Legal
Last updated: October 29, 2026 · Driftly, operated by GenBetaMama Labs, Philippines
This policy explains what Driftly stores, what can leave your device, when, and what control you have. It is written for the parent, guardian or caregiver who uses the app.
Driftly is in closed testing. This policy describes how the app behaves today and will be updated as the app changes.
Driftly keeps everything on your phone by default. There is no sign-up - no email address, no password. There is no advertising and no analytics of any kind. Three features can send information off your device, each behind its own separate consent: multi-caregiver sync, which is end-to-end encrypted so we cannot read it; AI logging; and the AI Weekly Summary. Subscribing (see Subscriptions below) also involves our servers and our payment provider, but never information about your child.
About your child: a first name (a nickname or initial works fine), an age band, and optionally an exact birthday. We do not store photographs of your child, government identifiers or contact details. We never record your child's sex.
Activity records: every entry you create - sleep, nursing, bottle, pumping, diaper, solids, tummy time, bath, activity, medicine, growth, potty and temperature - with timestamps, values, and any free text you type, including notes, food names and medicine names.
Memories: journal entries, moments, teeth records, milestones, vaccinations and reminders.
Preferences: settings, consent flags, and - if you use sync - your household key.
How it is protected: Driftly's data on your phone is encrypted at rest. Your activity records sit in an encrypted database. Your child's profile, Memories, preferences, the household key and the sync sign-in are held in your device's secure store (the iOS Keychain, or storage protected by the Android Keystore). All of it sits inside the app's private sandbox, protected by your device passcode or biometrics.
Three things live outside that encryption, by design. Reminder notifications are scheduled with your phone's operating system, which keeps their wording; Driftly uses generic wording only ("A medicine may be due"), never names or medicines. Exported files are created only when you export, and are deleted from Driftly's storage once the share sheet closes. If you subscribe, our subscription provider's software keeps its own record of your subscription status on the phone.
Device backups. On Android, Driftly opts out of Android backup and device-to-device transfer, so its data is not copied to your Google account or to a new phone. To move to a new phone, export a JSON backup and restore it there. On iOS, your iCloud or computer backup may include Driftly's data, protected by Apple's backup encryption and under your own account and Apple's policy.
| Free | Pro | Pro+ | |
|---|---|---|---|
| Timers and activity logging | Yes | Yes | Yes |
| History | Unlimited | Unlimited | Unlimited |
| Children | One | Multiple | Multiple |
| Drift Window predictions | – | Yes | Yes |
| Reports – day, week and month | Yes | Yes | Yes |
| Weekly trend insights | – | Yes | Yes |
| Export, reminders, voice | – | Yes | Yes |
| Multi-caregiver sync | – | – | Yes, with consent |
| AI logging and summaries | – | – | Yes, with consent |
| Information about your child leaves the device | Never | Never | Only with your consent |
Two independent locks apply: a feature transmits only if your plan permits it and you have given the specific consent for it. Both are enforced on your device. Our servers additionally check your subscription tier before handling any AI request.
By default, nothing does. Three features transmit information about your entries, each behind its own opt-in, and switching one on does not switch on the others. Subscriptions are covered separately below.
Available on Pro+, and only after you create or join a household. Each child record and log entry is encrypted on your phone before it is uploaded. The key stays on your devices and is shared only with caregivers you invite, through an invitation phrase. Our server stores only ciphertext. We cannot read your entries, your notes or your child's name, and neither can our hosting provider.
Deliberately excluded: your child's exact birthday is never uploaded, even encrypted.
If you join an existing household: any children already on your phone stay on your phone. They are never uploaded and no other caregiver can see them. Only children belonging to the household, and children you add after joining, are shared.
Visible to our server in plain form, so it can route and order the encrypted records: a household identifier (derived one-way from the household key), the identifier of each child and entry, a deletion flag and a timestamp, plus the household's member list (anonymous device identifiers and join times; caregiver display names are encrypted). We can also see how many records a household has and when they were written. None of this reveals the contents of your entries.
Sign-in: anonymous. The only identifier is one generated automatically for your device when you create or join a household, or open the subscription screen. No email, no password, no profile. Household size is limited to five caregivers.
Available on Pro+, and only if you switch on "Allow AI-powered chat logging". You then confirm each item before it is sent. This exists for what the app cannot interpret on its own: a chat message its on-device parser does not understand, a photograph of a handwritten log sheet, or an ambiguous spreadsheet from another app.
Each request also includes your device's time-zone name (for example "Asia/Manila"), its current offset from UTC, and today's date on your device, so that times like "2am" or "this morning" are placed on the right day and at the right time; we do not store them. The time-zone name shows the region your device is set to.
The request travels to our server function, which redacts email addresses and long digit sequences again as a second line of defence, and forwards it to Anthropic's API to be interpreted. Our function stores none of it: not the text, the image, the rows, or the reply.
Available on Pro+, behind a separate one-time consent shown on its own screen, with declining given equal weight. Only an anonymised statistics bundle is sent: counts, durations, averages, neutral labels and the age band. No name, no notes, no photographs, no raw entries. Two independent checks enforce this - the app refuses to transmit a payload containing any disallowed field, and the server rejects one outright. Nothing is retained after your summary is generated.
Subscribing does not create an account and does not require an email address. Purchases are processed by Google Play or the App Store, which hold your payment details under their own policies. We never see your card details.
We use RevenueCat only to process subscriptions: to show plans and prices, complete purchases and restores, and confirm your subscription status. It receives an anonymous identifier, purchase and receipt information, and device information its software collects, typically device model, operating system version, app version and country. It receives no name, no email and no information about your child. Its paywall and diagnostics features, which would report how you use the subscription screen, are not included in Driftly. The subscription screen is Driftly's own.
RevenueCat is first contacted when you open the subscription screen, and again at each launch after you have subscribed. Opening the subscription screen also creates the anonymous identifier described above, so that a purchase can be linked to it.
While sync is on, the app asks our server whether your subscription is active, sending only that anonymous identifier. We store a subscription record against it. It contains nothing about you or your child.
We want to be straightforward about one point: subscriptions are the only part of Driftly that involves our servers without a feature-specific opt-in. It is how a paid app verifies payment, and it never involves your child's information.
Voice logging uses your device's on-device speech recognition, and the resulting text is interpreted by a rule engine running on your phone. Audio never leaves your device: no recording is sent to us or to anyone else.
On iPhone, Driftly requires on-device recognition. On Android it needs Android 12 or later and a phone with on-device speech recognition, plus your language's speech pack, which the app can help you download. Where that isn't available, voice logging is turned off rather than falling back to an online service.
| Processor | What it receives | When |
|---|---|---|
| Supabase | Encrypted records (ciphertext only), routing identifiers, your anonymous device identifier, subscription tier, and - in transit only - the contents of AI requests | If you enable sync or an AI feature, or open the subscription screen |
| Anthropic | Chat text or spreadsheet rows with identifiers removed, or the photograph you attached; or, for weekly summaries, anonymised numbers only. Reached only through our server - your device never contacts Anthropic directly | Only when you use an AI feature |
| RevenueCat | An anonymous identifier, purchase information, and device information | When you open the subscription screen, and while you have a subscription |
| Google / Apple | Payment details and purchase history | Platform-level |
No processor receives information about your child from the Free or Pro plan. If you open the subscription screen, Supabase and RevenueCat receive the anonymous identifier and the device and purchase information described above.
Export. You can export your data as CSV, XLSX or a complete JSON backup at any time. The file is created on your device and handed to your operating system's share sheet - you choose where it goes, and Driftly never uploads it. Exported files are not encrypted and contain your child's name and anything you have written, so take care where you store them. Driftly deletes its copy of the file once the share sheet closes.
Restore. A JSON backup can be restored, replacing the data on your phone. Restoring is unavailable while your phone is in a household, because a restored snapshot could overwrite other caregivers' newer entries.
Deleting your data. You can delete individual entries, a whole child, or everything. While your phone is in a household, deleting a child or deleting everything is unavailable - this protects the other caregivers' records. Leave the household first; deletion then removes data from your phone only. Deleting everything also signs your phone out of its anonymous sync identifier; that identifier and any subscription record remain on our servers (see How long we keep things).
Leaving a household does not delete anything on your phone. If other caregivers remain, your phone simply stops syncing, and entries you added to shared children stay with the household. If you are the last caregiver, leaving deletes the shared copy from our servers entirely - while everything on your phone remains, including children that were shared with you. Deleting a single entry always works and applies to every caregiver's phone.
Rights you have. Subject to your local law, you may request access to, correction of, export of or deletion of data we hold. In practice that means household records (encrypted entries and the member list), anonymous identifiers with our hosting provider's standard sign-in records (such as IP address and time), and subscription records, since everything else never reaches us. Household records are encrypted, so we can delete them but cannot read or correct their contents. You may withdraw any consent at any time, which stops future transmission.
The user is an adult; the child is the subject. Driftly is intended for parents, guardians and caregivers. The child is the subject of the records, not the user of the app. We do not knowingly allow children to use Driftly directly.
This distinction matters. Children's privacy laws - including COPPA in the United States and the child-specific provisions of the GDPR - are aimed principally at services directed at or used by children. Driftly is directed at adults but records information about a child, which is treated differently across jurisdictions.
Data minimisation in practice: a first name and an age band are all that is required. An exact birthday is optional, and when provided is never uploaded. A child's sex is never recorded at all. No child data is involved in any subscription or billing process. Children already on a phone before it joins a household are never shared.
Compliance status: we make no definitive claim of COPPA or GDPR-K compliance at this stage. Formal review by qualified legal counsel is pending and will be completed before public launch. This section describes design intent, not a legal conclusion.
Driftly's data on your phone is encrypted at rest and held in the app's private sandbox (see What Driftly stores on your device for the three exceptions). Synced records are encrypted on your device before upload, and the keys never reach our servers. No system is perfectly secure, and we cannot guarantee absolute security.
Where sync, AI features or subscriptions are used, information may be processed on servers outside your country, including in the United States.
We will update this policy as the app changes. If a change would cause information to leave your device in a new way, we will tell you in the app and ask for fresh consent where required. We will not retroactively apply a materially less protective policy to information already collected.
Questions or requests: driftly.babyapp@gmail.com.