milestones, notes, growth and everyday logs, quotes, nicknames, selected photos and optional recordings in its local app storage. It does not apply its family-sync encryption to local files. Device protection and any device or cloud backups you enable are separate.
You can use local features without a sync account. Photos are imported when you select them. The updated app stores photos added to entries as JPEG images with the longer side reduced to at most 2560 pixels; camera metadata such as location is not kept in that copy. Microphone access is requested for optional recordings. Import and export use files and destinations you choose.
3. Optional sync and encryption
Family sync uploads selected child bundles encrypted on your device with AES-256-GCM. The key is derived locally from your family passphrase and family identifier; current app versions stretch the passphrase with PBKDF2 (600,000 iterations) before deriving the key, which makes guessing weak passphrases slower but does not make them safe. Inspected sync requests do not transmit the family passphrase. Anyone with the required family access and passphrase can decrypt shared content.
Supported content includes profiles, events, logs, profile and nickname photos, nickname audio recordings and event media. Older app versions did not include nickname audio recordings; those devices may show a recording reference without the file. Encryption does not make a weak or disclosed passphrase safe. New families require a longer passphrase; the operator cannot recover or reset it.
On the device, the updated app keeps the sign-in session and family passphrases in the iOS Keychain instead of the app’s general settings. Keychain items can be included in encrypted device backups.
Account information and family/sync metadata are not inside the encrypted child bundle. These include username, email, password hash, account and family identifiers, family name, invitation code, membership, child identifiers, content hashes, versions, timestamps and deletion markers. Passwords are submitted for registration/login; the server stores salted password hashes.
The default service is hosted on the operator’s Hetzner server in Germany. Hosting infrastructure processes connection information such as IP addresses and request times. A custom server may be hosted elsewhere.
4. Purposes and recipients
Local data supports the journal, charts, search and exports. Account and sync information supports authentication, family membership and delivery of shared records. Family participants receive content you share. Hosting providers process information needed to operate the service.
The inspected app contains no advertising or analytics SDK. We do not use app content for advertising or sell it to data brokers. This does not mean that online services operate without technical connection data.
5. Exports and feedback
PDF, ZIP, JSON and CSV exports are not encrypted by the family-sync mechanism. Copies sent to other people or storage providers are outside the app’s control. Exports include available media; a missing file cannot be included.
Feedback opens an email draft to apps@cblum.ch. You choose whether to send it. Your text, optional contact details and any selected diagnostic details are processed through your email provider and the receiving mail service. They are separate from encrypted sync. Do not include sensitive child information unless necessary.
6. Retention, deletion and logout
Sync records have no automatic expiry based on inactivity. The updated service removes a child’s encrypted payload when it confirms an authenticated deletion for that family. A minimal marker containing the family/child identifiers, deletion time and version remains to prevent an offline device from uploading the deleted record again.
The updated app requests server confirmation before deleting a shared profile locally. If confirmation fails, it reports the error and keeps that local profile so you can retry explicitly. The server requires an explicit deletion confirmation from the updated client; automatic duplicate cleanup and ambiguous deletion markers from older versions do not authorize server erasure. Updated devices apply server deletion markers when they next sync. These protections require the updated app build. Old or offline devices, exports and manually shared copies can retain data.
Removing a local profile or resetting local data is not a guarantee that every residual media file, device backup or independent copy has been erased. Unsharing and logging out do not delete the server’s copy. Logout clears the app’s saved active session and family passphrases; you will need your passphrase again to decrypt shared content after signing in.
Account deletion. In the updated app you can delete your sync account under Family Sync after re-entering your password and confirming explicitly. The server then deletes your username, email address, password hash and family membership. Shared child content belongs to the family, not to the member who uploaded it: if other members remain, the family and its encrypted child bundles stay available to them and the invitation code is renewed. If you are the last member, the family record, all of its encrypted child bundles and its deletion markers are deleted as well. To remove a shared child for everyone, delete that child explicitly before deleting your account.
Leaving or switching a family. The same rule applies when you leave a family in the updated app or switch your account to another family: if other members remain, they keep the family and its encrypted bundles and the invitation code is renewed; if you are the last member, the server deletes the family, its encrypted bundles and deletion markers after you confirm this explicitly. Your account itself remains. Any member can renew the invitation code; the previous code then stops working. A renewed code does not remove existing members, and anyone who knows the family passphrase can still decrypt content shared before.
Deleting a family group. In the updated app any member can delete the whole family group after re-entering their account password and confirming explicitly. The server then removes the family record, every membership, the invitation code and all encrypted child bundles and deletion markers of that family, including children shared by other members. All member accounts remain. Other members’ devices keep their local copies as unshared data and stop syncing for that family at their next sync. Leaving a family in the updated app also asks for your account password.
After account deletion the app removes the session and family passphrases from your device. Child data on your device remains as unshared local data unless you also choose to erase all app data on the device. Account deletion does not remove copies on other members’ devices, exports, emails, or device and cloud backups. Signing out alone does not delete your account. For other access, correction or deletion requests, contact apps@cblum.ch.
Server backups. The server that holds the sync database is backed up every night to storage operated by us in Switzerland. The backups contain the same data as the database: account and family metadata, and child content that remains encrypted with your family passphrase. We do not add our own encryption to these backups. Older backups are deleted automatically, so data deleted from the service can remain in backups for up to about 4 months. If we have to restore a backup, we re-apply deletions made after its date where this is feasible.
7. Your choices and rights
You can use the app locally, choose which children to share, manage device permissions and control your exports. For requests concerning personal data or a question about retention and recipients, contact apps@cblum.ch. Rights of access, correction and deletion apply subject to applicable Swiss data protection law and, where applicable, other data protection law. You may contact the competent data protection authority.
8. Medical information
The app records information and displays reference views. Growth charts use percentile values transcribed from the WHO Child Growth Standards for ages 0–36 months; values between whole months are approximated. The app does not diagnose medical conditions or provide a validated assessment of growth or health. Consult qualified medical professionals about health concerns; contact local emergency services in an emergency.