Privacy Policy

Last updated: 15 April 2026

1. Who we are

Yayby ("we", "us", "our") is an iPhone and iPad application operated by Andrew Hingston, based in Australia. Contact: support@yayby.com.

2. What we collect (and what we don't)

Yayby is built to minimise the personal data we hold. The only personal data we may receive is what you explicitly provide during optional steps:

• Email and first name (optional) — during onboarding we offer an optional step to capture an email and first name so we can send you order receipts and important account notifications if you order a printed baby book. Skipping this step is fully supported; the app works without it.
• Shipping address (only if you order a printed book) — forwarded to Prodigi for fulfilment.
• Payment details (print orders only) — handled entirely by Stripe. We never see or store your full card number.

We do not collect:

• A password — there's no account system
• Your phone number, date of birth, or location
• IP address beyond what's technically required to route a network request (not persisted)
• Your contacts, calendar, browsing history, or photos outside what you explicitly attach inside the app
• Any analytics, telemetry, or crash-report data via third-party SDKs
• Device advertising identifiers

3. Where your baby's content lives

Photos, videos, voice notes, milestone records, growth entries, and written notes captured in Yayby are stored in your own iCloud account, using Apple's CloudKit framework and an app-specific iCloud ubiquity container (iCloud.com.yayby.dev). This content never reaches Yayby's servers. It is governed by your Apple ID's terms and Apple's iCloud Privacy Policy.

If you choose not to enable iCloud, content is stored locally on your device only.

4. What our backend handles

Yayby operates a small Supabase-hosted edge-function API that handles narrow, transactional tasks:

• Unlock purchase verification — validating your StoreKit 2 receipt when you buy the one-time app unlock, and storing an anonymous device identifier so the unlock can be restored if you reinstall the app on the same Apple ID.
• Print-book orders — when you order a printed baby book, we receive the shipping address you enter, hand payment off to Stripe, and forward the fulfilment request to Prodigi (our print partner). We retain order status so you can see it in the app.
• Optional email and first name — if you provide these during onboarding or at order time, we store them to send order receipts and important account notifications.

No photos, videos, milestones, growth data, voice notes, or personal notes ever reach our backend.

5. Third parties we rely on

• Apple — iCloud (CloudKit) for storage and sync; App Store for distribution and in-app purchase billing. Governed by Apple's Privacy Policy.
• Supabase — hosting our narrow edge-function API (unlock verification and print-order workflow). See Supabase's Privacy Policy.
• Stripe — payment processing for printed-book orders. We never see or store your full card details; Stripe handles the entire payment lifecycle. See Stripe's Privacy Policy.
• Prodigi — print fulfilment and worldwide shipping. Receives your shipping address and order details only. See Prodigi's Privacy Policy.

6. Data security

All communication between Yayby and our backend uses HTTPS. Sensitive on-device values (device identifiers, unlock-state dates, purchase tokens) are stored in the iOS Keychain — Apple's most secure local storage. The Prodigi webhook that notifies us of print-order status is secured with URL token verification so updates cannot be spoofed.

7. Subscriptions & purchases

Yayby's one-time unlock purchase is billed through Apple's App Store and governed by your Apple ID. We receive a transaction confirmation and an anonymous receipt — we do not see or store your full credit-card details. Printed-book orders are billed separately through Stripe; card details are handled entirely by Stripe.

8. Children's privacy

Yayby is intended for use by parents, grandparents, and caregivers to capture memories of their own children. The app is not directed at children under 13, and we do not knowingly collect personal information from children. Content captured about a child is held by the account-holder parent or guardian; Yayby has no access to it.

9. Your rights

Because we collect so little, there is little to request access to or delete from our servers. You have the right to:

• Delete all your data — Settings → Delete My Data in the app wipes local content, iCloud sync state, and any print-order history on our backend.
• Request a summary of any backend records tied to your anonymous device identifier or print orders — email support@yayby.com.
• Export your data — printed-book orders can be exported as PDFs on request; photos and videos remain in your own iCloud and can be shared out via Apple's native Share sheet.

10. International users

Yayby is available worldwide via the Apple App Store. Printed baby books ship internationally via Prodigi. Backend infrastructure is operated in Supabase's Tokyo region; data transfers are governed by Supabase's standard contractual clauses. Because we collect no personal content, the data-transfer surface is minimal.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated "Last updated" date. Continued use of Yayby after a change is posted constitutes acceptance of the updated policy.

12. Contact

Questions about this Privacy Policy? Email support@yayby.com. Security vulnerabilities: security@yayby.com (or see /.well-known/security.txt).