Privacy Policy
July 2, 2026
1. Data controller
Sunny Seed is operated by Roman Koropets, an individual (sole trader) based at 16 Nobel Brothers Street, Apartment 46, Batumi, Georgia, who acts as the data controller for your personal data. Our primary database and files are hosted in Belgium (EU) on Google Cloud infrastructure in the europe-west1 region. For any privacy question or to exercise your rights, contact support@sunnyseed.app.
2. Data we collect
Data you provide: account details (email, name), your child's profile (name, date of birth, sex, photo, prematurity details), diary entries, tracker records (sleep, feeding, diapers), growth measurements, vaccination records, milestones, voice notes, and photos/videos you add. Data collected automatically: technical and usage data such as device identifiers, push token, app/website interaction events, approximate region, and subscription status. We do not collect precise location and we do not use advertising trackers.
3. Health-related data
Some information about your child (growth measurements, feeding, sleep, diapers, vaccinations) may qualify as health-related (special category) data under GDPR Art. 9. We process it only to provide the diary and tracking features you use, on the basis of your explicit consent, which you give when you add such data. You can withdraw consent at any time by deleting the data or your account.
4. Legal bases (GDPR Art. 6 & 9)
We process your data on these bases: (a) performance of our contract with you — to provide the app and its features; (b) your consent — for AI features, optional analytics, and health-related data (Art. 9(2)(a)); (c) our legitimate interests — to keep the service secure and to improve it, balanced against your rights; (d) legal obligations — where the law requires. Where processing relies on consent, you may withdraw it at any time.
5. How we use your data
We use your data only to provide Sunny Seed: storing your diary, generating AI responses and monthly letters, calculating WHO growth charts, sending vaccination reminders and account emails, and creating PDF/JSON exports. We do not sell your data and we do not use it for advertising or cross-app tracking.
6. AI features
AI responses, entry enhancement and monthly letters are generated using the Anthropic (Claude) API. We send only the context needed to answer your request (e.g. your child's age, relevant metrics, and the diary or tracker details you selected) and avoid sending account identifiers where not needed. Voice notes on iOS are transcribed on your device (the audio does not leave your phone); where on-device transcription is unavailable, audio may be transcribed via the OpenAI API and deleted after processing. Our AI providers process this data to return a result and do not use it to train their models. AI output is informational only and is not medical advice or a diagnosis.
7. Sharing & sub-processors
We share data only with service providers acting on our instructions: (a) Google Firebase — authentication, database, cloud functions, push notifications and analytics; (b) Cloudflare — media file storage (R2) and email routing (Workers); (c) Anthropic — AI responses; (d) OpenAI — voice transcription where on-device is unavailable; (e) Amplitude — product analytics; (f) RevenueCat — subscription management; (g) Resend — transactional and lifecycle emails; (h) Apple and Google — sign-in and app-store subscription billing. All processors are bound by data-processing agreements. We do not sell your data.
8. International transfers
Our primary storage is in the EU. Some processors (e.g. Anthropic, OpenAI, Amplitude, RevenueCat, Apple, Google) may process data in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards — Standard Contractual Clauses and/or the EU-US Data Privacy Framework — where applicable.
9. Partner access
If you invite a partner or grandparent, they can view or edit your child's data according to the role you assign (editor or view-only). You can revoke access at any time in Settings → Shared access.
10. Data retention
We keep your data while your account is active. You can delete your account at any time in Settings → Account → Delete account. On deletion, your personal data and media files are removed immediately from our active systems; residual copies in encrypted backups are purged within 30 days.
11. Your rights (GDPR)
You have the right to access, rectify, erase, restrict, and object to processing, and to data portability (in-app export as PDF or JSON). Where processing is based on consent, you may withdraw it at any time. To exercise a right, contact support@sunnyseed.app. You also have the right to lodge a complaint with your local data protection authority.
12. Security
We protect data with encryption in transit (HTTPS) and at rest, access-controlled databases (per-user Firestore rules), signed URLs for media, and API keys kept server-side only. No method is 100% secure, but we work to protect your information.
13. Children's privacy
Sunny Seed is for parents and caregivers aged 18+. We do not knowingly collect data directly from children, and the app is not directed to children. You provide data about your child as their parent or guardian, and we never use children's data for advertising or to train AI models.
14. Cookies & analytics
Our website uses strictly necessary cookies and local/session storage for authentication and attribution (UTM). Analytics (Firebase Analytics / GA4, and in-app Amplitude) are used to improve the product; in the EEA/UK, non-essential analytics are used only with your consent. We do not use advertising cookies.
15. Changes & contact
We may update this policy; we will note the date above and, for material changes, notify you by email or in-app. Questions or requests: support@sunnyseed.app. We respond within 30 days.