KukumumaPrivacy Policy
Kukumuma is a baby-tracking and postnatal care app. It helps you keep notes; it is not a medical device. This page explains what we collect, why, who sees it, how long we keep it, and what you can do about it. We have written it to be read.
Who is responsible for your data
Kukumuma is operated by Creature Web Solution, a sole proprietorship at 2096 R No MHB Colony, Trimbak Road, Satpur, Nashik, Maharashtra 422007, India. Creature Web Solution is the data controller. Contact us about anything in this policy at [email protected]. Our servers are in US East (Ohio), on Amazon Web Services (us-east-2).
What we collect, and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: email address, your name, a sign-in identifier from Firebase/Google, the privacy-policy version you agreed to and when | To create your account, sign you in, and prove your consent | Contract (Art. 6(1)(b)); legal obligation to evidence consent |
| Your baby: name (a nickname is fine), date of birth, birth weight | To work out age and growth and show them to your partner | Your explicit consent (Art. 9(2)(a)) as this relates to health |
| Daily records you log: feeds, sleep, nappies, temperature, medicine, growth, cries, white-noise sessions, notes, and your own recovery notes | To give you your timeline, insights and reminders, and to sync them to your other phones and your partner | Your explicit consent (Art. 9(2)(a)) |
| Medications, doctors and appointments | Reminders and a shared care schedule | Your explicit consent (Art. 9(2)(a)) |
| Insurance and emergency details (blood group, allergies, conditions, contacts, policy numbers) | So you have them at hand. They are encrypted on your phone before upload (see "Security") | Your explicit consent (Art. 9(2)(a)) |
| Security records: your IP address, device name and the time of sign-ins and account changes | To protect accounts and investigate abuse | Legitimate interests (Art. 6(1)(f)) |
The app contains no advertising or analytics trackers. We do not sell data, and we do not use your data to profile you or to train AI models.
This website
kukumuma.com uses Google Analytics to learn which parts of the page help parents most, but only if you choose "That's fine" in the cookie banner. Until then no analytics cookie is set. IP addresses are anonymised, advertising features and Google signals are off, and nothing from the app reaches the website. You can change your choice at any time with "Cookie settings" in the footer. Google acts as our processor for this; the legal basis is your consent (Art. 6(1)(a)).
Your consent
Because information about a baby's health is a special category of data, we ask for your explicit consent when you create an account. You can withdraw it at any time by deleting your account (Settings → Your data → Delete my account). Withdrawing does not affect what we did before. Without consent we cannot provide the synced service.
Microphone, camera and calendar
- Microphone: used only while the cry monitor is switched on. Sound is analysed on your phone. The temporary recording is deleted straight away; only a short summary of the sound (for example loudness and pitch measures) can be saved as part of a cry entry. Audio is never uploaded.
- Camera / photos: only if you add a photo of an insurance card. Card photos stay on your phone.
- Calendar: only to add an appointment you create to your phone's calendar.
- Notifications: reminders are scheduled on your phone.
Who can see your data
- People you invite. Your family space can be shared with a partner, caregiver or viewer. You choose the role; what each role can see is limited (for example, only parents see insurance and emergency details). The owner can remove members.
- Service providers (processors). Google Firebase Authentication and Google Sign-In handle sign-in and may process your email address and sign-in identifier, including outside the EEA under Google's data-processing terms and standard contractual clauses. Our hosting provider stores the database in US East (Ohio), on Amazon Web Services (us-east-2).
- We do not otherwise share your data, except where the law requires it.
Security
- All traffic is encrypted with HTTPS. Sign-in tokens are kept in your phone's secure keystore.
- Insurance and emergency details are encrypted on your phone with AES-256 before upload. The key is stored on our server wrapped by a separate master key that is not in the database, so a stolen database or backup would not expose those details. Be aware that this is not end-to-end encryption: the running service can release the key to signed-in parents of your family. Your other records (baby profile, logs, medications, appointments) are stored on the server unencrypted at the field level.
- The database is not reachable from the internet, and we keep an audit log of security events that never contains health data.
How long we keep data
- Your data is kept while your account exists.
- When you delete a single entry, it is marked deleted so your other phones learn about it, and erased from our database after 30 days.
- When you delete your account, your account and everything stored with it is erased immediately from our live systems. If you are the only member, your family's records go with it; if others share your family you must first make another member the owner.
- Backups are made daily and kept for 14 days, so deleted data can remain in a backup for up to 14 days before it is overwritten. We do not restore deleted accounts from backups.
- Security log entries (including IP addresses) are erased after 180 days.
Your rights
Under the GDPR you can ask us to: access your data, correct it, erase it, restrict or object to its use, receive it in a portable format, and withdraw consent. Most of this you can do yourself in the app, under Settings → Your data: edit anything you logged, Export my data (a JSON file of everything we hold about you that you are allowed to see), and Delete my account. For anything else, write to [email protected]; we answer within one month. You can also complain to your local data-protection authority.
Children
Kukumuma is for parents and carers aged 16 and over. It stores information about a baby that you, as parent or guardian, choose to enter on their behalf.
International transfers
Our servers are in the United States (US East (Ohio), on Amazon Web Services). If you use Kukumuma from the EEA, UK or Switzerland, your data is therefore transferred to the US. Amazon Web Services acts as our processor under its data processing addendum, which includes the EU standard contractual clauses and also relies on the EU-US Data Privacy Framework. Google processes sign-in data under Google's own data-processing terms with the same safeguards. We operate from India and access the data from there, so it may also be accessed from India. You can ask us for a copy of these safeguards at [email protected].
Changes to this policy
If we change it in a way that matters, we will update the version number above and ask you to agree again in the app.
Contact
Creature Web Solution (trading as Kukumuma) · 2096 R No MHB Colony, Trimbak Road, Satpur, Nashik, Maharashtra 422007, India · [email protected]