01Who we are
Firstlings: Baby Journal ("Firstlings", "the app") is a baby diary for Android and iOS. It is published by Barrens Soft (trade name), the independent software studio operating under the name Barrens Soft ("we", "us"). Barrens Soft is the data controller. If a company takes over the app, we will update this policy and tell you in the app. For the personal data described in this policy we are the data controller. We are not the controller of your diary: it stays on your device and in storage you control (see sections 3 and 4).
Postal address of the controller: Barrens Soft, Mihaylovo village 6051, Bulgaria. Contact for anything privacy-related: apps@barrenssoft.com.
02The short version
- There is no account and no login, and we run no server that holds your data.
- Everything you put in the diary (moments, photos, voice notes, letters, words, keepsakes, your child's name, birth date and avatar) is stored only on your device. We never receive it.
- Backup is optional and goes to your own Google Drive or iCloud. A ZIP export is a file you keep yourself.
- Usage analytics are collected only if you agree. Firebase Analytics is off by default and uses a fixed list of generic events. We also use Firebase for crash reports and remote settings. None of it contains text you typed, names, dates or diary content.
- The app is free to use. Without Plus it shows ads from Google AdMob, and it offers optional paid extras: Firstlings Plus (a subscription or a one-time Lifetime purchase) and Siblings (a one-time purchase). In the EEA, the UK and Switzerland we ask for your consent before any ad is requested, and you can change your choice in Settings → Privacy choices.
- To delete your data, use Settings → Delete all data, the delete options for single entries, or uninstall the app. Questions: apps@barrenssoft.com.
03Your diary stays on your device
Firstlings works offline. It keeps the following in the app's private storage on your phone or tablet:
- the children you add: name, birth date or due date, colour, and the avatar you build or the photo you choose for it;
- your diary: moments, firsts, words and sayings, letters, keepsakes, monthly photos, counters, and the photos and voice notes attached to them;
- your settings, such as theme, night hours, units, language, the reminder and the app lock.
We do not receive any of this, and it is never sent to our analytics, crash reporting, advertising or configuration services. Android's own device backup is limited to a few sound and media settings; the diary itself moves to a new phone only through the backup or the ZIP export described in section 4.
Uninstalling the app, or clearing its data in your device settings, removes everything stored on the device.
04Backup and export
You decide whether your diary leaves the phone, and where it goes.
- Cloud backup (optional, free): the app offers a backup to your own Google Drive, in its hidden app-data folder, or to your own iCloud on iPhone and iPad. It is off until you turn it on. The copy is uploaded straight from your device to your account with Google or Apple. We have no access to it and cannot read it. Google or Apple store it under their terms, and it counts towards your own storage.
- Google Drive access: when you turn on Drive backup, Google asks you to allow access to the app-data folder only (the
drive.appdatapermission). The app cannot see your other Drive files. You can remove the access at any time in your Google Account settings. - ZIP export: you can export your whole diary as a ZIP file and save or send it wherever you choose. Once exported, the file is under your control.
- PDF and share cards: books, cards and images you create are made on your device. They leave it only when you choose where to save or share them, and the sharing is done by the app you pick, not by us.
Firstlings' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your Drive is used only to back up and restore your diary for you, is never transferred to us or anyone else, and is never used for advertising.
05Photos and the gallery album
- Clean copies: the copy of a photo stored in your diary has its location (GPS) and other camera metadata removed. Only the date and time it was taken are kept, so the diary can place it on the right day.
- Gallery album: photos you take with the app's camera, and images you make in the app (such as cards), are also saved to a "Firstlings" album in your device's gallery. Photos you pick from your gallery are copied there only if you turn on "Also copy picked photos to the album" in Settings (off by default). On iPhone, depending on the photo access you allow, these copies may appear in Recents instead of the album. Deleting a moment in the app does not delete the copy in your gallery.
- Picking photos: the app uses the system photo picker, so it sees only the photos you select and needs no permission to read your gallery.
06Device permissions
Firstlings asks for a permission only when you use the feature that needs it, and works without it.
- Camera: for taking photos in the app, such as the monthly photo. Asked the first time you open the camera.
- Microphone: only for recording voice notes. Asked the first time you record.
- Notifications: only if you turn on the daily reminder (off by default). By default the reminder text on the lock screen does not show your child's name.
- Fingerprint or Face ID: only for the optional app lock. The check is done by your device; we never receive biometric data.
- Photos: no permission is needed to pick photos (system photo picker). On iPhone, the app asks to add photos to your library for the gallery album.
- Not requested: contacts, location, calendar or your Google or Apple account details beyond the Drive or iCloud backup you set up.
07Third-party services
To run the app we use the following services from Google (and the app stores for purchases). Firebase (Analytics, Crashlytics, Remote Config) is provided by Google LLC, which processes the data on our behalf as our processor under the Firebase data processing terms. Where stated, Google or Apple act as independent controllers. None of them receives your diary.
| Service | What is processed | Why |
|---|---|---|
| Firebase Analytics (only if you agree) | Off by default; it runs only after you agree to usage analytics. Then: events from a fixed allow-list, such as "moment added" (with a photo-count range), "sound started", "backup turned on", "paywall viewed" or "purchase completed" (with the product, such as Plus yearly), each with only preset values; whether you have Plus or Siblings; your ad-consent answer (personalised or not); a few events the SDK records itself (such as first open and session start); the app-instance ID; device, OS and app version; approximate country derived from the IP address. The advertising ID is not collected for analytics. Never free text, names, dates, ages, words or diary content: the app checks every event against the allow-list and drops anything else. | To understand which features are used and improve the app. Analytics data is not used for advertising. |
| Firebase Crashlytics | Crash reports and diagnostic data: device model, OS and app version, stack traces, technical log lines (with quoted text and database values removed), and a crash-report installation ID. If you have agreed to usage analytics, a crash report also includes the most recent analytics events from the same allow-list, as "breadcrumbs" of what happened just before the crash; they carry no diary content and no free text. If analytics is off, crash reports contain no breadcrumbs. | To find and fix crashes and errors and keep the app stable. Crash reports never contain diary content. |
| Firebase Remote Config | An installation ID and basic device and app information, used to fetch settings. | To adjust feature settings (for example ad limits or limits for free features) without an app update. It never carries diary content. |
| Google Sign-In / Google Drive | Only if you turn on Drive backup: your authorisation for the app-data folder, and the backup files moving between your device and your own Drive. | To back up and restore your diary in your own Drive (section 4). We never receive this data. |
| Apple iCloud | Only if you turn on iCloud backup: the backup files in your own iCloud. | To back up and restore your diary (section 4). We never receive this data. |
| Google AdMob and its consent tool (User Messaging Platform) (only without Plus) | Advertising ID or app set ID (where available and permitted), IP address and the approximate location derived from it, device information, your consent choices, and ad-request and ad-interaction data. | To show ads (section 8), measure them and prevent ad fraud. For ads, Google acts as an independent controller under its own privacy policy. |
| Google Play Billing / Apple App Store | Which product you bought, its status, renewal and trial dates. Payment details are handled entirely by Google or Apple. | For in-app purchases (section 9). Google and Apple act as independent controllers for the payment. We never see your card or payment details. |
Google's privacy policy: policies.google.com/privacy. How Google uses data from apps that use its services: policies.google.com/technologies/partner-sites. Apple's privacy policy: apple.com/legal/privacy.
08Advertising and consent
Firstlings is free to use and is paid for by ads from Google AdMob for people who do not have Plus. Ads appear as banners on browsing screens; as a full-screen ad, at most once a day, when you finish editing a child's avatar (never the first time you create it); and as rewarded videos that you can choose to watch to unlock an extra. Rewarded videos are always optional. With Firstlings Plus (subscription or Lifetime) the app makes no ad requests at all and shows no consent message for ads. Siblings alone does not remove ads.
- Calm by design: ads are never shown while you write or record in the diary, while sleep sounds play, at night (in your night hours or night mode), or in sharing, export, backup or purchase flows.
- Content: ads are limited to Google's family-friendly rating (G), and sensitive ad categories are blocked.
- EEA, UK and Switzerland: the ad service is not started and no ad is requested until you have answered Google's consent message (User Messaging Platform), which the app shows after you have started using it, never during setup. The message has three choices: "Consent", "Do not consent" and "Manage options", where you can choose individual purposes. If you do not consent, you can still use the app; Google then shows only non-personalised or limited ads, which are not based on your profile. You can change or withdraw your choice at any time in Settings → Privacy choices.
- United States: where a US state privacy law applies, the same Settings → Privacy choices row lets you opt out of the use of your data for targeted advertising (see section 14).
- Usage analytics are separate: Firebase Analytics is off by default and turns on only if you say yes on the one-time card in the app or switch on Settings → Share anonymous app counts. Turn the switch off at any time to withdraw. Your answer to the ad-consent message never turns analytics on, the advertising ID is never collected for analytics, and analytics data is never used for advertising.
- Android: AdMob uses your device's advertising ID for ads. You can reset or delete it in your device's Google settings.
- iOS: Firstlings does not ask for App Tracking Transparency permission, so Apple's advertising identifier is not available to us or to AdMob.
Ads never receive your diary content, your child's name or birth date.
09In-app purchases
The app is free to use. It offers optional paid extras through Google Play and the Apple App Store: Firstlings Plus, as an auto-renewing subscription (monthly or yearly) or a one-time Plus Lifetime purchase, and Siblings, a one-time purchase for more children. Payments are processed entirely by Google or Apple. The app reads the purchase status from the store on your device and keeps a small record of it on the device (which product, renewal or expiry date, trial end) so that Plus also works offline. This record is not included in backups or exports and is removed by Delete all data. If you have agreed to usage analytics, the purchase events listed in section 7 are counted too. We do not run a purchase server, we do not receive your purchase history, and we never see your card or payment details. Google and Apple keep their own purchase records under their privacy policies.
Subscriptions renew automatically until you cancel them. You manage and cancel them in your Google Play or Apple account, not in the app, and uninstalling the app does not cancel a subscription. Prices, renewal, cancellation and refunds are described in our Terms of Use.
10Legal bases (EEA and UK)
- Performance of a contract (Art. 6(1)(b) GDPR): providing the app, the backup you turn on, and your purchases, including checking with the store which extras you own.
- Legitimate interests (Art. 6(1)(f)): crash reporting, to keep the app stable and secure; remote configuration; showing non-personalised or limited ads to people without Plus, which keeps the app free; and answering your emails. None of it contains diary content. You can object at any time (section 14).
- Consent (Art. 6(1)(a) GDPR and the ePrivacy rules on storing or reading information on your device, in Bulgaria the Electronic Communications Act): usage analytics, personalised advertising, and storing or reading identifiers on your device for ads. You can withdraw consent at any time in Settings (Privacy choices for ads, Share anonymous app counts for analytics); this does not affect processing that took place before.
- Legal obligation (Art. 6(1)(c)): where we must keep or disclose data by law.
12How long data is kept
- Your diary on the device: until you delete it, clear the app's data or uninstall the app. A child you delete can be restored for 7 days and is then removed for good.
- Your cloud backup: in your own Google Drive or iCloud until you delete it (section 13).
- Crashlytics crash reports: kept by Google for up to 90 days.
- Analytics: event data is kept for no longer than 14 months, the maximum retention setting of Google Analytics for Firebase.
- Advertising data: retained by Google under its own policies. Your consent choices are stored on your device until you change them or uninstall the app.
- Purchase record on the device: until Delete all data or uninstall; Google and Apple keep their own purchase records.
- Emails you send us: as long as needed to answer you, and then deleted within a reasonable time unless we need them to establish or defend legal claims.
13Deleting your data
- In the app: delete single moments, letters and other entries, or delete a child with their memories (restorable from Family for 7 days).
- Everything on the device: use Settings → Delete all data. It deletes every child's diary, the photos and voice notes stored in the app, your settings and scheduled reminders, turns usage analytics off at once and, if you tick "Also delete my cloud backup", deletes your cloud backup first. Photos already saved to the Firstlings album in your gallery and ZIP files you exported stay where you saved them. Uninstalling the app or clearing its data in your device settings also removes everything on the device.
- Google Drive backup: in Google Drive settings, under Manage apps, delete the hidden app data of Firstlings, and remove the app's access in your Google Account if you wish.
- iCloud backup: delete it in your iCloud storage settings on your iPhone or iPad.
- Analytics and crash data: this data is not linked to your name, so we cannot look it up by person. If you want us to try, email apps@barrenssoft.com and we will help as far as Google's tools allow.
14Your rights
Depending on where you live, and in particular under the GDPR, you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to processing, including processing based on legitimate interests;
- data portability (your whole diary is also available to you as a ZIP export);
- withdraw consent at any time;
- lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. In Bulgaria this is the Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg); in the UK it is the Information Commissioner's Office (ico.org.uk).
Most choices you can make yourself, at once, in the app: withdraw analytics consent (Settings → Share anonymous app counts), change ad consent (Settings → Privacy choices), export your diary (ZIP) or delete it (Settings → Delete all data). For anything else, email apps@barrenssoft.com. Because there is no account and we do not know who you are, we may need details that help us find the data. We reply within one month, free of charge. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.
If you live in the United States. We do not sell personal data for money. When you see ads without Plus, Google receives identifiers (such as the advertising ID), IP address, approximate location and ad-interaction data (the categories "identifiers", "internet or other electronic network activity" and "geolocation data"). Under some state laws, such as those of California, Virginia, Colorado or Connecticut, letting Google use this data for personalised ads can count as "selling" or "sharing" personal data for targeted advertising. You can opt out in Settings → Privacy choices, or by deleting or resetting your device's advertising ID; with Plus no ad data is sent at all. Depending on your state, you also have the right to know, access, correct and delete your personal data and to appeal our answer. Email us to use them; we will not treat you differently for doing so. We do not knowingly sell or share the personal data of anyone under 16, and we do not use sensitive personal data to infer characteristics about you.
15Children and parents
Firstlings is made for parents and carers aged 18 and over. It is not directed at children: during setup a short "for grown-ups" check (a parent gate) asks you to confirm that you are a parent or carer aged 18 or over. The diary is about your child, but it stays on your device and in storage you control, so we do not collect children's personal data: you keep it for your own family. Nothing from the diary, including your child's name, birth date, photos or voice, is used for analytics or ads. Because the app's audience is adults, ad requests are not marked as directed at children, but ads are limited to the family-friendly G rating. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it. Please think of your child's privacy when you share cards, photos or exports outside the app.
16A diary, not a health app
Firstlings is a memory diary. It is not designed to collect medical or health data, we never receive any, and it gives no medical advice. Anything you choose to write or count in the diary (for example a first tooth, feeds or naps) stays on your device like the rest of it and is never sent to analytics, crash reports or ads.
17Security
Your diary is kept in the app's private storage, protected by your device's own security, such as screen lock and storage encryption. The optional app lock adds a PIN (kept in the Android Keystore or iOS Keychain, never in backups) and fingerprint or Face ID, and hides the diary from screenshots and the app switcher on Android. Data sent to Firebase, AdMob, Google Drive and iCloud is encrypted in transit.
18Changes to this policy
We will update this policy when the app or the law changes, for example when a new service is added or when a company takes over the app. The effective date at the top shows the current version. If a change is significant, we will also tell you in the app.
19Contact
Barrens Soft, Mihaylovo village 6051, Bulgaria · apps@barrenssoft.com