Privacy Policy - Storkino
What stays on your phone (short version)
- Everything you log about your baby (feeds, sleep, diapers, growth, temperature, symptoms, medicines you record, notes, photos, voice notes) is stored on your iPhone. There is no account and no sign-up.
- Care records are encrypted on the device. Photos are protected by iOS Data Protection but are not additionally encrypted by the app.
- We have no ads, no analytics, no crash-reporting service and no tracking. We do not sell data.
- Data leaves your phone only in three cases, all under your control: (1) you share or back up a file, (2) you switch on the optional Family Sync, (3) you switch on the optional outing weather and type a place name.
- Family Sync is end-to-end encrypted. Our server stores ciphertext it cannot read, plus technical account data described below.
- Family Sync is not yet offered in the current version of the app. The parts of this policy about Family Sync and our sync server apply only once it is switched on in an update; we will tell you in the app before that.
1. Who is responsible
The controller within the meaning of the GDPR is:
- Name: Caglar Ilhan
- Contact for all privacy questions: hello@storkino.com
We have not appointed a data protection officer. Write to the address above for anything in this policy.
2. What we process, why, and on what legal basis
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Local app use | Care records you enter (feeds, sleep, diapers, growth, temperature, symptoms, medicines logged, notes), photos, voice notes, settings | Providing the app's functions on your device | Stays on your device; we do not receive it and are not the controller of it. Where the law treats the app provider as involved, Art. 6(1)(b) GDPR (the service you asked for) |
| Family Sync (optional) | Encrypted records, random identifiers, member role, public key, encrypted device label, record sizes, revision numbers, timestamps, IP address in server logs | Sharing records between the phones of your family | Art. 6(1)(a) and Art. 9(2)(a) GDPR: your explicit consent, given by switching the feature on; withdraw by switching it off and leaving or deleting the family |
| Server operation and security | IP address, request time and technical metadata in short-lived server logs; rate-limit counters; audit entries (action and count only) | Keeping the service secure and stable, abuse prevention | Art. 6(1)(f) GDPR: legitimate interest in secure operation |
| Outing weather (optional, off by default) | The place name you type and the app language, sent to open-meteo.com; Open-Meteo also sees your IP address | Showing the weather for an outing | Art. 6(1)(a) GDPR: consent, given by switching the feature on and typing a place |
| Purchases | Handled by Apple. We only see whether Premium is active on your device | Providing Premium | Art. 6(1)(b) GDPR |
| Voice to text (optional) | Audio is recognised on your device by default. Only if you allow online recognition, Apple's speech service processes it | Turning speech into a care record you confirm | Art. 6(1)(a) GDPR: consent (the online option) |
| Reminders | Nothing is sent to us. Notifications are scheduled locally | Reminders | Local only |
| Backups and exports | Files you create and send via the iOS share sheet | Your own backup and portability | Local only; the destination is your choice |
| Support e-mails | Your e-mail address and what you write to us | Answering you | Art. 6(1)(b) or (f) GDPR |
| Legal site (this website) | This website is hosted on GitHub Pages; GitHub logs your IP address and request when you open these pages, for delivery and security. The pages contain no scripts, cookies, fonts or content from other sites | Delivering the pages securely | Art. 6(1)(f) GDPR |
Nothing in the table is used for advertising, profiling, or automated decisions that affect you.
3. Health data and your child's data
Baby records can reveal health information (for example temperature, symptoms, medicines you log). Under Art. 9 GDPR this is special-category data, and it concerns your child. We therefore apply these rules:
- You enter the data yourself as parent or legal guardian, and you decide what to record.
- It stays on your phone by default. It is processed outside your phone only if you switch on Family Sync, and then only in end-to-end encrypted form. Your explicit consent is the basis for this.
- We collect only what the features need: no names, e-mail addresses or phone numbers are required for Family Sync.
- The app does not diagnose, give dosing advice or monitor health. See the Terms of Use.
4. Recipients and processors
- Hetzner Online GmbH (Germany) hosts the sync server in a data center in Nuremberg, Germany. It acts as our processor under a data processing agreement (Art. 28 GDPR). It has access to the servers, not to your readable records.
- GitHub, Inc. (USA) hosts this website (GitHub Pages) and processes visitors' IP addresses for delivery and security. GitHub is certified under the EU-U.S. Data Privacy Framework, which covers this transfer.
- Apple Inc. provides the App Store, in-app purchases and, only if you allow online recognition, speech recognition. Apple acts for its own purposes under its own privacy terms.
- Open-Meteo (open-meteo.com) receives the place name and app language if you use outing weather. It is an independent third party and is not our processor. See its privacy policy.
- Other members of your family receive the records you sync, in readable form on their devices, when you invite them.
- We do not sell data, do not share it with advertisers and use no analytics or advertising providers.
5. Transfers outside the EU/EEA
We store and process Family Sync data in Germany and do not transfer it ourselves to countries outside the EU/EEA. Two exceptions depend on your choices: Apple (App Store, purchases, online speech recognition) may process data in other countries under its own terms and safeguards; and Open-Meteo, if you use outing weather, processes the request under its own policy and where it operates. These parties act on their own responsibility; we do not control their processing.
6. How long we keep data
- On your phone: until you delete it (the "Your data" screen, "Delete all my data", removes the records, photos, reminders and the encryption key) or uninstall the app.
- Sync server, when the owner deletes the family in the app: the family, its members, invitations, encrypted records and key envelopes are deleted immediately from the live database. They disappear from our nightly backups within 14 days.
- Sync server, when you leave a family or the owner removes you: your access is revoked and your key envelopes are deleted. Your pseudonymous membership entry (random identifier, role, public key, encrypted label) is removed when the family is deleted.
- Inactive families: a family in which no member has connected for 24 months is deleted automatically.
- Audit entries (random identifiers, action, count, time; no content) are kept for at most 12 months.
- Server logs that may contain your IP address are kept for at most 14 days.
- Support e-mails: for as long as needed to answer you and for legal retention duties, then deleted.
- Weather requests: the result is saved only in your outing record on your phone. Open-Meteo keeps data under its own policy.
7. Your rights
You have the right to access, rectification, erasure, restriction, data portability, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing. You may also lodge a complaint with a supervisory authority, for example in the EU member state where you live or work.
What the app offers directly:
- Access, rectification and portability: all your records are visible and editable in the app. "Your data" lets you create a backup file (optionally passphrase-protected) and export a CSV of every record.
- Erasure on your phone: "Delete all my data".
- Erasure on the server: in the Family Sync screen, members choose "Leave family" and the owner chooses "Delete family on the server". "Delete all my data" (Settings > Data & privacy) does both for you when Family Sync is on: it first deletes the family on the server (owner) or removes you from it (member or viewer) and only then erases this phone. Viewers keep a read-only copy on the phone, which the app cannot erase for them; it is removed when you delete the app. When it finishes the app confirms the deletion and shows the support code as a reference for your records. If the server cannot be reached nothing is deleted yet and the app says so. Deleting the app itself does not delete a family on the server, so use one of these first. To find server data for a request, send the support code shown under Data & privacy (a short hash of your family and member identifiers; we cannot derive your identifiers from it).
- Withdrawing consent: switch off Family Sync (leave or delete the family) or the outing weather.
Because our server holds no names or e-mail addresses and cannot read your records, we usually cannot tell which stored data belongs to you. If you ask us to act on server data, please use the in-app functions or give us information that lets us find your family; we will not ask for more than needed (Art. 11 GDPR). Write to hello@storkino.com; we answer within one month.
8. Children
The app is for parents, guardians and caregivers who are adults. It is not directed at children and is not in the Kids category. Data about a child is entered and controlled by the parent or guardian, who is responsible for sharing it only with people entitled to it. Parents with joint custody should agree on who has access.
9. Security
- Care records on the device are encrypted with AES-256-GCM; the key is in the iOS Keychain and does not leave the device. An optional app lock uses Face ID, Touch ID or the device passcode.
- Family Sync encrypts each record on your device with XChaCha20-Poly1305 using a family key that only family devices hold. When a member is removed the owner rotates the key. A removed member keeps what was already downloaded to their device.
- Backups can be protected with a passphrase (PBKDF2-HMAC-SHA256, AES-256-GCM). A forgotten passphrase cannot be recovered. A backup made without a passphrase is readable by anyone who has the file.
- Photos rely on iOS Data Protection and are not additionally encrypted by the app. A backup that contains photos and has no passphrase holds them unencrypted.
- All traffic to our server and to Open-Meteo uses HTTPS. The server limits request rates and does not log request contents or access tokens.
- The app talks only to the sync address built into the app, not to addresses found in invitation links.
No system is perfectly secure. If a personal data breach is likely to put you at risk, we will notify the supervisory authority within 72 hours and you without undue delay where required.
10. Cookies, tracking and device access
The app contains no advertising or analytics code, uses no advertising identifier and does not track you. It stores keys and tokens on your device only to provide the functions you ask for (strictly necessary under Section 25 TDDDG and Art. 5(3) ePrivacy Directive). It asks for permission before using the camera (photos, QR codes), photo library, microphone, speech recognition, Face ID and Bluetooth, and works without the optional ones. This website sets no cookies.
11. Changes
When this policy changes in a way that matters, we update this page and the date above, and where required we tell you in the app. Earlier versions are available from us on request.
12. Contact
Caglar Ilhan - hello@storkino.com