Giggle & Grow

Privacy policy

Last updated 10 November 2026

The short version

Everything you log in Giggle & Grow stays on your phone. There's no account, and we can't see your baby's details, meals, allergens, reactions, photos or videos. Your diary is never sent to us.

A few things do leave your phone, and only for these reasons:

Who we are

Giggle & Grow is made by [trader name], [UK address]. If you have a question about this policy, email hello@giggleandgrow.co.uk.

What the app keeps, and where

Everything below stays on your phone, except where a section says otherwise: if you share the diary with your partner (iPhone, Plus), it is also kept in iCloud (see Sharing with your partner), and AI answers send only your question (see AI answers).

Checking a product

When you scan or type a barcode in "Check a product", the app sends only that barcode number, and the language the app is set to, to Open Food Facts, a free food database run by a French non-profit, to look up the product. It sends nothing about you or your baby, and no cookies. Like any website, Open Food Facts receives your phone's IP address with the request. The app keeps a short list of the products you've checked (the barcode and product name, up to 20) on your phone, so you can look one up again. You can clear it from the Check a product screen, and it's included in your backups.

The camera picture used to read a barcode is only looked at on your phone. It's never recorded, saved or sent. On iPhone, reading an ingredients label with the camera also happens only on your phone: the words it reads are checked for allergens there and never saved or sent.

Wear OS watch (Android)

The Android app comes with a Giggle & Grow app for Wear OS watches. After each change, the phone app gives a small summary to Google Play services on your phone, which passes it to watches paired with your phone. The summary holds your baby's first name, your country's emergency number, the choking steps and the words the watch shows. With Plus, it also holds the next allergen to try and how many foods and allergens have been tried. It holds nothing about meals, reactions or notes. It also holds the start time of a feed, sleep or contraction timer that's running. With Plus, it holds the time of the last feed, and the watch has one-tap buttons for your stage, such as a period starting, folic acid, a feed or a nappy. What you tap goes back to your phone the same way and joins your diary when you next open the app.

It only goes to your own devices, never to us. Google Play services usually sends it straight from your phone to your watch. When they aren't connected directly, Google may carry it through its own servers to reach your watch, under your Google account and Google's privacy policy. If no watch is paired, it stays on your phone. The watch shows your baby's first name, so anyone who can see your watch may see it. While you're trying for a baby, the watch shows a 'Log a period' button, so anyone who sees your watch may guess.

To remove it, uninstall Giggle & Grow from your watch. Settings → Delete everything on your phone also clears it.

Apple Watch (iPhone)

The iPhone app comes with a Giggle & Grow app for Apple Watch. After each change, the phone app gives the watch the same small summary as the Wear OS watch gets (see above), using Apple's own link between a paired iPhone and Apple Watch. With Plus, the watch has one-tap buttons for your stage, such as a period starting, folic acid, a feed or a nappy. What you tap goes back to your iPhone the same way and joins your diary when you next open the app. With Plus, the Apple Watch summary also holds the time of the last feed and, while a feed, sleep or contraction timer is running, the time it started, so the watch can show them counting up. It never holds what was fed or how much. While you're expecting, it also holds the maternity unit number you saved, for a call button on the watch.

It only goes between your own iPhone and watch, never to us. Apple carries it under Apple's privacy policy. The watch shows your baby's first name, so anyone who can see your watch may see it. While you're trying for a baby, the watch shows a 'Log a period' button, so anyone who sees your watch may guess. To remove it, delete Giggle & Grow from your watch.

Sharing with your partner (iPhone)

With Plus on iPhone, you can share the diary with the other parent's iPhone from Settings → Share with your partner. It uses Apple's iCloud sharing: the diary is kept in the iCloud account of the parent who starts the share, and Apple lets only the people that parent invites see and change it. Each parent signs in with their own Apple ID. We have no account, server or copy, so we never see it. Photos and videos aren't shared; they stay on each phone.

Apple stores it under Apple's privacy policy. To stop, tap Stop sharing (or Leave the shared diary on the other phone). Each phone keeps its own copy. To remove the shared copy from iCloud too, go to the iPhone Settings app → your name → iCloud → Manage storage → Giggle & Grow.

Family feed (iPhone)

With Plus on iPhone, you can post chosen photos and a few words to a private family feed from Settings → Family and friends, and invite grandparents and family to look at it. It uses Apple's iCloud sharing, in the same way as the shared diary: the posts are kept in your own iCloud account, and Apple lets only the people you invite see them. They can look but can't post, change or comment. Your diary is never part of the feed. We have no account, server or copy, so we never see it. You decide what goes in. Anyone you invite can save or screenshot what they see, so only post what you're happy to share.

To remove a post, tap Delete post. To end the feed, tap Stop the family feed: every post is deleted from iCloud and family can no longer see it. Family can leave at any time. While loss support has paused updates, nothing can be posted and family see only that updates are paused. "Meet other parents" on the same screen is a list of links to charities and public services; we don't run those groups, and the app shares nothing with them.

Adverts and shop links marked Ad

The free phone app shows one small Google AdMob banner at the bottom of Memories, the meal plan and Settings, and nowhere near health information. Plus removes it. The website shows no Google ads.

The ads are never personalised. The app asks Google only for non-personalised ads and never shows Apple's tracking prompt. The only thing the app itself tells Google is the topic of the page (for example "baby keepsakes"), so the ad matches the page, not you. Nothing from your diary is ever shared. To show and count an ad, Google's software receives what any ad needs: your device and app details (an app-specific identifier on iPhone; on Android the app has no access to your phone's advertising ID), your IP address (from which an approximate location can be worked out) and whether you tapped the ad. Google uses this under its own policies to deliver and measure the ad and to prevent fraud (see how Google uses information from apps that use its services). In the UK and EU, Google's consent message asks you first, and you can change your choice at any time in Settings, Ad privacy choices. The legal basis is your consent where the law needs it, and otherwise our legitimate interest in paying for the free app. Adverts for formula, bottles and teats, health products, dating, gambling and alcohol are blocked.

The baby buying list and the kit lists also show small shop links marked Ad. Each one opens a search on a shop's website (Amazon) for a baby item that suits your stage, for example a pregnancy item while you're expecting. Sometimes a brand books the card space on Memories, the plan or Settings directly; its card is marked Ad and is a plain link with no tracking.

Nothing is sent until you tap a link. When you do, the shop learns which search you opened and that you came from Giggle & Grow (our shop tag), so we may earn a commission if you buy. Because the item is picked for your stage, the search can hint at your situation, for example that you're expecting. The link never carries your baby's name or anything else from your diary, and the app uses no cookies or tracking to show these links. Once you're on the shop's website, its own privacy policy and cookies apply.

Buying Plus

Plus is bought through Apple's App Store on iPhone, or Google Play on Android. They handle the payment and your account under Apple's privacy policy or Google's privacy policy. We don't receive your name, email or card details, only sales totals and the anonymous purchase records described below. Plus is a monthly, six-month or yearly subscription, or a 9-month pregnancy plan that doesn't renew. The app asks the store whether you have Plus on your account and, for a subscription, whether it is active and when it renews or ends. That check stays between your phone and the store. Payment, renewals and cancelling are all handled by Apple or Google, in your App Store or Google Play account. We never see your card details.

RevenueCat. In the phone app, a copy of each store purchase record goes to RevenueCat, Inc. (USA), which works for us as a processor. It lets us offer things like the switch to yearly, which Apple requires to be signed by a server, and shows us subscription numbers. RevenueCat gets a random id made by the app, the product, price, currency, country and dates of each purchase, and the store's receipt or purchase token. It never gets your name, email, card details or anything from your diary, and the id isn't linked to you. Transfers to the USA are covered by the EU-US Data Privacy Framework and the UK extension, or standard contractual clauses. See RevenueCat's privacy policy. Our lawful basis is legitimate interests (running Plus subscriptions and knowing how many people have them).

Quick answers and AI answers

Quick answers first look in the app's own guides on your phone. Nothing leaves your phone for that.

With Plus, you can also use AI answers. They're off until you agree on a screen that explains it, and you can turn it off again in Settings. When you ask, the app sends: your question (with your child's name, email addresses and phone numbers taken out first), the app's language, your country, the stage (trying, pregnancy, baby, weaning or toddler), your child's age in months or your week of pregnancy, and the random id RevenueCat made for the app (see Buying Plus), so we can check you have Plus. Your diary, photos and notes are never sent.

The question goes to our small server run on Cloudflare, Inc. (USA), which passes the question and its context, but not the id, to Anthropic, PBC (USA), whose AI model writes the answer. Both work for us as processors. We don't store questions or answers. The server only keeps counts of questions per day and month against a scrambled (hashed) copy of the id, for up to 32 days, to keep the daily limit fair. It also remembers, for up to 6 hours, whether that scrambled id has Plus, so it doesn't have to ask RevenueCat every time. Cloudflare receives your phone's IP address with the request, like any website. Anthropic keeps questions only for a limited time under its commercial terms and doesn't use them to train its AI.

Plate photo check (Plus, in Family meal time): if you choose to check a photo of your child’s plate, the app first makes the photo small on your phone, then sends it the same way as a question, with the meal name and the same context. It’s used only to write that answer: our server doesn’t keep it, the app doesn’t save it, and Anthropic handles it as it handles questions. Please photograph only the food.

Questions can be about your health or your child's, which is special category data, so we only send them with your explicit consent (UK GDPR and EU GDPR Articles 6(1)(a) and 9(2)(a)). You can withdraw it at any time in Settings. Transfers to the USA are covered by the EU-US Data Privacy Framework and the UK extension, or standard contractual clauses with the UK addendum.

AI answers are clearly marked as written by AI. They can be wrong, and they aren't medical advice. The app never sends emergencies, symptoms, medicines or questions about fertile days to the AI: it shows the emergency number, the app's own first aid steps or who to ask instead.

Gift lists

Your baby list stays on your phone until you choose to share it as a gift list. Before you share, the app shows exactly what goes on it: the title you typed, item names, how many, which are must-haves, section headings and any shop links you added. Never your child's name, dates, photos, private notes or anything from your diary.

A gift list can travel in two ways. A link-only list is written into the link itself, after the # sign, which browsers never send to a server, so we never receive it. A live list is kept on our small server run on Cloudflare, Inc. (USA), as our processor, so guests can see which presents are already taken and you can stop sharing at once. The server stores only the list described above, a scrambled copy of the secret that lets your phone change or delete it, and which items a guest has picked, against a scrambled copy of a random id made in the guest's browser. It doesn't store names or email addresses, and keeps no logs. To stop misuse, the server keeps a scrambled (hashed) copy of the IP address of a device that uses it, for up to 2 days. A live list is deleted as soon as you stop sharing, and otherwise at its end date (at most 6 months). Cloudflare receives the IP address of each phone or browser that opens it, like any website.

Anyone you send the link to, and anyone they forward it to, can see the list. Guests' picks are kept in their own browser. Our lawful basis is performing the service you asked for (UK GDPR and EU GDPR Article 6(1)(b)) and, for guests, our legitimate interest in letting them mark a present (Article 6(1)(f)). Transfers to the USA are covered by the EU-US Data Privacy Framework and the UK extension, or standard contractual clauses.

Baby shower guest page

If you make a guest page for a baby shower, the details you type (a name for the shower, the date, a time, an optional message to guests, your country, and which parts of the page are switched on; never the address, which stays on your printed invite) are kept on the same server run on Cloudflare, Inc. (USA), as our processor, with a scrambled copy of the secret that lets your phone read and delete it. Guests who open it from the QR code or link can tell you whether they're coming, under the name they type and how many of them, and can send you photos from the day. Photos are made smaller in the guest's browser first, which also removes hidden details such as where a photo was taken.

Only your phone can see the replies and photos: guests never see each other's. A photo is deleted from the server as soon as you save it to your app. Everything else is deleted when you stop sharing, when you use "Delete all data", and otherwise 30 days after the shower. We don't store email addresses and keep no logs. To stop misuse, the server keeps a scrambled (hashed) copy of the IP address of a device that uses it, for up to 2 days. Our lawful basis is performing the service you asked for (Article 6(1)(b)) and, for guests, our legitimate interest in passing their reply and photos to you (Article 6(1)(f)). Guests should only send photos the people in them are happy to share. Gift ideas on the page (shown only if you switch them on and have no gift list) may be affiliate links marked Ad, which open the shop's own site; the page adds no tracking of its own. The "Add to calendar" file is made in the guest's own browser. Transfers to the USA are covered as above.

Print designer

Our print designer (design.html, also opened from the app) keeps your design and the photos you add on your own device, in your browser's storage, until you choose otherwise. You can remove photos from it at any time.

If you ask for an order code, your design and the photos in it are sent to our small server run on Cloudflare, Inc. (USA), as our processor, so the print shop can make your order. Photos are made smaller and saved as new JPEG files first, which also removes hidden details such as where a photo was taken. The server keeps the design, its photos, a scrambled copy of the secret that lets your browser delete it, and the date. It doesn't store your name or email address, and keeps no logs. To stop misuse, the server keeps a scrambled (hashed) copy of the IP address of a device that uses it, for up to 2 days. Everything is deleted by itself after 90 days, or straight away if you choose "Delete my design and photos now". The order code alone doesn't open your design: only we can, with a separate key, and the print files can only be fetched by our print partner through a signed link.

Your design may show people's names and faces, including your child's. Only use photos you're happy to have printed. Our lawful basis is performing the service you asked for (UK GDPR and EU GDPR Article 6(1)(b)). Transfers to the USA are covered by the EU-US Data Privacy Framework and the UK extension, or standard contractual clauses. Your Etsy order itself is handled under Etsy's own privacy policy.

Printing and delivery. When you order on Etsy with your code, Etsy passes us your order: what you bought, your name and your delivery address. We send that, with the link to your print files, straight to our print partner (Gelato, Norway, Prodigi, UK, or Printify, USA, depending on the product), who prints your order and posts it to you. We don't keep your name or address: our server keeps only the order number, the order code it used and the date, for 180 days, so the same order is never printed twice. Your email address is not passed on; Etsy tells you when your order is on its way. When our print partner posts it, we keep the carrier and tracking number with your design (never your name or address), so the designer on your phone can show how your order is getting on; they're deleted with the design after 90 days. Our print partner keeps the delivery details under its own privacy policy. Our lawful basis is performing your order (Article 6(1)(b)).

This website

The website is hosted by Netlify. Like any web host, Netlify keeps short-term server logs, including IP addresses, to run and protect the site. Netlify is a US company, so these logs may be handled in the United States, protected by the standard data protection clauses in Netlify's data processing terms. The legal basis is our legitimate interest in keeping the website running and secure. The website uses no cookies and no analytics. If you use the web version of the app, your diary is kept in your browser on your phone, not on the website.

If you email us

We use your email address and message only to reply and to fix any problem you report. We keep the conversation for up to 12 months, then delete it. The legal basis is our legitimate interest in answering you. Please don't send us health details you don't need to.

Deleting your information

In the app, go to Settings → Delete everything, or delete the app. That removes the diary, photos, videos and reminders from your phone. Delete everything also clears the summary on a paired Wear OS watch. Backup files you've saved are yours to delete. To have support emails deleted sooner, ask us. If you share the diary with your partner, Delete everything first leaves the shared diary, so the other parent keeps their copy. To remove the shared copy from iCloud, see Sharing with your partner.

Your rights

Under UK and EU data protection law you can ask to see, correct, delete or receive a copy of personal information we hold about you, or ask us to limit how we use it, and you can object to how we use it. The only information we could hold is support emails, the short-lived daily counts kept for AI answers (see AI answers), the purchase records RevenueCat keeps for us (see Buying Plus), a gift list you share as a live list (see Gift lists), a baby shower guest page with its replies and photos (see Baby shower), and a design you send for a print order with the short record of that order (see Print designer). We can't link any of these to your name. If you live in Australia, the Privacy Act 1988 and the Australian Privacy Principles give you similar rights. In New Zealand, it's the Privacy Act 2020. In Canada, it's the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector, as updated by Law 25.

The person responsible for the protection of personal information, including under Quebec's Law 25, is [contact name], at hello@giggleandgrow.co.uk. We're based in the UK, so support emails are handled in the UK. The website's server logs may be handled in the United States (see This website). In Australia and New Zealand, please contact us first. If you're not happy with our answer, you can then complain to the regulator.

If you're unhappy with how we've handled your information, you can complain to a data protection authority, in particular the one where you live, where you work or where you think the problem happened. In the countries Giggle & Grow is offered in, these are:

If you live in another EU country, you can complain to your own country's data protection authority.

Changes

If this policy changes, the new version will be here with a new date. We'll never start collecting your diary without asking you first.

Help and support · Open Giggle & Grow · Open-source licences · Impressum

English · Deutsch · Français · Nederlands · Svenska