This is a translation. The Spanish version prevails.
Baby Cocoon Privacy Notice
Last updated: 2026-10-24
Simplified notice
- Epifanias Digitales LLC is responsible for your personal data.
- Before you create an account, your baby's and your pregnancy data are stored only on your phone.
- We record data about your account, your family, your baby and your pregnancy, including the child's health data (sensitive data): feeds, sleep, diapers, medicines, temperature, measurements, milestones, vaccines and photos. Also the pregnancy data you record yourself (symptoms, kicks, weight, mood, contractions and questions for your visit) and your prenatal appointments and studies. If you say so, whether you are the pregnant person or her partner; your doctor's contacts (name and phone number); the birth plan, the hospital bag and the questions for the pediatrician.
- We use your data only to run the app: store it, sync it with your family, send you notices and manage your subscription. No advertising, no sale of data, no tracking, and we do not train artificial intelligence models with it.
- Reports and the birth plan are generated on your phone and you send them to whomever you choose; they do not go through our servers. Only if you create a read-only link to a pediatric report do we keep a copy for 7 days.
- Our servers and our providers' servers are in the United States; we make international transfers to the processors listed below.
- To process the child's health data we ask for your express consent. You can revoke it in Settings.
- You can exercise your rights of access, rectification, cancellation and opposition (ARCO) by writing to privacy@{{DOMINIO}}.
- You can delete your account from the app or on the Delete your account page.
Full Privacy Notice
1. Controller
The party responsible for processing your personal data is Epifanias Digitales LLC, trade name Baby Cocoon.
- Address: United States (USA)
- Website: {{DOMINIO}}
- Privacy email: privacy@{{DOMINIO}}
2. Personal data we collect
| Category | Data |
|---|---|
| Account | Email address, name, Apple or Google identifier if you sign in with them |
| Family | Family name, time zone, members, roles, relationship to the baby, profile photo, whether you are the pregnant person or her partner (you tell us) |
| Baby (sensitive data) | Name (optional during pregnancy), stage (pregnancy or born), birth date, due date, sex, photo |
| Pregnancy (sensitive data) | Due date, gestational week (computed on your phone and not stored), pregnancy moments (photos and notes) |
| Mother's log (sensitive data) | Symptoms and their intensity, kick sessions, weight, mood, contractions and questions for your visit. Only the pregnant person records it, about herself, except contractions, which her partner can also start and end. Includes the first movements she marks. |
| Appointments and studies (sensitive data) | Type (visit, ultrasound, lab test), date and time, with whom and where, notes on what you were told and result photos. |
| Health contacts | Name and phone number of your doctor, midwife, pediatrician or hospital that you save to call with one tap. |
| Birth plan and hospital bag (sensitive data) | Your birth preferences by section, notes and the hospital bag list. |
| Questions for the pediatrician (sensitive data) | The questions the family notes down for the baby's visit and whether they were answered. |
| Report links (sensitive data) | If you create a read-only link, a copy of the pediatric report (the baby's name and age, growth, feed, sleep and diaper averages, milestones, vaccines and, if you include them, your questions) and who created it, for 7 days. |
| Care records (sensitive data) | Feeds, bottle content, sleep, diapers, medicines and doses, temperature, notes |
| Measurements (sensitive data) | Weight, length and head circumference |
| Milestones and vaccines (sensitive data) | Developmental milestones checked and vaccine doses applied |
| Moments | Photos, text, reactions and comments from the family |
| Consents | Record of the consents you grant or revoke, with version and date |
| Notifications | Your device's push notification token |
| Purchases | Subscription status (active, trial, expiry, product) reported by RevenueCat, and an anonymous purchase identifier before you create your account |
| Sessions | IP address and user agent of your sessions (security and abuse prevention) |
| Technical | Server logs for security and error detection |
The baby's, the pregnancy's and the mother's health data, the appointments and studies, the birth plan, the questions for the pediatrician and the reports are sensitive data. We do not collect precise location, your phone's address book or advertising identifiers.
Before you create an account
You can use Baby Cocoon without creating an account. Until you do, your baby's and your pregnancy data are stored only on your phone and are not sent to our servers. In that mode the app contacts only two services: RevenueCat, with an anonymous identifier, to check, restore or make purchases after the initial setup (no health data), and Expo, to check for app updates (no personal data). Before an account we use no push notifications and no analytics. When you create your account, the data stored on your phone is uploaded to your family's space on our servers.
3. Purposes
We process your data only for these purposes, all necessary for the service:
- Create and maintain your account and your family.
- Store and sync the baby's records across the family's devices.
- Send notices you turn on (for example, when another member logs something).
- Email you sign-in codes.
- Manage your subscription and verify your purchases.
- Protect the service against abuse and handle errors.
- Generate reports and the birth plan on your phone as a PDF or text for you to share and, if you ask, a temporary read-only link to a pediatric report.
We have no secondary purposes: no advertising, no marketing profiles, no sale of data, no tracking and no artificial intelligence training.
4. Express consent for the child's health data
Care records, measurements, milestones and vaccines are health data of a minor and therefore sensitive data under the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) currently in force. By accepting this notice and the consent on your baby's health and pregnancy data, which is recorded on your phone before any of that data is captured and uploaded with your account, you declare that you are the baby's mother, father or legal guardian and you expressly consent to its processing for the purposes in section 3.
The same express consent covers the data of your own pregnancy that you record yourself (symptoms, kicks, weight, mood, contractions and questions) and your appointments and studies. The same consent covers the birth plan, the questions for the pediatrician, the reports and your partner's access to contractions. Because this notice changed, the app asks each member to accept it again.
You can revoke this consent in Settings. Once revoked, we stop syncing new health data. Revoking does not erase what is already stored; to do that you can delete your account (section 8). If we update this notice, we will ask for your consent again.
5. Processors and international transfers
We use providers that process data on our behalf (processors) and do not use it for their own purposes. Their servers are in the United States, so there are international transfers of data.
| Provider | Purpose | Data | Country |
|---|---|---|---|
| Vercel | Server hosting | All data passing through the API and the report link page | United States |
| Turso | Database | Account, family, baby and record data, and the copy of a report with a link while it is active | United States |
| Cloudflare (R2) | Photo storage | Baby, moment, profile and study result photos | United States |
| Amazon Web Services (SES) | Sending sign-in code emails | Email address | United States |
| RevenueCat | Subscription management | Anonymous identifier (before an account) or user identifier, purchase status | United States |
| Expo | Push notification delivery (account only) and app update checks | Notification token; app version | United States |
| Apple and Google | Sign-in and store purchases | Account identifier, purchases | United States |
Beyond these processors and the family you invite, we do not share your data, except when required by a competent authority.
6. Shared family
If you invite someone, they can see the baby's data and the family's moments according to their role: Owner (manages the family and can edit), Caregiver (logs and edits care records) and Viewer (read and comment only). You choose the role when you invite. Members see your name and profile photo.
The mother's log (symptoms, kicks, weight, mood, contractions and questions) is recorded only by the pregnant person, about herself, and only she and the family's owners can see it, with one exception: contractions are also seen, and can be timed, by the member who said they are her partner or the pregnant person, if they are an owner or caregiver; viewers never receive them. Appointments and studies, with their notes and result photos, are seen by owners and caregivers; viewers never receive them. Result photos are kept in private storage, like moments.
Health contacts, the birth plan and the hospital bag, and the questions for the pediatrician are seen and edited by the family's owners and caregivers; viewers never receive them. Birth plan preferences (for example, about pain or breastfeeding) reach any caregiver you invite this way.
Pregnancy and pediatric reports and the birth plan are generated on your phone, as a PDF or text, with the data you can see (the pregnant person or an owner), and you send them to whomever you choose from your phone's share sheet (for example, WhatsApp or email). Our servers do not receive those files; once you send them, whoever receives them keeps them under their own rules.
An owner or caregiver can create a read-only link to a pediatric report. To do so we keep a copy of that report on our servers for 7 days; we delete it at most 24 hours after it expires, or as soon as you revoke the link. Until then, anyone who has the link can read the report, so share it only with whoever should see it. The link does not appear in search engines.
Ask Cocoon answers on your phone using our own content and your records stored on the phone; it does not send your question to our servers or to any other service.
Appointment reminders are local notifications on your phone: they do not go through our servers and on the lock screen they only say "You have an appointment" with the date and time. "Add to my calendar" opens your own phone's dialog to create the event; the event is created only if you confirm it, carries the appointment's title, time and "with whom and where" to the calendar you choose (which may sync with iCloud, Google or a work account), and Baby Cocoon never reads your calendar.
7. ARCO rights and revocation
You have the right to access your data, rectify it, cancel it and oppose its processing (ARCO), and to revoke your consent.
- Write to privacy@{{DOMINIO}} from the email address you registered with.
- State your name, which right you are exercising and which data it concerns.
- We reply within 20 business days at most and, where appropriate, apply the change within the following 15 business days.
If you believe your right was not honored, you may turn to the competent data protection authority in Mexico.
8. Deleting your account
From the app: Settings > Delete account. There is also a public page: Delete your account.
- Your account, your moments, comments and reactions, your profile photo and their photos are deleted.
- If a member leaves the family or deletes their account, their mother's log is deleted, except the contractions they recorded, which stay as part of the family's birth record; the notes and photos of the appointments they created are removed (the date stays in the family calendar) and the report links they created are deleted. Health contacts, the birth plan, the bag and the questions stay as family data.
- The family's care records stay as the family record and appear as "Former member".
- If you are the last owner, the longest-standing member with edit rights takes over; if there is none, the whole family and its photos are deleted.
- We keep the purchase-status record linked to your identifier, only to reconcile billing.
9. Retention
We keep your data while you have an account. When you delete it, data is erased as described in section 8. Technical logs are kept for a short period for security. Data stored only on your device is erased when you delete your account or uninstall the app. The copy of a report with a link is deleted at most 24 hours after its 7 days of validity, or as soon as the link is revoked, or if the baby or the family is deleted.
10. Security
Data travels encrypted (TLS). Photos are in private storage and delivered with temporary links of limited life. Access to a family's data is limited to its members. Each report link uses a long random code that we store encrypted with a hash function; the page is not cached or indexed.
11. Minors
Baby Cocoon is an app for adults (18 or older). It records data about a minor under the control of their mother, father or guardian. We do not create accounts for minors and do not collect data from them directly. If you believe a minor created an account, write to us and we will delete it.
12. Informational content
Baby Cocoon's health content (milestones, vaccines, growth charts, tips) is general information. Pregnancy content (week by week) is general information and does not replace a visit to your doctor. The kick counter and contraction timer are informational and do not replace your doctor. The 5-1-1 rule of the contraction timer is an informational reference. The day plan and intense weeks are estimates, not schedules. Reports show data only, without interpreting it. It does not replace your pediatrician and offers no diagnosis or treatment. In an emergency call your local emergency number (911 in Mexico).
13. Changes to this notice
We may update this notice. We will publish the new version at {{DOMINIO}} and, if the change is important or alters the purposes, tell you in the app and ask for your consent again where required. The last-updated date is the publication date.
14. Contact
- Email: privacy@{{DOMINIO}}
- Controller: Epifanias Digitales LLC
- Address: United States (USA)