Version 1.1 · Last updated: September 11, 2026
Privacy Policy
This policy explains what stays on your device and how account, payment, support and analytics information is handled. Please read it before using the service.
1. Controller and scope
BabyMoment is operated by Li Xiang, an individual in China. We determine the purposes and means of processing personal information for this service. Privacy and support contact: babymoment.app@gmail.com. This policy applies to https://www.babymoment.app and accompanies our Terms of Service.
2. Local photos and baby information
Your selected original photos, capture times and the birth date, name or nickname you enter are processed in your browser for date and age calculations, editing, videos and PDF exports. The product does not upload originals to our servers to perform these tasks. Photos and workspace data may be saved in local IndexedDB; birth dates, names, nicknames and preferences may be saved in browser storage so you can resume work. These do not sync to other devices when you sign in. Delete photos in the product or clear this website’s data in your browser settings. Signing out does not clear local photos. You manage and back up downloaded files yourself. If you voluntarily send photos or other information through email, WeChat or feedback, that content enters the relevant communication channel and is outside this local-processing arrangement. Avoid sending unnecessary children’s or sensitive information.
3. Information processed over the network
Accounts: email, user identifiers, verification and session information, and necessary authentication records. If you choose Google sign-in, the authentication service receives authorized basic profile information such as email, name and avatar. We do not receive your Google password. Transactions: account and buyer email, order and payment identifiers, amount, currency, payment and refund status, purchase time, access expiry, and necessary transaction records returned by the payment provider. Contact and feedback: email, phone number, WeChat ID, survey answers and support messages you voluntarily provide. Visits and usage: request IP address, browser and device information, referrer and page URLs, interaction events, usage statistics such as photo counts, and error or security logs. What each provider receives depends on the features and analytics settings in use. Analytics events do not require original photo uploads.
4. Purposes and legal bases
We use account information for sign-in and access management, transaction information for payment reconciliation, activation and refunds, and contact details to answer your requests. These activities are necessary to provide the services you request. Necessary logs support security, troubleshooting and fraud prevention. We retain transaction records required by law. Usage analytics help us understand and improve the product. Where the GDPR or similar laws apply, service delivery and billing rely on performance of a contract, mandatory records on legal obligations, and necessary security and support may rely on legitimate interests. Optional analytics or other processing that legally requires consent must rely on your consent. Reading this policy alone is not consent to all optional processing.
5. Cookies, browser storage and analytics
Necessary cookies and storage support sign-in, language preferences, free usage limits and workspace state. Blocking them may affect sign-in or local recovery. We use Google Analytics 4, Microsoft Clarity, Umami and Vercel Analytics to understand visits, referrals, clicks and feature use. Clarity can record page interactions for heatmaps and session replays. The product masks content areas such as photo previews, but not all page information is hidden. You can turn off analytics in this browser. After reloading, the website will no longer load these analytics tools. The preference is stored in a cookie for 365 days and applies only to this browser. It does not delete previously transmitted information and is lost if you clear cookies. Your browser also provides cookie and website-storage controls.
6. Providers and disclosures
We transmit relevant information to providers needed to operate the service: Supabase: authentication, sessions, order and access databases. Resend: sign-in verification email delivery and necessary delivery information. Waffo Pancake: online payment, billing and transaction processing. Payment card data is handled through the Waffo Pancake payment flow; BabyMoment does not store full card numbers on its servers. Vercel: website hosting and requests; Railway: hosting for contact and feedback APIs. Google: optional Google sign-in, Gmail support correspondence and Google Analytics. Microsoft Clarity, Umami and Vercel Analytics provide the analytics described above. If you choose manual WeChat communication or purchase, the relevant content is also subject to WeChat and payment-channel rules. Providers may independently process some information to meet their own legal duties; their policies do not replace our responsibilities for this service. We may also disclose necessary information to comply with law, respond to lawful requests or protect legal rights. Other disclosures will obtain authorization where required by law.
7. Security and incidents
The website uses HTTPS for account and service requests. Authentication is handled by the identity service, payment callbacks are signature-verified, and permissions restrict server data access. Local photo processing reduces original-image transmission. No system can guarantee absolute security. Protect your email, device and credentials. Do not send passwords, verification codes or full card numbers to support. If an incident affects personal information, we will investigate, contain and remediate it and notify relevant authorities and affected users where required, within the applicable legal deadlines.
8. Retention and deletion
Local photos, baby information and preferences remain in the current browser until you delete them, clear website data or the browser removes storage. We cannot remotely delete your local files. The analytics opt-out preference cookie lasts 365 days. Retention of server account, transaction, support and log data depends on service needs, dispute handling and applicable legal obligations. Contact babymoment.app@gmail.com to request deletion or ask about retention. Records required by law will be limited to the relevant purpose.
9. Your rights
Subject to applicable law, you may request information and access, copies, correction, deletion, restriction, portability, objection to certain processing or withdrawal of consent. Withdrawal does not affect the lawfulness of earlier processing. Send requests to babymoment.app@gmail.com. We may ask for proportionate information to verify account ownership, but will not require passwords or full card numbers. Account deletion does not automatically remove legally retained transaction records or photos on your device. You may complain to a competent local privacy or consumer-protection authority if you disagree with how your request is handled.
10. Service and marketing communications
Verification codes, security notices, order issues and policy updates are service-related communications. We use contact details you submit to respond to the relevant request. Contact babymoment.app@gmail.com to ask us to stop nonessential product communications; necessary service notices are unaffected.
11. International processing
We operate in China and use international cloud, email, authentication and payment providers. Information you submit over the network may be processed outside your country or region. Using these services does not automatically upload locally processed photos. Privacy protections may differ between countries. Where specific safeguards, assessments or consent are legally required for a transfer, those requirements must be met. Contact babymoment.app@gmail.com to ask about recipients and processing arrangements relevant to your data.
12. Children and their photos
The service is intended for users aged 18 or older, including parents or legal guardians processing children’s photos. Only use photos and information you are authorized to process, and avoid sending unnecessary children’s information to support or feedback channels. Adult use of local tools to process baby photos and ages does not mean we offer accounts to children. If you believe a minor has submitted personal information to us without appropriate authorization, contact babymoment.app@gmail.com so we can investigate and take appropriate deletion or other action.
13. Policy updates and third-party links
We update this policy as the product and processing practices change and revise the date on this page. Material changes are notified through the website or account email; where renewed consent is legally required, we will obtain it. Third-party links help explain provider arrangements. Their policies also apply when you independently use their services.
14. Contact
Controller: Li Xiang, an individual operating in China. Privacy requests, account deletion, support and security issues: babymoment.app@gmail.com. Describe your request and provide only necessary account information.