Privacy Policy

Last updated: 16 July 2026

1. Who we are

moppet is a multi-caregiver baby-tracking app. The data controller is Roebling Foundry LLC, a limited liability company registered in New York, United States. If you have any question about your data or this policy, contact us at privacy@mymoppet.com.

Our representative in Europe. Because we are based outside Europe, we have appointed DataRep (a trading name of Data Protection Representative Limited, 77 Camden Street Lower, Dublin, D02 XE80, Ireland) as our data protection representative in the European Union and EEA under Article 27 of the GDPR, in the United Kingdom under Article 27 of the UK GDPR, and in Switzerland under Article 14 of the Swiss FADP. If you are in one of those places, you can raise any question about your data or exercise your rights through DataRep by emailing datarequest@datarep.com with "moppet" in the subject line, by using the web form at www.datarep.com/data-request, or by writing to DataRep at any of their locations across the EU, EEA, UK, and Switzerland. If you write by post, mark your letter for "DataRep", not moppet, or it may not reach them. Contacting DataRep does not limit your right to contact us directly at privacy@mymoppet.com, or to complain to your data protection authority.

2. What this covers

This policy explains what personal data moppet processes, why, where it is stored, and the rights you have.

3. The data we process

You give us:

• Account data: your email address (or, if you use Sign in with Apple, the private relay address Apple provides) and the display name you choose for your household.
• The information you log about your child: the child's name, date of birth, sex (optional), and the care entries you record, such as feeds, diapers, sleep, nursing and pumping, solids, growth measurements, temperature, medications, milestones, and any free-text notes. Some of this is health-related information about your child, which is treated as sensitive (see section 5).

Created automatically:

• A login session token so you stay signed in. That is it.

What we deliberately do not do: moppet contains no analytics, no advertising identifiers, no third-party trackers, and no cookies for tracking. We do not build profiles of you and we do not sell or share your data with anyone for their own purposes.

4. Why we process it, and our legal basis (GDPR Article 6)

• To provide the service: create your household, sync entries across caregivers, show reminders. Legal basis: performance of a contract (Art. 6(1)(b)).
• To keep the service secure and prevent abuse. Legal basis: our legitimate interests (Art. 6(1)(f)).

5. Sensitive data about your child (GDPR Article 9)

Some entries (for example temperature, medication, health notes, growth) may be health data about your child. Where that is the case, we rely on your explicit consent (Art. 9(2)(a)), which you give by choosing to record it. You can delete any entry, or your whole account, at any time (see section 8).

6. Who processes your data, and where it is stored

We use a small number of processors who act only on our instructions:

Note translation. When a caregiver opens a note written in a language other than their own, the note text is sent to DeepL to translate it on demand, and the translation is cached so this happens only once per note. DeepL processes the text only to perform the translation, under our agreement (paid API and Data Processing Addendum), and it does not use your text to train its models. DeepL is in the EU. If your household is single-language, no note is ever sent for translation.

Medication help. When you use the medication feature, the instruction you type or the photo of a medicine label you add is sent to Anthropic's Claude model, which reads the details into a schedule for you. Claude is also used as a fallback to translate a note when DeepL does not cover the language. Anthropic processes this text only to perform the task, under its commercial terms, and does not use it to train its models. Anthropic is in the United States.

Where your data is stored. Your household and child records are stored in the EU (Supabase, in Frankfurt, Germany). Two features send specific text elsewhere: translation (DeepL, in the EU) and medication reading with translation fallback (Anthropic, in the US). Apart from those, the baby-care data you log is not transferred outside the EU or EEA. App builds and over-the-air updates run through Expo and EAS in the US, which handle the app itself, not your household's care data. The mymoppet.com web address is served by Vercel (US), which delivers the app interface but does not store or access your household data. If you buy a subscription, Apple processes the payment and RevenueCat (US) manages the subscription's status, and neither ever receives your child's care data. These processors act only on our instructions. We do not sell or share your data, and we use no one else.

7. How long we keep it

We keep your data for as long as your account is active. When you delete your account (Settings, then Delete account), we remove it from our live systems straight away, and it stops being visible to you or any caregiver at once. Copies can remain for a short time in our hosting provider's encrypted daily backups, which roll off within 7 days. A household that only you belong to is deleted along with all its entries. Co-caregivers' households remain with them.

8. Your rights

Under the GDPR you have the right to:

• Access the data we hold about you.
• Rectify inaccurate data. You can edit entries and your profile in the app.
• Erase your data. Settings, then Delete account, removes it from our live systems immediately (see section 7 for backups).
• Port your data. Settings, then Export, gives you a CSV of every entry.
• Restrict or object to processing, and to withdraw consent at any time.
• Lodge a complaint with your data protection authority, for example Datatilsynet in Denmark or the CNIL in France.

To exercise any right that cannot be done in-app, email privacy@mymoppet.com.

9. Security

Your data is protected by row-level security (each household can only see its own data) and is encrypted in transit. Access ends immediately when a caregiver is removed.

10. Children and your child's data

moppet is used by adult caregivers to record information about their own child. It is not intended for use by children, we do not market it to children, and we do not knowingly allow children to create accounts. If we learn that a child under 13 has created an account, we will delete it.

Your child's records belong to you. Everything moppet holds about your child is entered by you (or a caregiver you invited), and you stay in control of it. You can edit or delete any entry, export everything as a CSV, and delete the whole account at any time (sections 7 and 8). We use your child's information only to provide the app to your household, never for advertising, profiling, or sale, and there are no third-party trackers (section 3).

For US families: moppet is a service for adults and is not directed to children under 13. We do not collect personal information from children. The information you record about your child is provided by you, the parent or caregiver, and is handled as described in this policy.

For EU families: your child's health-related entries are special-category data processed with your explicit consent, as described in section 5, and stored in the EU (section 6).

11. Changes

We will update this policy as moppet evolves and change the "Last updated" date above. For material changes we will let you know in the app or by email.

12. Contact

moppet is a product of Roebling Foundry LLC (New York, United States). Privacy contact: privacy@mymoppet.com. In the EU, EEA, UK, or Switzerland you can also contact our representative, DataRep (see section 1).