This Privacy Policy explains what personal data we collect when you use the Pebby mobile app and website, why we collect it, how we use and protect it, and the rights you have. Our baseline is the EU General Data Protection Regulation (GDPR); if you are in the UK or the US, see the dedicated regional sections near the end.
01 Who we are
Pebby is a shared-care baby tracking app developed and operated by CREATIVE VLU SOLUTIONS SRL, a company incorporated under Romanian law and acting as the data controller for the personal data described in this policy.
When this policy says “Pebby”, “we”, “us”, or “our”, it refers to CREATIVE VLU SOLUTIONS SRL. For any privacy-related questions, reach us at privacy@pebby.app.
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. You can raise any data-protection matter with us at the contact address above.
02 What this policy covers
This Privacy Policy explains what personal data we collect when you use the Pebby mobile app and website (pebby.app), why we collect it, how we use and protect it, and what rights you have under GDPR. If you are in the United Kingdom or the United States, please also read the dedicated regional sections (UK and US) below, which describe additional rights and disclosures that apply to you.
Pebby is intended for use by adults (18 years and older). We do not knowingly collect personal data from children. Baby tracking data is entered by you as a caregiver. It is associated with your account, not with your baby's identity.
03 Data we collect
Account information
When you register, we collect your name, email address, and a hashed password. You may also optionally provide a baby name for display purposes.
Tracking data
The core purpose of Pebby is logging baby care events. This includes feeding sessions (type, duration, amount), sleep sessions (start, end, notes), and diaper changes. You enter this data yourself; we store it to display it to you and your co-caregivers.
Shared-care group data
If you invite other caregivers (e.g., a partner, grandparent, nanny), their name and email address become visible within your shared group, and tracking data you enter is visible to all group members. You control who is in your group at all times.
Payment and billing information
Pebby is a paid subscription service. Payments are processed by Stripe and subscription management is handled by Adapty. We do not store your card number, CVV, or full payment details. These are handled entirely by our payment processors. We do store subscription status, plan type, and billing history.
Device and push notification data
To send you alerts and reminders (e.g., feeding time notifications), we collect your push notification token. We also collect basic device information such as device type, operating system version, and app version for technical support and compatibility.
Usage and analytics data
We use Firebase Analytics (Google) to understand how users interact with the app: which features are used, session length, and similar aggregate usage patterns. We use Firebase Crashlytics to automatically detect and report app crashes, which helps us fix bugs. These tools may collect device identifiers, IP addresses, and event data.
Marketing and attribution data
We use Moosend to send our email campaigns; where you have opted in, Moosend may record email interactions (such as opens and clicks) to help us understand campaign effectiveness.
Website data
Our website (pebby.app) is a static site that does not run analytics or advertising trackers and sets no marketing cookies. See Cookies & Website Tracking below and our separate Cookie Policy for full details.
04 How we use your data
- Provide the service: store and sync your tracking logs, display them to you and your caregiving group in real time.
- Account management: create and authenticate your account, manage your subscription.
- Process payments: initiate and manage billing via Stripe and Adapty.
- Send notifications: deliver reminders and handover summaries via push notifications.
- Improve the app: use aggregated analytics to identify popular features, detect crashes, and fix bugs.
- Measure marketing: measure email-campaign effectiveness via Moosend.
- Communicate with you: send service/transactional messages and, where permitted, marketing communications you can opt out of (see Marketing Communications).
- Comply with legal obligations: retain records as required by applicable law.
05 Cookies & website tracking
Our website is a static site. It does not run analytics or advertising trackers, and it sets no marketing cookies. The only data stored in your browser is a small theme preference (light/dark) we keep in local storage so the site remembers how you like it to look. This is not used to track you and is never shared.
For the full list of technologies and how to control them, see our dedicated Cookie Policy.
06 Legal basis for processing (GDPR)
- Performance of a contract (Art. 6(1)(b)): processing your account data, tracking logs, and payment information is necessary to provide the subscription service you signed up for.
- Legitimate interests (Art. 6(1)(f)): using Firebase Analytics and Crashlytics to maintain app quality and security, and processing the personal data of invited caregivers so the shared-care feature can function. Our interest in running a stable, useful service is balanced against the limited privacy impact of this processing.
- Consent (Art. 6(1)(a)): sending marketing emails via Moosend. You can withdraw this consent at any time (via the unsubscribe link in any marketing email, or by contacting us).
- Legal obligation (Art. 6(1)(c)): retaining financial records as required by Romanian and EU law.
07 Sensitive / special-category data
Some data you enter (such as feeding, sleep, and diaper logs relating to your baby) could be considered information about a person's health. Although this data is entered by an adult caregiver and stored under the adult's account, we treat it with particular care.
To the extent any data you enter constitutes special-category data under Article 9 GDPR, we process it only on the basis of your explicit consent, given when you choose to enter it, and solely to provide the tracking and shared-care features to you and the caregivers you authorise. We do not use this data for advertising or profiling, and you can delete it at any time within the app.
08 Shared-care feature and caregivers' data
When you invite someone to your Pebby caregiving group, they will be able to see all tracking data in the shared profile, as well as your display name. You are responsible for only inviting people you trust. You can remove any caregiver from your group at any time from within the app, immediately revoking their access.
Personal data of people you invite. When you invite another caregiver, we process their name, email address, and (if they use the app) their device and push-notification data so they can join and use the shared group. We rely on our legitimate interest (and yours) in providing the shared-care functionality you requested as the legal basis for this processing. You confirm that you have the authority and, where appropriate, the permission of the people you invite to share group data with them. Invited caregivers can exercise their data rights directly with us.
09 Children's privacy & baby data
Pebby is designed for and marketed to adults (18+). We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us at privacy@pebby.app and we will promptly delete the account.
Baby tracking data is entered by adult caregivers and is associated with the adult's account, not with the baby as an identified individual. We never use information relating to your baby for advertising, marketing, profiling, or sale, and we never share it with third parties except the processors strictly necessary to operate the service. It is used solely to provide the tracking and shared-care features to you and the caregivers you authorise.
10 Third-party processors
nam5 multi-region) and safeguarded by Standard Contractual Clauses. Policy: firebase.google.com/support/privacyWe do not sell your personal data to any third party. We may disclose data where required by law or to protect our legal rights.
11 International data transfers
Some of our third-party processors are based outside the European Economic Area (EEA), primarily in the United States. Where this is the case, we ensure appropriate safeguards are in place to protect your personal data in accordance with GDPR and UK GDPR requirements. Specifically, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK Addendum / IDTA for UK data).
12 Data retention
We keep personal data only for as long as necessary for the purposes described in this policy:
| Data | Retention period |
|---|---|
| Account & tracking data | For as long as your account is active; deleted within 30 days of account deletion. |
| Financial / transaction records | Up to 7 years, as required by Romanian and EU accounting law. |
| Usage analytics (Firebase Analytics) | Up to 14 months (Google Analytics for Firebase default), then automatically deleted. |
| Crash reports (Crashlytics) | Up to 90 days (Firebase Crashlytics default). |
| Marketing data (Moosend) | Retained while you remain opted in; deleted on consent withdrawal or unsubscribe. |
| Support correspondence | Up to 24 months after the matter is resolved. |
Anonymised, aggregated analytics data that cannot be linked back to you may be retained indefinitely.
13 Automated decision-making & profiling
We do not use your personal data to make decisions about you solely by automated means that produce legal or similarly significant effects (Article 22 GDPR). We do not carry out automated profiling of your or your baby's data for advertising purposes.
14 Marketing communications
We may send you service/transactional messages (for example, billing notices, security alerts, and important changes). These are necessary to provide the service and are not optional. Separately, we may send marketing communications (such as product news) only where you have opted in or where otherwise permitted by law. You can opt out of marketing communications at any time using the unsubscribe link in any marketing email, or by contacting privacy@pebby.app. Opting out of marketing does not stop transactional messages.
15 Your rights under GDPR
If you are in the EU/EEA (and, with equivalent rights, the UK), you have the following rights regarding your personal data:
To exercise any of these rights, email us at privacy@pebby.app. We will respond within one month (extendable by two further months for complex requests, as permitted by GDPR). You also have the right to withdraw consent (e.g., for marketing) at any time, without affecting the lawfulness of prior processing.
16 Account & data deletion
You can delete your account at any time directly in the app: go to Settings → Account → Delete Account. You can also request deletion by emailing privacy@pebby.app. When you delete your account, we delete your personal data within 30 days, except records we are legally required to retain (such as financial records). For what happens to shared-group data, see the shared-care section above.
17 Business transfers
If Pebby or CREATIVE VLU SOLUTIONS SRL is involved in a merger, acquisition, financing, reorganisation, or sale of assets, your personal data may be transferred as part of that transaction. We will ensure any recipient continues to protect your data consistently with this policy, and we will notify you of any change in the controller of your data and any material change to how it is handled.
18 Do Not Track & Global Privacy Control
Some browsers offer “Do Not Track” (DNT) signals or a Global Privacy Control (GPC). Our website sets no advertising or analytics cookies, so there is currently nothing for these signals to opt you out of. If we ever introduce such technologies, we will honour recognised opt-out signals such as GPC where they are legally effective.
19 Third-party links
Our app and website may contain links to third-party sites or services (for example, our processors' policies). This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review their policies before providing them with personal data.
20 Security
We take the security of your data seriously. All data is transmitted over encrypted connections (TLS/HTTPS). Data is stored with access controls limiting who within our organisation can view it. Payment data is never stored on our servers; it is tokenised and handled entirely by Stripe.
No system is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by GDPR (and UK GDPR) without undue delay.
21 UK users: UK GDPR
If you are in the United Kingdom, your personal data is protected under the UK GDPR and the Data Protection Act 2018. You have the same data-subject rights described above. Our lawful bases, retention periods, and international-transfer safeguards (using the UK Addendum or IDTA) apply equally to you.
If you are not satisfied with our response to a privacy request, you have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk.
22 US users: your state privacy rights
This section applies to residents of US states with comprehensive consumer-privacy laws (including California's CCPA/CPRA, Virginia, Colorado, Connecticut, and others). It supplements the rest of this policy.
We do not “sell” your personal information, and we do not “share” it for cross-context behavioural advertising.
Categories of personal information we collect: identifiers (name, email, device IDs); commercial information (subscription/billing history); internet/usage activity; approximate location (from IP); and information you enter about baby care. We collect these for the business purposes described above and do not collect them for sale.
Your rights include the right to know/access, delete, correct, and opt out of sale/sharing and targeted advertising, and the right not to be discriminated against for exercising them. To exercise these rights, email privacy@pebby.app.
Authorised agents. You may use an authorised agent to submit a request on your behalf. We may require the agent to provide proof of authorisation and may ask you to verify your identity directly.
US consumer health data (Washington, Nevada, Connecticut)
Some data you enter about your baby may be considered “consumer health data” under laws such as Washington's My Health My Data Act and similar Nevada and Connecticut laws. We collect such data only to provide the service, with your consent; we do not sell it; and we do not share it with third parties except the processors strictly necessary to operate the service.
23 Changes to this policy
We may update this Privacy Policy from time to time. For material changes, we will notify you at least 30 days in advance by email or via an in-app notice. The “Effective date” at the top of this page will always reflect the most recent version. Continued use of Pebby after changes take effect constitutes your acceptance of the updated policy.
24 Contact us & supervisory authorities
For any privacy-related questions, requests, or complaints:
If you are not satisfied with our response, you have the right to lodge a complaint with your data protection supervisory authority. In Romania, this is:
ANSPDCP, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal · www.dataprotection.ro
UK residents may complain to the ICO (ico.org.uk). EU residents may also contact the supervisory authority in their country of residence.
Effective date: 18 June 2026 · © 2026 CREATIVE VLU SOLUTIONS SRL