Privacy Policy

1. Who we are

Nurture is run by NURTURE-CHAT LTD, a company registered in England and Wales (company number 17023823), whose registered office is 214 Hendon Way, London, England, NW4 3NE. We are the “controller” of your personal information, which means we decide how it’s used and we’re responsible for looking after it. You can reach us about anything in this policy at nurturechatteam@gmail.com.

This policy covers the Nurture app for Android (and iPhone, when available), the web app, and our website, wherever you live. If you’re in the US, our Consumer Health Data Privacy Policy adds to it. How the assistant handles difficult moments is in our AI Safety & Crisis Protocol.

2. What we collect

What you give us

• Your account: your name and email address. If you sign up with an email and password, we store the password only as a secure one-way hash. If you choose “Continue with Google”, we receive your name, email address and Google’s account identifier for you — never your Google password. We also send one-time codes and links to check your email address or reset your password.
• Your settings: things like your units, theme, notification choices and what the assistant is allowed to use.
• Your baby’s details and records: each baby’s name, date of birth or due date and sex, and what you log — feeds, sleep, nappies, notes, growth measurements, milestones (with any photos or videos you add), medicines and doses given, appointments, allergies, and documents you upload. Much of this is information about your baby’s health, which the law treats as “special category” data and which we treat with extra care (see sections 3 and 10).
• Your chats with the assistant, including voice notes you record (see section 4), and the facts the assistant remembers about your family.
• Your family: who you invite or join, their role (parent or caregiver), and who logged each entry.
• Community: your posts and replies (including ones you post anonymously), your reactions, the groups you join or ask to join, your private messages, the people you block, and anything you report.
• Suggestions and messages to us: feedback you send through the app, and emails you send us.
• Referrals: if you invite a friend or were invited, we record who referred whom.

What we collect as you use Nurture

• Your plan: whether you’re on a free trial or a paid plan, which plan, and when it renews or ends. We receive this from Google Play or the App Store (through RevenueCat) or, for older web subscriptions, from Stripe. We never see your card details.
• Activity: when you last used the app and which days you used it, when you signed in, and how many messages you’ve sent the assistant — so we can understand how Nurture is used and keep it running well.
• Assistant usage: for each request to the assistant, which feature it was for, how much text it used and what it cost us. Not the words themselves.
• Safety signals: if something you write to the assistant suggests you or your baby might need a professional, we note that it happened, when, and what kind of concern it was — never what you wrote — so our team can see that the safety features are working.
• Emails we’ve sent you, so the same email is never sent twice.
• Notifications: if you turn them on, a push token for your phone or browser, so we can deliver them.
• Security: your IP address, used briefly to limit repeated attempts (for example, lots of sign-in attempts) and stop abuse.
• Website and app performance: anonymous, cookie-free page-view and speed statistics (see section 13), and error reports when something breaks (see section 6).

3. Why we use it, and our lawful basis

UK data protection law (and, if you’re in the EU, the GDPR) says we need a lawful reason for each use. Ours are:

• To provide Nurture to you (contract — Article 6(1)(b)). Running your account, storing and syncing your records with your family, the assistant, reminders, notifications, the community, your subscription, and the emails that go with them (such as verifying your address, your trial starting or ending, receipts and account changes).
• Your baby’s health information, and yours (explicit consent — Articles 6(1)(a) and 9(2)(a)). Health information is special category data. We only hold it because you choose to add it, and we rely on your explicit consent, which you give with its own tick when you sign up. We never rely on contract or legitimate interests alone to use health information. As the parent or carer, you give that consent on your baby’s behalf. You can withdraw it at any time by deleting the records, switching off what the assistant can use in Settings → Assistant, or deleting your account. Withdrawing doesn’t affect what we did before.
• Keeping Nurture safe and working well (legitimate interests — Article 6(1)(f)). Stopping abuse and fraud, rate limits, checking community content, fixing errors, understanding in aggregate how the app is used, keeping an eye on our running costs, and improving the service. We only do this in ways you’d reasonably expect and that don’t override your rights.
• Meeting our legal obligations (Article 6(1)(c)). For example, keeping financial records, and responding to lawful requests from the authorities.

We never sell your information, never use it for advertising, and never use your baby’s records to train AI models.

5. Your family

If you invite a partner or caregiver, they can see and add to your baby’s records, with each person’s name on what they logged. Caregivers don’t see documents and can’t change your baby’s details. Your chats with the assistant, your personal memories, your community posts and your private messages are never shared with them. You can remove anyone, or leave a family, at any time. Please only invite people you trust with your baby’s information.

6. Companies that help us run Nurture

We use a small number of service providers (“processors”). They may only use your information on our instructions, to provide their service to us, and must keep it secure.

• Supabase — our database and file storage (your records, photos, videos and documents).
• Vercel — hosts the app’s servers and website, and provides cookie-free usage and speed statistics.
• OpenAI — the assistant, the morning note, chat titles, voice-to-text, and automatically checking community posts, replies and private messages for harmful content.
• Google — Google Play Billing for subscriptions, “Continue with Google” sign-in, and delivering push notifications to phones (Firebase Cloud Messaging).
• Apple — in the iPhone app: App Store subscriptions, “Continue with Apple” sign-in (which can give us a private relay email address instead of your own), and delivering push notifications to iPhones.
• RevenueCat — manages app-store subscriptions for us and receives purchase records from Google Play and the App Store, linked to your account by an internal id.
• Stripe — payments for older web subscriptions.
• Resend — sends our emails (such as verification codes, password resets, trial and subscription emails, and account confirmations).
• Sentry — tells us when something breaks. We set it up so it never receives your name, email, cookies, or what you typed, and we strip request contents and private links before anything is sent; it is set not to store IP addresses.
• Capgo — delivers updates to the app on your phone. When the app checks for an update it sends the app version, an anonymous device id and your IP address; it never receives your records.
• Upstash — keeps short-lived counters (keyed by account or IP address) to stop abuse; they expire automatically.
• Web push services — if you turn on notifications in a web browser, your browser’s own push service (for example Google, Mozilla or Apple) delivers them.

We may also share information:

• When the law requires it, or where it’s needed to protect someone’s safety.
• If Nurture is sold or merged, with the new owner, who would have to keep protecting it as this policy says. We’d tell you first.

7. Information leaving the UK and the EU

Some of our providers are based in, or store information in, the United States or other countries outside the UK and the EU. When your information is transferred, we make sure it’s protected as the law requires — for example because the country is covered by “adequacy” regulations (including the UK–US data bridge and the EU–US Data Privacy Framework, for providers certified under them), or under the UK’s International Data Transfer Agreement or Addendum, or the EU’s standard contractual clauses. Where information is held in the US, it may be accessible to US authorities under US law. You can ask us for a copy of the safeguards for a particular provider.

8. The community

The community is shared with other parents, so please think about what you post — anything in a public group can be seen by other members. Posting anonymously hides your name from other members, but we still know which account posted it. Private groups are visible only to their members.

To keep the community kind, posts, replies and private messages are checked automatically when you send them, and something clearly harmful may be held back or not posted. If you think we got that wrong, email us and a person will look at it. If someone reports a post or message, a member of our team reads it and may remove it or pause an account. Otherwise we don’t read private messages.

9. How long we keep it

We keep your information for as long as your account is open, so Nurture keeps working for you and your family. When you delete your account, it’s deleted straight away, with no waiting period — your profile, your babies and all their records, photos, videos and documents, your chats and the assistant’s memories, your community posts, replies and messages, and your notification tokens. We also ask RevenueCat and Stripe to delete their customer records for you. A few things are different:

• A deletion record: a scrambled, one-way code made from your email, the date, whether you had a subscription, and any reason you gave, so we can confirm a deletion took place. It can’t be turned back into your address.
• Entries you logged in someone else’s family stay with their baby’s records.
• Payment records: Google Play, the App Store and Stripe keep their own records of transactions as the law requires them to, and we keep the financial records the law requires of a UK company — normally for six years.
• Backups: our database provider keeps backups for disaster recovery, for up to 7 days. Deleted information disappears from them as they roll over, and isn’t restored except to recover from a failure.
• Our providers’ own short-term copies: for example, OpenAI may keep requests for up to 30 days (section 4), and error reports are deleted after at most 90 days.

See how to delete your account.

10. Your baby

Nurture is for parents and carers aged 18 or over. Babies and children don’t use it — but much of what you log is about them, so we treat it with extra care. It’s only shared with the people you invite, it’s never used for advertising or sold, and it’s never used to train AI models. By adding it, you confirm you’re the baby’s parent or have the right to share their information. If you think someone has added information about your child without the right to, please contact us.

11. Your rights

Under UK data protection law you have the right to:

• See the information we hold about you and get a copy of it;
• Correct anything that’s wrong — most of it you can change in the app;
• Delete it — you can delete your account yourself in Settings, or follow these steps if you no longer have the app;
• Take it with you — ask us and we’ll send your information in a common, machine-readable format;
• Object to how we use it where we rely on legitimate interests, or restrict how we use it while a concern is sorted out;
• Withdraw your consent at any time (see section 3);
• Ask a person to review an automated decision, such as a community post that was held back. We don’t make decisions about you by automated means alone that have legal or similarly significant effects.

If you’re in the EU, you have the same rights under the GDPR. If you’re in the US, see our Consumer Health Data Privacy Policy for your rights over health data, including how to appeal.

To use any of these rights, email nurturechatteam@gmail.com from the address on your account. We’ll reply within one month, and it’s free. We may need to check it’s really you first.

Complaints. If you’re unhappy with how we’ve handled your information, email us with the subject “Complaint”. We’ll acknowledge it within 30 days, look into it, and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at any time, at ico.org.uk or on 0303 123 1113. If you’re in the EU, you can complain to the data protection authority where you live.

12. Keeping it safe

• Everything is encrypted in transit (HTTPS), and stored encrypted (AES-256).
• Passwords are stored only as secure one-way hashes.
• Each family can only ever reach its own records.
• Photos, videos and documents are stored privately, and shared only through short-lived links.
• Access to our systems is limited to the people who need it.
• We review the app’s security regularly.

Encryption protects your information while it’s stored and while it travels, but it isn’t end-to-end: Nurture, and the providers in section 6, have to read it to run the service for you. No system is perfectly secure. If a breach ever put your information at risk, we’d tell the ICO within 72 hours where the law requires it, and tell you without undue delay if it’s likely to affect you seriously.

13. On your phone, and cookies

Nurture keeps an offline copy of your records on your device so it works without signal, your sign-in in the phone’s secure storage, and a short summary for home-screen widgets. Widgets can show things like the last feed on your home screen — remove them if other people use your phone. Medicine and appointment reminders are scheduled on your phone itself. If you turn on the app lock, your fingerprint or face is checked by your phone — it never reaches us. Uninstalling the app removes what’s stored on the device.

Cookies: on the web we use one essential cookie to keep you signed in, and your browser’s local storage to remember things like your theme and to keep your offline copy. Our usage and speed statistics are cookie-free, and we don’t use advertising or tracking cookies — so there’s nothing to accept or decline.

14. Changes to this policy

We’ll update this policy when Nurture changes. If a change matters, we’ll tell you in the app or by email before it takes effect. The date at the top shows when it was last updated.

15. Contact us

Questions about this policy or your information? Get in touch — a real person will reply.

NURTURE-CHAT LTD · Company number 17023823 · 214 Hendon Way, London, England, NW4 3NE