Privacy Policy

This Privacy Policy describes how Objectif Thunes (an Australian sole trader based in New South Wales, "we", "us", "our") collects, uses, stores, and discloses personal information when you use the Veilleuse mobile application (the "App") and the marketing website at veilleuse.app (the "Site"). We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and, where applicable, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

The short version. We ask for your email, and that's the entire signup. No phone, no demographic question, no password. Everything else in the App is information you choose to record about your child so the App can show it back to you: feeds, sleep, nappies, and similar daily entries. That information is yours, it is stored only to run the App for you and the people you share a child's log with, and it is never sold, shared with advertisers, or used to train AI. There are no advertising trackers, no third-party analytics, and no cookies on this Site. The App does send crash reports, so we can fix what breaks; they carry no name, no email and none of your child's records (§1).

By using the App or the Site you confirm you have read this Policy. If you do not agree, please do not use them.

1. Information we collect

We collect the minimum needed to run the App, and nothing more. The only identifier we require is your email, and only because that's how we send you a sign-in code. Everything else is optional and entered by you.

Email address (required, for sign-in only). We use it to deliver a one-time-password (OTP) code each time you sign in. We do not store or set a password. We do not send marketing emails by default.

Display name (optional). You may set a first name or nickname so the App can greet you and so people you share a log with can see who recorded an entry. It can be anything you like and can be changed or removed at any time.

Child records (optional, entered by you). To use the trackers you create a child profile (a name or nickname you choose, and optionally a date of birth) and record daily entries such as feeds, sleep, nappies, and free-text notes. Information about a child's feeding, sleep, and health can be sensitive information under the Australian Privacy Principles and special-category data under GDPR. We process it only with your consent, given when you create the record, and only to store it and show it back to you and the people you share the child's log with. You can delete any entry, any child profile, or your whole account at any time, and deletion removes the records from our systems within the period set out in §6.

Child picture (optional). You may give a child profile a picture: either one of the illustrated avatars built into the App, or a photo you choose from your phone. Choosing an avatar sends us only the avatar's name. A photo is uploaded to private storage, is shown only to you and the people you share the child's log with, and is replaced or removed when you change it or delete the profile.

Crash reports. When the App crashes or hits an unexpected error, it sends a crash report to our crash-reporting processor Sentry so we can find and fix the fault. A report contains technical details only: the error and where in the App it happened, the device model, operating system and App version, a random identifier for the installation, and the App's most recent requests to our server, which include internal record identifiers but no names and no content of your records. It never contains your email, your display name, your child's name or entries, or anything you said by voice. Sentry does not store your IP address.

Voice logging. If you log by voice, your phone turns what you say into text, with its own speech recognition or with its maker's speech service: Apple's on an iPhone, Google's on many Android phones. When that service is used, the sound goes to Apple or Google under their own terms. We never receive the sound. The text, your child's first name and which entries are currently running are sent to our server, which asks an OpenAI GPT model to turn them into draft entries. You check the drafts before anything is saved. We do not keep the text or any sound.

Asking about babies. If you are on the Family plan and type a question in Ask, the question goes to our server with the language of the App. The App first checks the question on your phone for words that point to an emergency, a medicine or a fever, and answers those itself without sending anything. For the other questions, our server works out your child's age in whole weeks from the date of birth you entered, then asks an OpenAI GPT model to pick the right guides and to answer in two or three sentences from the guides' own text. The model receives the question, the age in weeks and the guides, never your name, your email or your child's name. We do not keep the question or the answer on our server; the conversation is kept only on your phone. The guides themselves are the same for everyone: reading them sends nothing about you.

Reminders and timers on your other phones. If you allow notifications, your phone gives us its push address (a token from Apple's Push Notification service), with the App's language, your time zone and whether your phone shows a 24-hour clock, so that sleep and nappy reminders arrive in your language at your time. If a timer runs on the Lock Screen, the phone also gives us the token of that timer, so a timer started or stopped by someone you share the log with shows on your phone too. A reminder or a timer update carries your child's first name and the time of the entry. We remove a token when you sign out, when Apple tells us it no longer works, or when you delete your account.

Sharing records (functional). If you share a child's log with a partner or carer, we store who has access to which child so the App can show the right records to the right people. Nothing about a child is visible to anyone you have not explicitly shared with.

Subscription state. If you subscribe, the purchase is processed exclusively by Apple App Store or Google Play, and reconciled through our subscription processor RevenueCat. We receive a status flag (active / trial / cancelled / expired) and a customer identifier. We never receive, see, or store payment card numbers, bank details, or CVVs.

Network metadata. When the App or Site makes a request to our servers, we observe the source IP address. IPs are used strictly to: enforce rate limits (e.g. on OTP requests, to prevent abuse), detect and block automated attacks, and produce aggregate operational metrics. We do not derive location below country level from IPs, and we do not store IP-to-account joins beyond the rate-limit windows defined in §6.

Device-local data. Your sign-in session, your language choice, and a cached copy of recent records (so the App opens instantly and works briefly offline) are stored on your device using the operating system's secure on-device storage. The cache is a copy of records already held on our servers; nothing else in it reaches our servers.

Support correspondence. If you email us we keep the message, our reply, and any attachments for as long as needed to resolve the request and to maintain a record of the interaction (typically 24 months).

2. Information we do NOT collect

• We never ask for your last name, your date of birth, your gender, or any other identity attribute about you. Signup is email-only; a display name is optional.
• We never ask for a child's legal name or any government identifier. A child profile needs only a name or nickname of your choosing. A picture is optional, and a built-in avatar works as well as a photo.
• We never ask for your phone number, postal address, or any government identifier.
• We do not collect precise geolocation (no GPS, no Bluetooth scanning, no Wi-Fi triangulation).
• We do not collect contacts, calendar, or any other on-device source. The photo library is used only if you choose a picture for a child. The microphone is used only while you log by voice. Notifications are used only if you allow them, for reminders and for timers. The sound is turned into text by your phone, or by Apple's or Google's speech service. We never receive the sound.
• We do not embed advertising trackers, third-party analytics, or social-media pixels in the App. There is no Google Analytics, no Meta Pixel, no Mixpanel, no Amplitude. Nothing of that kind, anywhere. Crash reports (§1) are used only to fix faults, never for analytics or advertising.
• The Site uses no third-party analytics, no cookies for tracking, and no cookies that require consent under EU/UK rules. The only browser storage we use is functional (e.g. remembering your selected mode).
• We do not sell, rent, or trade personal information to third parties. Ever.
• We do not use your data to train machine-learning or AI models.

3. How we use information

We process the information described in §1 for the following purposes only:

• To provide the core functions of the App (authentication, storing and showing your records, sharing a child's log with people you choose, subscription gating).
• To compute the summaries and timelines the App shows you from your own records, and to send the reminders you have switched on.
• To answer the questions you ask in Ask from our guides.
• To deliver transactional emails (OTP codes, account-related notices).
• To protect the service against fraud and abuse (rate limiting, anomaly detection).
• To find and fix faults in the App from crash reports.
• To respond to your support, privacy, or legal requests.
• To meet our legal obligations (e.g. responding to a lawful demand from an Australian authority).

Under GDPR / UK GDPR, our lawful bases are: (a) performance of the contract for account, subscription and record-keeping functions; (b) legitimate interest for fraud prevention, security and fixing faults from crash reports; (c) your explicit consent for child records, which may include health-related information (Article 9(2)(a)); (d) legal obligation when required by law. Under the Australian Privacy Principles we collect sensitive information only with your consent and only where reasonably necessary for the App's functions.

4. Service providers (processors)

We use the following processors. Each is bound by a written agreement to handle your data only on our instructions, to maintain security safeguards at least equivalent to ours, and to notify us promptly of any incident.

• Turso: database hosting, in the United States (Virginia).
• Cloudflare R2: private file storage for a child's photo, if you upload one.
• Railway: backend application hosting, in the United States.
• Resend: transactional email delivery (OTP codes).
• RevenueCat: subscription state management.
• Upstash: short-lived rate-limit counters and caches.
• OpenAI: turns the text of a voice log into draft entries, and answers a question asked in Ask from our guides. OpenAI does not use this text to train its models and does not store it for later use. It keeps it in abuse-monitoring logs for up to 30 days, unless the law requires longer or it is needed to protect OpenAI's services or others from harm.
• Apple Push Notification service: delivers reminders and timer updates to iPhones (§1).
• Sentry: crash reporting (§1). Crash reports are stored in the United States.
• Apple App Store / Google Play: payment processing and store distribution. These are independent controllers under their own privacy policies; we only receive the subscription state described in §1.

5. International transfers

Some processors named in §4 store data outside Australia (typically in the United States or the European Union). Where personal data of EU/UK residents is transferred out of the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses approved by the European Commission (and the UK addendum where relevant). Where personal data of Australian residents is transferred overseas, we comply with APP 8 and take reasonable steps to ensure the recipient handles the data consistently with the Australian Privacy Principles.

6. Retention

• Account data: for as long as your account exists. Deleted within 30 days of account deletion.
• Child profiles and records: for as long as you keep them. Deleted within 30 days of you deleting the entry, the child profile, or the account.
• OTP codes: stored as a one-way hash; expire and become unusable within 10 minutes; purged within 24 hours.
• Rate-limit IP counters: purged within 1 hour (per-IP send window) or 60 seconds (per-email cooldown).
• Push tokens: until you sign out on that phone, Apple reports the token no longer works, or you delete your account.
• Crash reports: deleted by Sentry within 90 days.
• Server access logs: purged within 30 days unless we are required to retain them longer to investigate a specific incident.
• Subscription receipts: retained for 7 years to meet Australian tax and accounting obligations (Income Tax Assessment Act 1936 s.262A).
• Support correspondence: 24 months from last contact.

7. Your rights

Regardless of where you live, you can:

• Request a copy of the personal information we hold about you.
• Ask us to correct information that is inaccurate or out-of-date.
• Request deletion of your account and all associated personal information.
• Withdraw any consent you have given (this does not affect prior lawful processing).
• Lodge a complaint with us in the first instance. If it is not resolved, complain to your local supervisory authority (in Australia, the Office of the Australian Information Commissioner; in the EU/UK, your national data-protection authority).

Email contact@objectifthunes.com with the subject line "Privacy request". We respond within 30 days. We may ask you to verify control of the account email before acting on a request.

8. Security

Account credentials use OTP only (no passwords to leak). All traffic between the App and our servers is TLS-encrypted. Records are only ever returned to the account that created them and to accounts that account has explicitly shared a child with. Database access is restricted to least-privileged service accounts. Despite reasonable measures, no system is perfectly secure, and we cannot guarantee absolute security of information transmitted over the internet.

9. Data breach notification

If we become aware of a personal-information breach likely to result in a risk of harm to affected individuals, we will notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable, and in any case within the timelines required by the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988). For affected EU/UK residents we will additionally notify the relevant supervisory authority within 72 hours where required by Article 33 GDPR.

10. Children

The App is intended for parents, guardians, and carers, who must meet the age requirement in the Terms of Service. Children are the subject of records, never users of the App. Information about a child is entered by the adult responsible for that child, who gives consent on the child's behalf. When a child is old enough to exercise their own privacy rights under the law that applies to them, they may contact us to access or delete records about them. We do not knowingly allow anyone under 13 (or under 16 where local law sets a higher digital-consent age) to create an account; if you believe one has, contact us and we will delete it.

11. Changes

We may update this Policy from time to time. The "Last updated" date above always reflects the current version. Material changes that broaden the use of personal information will be announced in-app and via email at least 14 days before they take effect.

12. Contact

Objectif Thunes New South Wales, Australia contact@objectifthunes.com