Privacy Policy (Draft)

Who we are

BumpTribe (“we”, “us”) provides a free, private pregnancy and parenting platform at bumptribe.co. For UK/EU data protection law, we are the “data controller” of the personal data described here. Our contact point for privacy questions is hello@bumptribe.co.

The data we collect

We keep collection to the minimum a feature genuinely needs.

Account data: your email address and a password (stored only as a secure hash), or a Google sign-in identifier if you use Google to sign in. An optional display name and profile photo.
Profile & preferences: your journey stage (trying to conceive, pregnant, or parenting), country, timezone, and your consent and privacy choices.
Health data (special category): only if you choose to use the relevant features — due date, last-period or conception dates, cycle length, any optional fertility-awareness notes you choose to add (basal body temperature and cervical-mucus observations), contraction and kick-counter sessions, and any children you add. This now also includes baby-tracking data: feeding, diaper and sleep logs, developmental milestones you mark, and a private journal of written memories and photos (including weekly bump photos and a first-year baby album). See our separate Consumer Health Data Privacy Policy.
Your child’s data: information you record about a child (name, dates, logs, milestones, journal entries and photos) is your child’s personal data. We collect the minimum a feature needs, use it only to provide the tools you choose, and never sell it or use it for advertising or profiling. You can share it only with people you invite (see below), and delete it at any time.
Sharing: if you invite a partner or family member, we store the invite (their email, the permission you granted, and its status) so they can access what you shared. You can change or revoke this at any time.
Content you save: guides and articles you bookmark.
Technical data: essential cookies for signing in, and — only with your consent — limited analytics. See our Cookie Notice.

We do not require your date of birth beyond confirming you meet our minimum age, and we do not collect precise location.

Why we use it, and our lawful bases (UK GDPR)

Under UK GDPR we must have a “lawful basis” for each use of your data:

Providing the service (your account, the tracker and tools) — Contract (Art. 6(1)(b)): we can’t provide these features without processing the data you give us.
Keeping the service secure and working (preventing abuse, fixing problems) — Legitimate interests (Art. 6(1)(f)).
Health data (pregnancy, fertility, cycle, children) — your explicit consent (Art. 9(2)(a)). We store nothing in this category until you have given explicit, opt-in consent, and you can withdraw it at any time.
Marketing emails — your consent (Art. 6(1)(a)), which is separate, opt-in, and never required to use BumpTribe.
Non-essential cookies/analytics — your consent (UK PECR), which you can change any time.

Community & your public profile

BumpTribe includes a community for adults (18+). If you take part, some information is visible to other members — please keep this in mind and don't share anything you want to keep private.

Your public profile is separate from your private account. If you create one, your chosen username, optional bio and profile photo are visible to others. It never includes your email, pregnancy, fertility, children, logs, due dates or location.
Community posts are public within BumpTribe. Threads, comments and reactions you make in groups are visible to other members (sensitive support groups are visible only to their members). Please treat what you post as public.
Blocking: you can block another member. You then no longer see each other's posts, comments or reactions, and they can't reply to your threads. The person is not told they've been blocked.
Reporting & moderation: you can report any post, comment or profile. Reports go privately to our moderators, who may remove content or warn, mute or ban an account. The person reported is never told who reported them. We also run automated checks (for banned words, spam and unsafe links) that may remove content or flag it for review. See our Community Guidelines and the child-safety reporting page.

Registries, shortlists, budgeting & shopping

Baby registry. Items you add are yours. If you turn on the public share link, anyone with the link can view that registry (read-only) — so only share it with people you choose.
Gift reservations. When someone reserves a gift on a public registry, they may optionally leave a name and email so the parents-to-be know who reserved it (they can also reserve anonymously). We use those details only to show the reservation to the registry owner and to let the giver cancel it — never for marketing. They are deleted with the registry. If you left a reservation and want it removed, contact us at hello@bumptribe.co.
Baby-name shortlist & budget plans. Your saved names and any budget plans you save are private to your account (you can privately share a shortlist with a partner if you choose). They are not health data, are included in your data export, and are deleted with your account.
Affiliate links & shopping. Some links on our registry, guides and budgeting pages are affiliate links— if you buy through them we may earn a small commission, at no extra cost to you. We disclose this clearly wherever such links appear. We do not share any of your data — and never any pregnancy, fertility or baby-health data — with advertisers or affiliate partners, and we don't use your data for ad targeting. See our Editorial & Medical Review Process for how we keep commerce separate from our guidance.

What we will never do

We never sell your personal information.
We never share your health data for advertising or third-party profiling.
We do not use your health data to target ads.
We do not claim to be “HIPAA compliant” — BumpTribe is a direct-to-consumer service and HIPAA does not apply to it.

Who we share data with

We share personal data only with service providers who help us run BumpTribe, under contracts that require them to protect it and use it only on our instructions:

Supabase — our database, authentication, and file storage provider.
Vercel — our hosting and content-delivery provider.

We may disclose data if required by valid legal process. We will require proper legal process, collect as little as possible so there is less to compel, and — where lawful — aim to be transparent about such requests.

International transfers

Our providers may process data in the United States and other countries outside the UK/EEA. Where data is transferred internationally, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses, together with any additional measures needed to protect your data. [The specific transfer mechanisms and provider regions are to be confirmed and documented by counsel — placeholder.]

How long we keep it (retention)

Account & profile: for as long as your account is open. When you delete your account, we delete it.
Pregnancy & fertility data (due date, cycle, contraction and kick logs): kept while you use the related feature and while your health-data consent is active. If you withdraw consent we stop processing it and offer to delete it.
Baby logs & milestones (feeding, diaper and sleep logs; milestones): kept for as long as your account is open, so your history is there when you want to look back — unless you delete them sooner.
Journal entries & photos: kept for as long as your account is open, or until you delete them. When you delete a photo, an entry, or your account, we remove the entry and delete the photo files from storage — we do not keep them afterwards.
Registries, name shortlists & budget plans: kept for as long as your account is open, or until you delete them. Gift reservations left by others are kept while that registry exists and are deleted with it (or when you delete your account).
Consent & rights records: kept as a minimal audit trail to demonstrate compliance. Deleting your account hard-deletes your consent records and revokes any access you shared.
Community content on deletion: when you delete your account we fully remove your public profile, your private and health data, your reactions and group memberships, and your personal identifiers. However, so we don't break conversations that other members are part of and rely on, the threads and comments you wrote may remain in an anonymised form — kept without your name or any link back to you, shown simply as written by a member. If a specific post needs to be removed entirely, contact us.

In every case you can delete individual items, or your whole account, at any time in Profile & settings, and we act on it immediately.

Your rights

Depending on where you live, you have some or all of these rights. You can exercise most of them yourself in Profile & settings:

Access — get a copy of your data (self-serve export).
Rectification — correct your data by editing your profile.
Erasure — delete your account and data.
Portability — download your data in a structured JSON format.
Restriction & objection — pause certain processing or object to it, and opt out of marketing at any time.
Withdraw consent — as easily as you gave it.

US residents have additional rights — see our US State Privacy Rights page. You also have the right to complain to a regulator: in the UK, the Information Commissioner’s Office (ICO).

Children

BumpTribe is intended for adults. We do not knowingly collect data from children under 13. Where the service is used by under-18s, we apply high-privacy defaults for everyone. See our Terms of Service for age requirements.

Security

We protect your data with row-level database security (so you can only access your own rows), encrypted connections, and strict server-only handling of sensitive keys. No system is perfectly secure, but we design to minimise what we hold and who can reach it.

Changes to this policy

If we change what we collect or how we use it, we will update this policy (and our Consumer Health Data Privacy Policy) at the same time, and note the change here.

Contact

Questions or requests: hello@bumptribe.co. [UK/EU representative details, if required, to be added.]