Baby DashboardPrivacy Policy
Baby Dashboard is a baby-activity log at baboolog.com and app.baboolog.com. This policy explains what it collects, why, and the choices you have. Questions: [email protected].
1. What we get from Google
- Sign in with Google: your name, email address and profile picture, to create your account and recognise you.
- Connect Google (one-time consent): access under the
drive.filescope — it covers only spreadsheets you create with Baby Dashboard or choose yourself in the Google Picker. Baby Dashboard cannot see, list or open any other file in your Google Drive.
2. What we store, and why
| Data | Why |
|---|---|
| Email, name, account status (pending / approved), admin flag | Your account and the manual approval of new users |
| Sign-in sessions (stored only as a one-way hash), expiry time | Keeping you signed in for up to 30 days of inactivity |
| Google refresh token (encrypted with AES-GCM), the Google email you connected, granted scope | Getting short-lived access to your chosen sheets without asking you to sign in again |
| Your list of sheets: spreadsheet ID, the name you gave it, your role, last used time | Showing your sheets and opening the right one |
| Siri / Shortcuts keys (stored only as a hash), label, created and last-used times | Letting your phone log entries by voice, and letting you revoke a key |
This is stored in a Cloudflare D1 database. Your baby's activity data (feeds, sleep, nappies, sickness, measurements) is not stored there: the app in your browser writes it directly to your Google Sheet. When you log by voice, our server writes the new row to your sheet and reads the date and time columns it needs to place the row and work out sleep duration — it doesn't keep a copy.
Your browser also keeps a small local cache (your sheet list and display preferences) in its own storage.
3. Google API Services: Limited Use
Baby Dashboard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is used only to provide the features you see in the app; it is not sold, not used for advertising, not used to train AI or machine-learning models, and not read by people except with your permission (for example, when you ask for support), for security reasons, or where the law requires it.
4. Who processes data for us
- Google — sign-in and your Google Sheet (governed by your Google account terms).
- Cloudflare — hosting, the app's server code and the D1 database.
- An email delivery provider — only if account-approval emails are switched on: your email address is included in the notice sent to the administrator.
We don't share data with anyone else.
5. Cookies
One essential cookie, bd_session, keeps you signed in (HttpOnly, secure, same-site). Google's sign-in
button may set its own cookies. There are no analytics or advertising cookies.
6. How long we keep it, and deleting it
- Disconnect Google in the app revokes Baby Dashboard's Google access and deletes the stored token at once. You can also remove access any time at myaccount.google.com/connections.
- Signing out deletes that session; unused sessions expire after 30 days.
- Siri keys can be revoked in the app.
- Delete your account: email [email protected] from the address you sign in with. We delete your account, sessions, tokens, sheet list and keys within 30 days.
- Your Google Sheet is yours: we never delete it. Remove it in Google Drive if you want it gone.
7. Security
All traffic uses HTTPS. Google tokens are encrypted at rest, session tokens and Siri keys are stored only as hashes, and access to the database is limited to the operator.
8. Children
Baby Dashboard is for parents and caregivers. It isn't directed at children, and children shouldn't create accounts. Information about a baby is entered by the parent or caregiver and kept in their own Google Sheet.
9. Changes
If this policy changes, we'll update the date above, and for significant changes we'll tell you in the app.