Pillowpine Privacy Policy

Effective date: October 25, 2026

Pillowpine is a baby log for iPhone, made by an independent developer. This policy explains what happens to your information when you use the app. In this policy, “we” and “us” mean the maker of Pillowpine.

The short version

• Everything you log, including your baby’s name and birthday, is saved on your phone.
• There is no account and no login.
• Nothing you log leaves your phone unless you turn on family sharing. Shared logs are end-to-end encrypted, so we can’t read them.
• Your logs are never saved to iCloud and are always left out of iPhone backups.
• There are no ads, no analytics, no crash reporting and no tracking. We never sell your data.
• Pillowpine Plus is billed and managed by Apple. We never see your card details.

What you log stays on your phone

Everything you log is saved on your phone. That includes feeds, sleep, diapers, pumping, growth, medicine, notes, your baby’s name and birthday, your family list and your settings. It is not sent to us or to anyone else, unless you turn on family sharing (see below).

There is no account and no login. We don’t have a dashboard of your data, so we can’t see it, and we never sell it.

Never in iCloud or iPhone backups

Your logs are never saved to iCloud. They are always left out of your iPhone’s backups, whether it backs up to iCloud or to a computer. The few times shown on the widget are also stored in a folder that is left out of backups.

To move to a new phone, save a backup file in Your data, or use family sharing, which is end-to-end encrypted.

Earlier test versions had an “Include in iPhone backup” switch. It has been removed. If you had turned it on, older backups may still contain your logs until they are replaced or deleted.

No ads, no tracking

There are no ads, no ad trackers, no analytics and no crash reporting service in Pillowpine. We don’t track you across other apps or websites, and we don’t share anything with data brokers.

Family sharing

Family sharing lets the people caring for your baby see and add to the same log. It is off until a parent turns it on in Family. Inviting one partner (a co-parent) is free. Adding caregivers, such as a grandparent or nanny, is part of Pillowpine Plus. A family can have two parents and up to 12 phones.

End-to-end encrypted. Each change (a log, a baby’s details, a freezer bag, your name, the family name and whether your phone has Pillowpine Plus) is locked on your phone before it is sent. The key is inside the invite QR code and never reaches our server, so we can’t read your logs, and neither can our hosting provider.

How it travels. Changes pass through our sync server, run by Cloudflare, our hosting provider. The server deletes each change after 30 days. Every phone in the family keeps its own full copy, and logging works offline.

What the server keeps, only while sharing is on:

• the encrypted changes, for up to 30 days;
• random IDs for the family, each person and each phone;
• scrambled versions (hashes) of each phone’s secret token and of the invite code;
• whether each person is a parent or a caregiver;
• notification choices;
• if family notifications are on, the phone’s Apple push token.

When someone adds a log, their phone also tells the server what kind of log it is (for example, “feed”), only so it can decide whom to notify. This isn’t saved. Your IP address is used to limit abuse and isn’t saved in our database. When the last phone leaves, or no phone opens the family for 180 days, the family is deleted from the server.

The invite QR code. Anyone who scans it can join and read your family’s logs, so show it only in person. A parent can remove a phone at any time. It stops syncing, but the logs already on it stay on it.

The app asks for the camera only to scan a family invite QR code. It never takes or saves photos or video.

Family notifications

With family sharing on, you can be notified when someone else logs. These notifications go through Apple’s push service and say only what kind of log was added, like “A feed was logged.” They never include names, amounts or notes. You choose all logs, some types or none, and you’re never notified about your own logs. A parent can turn notifications off for caregivers or limit them to some types.

Reminders, widgets and the Lock Screen

Reminders are scheduled on your phone only. Unless you turn on Show details, reminders don’t show your baby’s name or medicine names on the Lock Screen.

Feed, sleep and pumping timers can appear on the Lock Screen and in the Dynamic Island as a Live Activity. They never show your baby’s name.

The Pillowpine widget shows buttons to log. If you turn on Show details on widgets in Settings, it also shows how long it has been since the last feed, diaper and sleep, never a name. iPhone hides these details on the Lock Screen until you unlock. To show them, these few times are saved on your phone where the widget can read them, in a folder left out of iCloud and computer backups.

Importing from another app

You can import a CSV file exported from Nara Baby or Huckleberry. The file is read on your phone, and its logs are saved on your phone like everything else. It is not uploaded to us. Nara Baby and Huckleberry are trademarks of their respective owners. Pillowpine is not affiliated with or endorsed by them.

Pediatrician report

The pediatrician report (PDF or CSV) is free for everyone. It is made on your phone and goes only where you choose to send it. The temporary copy made for sharing is then deleted from the app.

Face ID

If you choose to lock Pillowpine with Face ID (or Touch ID or your passcode), iOS handles the check. The app only learns whether it succeeded and never receives your face data.

Anonymous feature suggestions

You can choose to send up to 4 feature suggestions from Settings. They are anonymous: they are sent without your name, email or an account. Each suggestion includes:

• the text you type (up to 280 characters);
• the app version;
• the time it was written, and a random ID used to avoid saving the same suggestion twice.

Suggestions are stored in a database run by Cloudflare, our hosting provider. They don’t include your logs, your baby’s details or information about your device. Your IP address itself is not saved. To limit spam, the server keeps a scrambled code made from it with a secret value, which changes every day.

Please don’t include your baby’s name or health details in a suggestion. Because suggestions are anonymous, we can’t link one to you, reply to it or find it later to delete it.

Your choices: export and delete

You can export everything at any time as a spreadsheet (CSV) or a full backup file. The file goes only where you choose to send or save it.

You can delete everything with one button in Your data. This removes every log, your baby’s details and your family from your phone. With family sharing on, it also takes your phone out of the family; the other phones keep their copies. Deleting the app also removes its data from your phone.

Pillowpine Plus and purchases

Pillowpine Plus is an optional auto-renewable subscription: $1.99 a month or $14.99 a year (US prices; your local price is shown before you confirm). Payment is charged to your Apple Account when you confirm. It renews automatically unless you turn off auto-renew at least 24 hours before the end of the current period. You can manage or cancel it at any time in your Apple Account settings. If Plus ends, nothing you logged is deleted, and core logging stays free.

Purchases are billed and managed by Apple. We never see your card details. The app checks your subscription with Apple on your phone, and your purchase is not sent to a server of ours. If the App Store can’t be reached, the app may contact apps.apple.com to check your connection, without sending cookies. Apple’s handling of your purchase is covered by Apple’s own privacy policy. Apple’s standard license agreement (EULA) applies to the app.

Health information and US state laws

What you log about your baby, such as feeds, sleep, growth and medicine, can be health information. We designed Pillowpine so that we don’t receive it in readable form: it stays on your phone, and when family sharing is on, it is end-to-end encrypted before it leaves your phone.

FTC Health Breach Notification Rule. If there were ever a breach of unsecured, identifiable health information that we hold, we would notify affected people, and the Federal Trade Commission where required, as that rule requires.

Washington’s My Health My Data Act and similar laws. We don’t sell health data, and we don’t use it for advertising. We don’t share it with anyone, except that encrypted family-sharing changes pass through our hosting provider, Cloudflare, which can’t read them. You can see, export and delete your data in the app at any time. Because we can’t read your logs, we can’t look them up or delete them for you, but you can always ask us a question or make a request at pillowpine.app@agentmail.to. If we ever deny a request, you can appeal by replying to our answer.

Children’s privacy

Pillowpine is made for parents and caregivers, not for children to use. We don’t knowingly collect personal information from children. The information about your baby that you enter stays on your phone, or is end-to-end encrypted if you use family sharing. If you think a suggestion included information about a child, please contact us and we will do our best to remove it.

Changes to this policy

If we change this policy, we will post the new version here and update the effective date. If a change affects how your data is handled, we will also tell you in the app before it takes effect.

Contact

If you have a question about this policy or your privacy, email us at pillowpine.app@agentmail.to. For help with the app, see Support.