Privacy Policy

1. Introduction

This Privacy Policy describes how Promptify Corp ("MomNotes", "we", "us", or "our") collects, uses, discloses and safeguards your personal data when you use the MomNotes mobile application and this website (together, the "Service").

By creating an account or otherwise using the Service, you acknowledge that you have read and understood this policy. If you do not agree with it, please do not use the Service.

MomNotes is designed for a single adult account holder. There are no shared accounts, no co-owners, and no mechanism by which another MomNotes user can view the contents of your account.

This policy applies to personal data processed by MomNotes. It does not apply to third-party services that you may access separately, which are governed by their own privacy policies.

2. Types of Data We Collect

2.1 Information you provide

• Account information — your name, email address, and the sign-in provider you used (Sign in with Apple or Google). We do not create, receive or store passwords.
• Profile information — the name your children call you, your display name, your chosen accent colour, your signature line, and an optional profile photograph.
• Family information — a family name and, for each child, their name, nickname, date of birth and gender where you choose to provide them.
• Content you create — notes, milestones, growth entries and sealed letters, including titles, body text, occasions, reveal dates and reminders.
• Media — photographs and videos you attach to notes, and the photographs you select as a child's profile image.
• Health-related measurements — your child's height and weight, where you choose to record growth entries.
• Voice recordings — audio you record to dictate a note. See Section 3.2.
• Order information — delivery name, postal address and contact email when you order a printed book or keepsake.
• Correspondence — the content of any message you send us for support.

2.2 Information collected automatically

• Usage and diagnostic data — a fixed set of product events (for example, that a note was created, that a transcription failed, that checkout began) together with non-content properties such as counts and categories, plus crash reports. This data is associated with an anonymous device identifier.
• Device and subscription identifiers — a push notification identifier for each device on which you enable notifications, the device platform, and the customer identifier assigned by our subscription provider.

2.3 Data we do not collect

• We do not collect your precise or approximate location.
• We do not collect your contacts, calendar or health app data.
• We do not receive or store payment card details. These are handled directly by Apple or Stripe.
• We do not use advertising identifiers, ad networks or cross-app tracking technologies.

3. How We Collect Data

3.1 Directly from you

The substantial majority of the data MomNotes holds is created by you deliberately: each note you write, each photograph you attach, each child you add. The Service does not scan your device, your camera roll, or any content you have not explicitly selected. Access to your camera, microphone and photo library is requested only at the point of use and may be declined or revoked at any time in your device settings.

3.2 Voice recordings and automated processing

When you dictate a note, the audio recording is transmitted to our artificial intelligence processing provider, which applies a speech-to-text model to produce a transcript. That transcript is then processed by a second model that formats it into readable text and proposes a title. The original transcript remains available to you within the app.

The audio recording is discarded after processing. MomNotes does not retain voice recordings.

Separately, if you order a keepsake requiring a cut-out image, the single photograph you select is transmitted to an image-processing provider to separate the subject from its background. No other personal data accompanies it.

Your content is not used to train artificial intelligence models, whether ours or our providers'. Our providers process this content solely to return a result to us, under contractual terms that prohibit its use for their own purposes.

3.3 From third parties

When you sign in with Apple or Google, we receive your name and email address from that provider. When you purchase a subscription, we receive purchase and renewal status from Apple via our subscription management provider.

4. How We Use Data

We use personal data only to operate and improve the Service. Specifically:

• To create and administer your account and authenticate you.
• To store and synchronise your content across your devices, and to maintain a local copy on your device so the app functions without a connection.
• To convert voice recordings into text and format them into readable notes.
• To deliver notifications you have enabled, including letter reveals, resurfaced memories, activity reminders and order updates.
• To fulfil orders for printed books and keepsakes, including production, shipping and delivery tracking.
• To process subscriptions, apply entitlements and honour gift codes.
• To maintain security and integrity, including detecting abuse and enforcing fair-use limits.
• To diagnose faults and improve the Service through aggregated usage analytics and crash reports.
• To respond to your enquiries and provide customer support.
• To comply with legal obligations, including retention of financial records.

We do not use your personal data for advertising, for automated decision-making producing legal or similarly significant effects, or for profiling.

5. No Sale of Data

We do not sell your personal data. We have never sold personal data, and we do not share personal data for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act and comparable legislation.

We do not disclose your personal data to advertisers, data brokers, analytics resellers, or any party seeking to market to you. The only parties who receive personal data are the service providers listed in Section 7, each acting on our instructions and for the limited purpose of delivering the Service.

Because we do not sell or share personal data in this sense, there is no sale from which to opt out. Your other rights under applicable law are set out in Section 12.

6. Lawful Basis for Collection

If you are located in the United Kingdom or the European Economic Area, we rely on the following lawful bases under the UK GDPR and EU GDPR:

1. Performance of a contract — processing necessary to provide the Service you have signed up for, including storing your content, synchronising it, and fulfilling orders you place.
2. Consent — processing you have specifically agreed to, such as push notifications and access to your camera, microphone and photo library. You may withdraw consent at any time without affecting processing already carried out.
3. Legitimate interests — processing necessary to keep the Service secure, to prevent abuse, and to understand how the Service is used in a privacy-preserving manner. We have assessed that these interests are not overridden by your rights.
4. Legal obligation — processing required to comply with law, including the retention of financial and tax records relating to purchases.
5. Vital interests — processing necessary in rare circumstances to protect the life or safety of any person.

7. How We Share Data

We disclose personal data only in the following circumstances:

• To service providers who process data on our behalf, under contract, and only to the extent necessary to perform their function. These are listed in Section 8.
• To comply with law, where we receive a valid and legally binding request from a competent authority. We assess each request and disclose only what is required.
• To protect rights and safety, where disclosure is necessary to prevent harm, investigate fraud, or enforce our terms.
• In a business transfer, if MomNotes is involved in a merger, acquisition or sale of assets. We will notify you before your personal data becomes subject to a different privacy policy.

We do not disclose personal data to any other party for any other purpose.

8. Third-Party Services

MomNotes relies on the following service providers. Each is bound by contractual data protection obligations and receives only the data its function requires.

These providers act as data processors. They are not permitted to use your personal data for their own purposes, to sell it, or to disclose it except as we instruct or as law requires.

9. Data Security

We implement technical and organisational measures appropriate to the sensitivity of the data we hold, including:

• Encryption in transit and at rest for all stored personal data and media.
• Server-side authorisation on every request, scoped to the signed-in account. There is no mechanism by which one account can read another's content.
• Unguessable storage keys and short-lived signed links for photographs and videos, so media cannot be enumerated or accessed by URL alone.
• Delegated authentication to Apple and Google, so no password is ever transmitted to or stored by us.
• Restricted internal access on a need-to-know basis.

9.1 Your responsibilities

The security of your account also depends on the security of the Apple or Google account you sign in with, and of the device on which you use MomNotes. We recommend enabling a device passcode and two-factor authentication on your sign-in provider.

9.2 Limitations

No method of transmission or storage is completely secure. While we work to protect your personal data, we cannot guarantee absolute security.

10. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this policy:

• Your content — retained for as long as your account remains open. This is intentional: a letter sealed for a child's eighteenth birthday must still exist eighteen years later.
• Voice recordings — not retained; discarded once transcribed.
• Deleted items — removed from our database and storage when you delete them.
• Usage analytics — retained by our analytics provider on a rolling basis for diagnostic purposes.
• Financial records — order and transaction records are retained for the period required by applicable tax and accounting law, in anonymised form after account deletion (see Section 11.2).

11. Deletion of Your Data

11.1 Deleting individual items

You may delete any note, photograph, video, child or chapter at any time within the app. Deletion removes the record and its associated files from our storage; items are not merely hidden from view.

11.2 Deleting your account

You may delete your entire account within the app, at Profile → Account → Delete account. This permanently erases your notes, letters, milestones and growth entries; all associated photographs and videos; every child record and profile image; your chapters, achievements, profile, activity records, notifications, registered notification devices, and subscription record.

Two categories of record are retained in anonymised form, because we are legally required to keep financial records:

• Order records — the transaction record is retained, but the delivery address is erased, the contact email is removed, item descriptions are stripped of personal names, and the printed files are deleted. Only the destination country is retained, for tax reporting.
• Gift records — where you redeemed a gift, the transaction record is retained, but your name, email address and any accompanying message are erased.

Physical items already printed and shipped cannot be recalled. The underlying data is deleted in accordance with this section.

12. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and obtain a copy.
• Rectify inaccurate or incomplete data. Most information can be corrected directly within the app.
• Erase your personal data, as described in Section 11.
• Restrict or object to certain processing.
• Data portability — receive your data in a structured, commonly used and machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with a supervisory authority.

12.1 United Kingdom and European Economic Area

If you are located in the UK or EEA, the rights above arise under the UK GDPR and EU GDPR. You may lodge a complaint with your national data protection authority; in the United Kingdom this is the Information Commissioner's Office.

12.2 California

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information is collected, used and disclosed; to delete personal information; to correct inaccurate personal information; to opt out of sale or sharing (we do not sell or share — see Section 5); to limit the use of sensitive personal information; and to be free from discrimination for exercising these rights.

We honour these rights for all users, regardless of location.

13. How to Exercise Your Rights

Most rights can be exercised directly within the app. You can edit your profile, family and content at any time, adjust notification preferences under Profile → Notifications, and delete your account under Profile → Account.

For access, portability or any other request, contact us using our contact form, selecting "Privacy or data request". We may need to verify your identity, which we will normally do by confirming control of the email address registered to the account.

We aim to respond within 48 hours on business days, and complete formal requests within 30 days. Where a request is complex we may extend that period as permitted by law, and will inform you if we do. We do not charge a fee for responding to a request, and we will not treat you differently for making one.

14. Children's Privacy

MomNotes exists for a parent to record memories about their children. The app therefore holds personal data relating to minors, provided by the parent.

• Accounts are for adults. The Service is not directed to children and is not intended for use or registration by anyone under the age of 13 (or the applicable minimum age in your jurisdiction).
• We do not knowingly collect personal data directly from children. We do not permit children to create accounts, and the Service contains no social features, messaging, or public profiles through which a child could submit information.
• Data about a child is provided by their parent, is visible only within that parent's own account, and is never made available to other users.
• Children's data is never used for marketing, advertising, profiling or artificial intelligence training, and is never sold.

If you believe that a child has created an account, or that personal data relating to your child has been provided to MomNotes without appropriate authority, please contact us using our contact form. We will investigate and delete the relevant data promptly.

15. International Data Transfers

MomNotes is operated from, and its data is stored on infrastructure located in, the United States. If you access the Service from outside the United States, your personal data will be transferred to and processed there, where data protection law may differ from that of your jurisdiction.

Where such transfers are subject to the UK or EU GDPR, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with contractual commitments from our service providers.

16. Data Breach Response

We maintain procedures to detect, investigate and respond to personal data breaches. In the event of a breach affecting personal data, we will act to contain the incident and assess its scope and impact.

Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you, we will notify you directly without undue delay, describing what occurred, the likely consequences, and the steps we have taken.

17. Do Not Track and Third-Party Links

Web browsers may transmit a "Do Not Track" signal. There is no accepted industry standard for responding to such signals, and this website does not respond to them. This is of limited practical consequence: we do not track users across third-party websites or applications, and we do not use advertising or cross-site tracking technologies.

This website and the app may contain links to third-party websites, including those of our service providers and the Apple App Store. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policy of any third-party site you visit.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, our practices, or applicable law. The date at the top of this page indicates when it was last revised.

If we make a material change, we will provide notice within the app before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

19. Contact Us

If you have questions about this policy, or wish to exercise any of your rights, please contact us:

We aim to respond to all enquiries within 48 hours on business days. Formal requests under Section 12 are completed within 30 days, as required by law.