Last Updated: July 2026
Version: 7.0.0 - Global Compliance & Privacy Shield
This document encompasses the Privacy Policy, End-User License Agreement (EULA), and Global Privacy Notices for the provisioning of the Cradly application worldwide.
Legal Framework (The Global Shield):
Binding Nature of the Document:
By downloading, installing, or beginning to use the application, you declare and undertake that you have read, understood, and accepted all provisions in this document.
Language of the Agreement & Comprehension:
The application and its comprehensive legal terms are provided primarily in English. By choosing to use the application and accepting these terms, you explicitly declare and warrant that you possess a sufficient understanding of the English language to comprehend the basic operation of the application, the provided legal summaries, and the associated legal risks. Users who do not possess sufficient language proficiency to understand these terms must not accept this agreement and should refrain from using the application.
Cradly is a local-first application built on the principles of privacy by design and data minimization. In accordance with Section 5 of the FTC Act prohibiting deceptive privacy practices, we explicitly declare how our architecture operates:
CRITICAL WARNING: ENCRYPTION KEY AND DATA SECURITY
Because the encryption key is generated and stored solely on your device, Cradly DOES NOT KNOW and TECHNICALLY CANNOT ACCESS this key.
Your data MAY BE PERMANENTLY LOST in the following situations:
Advanced Recovery Feature:
Our application attempts to repair corrupted local databases (SQLite) using built-in on-device tools. However, in cases of device loss, permanent formatting, or severe hardware crashes, data recovery is technically IMPOSSIBLE.
Cradly CANNOT recover your data from a central server under any circumstances and is NOT LIABLE for data loss because:
MANDATORY USER RESPONSIBILITY FOR BACKUPS:
The User is ENTIRELY RESPONSIBLE for the security and backup of their data. As a user, you must:
(Note: Features like cross-device syncing, cloud backups, or family sharing are currently disabled. Your data remains completely isolated and offline.)
Cradly accepts no liability for data loss experienced by users who ignore these warnings and fail to take regular backups.
In Cradly, the foundational legal agreements MANDATORY for accessing the app (e.g., EULA, Privacy Policy) are embedded as internal files (assets). Your consent to these foundational agreements is NEVER SENT to our servers; it is verified and stored 100% locally (offline) on your device.
Cradly only processes technical records on centralized servers (Supabase) for optional consent proof:
A. Optional Consent Records:
local_uuid_hash)consent_id)consent_type - e.g., AD_ALLOWED, CRASHLYTICS_ALLOWED)consent_text_hash)app_version)created_at)These cryptographic or pseudonymous tokens do not reveal individual identities. However, for maximum compliance, they are treated conceptually as personal data under global frameworks.
Cradly operates under the following legal roles regarding the processing of data:
A. Regarding Health Data (WE ARE NOT A DATA CONTROLLER OR BUSINESS):
Cradly acts strictly as a "Technical Infrastructure Provider" and is NOT a "Data Controller" (under GDPR/KVKK) or a "Business" (under CCPA) concerning the health data stored locally on the user's device.
Justification for This Legal Stance:
Our Responsibilities as a Technical Infrastructure Provider:
While we are not a Data Controller for your health information, we are obligated to provide a secure processing environment (acting effectively in a service-provisioning capacity). This includes employing AES-256 encryption standards, warning users about data loss risks (the need for backups), and complying with application-level security best practices.
Rights Regarding Your Encrypted Data:
Because Cradly has absolute Zero-Knowledge and zero access to the encrypted contents, legal rights (such as the Right to Rectification or the Right to Erasure) concerning health data cannot be addressed to Cradly. These rights remain inherently under the control of you, the device owner. You may exercise these rights directly within the application by modifying or deleting the entries yourself.
B. Regarding Optional Consent Data (LIMITED DATA CONTROLLER):
Cradly acts as a limited Data Controller exclusively concerning the pseudonymous consent logs (e.g., whether you accepted crash analytics). We determine the purpose (consent proof) and the means for this specific, highly limited processing.
Purpose: Storing optional consent records.
Server Location: EU-West-3 (Paris, France).
Transferred Data: Cryptographic hashes for consent logs. NO HEALTH DATA, NO CREDIT CARD INFO, NO NAMES are transferred.
Legal Basis & DPA: Processed based on Legal Obligation and Legitimate Interest. International transfers are governed by a Data Processing Agreement (DPA) incorporating Standard Contractual Clauses (SCCs) signed with Supabase Inc. (Executed Feb 28, 2026).
Scope: ONLY for users of the Free Version.
Advertiser Identifiers: Apple IDFA or Google GAID.
Data Controller for Ads: Google LLC operates as an independent Data Controller for the processing of advertising identifiers where applicable.
THE TWO-LAYER ADVERTISING FRAMEWORK:
The legal framework for displaying advertisements consists of two distinct layers:
1. Layer One: Ad Display (Contractual Condition)
Showing ads in the free version is an inseparable part of the Free Version EULA—the foundation of our freemium service model. It allows the app to be offered without charging a direct monetary fee. Therefore, the simple display of an ad relies on the performance of a contract (Terms of Service), not explicitly on user consent. To remove all ads entirely, you may purchase the Premium version.
2. Layer Two: Regional Personalization (NPA vs. Explicit Consent)
Whether the ads shown to you are personalized (using your IDFA/GAID) depends strictly on the geographical region in which the application is operated:
Note: The baby health data entered into the app is NEVER shared with advertising networks under any circumstances.
In addition to standard banner ads, Cradly offers rewarded ads that Free Version users can voluntarily watch in exchange for specific in-app features. These ads are completely optional and are never shown automatically.
Features Utilizing Rewarded Ads:
Activation Conditions:
Unlike standard ads, rewarded ads are NOT subject to the 7-day waiting period, the 8-record threshold, or the nighttime filter. Only the following two conditions must be met:
Completely Optional:
Watching a rewarded ad is never mandatory. Users who do not wish to view ads can purchase the Premium version to access these features ad-free or simply choose not to use the features.
Processed Data and Personalization:
Rewarded ads rely on the same consent decision as standard banner ads. In regions where Google UMP applies (EEA, UK, US regulated states), ads may be personalized or non-personalized based on your choice in the UMP consent form—Google's SDK makes the targeting decision based on the IAB TCF consent string. Outside these regulated regions, the application mandatorily applies the Non-Personalized (NPA) mode regardless of user action. Under no circumstances are baby health data shared with advertising networks or used for any ad targeting.
Cradly collects anonymous crash reports (Firebase Crashlytics) and usage analytics (Firebase Analytics) strictly based on explicit, optional user consent.
Purpose: Managing in-app purchases and subscriptions securely, and syncing them with app stores.
Data Processor: RevenueCat Inc.
Processed Data: Anonymous platform receipts and anonymous App User IDs. This data does NOT contain your name, email, or credit card. All payments are handled securely by Apple or Google; RevenueCat only verifies the transaction's success.
Legal Basis: Performance of a Contract and Legitimate Interest (Fraud Prevention). International transfers are safeguarded under SCCs.
HIPAA (Health Insurance Portability and Accountability Act):
CRADLY IS NOT A COVERED ENTITY OR A BUSINESS ASSOCIATE UNDER HIPAA.
This application is strictly a personal, consumer-facing record-keeping software tool. Because we do not collect, transmit, or process your health data on our servers, and we do not share it with healthcare providers, doctors, or health insurance companies, the data you enter is NOT protected by HIPAA regulations. Your data security relies entirely on the local device encryption and your device's security practices.
FDA (Food and Drug Administration):
This application is NOT a medical device, has not been evaluated by the FDA or any equivalent international medical authority, and does not provide medical diagnoses, treatment advice, or emergency alerts. (See EULA Section 3.1 for more details).
COPPA (Children's Online Privacy Protection Act - USA) & Global Equivalents:
While the subject matter of Cradly involves babies and children, the application is strictly designed for, and targeted at, parents and legal guardians aged 18 and older.
Cradly is NOT a "Child-Directed" application. We do not knowingly collect personal information from children under the age of 13 (or 16 under GDPR).
By using the application, you declare that you are the parent or legal guardian of the child(ren) whose data you enter, and you possess the legal authority to process such sensitive data on your own device. Device Security Warning: We strongly advise keeping your device locked to prevent accidental data deletion or modification by a child.
If you are a resident of California, Virginia, Colorado, or a state with a similar comprehensive privacy law, the following rights apply to the limited technical data we process:
If you are located in the EEA or the UK, your technical data (consent logs) is processed under the following legal bases (GDPR Art. 6):
Your GDPR Rights:
Because we do not have technical access to your locally encrypted health data (Zero-Knowledge), rights regarding access, rectification, and erasure of the health data itself must be exercised directly by you on your own device. For the deletion of technical consent logs on our servers, see Section 2.5.
Because of our "Local-First" architecture, we do not possess 99% of your data.
infocradlelog@gmail.com with the subject "Data Deletion Request". We will hash this ID, locate your records, and permanently anonymize or delete them within 30 days (unless required to be retained by law).NOT A MEDICAL DEVICE.
Cradly is an administrative tool designed to help parents record and organize baby care information. It is NOT a medical device, diagnostic tool, or a substitute for professional medical care.
USER AGREES THAT:
CRITICAL ALLERGY & DIETARY TRACKING DISCLAIMER:
Features tracking solid food introduction, recipes, or baby allergies function exclusively as a "Blank Digital Notepad." Cradly DOES NOT provide, endorse, or supply any pre-defined recipes, dietary recommendations, or medical advice. All food inputs and reaction records (e.g., rash, gas, allergies) are purely user-generated content. Cradly cannot guarantee the accuracy of your own notes or alerts. Parents and guardians maintain 100% absolute responsibility to consult a pediatrician for dietary choices and must seek immediate emergency medical attention if an allergic reaction occurs.
Cradly provides updates for security and new features. While we exercise reasonable technical care to ensure backward compatibility, local device environments are highly variable.
MANDATORY OPERATION - BACKUPS PRIOR TO UPDATES:
The User is OBLIGATED TO TAKE A BACKUP BEFORE INSTALLING ANY APPLICATION UPDATE.
Failure to do so may result in:
Cradly is NOT LIABLE for data loss resulting from the user's failure to create a backup before an update. Local devices may suffer data damage due to OS restrictions, hardware constraints, third-party software interruptions, or unforeseen technical errors, none of which Cradly controls.
DISCLAIMER OF WARRANTIES (COMMON LAW COMPLIANCE):
THE APPLICATION IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT PERMISSIBLE PURSUANT TO APPLICABLE LAW, CRADLY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE APP WILL BE BUG-FREE OR THAT THE DEVICE RELIABILITY WILL PREVENT DATA LOSS.
A. FREE VERSION LIABILITY (Freemium Model):
The free version is provided strictly on an "as-is" basis. Despite extensive technical safeguards designed by us (such as pre-update dynamic backups, schema auto-fixes, memory snapshots, and CSV export capabilities), device-level hardware/OS failures can occur. By using the Free Version, the user explicitly agrees that Cradly:
✓ Remains liable for intentional misconduct or gross negligence.
✗ Bears no liability for data loss beyond our technical control, as we provide all reasonable technical recovery safeguards locally.
B. PREMIUM VERSION LIABILITY (Capped Liability):
For users purchasing the Premium Version, Cradly's total, cumulative liability for all claims arising out of or related to this Agreement or the App shall not exceed the total Premium price paid by the user (e.g., $9.99). Liability is strictly limited to direct, foreseeable financial damages stemming from gross negligence or intentional misconduct. We do not compensate for indirect or consequential damages, emotional distress, lost time, or data loss resulting from missing backups or hardware issues.
C. STORAGE EXHAUSTION & EXTREME SYSTEM FAILURE:
We explicitly accept no liability if your creation of heavy digital assets (e.g., Uncompressed Video Journal entries) exhausts your physical storage capacity (Disk Full Exception). You acknowledge that a fully depleted hard drive may trigger severe Operating System crashes, silently terminate background alarm tasks, or result in irreversible corruption of your encrypted local database during active read/write cycles. Actively monitoring and maintaining sufficient free storage space on your device is strictly your responsibility. Although the application attempts to monitor available storage as a best-effort technical measure, Cradly cannot be held liable for any damages resulting from the operating system (iOS/Android) reporting inaccurate or fake available storage due to background cache processes or other apps consuming space simultaneously.
IMPORTANT NOTICE FOR PREMIUM SUBSCRIPTIONS:
The Premium version of Cradly is classified as digital content supplied instantly in a non-tangible medium. Under applicable global consumer protection laws (including the EU Consumer Rights Directive), you explicitly consent to perform the contract immediately upon purchase and acknowledge that you will lose your 14-day right of withdrawal (refund right) once the download or access begins. Refund requests are governed strictly by the policies of the platform where you purchased it (Apple App Store or Google Play Store). Cradly cannot override these platform policies.
The alarm and reminder functions of Cradly are subject to the restrictions of your device's local Operating System (Apple iOS or Google Android). The application does not use remote servers for push notifications (Offline/Local-First functionality); instead, it relies on local notification scheduling running directly on the device.
As a User, you explicitly understand and agree to the following technical facts:
Cradly provides tools (such as "Native Share" or "Export") allowing you to share your baby's photos, journals, or related statistics outside the application (e.g., to Instagram, WhatsApp, or saving natively).
Cradly includes a Voice Assistant feature that facilitates logging data using voice commands.
Subject to any mandatory overriding consumer protection laws of the jurisdiction in which you reside, these Terms and Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of Turkey.
BINDING ARBITRATION AND CLASS ACTION WAIVER (FOR US AND NON-EU USERS):
Any dispute, claim, or controversy arising out of or relating to this Agreement shall be determined by binding arbitration rather than in court. You and Cradly agree to waive the right to a trial by jury or to participate in a class action. For claims under $10,000, the arbitration will be conducted based solely on written submissions (Online Dispute Resolution) to minimize legal costs for both parties. By agreeing to this, you understand that your remedies are limited to individual arbitration and you cannot force Cradly into a foreign courtroom.
This agreement enters into force the moment the user completes the in-app consent flow.
Cradly reserves the right to amend these terms. Significant changes (e.g., broader data processing scopes) will be pushed via an application update, triggering a new mandatory required consent screen to ensure compliance. Refusal to accept updated terms may prevent further use of the application.
Jurisdiction Change and Re-Consent: Upon each launch, the application automatically detects the user's legal jurisdiction based on their IP address and device locale. If the device enters a different legal jurisdiction (e.g., moving from an unregulated region to the U.S. regulated states covered by CCPA/CPRA, or vice versa), or if the applicable legal text has been updated for the user's current region, the application will present the applicable regional legal document and require a new affirmative acceptance. Access to the application is conditioned upon acceptance of the terms applicable to the user's current jurisdiction. Prior consent records are not invalidated; all records are retained in encrypted form on the device.
If any provision of this Agreement is found to be unenforceable or invalid under any applicable law, such unenforceability or invalidity shall not render this Agreement unenforceable or invalid as a whole, and such provisions shall be deleted without affecting the remaining provisions herein. The valid portions of the agreement, especially the limitations of liability, shall remain in full force and effect.
Sections relating to limitation of liability, disclaimer of warranties, arbitration, and data zero-knowledge architecture shall survive any termination of this agreement or deletion of the Application by the user.
Cradly offers the ability to manage your baby's data from multiple phones (Family Sync). When devices are paired, data is physically copied to the paired devices. The fact that partner phones synced via this feature will have direct access to baby data is a risk explicitly accepted by the user, and the primary user is fully responsible for whom they share data with. Since Cradly does not use a central server, data transfer occurs exclusively and encrypted (End-to-End Encrypted) over your local network (e.g., the same Wi-Fi). Despite this, any risks of unauthorized access or sniffing attacks on the Wi-Fi network used are entirely the user's responsibility. Therefore, it is strongly recommended that this feature be used only on secure, private home networks where you know the password.
Connection Revocation and Data Deletion Policy:
Due to our local architecture, if the main device (Host) revokes a partner's connection, previously synced data cannot be remotely wiped from the partner's device. Revoking access only halts future data flow. The partner must manually delete the baby profile from their "Babies" screen to clear the data.
If the main device completely deletes a baby or resets the app, this bulk deletion syncs and wipes the data on the partner devices. However, a bulk deletion of a baby initiated by a partner device (Client) will not delete the baby on the main device. Only the deletion of individual data entries (e.g., a single feeding record) is synchronized and deleted on both devices simultaneously. The main user is solely responsible for managing the data they share.
Premium Subscription Sharing and Temporary Access Right:
Cradly supports sharing Premium features with family members through two different methods: