01 / Scope
Who this policy is for
This policy applies to the Nova Baby app ("Nova"), the website at getnovababy.com, the Nova waitlist and support interactions. The data controller is Studio Next Ltd., 85 Great Portland Street, London W1W 7LT, United Kingdom.
Nova is a caregiver-facing baby tracker. It is not directed to children and children should not create accounts or use the service independently. We nevertheless recognise that a parent or other caregiver enters information relating to a baby. We treat that child-related information with particular care. Nova is a tracking and informational tool, not a medical device, and it does not provide diagnosis or medical advice.
Nova is available to people around the world. UK data protection law, including the UK GDPR, applies to Studio Next Ltd. Other local privacy laws may also give you rights depending on where you live.
02 / Data map
Information we handle
Baby profile and activity log
You may enter a baby's name, date of birth, optional due date and activity events such as sleeps, feeds, pumping, nappies, potty use, solids, temperature, medicine notes, tummy time, baths and growth. An event can include its type, time, duration and details relevant to that event, such as feeding side or quantity.
The baby profile and activity log are stored locally in Nova's App Group container on your Apple device. This supports the main timeline, widgets, on-device sleep-window suggestions and local insights. Apple device or Finder backups may include this local container according to your Apple backup settings.
Import, export and sharing
If you import a CSV file, Nova reads the file you select to create local events. If you export, Nova creates a CSV containing your log. You decide where that exported file goes through Apple's share sheet. Anyone or any service you share it with will handle that copy under their own privacy practices.
Optional account and cloud backup
Nova works without a permanent account. If you choose Sign in with Apple or Google, we receive an authentication identifier and any name or email information that the provider makes available under your provider choices. Supabase provides authentication and maintains the session needed to attach data to your account.
For signed-in users, Nova can keep an optional Supabase cloud backup containing the complete baby profile and full event log. The backup is an account-linked recovery copy. Signing out leaves that backup attached to the account so it can be restored after signing in again.
Assistant and AI Patterns
When you ask Nova Assistant a question, your question, recent conversation turns, the baby's name and age context, and relevant log context are sent online through a Supabase Edge Function to Anthropic. Context can include daily summaries and a limited selection of recent event types, dates, times, durations, quantities and other event details needed to answer the question. The service also processes authentication and usage-limit records.
When AI Patterns is available under your entitlement, Nova can generate a whole-history narrative. It sends the baby's name and age context plus derived summaries and statistics about tracked days, sleep, feeding and other event patterns through Supabase to Anthropic. A generated Patterns result is cached locally for up to seven days before refresh. These AI features process data online only through an explicit user action; they are not required for basic logging.
Product analytics and diagnostics
Product analytics are enabled by default and can be switched off at any time in Nova Settings. PostHog receives a stable pseudonymous baby UUID as the distinct app-profile identifier, product interactions such as onboarding, logging, import, Assistant, purchase and Village actions, and application lifecycle and error or diagnostic information collected by its SDK. PostHog is configured to use its EU host.
Nova does not send the baby name or the contents of logged events to PostHog. Custom analytics may include limited measurements about an interaction, such as an event category, duration, count, selected radius, product identifier or whether GPS was used, and coarse app-profile attributes such as the baby's age band, whether history was imported, account type, notification permission and display preferences, but not the underlying baby log text, dates of birth or precise coordinates.
Village
Village is optional. If you join, Supabase stores the display name you provide, the baby's month, city, district label, match radius, cohort membership, meetup proposals and RSVPs. Reports about members or meetup content are sent to our support inbox when you choose the report action.
If you choose location matching, Nova makes a one-shot location request and rounds the coordinate before sending it. Precise coordinates are stored privately in Supabase and used by server-side distance matching until you leave Village, delete the Village profile or replace GPS matching with a manual district. Exact coordinates are not readable by other families and are not displayed in profiles or maps. Village members can see the profile, cohort and meetup information described in the consent screen.
When a Village forms, Nova may hand you off to WhatsApp. Opening or joining a WhatsApp group causes WhatsApp to process information under its own terms and privacy policy. Studio Next does not control WhatsApp's independent processing.
Waitlist, support, purchases and website
If you join the waitlist, Supabase stores the email address you submit, a source label and the submission timestamp. If you email support or submit a Village report, we receive your email address, message, references included in the prepared report and any information you add. Apple processes App Store and StoreKit purchases and provides Nova with product and transaction status rather than your full payment-card details.
Cloudflare delivers the website and processes normal web request metadata such as IP address, browser or device information, requested URL, timestamps and security signals. The website does not load third-party advertising or analytics scripts.
03 / Purposes
How and why we use information
Our purposes and legal bases depend on the feature and context:
- Provide the app and requested services. We process local logs, account sessions, cloud backups, Assistant requests, AI Patterns, purchases and exports to perform our contract with you or take steps at your request.
- Run optional Village and location matching. We process the profile and meetup information you choose to provide to deliver the Village service. Where required, we rely on your consent for precise location processing; you can instead enter a district and can withdraw by leaving Village.
- Improve reliability and understand product use. We use pseudonymous PostHog analytics and diagnostics for our legitimate interests in improving Nova, measuring feature performance, finding errors and preventing misuse. This analytics processing is not described as consent-based. You can object by switching analytics off in Settings or contacting us.
- Communicate with you. We use waitlist details with your consent to send the requested launch or beta message, and process support or moderation correspondence to answer your request and pursue our legitimate interests in safe support and community operations.
- Protect users and comply with law. We may process records where necessary for security, fraud prevention, dispute handling, legal claims and compliance with legal obligations.
Some entries, such as temperature or medicine records, may be special-category health data under UK GDPR when they reveal health information. Where Article 9 applies to optional cloud backup or online AI processing, our additional condition is your explicit consent under Article 9(2)(a). You give that consent by deliberately choosing sign-in or the relevant AI feature after Nova displays its online-processing disclosure and Privacy Policy link. You can withdraw for future processing by no longer using online AI, deleting the account to stop and remove account-linked cloud backup, and contacting us about eligible records already processed. Withdrawal does not affect processing that was lawful before it.
We do not sell personal information and do not use baby log contents for advertising.
05 / Lifecycle
Retention, choices and deletion
Where we have not configured a fixed period, we keep information only while it is needed for the purpose described, to provide an active feature, meet legal obligations, resolve disputes or protect security. We review purpose and account status rather than claiming a single period for every record.
Local app data
Your local baby profile and log remain in the App Group container until you remove them through available controls or uninstall the app, subject to copies in Apple device or Finder backups that you control. CSV files you export remain wherever you choose to save or share them.
The Settings action labelled Delete logged activity removes local logged events, quarantined event data and cached AI Patterns insights, and removes your Village profile and related Village data if present. If you are signed in, it also signs this device out. It does not delete the local baby profile, Supabase account, cloud backup, Assistant chat history, preferences, trial state or historical records already held by processors. The cloud backup is deliberately preserved and may be offered for restore after you sign in again.
Account and cloud data
The in-app Delete account action removes the Supabase authentication account and account-linked Nova backend rows, including the cloud backup, Village profile and membership, and account-linked Assistant usage records. Local app data remains on the phone. Records held independently by analytics, email, support, Apple, Google, WhatsApp or other providers are not automatically erased by the Supabase account deletion.
Waitlist and support or moderation messages are kept while needed to deliver the requested communication, handle the matter, maintain safety records and satisfy legal obligations. Contact us if you want us to locate and erase eligible waitlist, support or processor records.
Village and analytics controls
Leaving Village deletes your profile, stored coordinates, membership, your RSVPs and meetups you proposed from the Nova backend. It does not delete the local log, account, cloud backup or analytics records. Choosing a manual district when updating the Village profile clears previously stored GPS coordinates.
Switching analytics off in Settings stops future PostHog capture from Nova on that installation. Resetting the local app identity does not itself erase earlier PostHog records. To request erasure of eligible historical analytics or other processor records, email hello@getnovababy.com and include enough information for us to identify the relevant app profile without sending sensitive log contents.
We may retain limited records after a deletion request where required by law, necessary for security or fraud prevention, or needed to establish, exercise or defend legal claims. We will restrict those records to that purpose.
06 / Global processing
International transfers
Studio Next is based in the United Kingdom, while you and our providers may be elsewhere. Information may therefore be processed in the UK, European Economic Area, United States and other countries where a provider operates. Those countries may have different privacy laws.
Where data protection law requires it, we use an adequacy decision, the UK International Data Transfer Agreement or Addendum, approved standard contractual clauses, or another lawful transfer safeguard. You can contact us for more information about safeguards relevant to your data.
07 / Safeguards
Security
Nova uses local-first storage, encrypted network transport, provider authentication, row-level access controls, restricted service credentials and access limitations designed to reduce unauthorised access. Village coordinates are separated from readable profile data and are used by server-side matching rather than exposed to app clients.
No storage or transmission system can be guaranteed completely secure. Keep your device, Apple or Google account and email secure, install software updates and take care when exporting or sharing a CSV. If we learn of a personal data breach, we will assess and notify affected people and regulators where required.
08 / Your control
Your privacy rights
Depending on where you live and subject to legal limits, you may have rights to request access to your personal information, correct it, erase it, restrict its use, receive a portable copy, object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing. You may also have the right not to be subject to certain solely automated decisions. Nova does not use your information to make legal or similarly significant automated decisions about you or your baby.
You can exercise several choices directly through export, analytics opt-out, Village leave, Delete logged activity and Delete account. For anything else, contact hello@getnovababy.com. We may need to verify your request and will respond within the period required by applicable law.
You may complain to the UK Information Commissioner's Office at ico.org.uk. If you live elsewhere, you may also complain to the privacy or data protection regulator that applies in your location. We would appreciate the opportunity to address your concern first, but you do not have to contact us before a regulator.
Children
Nova is not directed to children and we do not knowingly invite children to create accounts or submit information. Caregivers decide what child-related information to record. If you believe a child has provided information directly without appropriate authority, contact us so we can investigate and delete it where appropriate.
09 / Updates
Changes and contact
We may update this policy when Nova's features, providers or legal obligations change. We will post the revised version here, update the effective date and provide additional notice in the app or by another suitable channel when a change is material.
Privacy contact
Studio Next Ltd.
85 Great Portland Street
London W1W 7LT
United Kingdom