Privacy Policy
Effective date: 17 October 2026 · Last updated: 17 October 2026
This Privacy Policy explains how act_outofthe_box ("Bebiio", "we", "us" or "our") collects, uses, stores and protects information when you use the Bebiio mobile application and related services (together, the "Service").
1. Who operates Bebiio
Bebiio is operated by act_outofthe_box. For any privacy question or request you can contact us at support@bebiio.com.
2. Scope of this Privacy Policy
This Policy applies to the Bebiio mobile application and to this website. It covers the information processed through the Service. It does not apply to third-party websites, stores or services that we do not control, even where the Service enables you to use them.
3. Information you provide
You provide information directly when you create an account, set up a family, add child profiles, record events, invite other people, share access, generate reports or contact us. The categories of information we process are described below.
4. Account information
To create and operate an account we process identifiers and authentication information such as your email address, your user identifier and authentication credentials managed through our authentication provider. We do not receive or store your password in readable form. If you sign in with a third-party provider (for example, Google or Apple), we receive the account identifiers that the provider returns to us.
5. Child profile information
Bebiio stores information about children, but the Service is operated by adults (see section 28). Child profile information may include a child's name, date of birth, and other details you choose to add. This information is entered and managed by the adult account holder or other authorized members of the family.
6. Baby and child tracking information
Bebiio lets you record baby and child care activity, such as feeding, sleep and diaper activity, as well as other records you choose to enter. Where you enter them, this may also include information such as symptoms, temperature, medication and vaccinations. This is user-entered child tracking information. Bebiio is not a medical records system and does not provide medical advice (see our Terms of Service).
7. Measurements and milestones
You may record measurements (such as weight and length) and milestones for a child. These records are associated with the relevant child profile within your family.
8. Family membership and sharing
Bebiio supports sharing within a family. When you join or create a family, we process membership information (such as your role and your user identifier) so that the same household records can be accessed by the members you authorize. Members you add can see and, depending on their role, edit the family's and children's information.
9. Share links with doctors and healthcare professionals
Bebiio allows you to intentionally share selected information with healthcare professionals (for example, a doctor) through the Service's sharing features. When you create a share, we process the information needed to make that share work, such as the scope and expiry of the share. You decide whom you authorize and what you share.
10. Invitation and access links
To invite people to a family or to share access, the Service may generate invitation or access links. We process the technical data needed to create, validate and expire these links so they can be used safely and only for the intended purpose.
11. Push notifications
If you enable notifications, the Service can send you push notifications, such as family activity updates and subscription or access reminders. Family activity notifications may identify the relevant child by first name so you know what the notification is about. The notifications are designed not to include sensitive event values or detailed tracking data in the push payload. Operating-system notification permission is separate from the categories you choose inside Bebiio.
12. Device push tokens
To deliver push notifications we process a device push token that your device provides for that purpose. The token is associated with your account so notifications can be routed to your device, and it is removed when you sign out or disable the relevant notifications.
13. Notification preferences
We store your notification preferences (for example, whether optional categories such as family activity or reminders are enabled) so we can respect your choices. You can change these at any time in the app.
14. Reports, exports and sharing
Bebiio can generate reports and allow you to export or share them. When you export or share information, you choose where it goes. Once you share information outside the Service, the recipient and any external destination you chose may process it under their own terms.
15. Subscriptions and payments
Bebiio may offer paid features. Where paid services are offered, payment processing may be handled by the applicable payment platform or payment provider. When payment is processed by an external payment provider, Bebiio does not receive or store your full payment-card credentials. We process limited subscription-related information (such as your entitlement status and related identifiers) to provide and manage paid features.
16. Service, security and technical data we actually collect
In operating the Service we process the technical data needed to run it securely, such as authentication, service configuration and security signals used to protect the Service (including app-integrity attestation). We do not use advertising or behavioural analytics, and we do not collect location data or access your contacts.
17. Firebase and Google infrastructure
The Service is built on Firebase and Google Cloud infrastructure, including authentication, managed database (Cloud Firestore), file storage, cloud functions and cloud messaging used to deliver push notifications. Application data is processed within this infrastructure on our behalf.
18. Apple and Google services
Where you choose to sign in with Apple or Google, or where you enable notifications on your device, Apple and Google process certain information as platform providers (for example, to deliver push notifications through their systems and to authenticate your sign-in). Their handling of that information is governed by their own policies.
19. Payment processors
Where paid features are processed through a payment provider (for example, through our billing backend), that provider acts as an independent payment processor for payment data. In-app purchases made through the Apple App Store or Google Play are processed by Apple or Google respectively, under their own terms and policies.
20. Purposes of processing
- To create and manage your account and provide the Service.
- To store and display the family and child records you enter.
- To enable family membership, sharing and healthcare sharing you choose.
- To send notifications you enable.
- To provide paid features and manage entitlements.
- To keep the Service secure, prevent misuse and maintain reliability.
- To respond to your support requests.
- To comply with legal obligations and enforce our Terms.
21. Legal bases under the GDPR (where applicable)
Where the EU/EEA GDPR or an equivalent law applies, we rely on:
- Performance of a contract — to provide the Service you requested and operate your account;
- Consent — where you enable optional features such as optional notifications, or where consent is otherwise required;
- Legitimate interests — to secure the Service, prevent misuse and maintain reliability, balanced against your rights; and
- Legal obligation — where we must retain or disclose information to comply with the law.
22. Sharing and processors
We share information with service providers who process it on our behalf to run the Service (for example, cloud infrastructure and messaging), and with the people you choose to share with through the Service (such as family members and healthcare professionals). We do not sell your information, and we do not share it for advertising.
23. International data processing and transfers
Our infrastructure is configured to process application data in the European region. Some providers used to operate the Service may process information in other locations. Where information is transferred internationally, we take appropriate measures as required by applicable law to protect it.
24. Data security
We use technical and organizational measures designed to protect information, including access controls, authentication and app-integrity protections. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
25. Retention
We retain information for as long as necessary to provide the Service, to satisfy legitimate and legal obligations, to prevent fraud and abuse, and to resolve disputes. When you delete your account, we handle account-related application data according to the deletion process described below. Some limited information may need to be retained where required by law, for security or fraud-prevention purposes, or for legitimate recordkeeping.
26. Account and data deletion
You can use the account deletion functionality available in the app. When you delete your account, the implementation removes account-related application data as part of the deletion process. We cannot guarantee immediate deletion from every backup or from records that a recipient you shared with has separately retained.
27. Your rights
Subject to applicable law (including the GDPR where it applies), you may have the right to access, correct, delete, restrict or object to the processing of your information, to data portability, and to withdraw consent where processing is based on consent. To exercise your rights, contact support@bebiio.com. You also have the right to lodge a complaint with your local data-protection authority.
28. Children's information
Bebiio stores information about children, but the Service and accounts are intended to be operated by adults, such as parents, legal guardians or other authorized caregivers. Bebiio is not intended for children to independently create or operate accounts. Child profiles and child-related information are entered and managed by those adults.
29. Parent/guardian responsibility
The adult account holder is responsible for ensuring that they have the appropriate authority to enter and share information relating to a child, and for deciding whom to authorize to access that information.
30. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes we will take reasonable steps to inform you, and we will update the effective date above. Continued use of the Service after an update means the updated Policy applies.
31. Contact us
Questions or requests about this Privacy Policy or your information: support@bebiio.com.
You can also read our Terms of Service or visit our Support page.