Privacy Policy

01Who we are

Bamboo is made by KD incubator UG (haftungsbeschränkt), Schonensche Str. 13, 10439 Berlin, Germany, represented by its managing director, Daniel Kilders Diaz (“we”, “us”). We are the controller responsible for your personal data under the EU General Data Protection Regulation (GDPR). You can reach us at office@kdincubator.com.

This policy covers the Bamboo app for iPhone and Apple Watch, including its widgets and Live Activities, this website at trackwithbamboo.com, and the emails we send. We’ll update it when Bamboo comes to Android.

02What you keep in Bamboo

Bamboo is a diary for your family, so what’s in it depends on what you choose to add:

• Your baby’s profile: their name, date of birth or due date, sex at birth and gestational age at birth, and any optional details you add, such as allergies, blood type, medical notes, and your pediatrician’s name and phone number.
• Everyday notes: feeds (nursing, bottles, pumping and solids), sleep, diapers, growth measurements, temperatures, medicine and medicine schedules, vaccinations, and appointments and other calendar events, with any location or notes you add.
• Getting ready for birth: your due date, prenatal checklist, hospital bag list and timed contractions.
• Your settings: for example feeding reminders, your preferred starting side, and the charts you like to see.

Some of this is health information about your baby, and the prenatal tools can say something about a pregnancy. We treat all of it as sensitive.

03Using Bamboo without an account

Without an account, everything you add stays on your iPhone and, if you use it, your paired Apple Watch. It isn’t sent to us. If you back up your iPhone with iCloud or a computer, that backup can include Bamboo’s data, under Apple’s terms and your own settings.

Your subscription and any feedback you choose to send are handled as described below.

04When you create an account

An account is optional. You need one to sync your records across devices or to share them with a partner. When you have one, we process:

• Account details: your email address and password. We store your password only as a secure one-way hash, never in a readable form.
• Your family’s records: everything described in section 02, so it can sync between your devices and your family. Each record notes which family member added it.
• Family sharing: the email address of the person you invite, the invitation’s status, each member’s role (admin or partner) and an optional “mom” or “dad” label.
• Your devices: an identifier created by the app, a push notification token, how far each device has synced, when it last checked in, and whether alarms are allowed on it. We use these to keep your devices up to date and to deliver feeding reminders.
• Calendar links: if you subscribe to your family calendar in another calendar app, we create a private link for it. Anyone who has the link can read that calendar, so share it with care. You can revoke it in Bamboo at any time.
• Account emails: we send verification codes, partner invitations and password reset links from accounts@trackwithbamboo.com. We don’t use your email address for marketing.
• Security information: sign-in tokens, password reset requests and technical data such as your IP address, which we use to protect accounts, for example by limiting repeated reset attempts.

05Bamboo Pro subscriptions

Bamboo Pro is sold through Apple’s App Store. Apple handles the payment, so we never receive your card or bank details.

We use RevenueCat to check whether your subscription is active. RevenueCat receives purchase and subscription information from Apple, an app user ID (a random ID, or your family’s Bamboo ID when you’re signed in, so one subscription covers everyone in your family on all their devices), and basic technical information such as the app version, your device’s operating system and your App Store country.

06Feedback you send us

Settings in Bamboo includes a roadmap and forms for feature requests and bug reports, provided through Northlight. If you send something, we receive what you write and any contact details you choose to include. Bamboo doesn’t attach your baby’s records or your account details.

07This website

trackwithbamboo.com uses no cookies, analytics, advertising or third-party scripts, and we host its fonts ourselves. Like any website, our server receives the information your browser sends with each request, such as your IP address, the page you asked for and your browser type, so it can deliver the page and stay secure.

If you use the password reset page, the email address or new password you enter is sent to our servers to complete the reset.

08Why we use your information

• To provide Bamboo: running your account, syncing and sharing your records, sending reminders and account emails, and managing your subscription. This is necessary to perform our agreement with you (Art. 6(1)(b) GDPR).
• Health information: when you sync details about your baby’s health or a pregnancy, we process them only to provide Bamboo’s features, based on your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time by deleting those entries or your account. This doesn’t affect what happened before you withdrew it.
• Improving Bamboo: when an account is deleted, we anonymize its family’s records as described in section 11 and use what remains to improve Bamboo’s features. Anonymized records no longer identify anyone.
• To keep Bamboo safe and working: preventing misuse, protecting accounts, delivering this website and answering your feedback. These are our legitimate interests (Art. 6(1)(f) GDPR).
• When the law requires it: for example to respond to a lawful request from an authority (Art. 6(1)(c) GDPR).

09Who we share it with

We don’t sell your personal data, and we never share it for advertising. We share it only:

• With your family. The partner you invite can see, add, edit and delete everything in your shared family.
• With services that help run Bamboo, which may only use it on our behalf and under our instructions:

• DigitalOceanHosts our servers and this website.
• ConvexStores the records you sync.
• ResendDelivers our account emails.
• AppleHandles App Store purchases and delivers notifications. Notifications carry a reminder or a sync signal, never your diary entries.
• RevenueCatKeeps track of your Bamboo Pro subscription.
• NorthlightReceives feedback, but only if you send some.

• With calendar apps you choose. If you subscribe to your Bamboo calendar, that app, such as Apple Calendar or Google Calendar, downloads it from your private link.
• When the law requires it, or when it’s needed to protect someone’s rights or safety.
• If our business changes hands, for example in a merger, in which case this policy continues to protect your information.

10Transfers outside the EU

Some of these services are based in, or process data in, countries outside the European Economic Area, including the United States. When that happens, we rely on safeguards recognized by the GDPR, such as the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

11How long we keep it

• Your records: for as long as you have your account. When you delete an entry, we remove its contents from our servers right away and keep only a small technical marker, so your other devices know to remove it too.
• Your account: when you delete it, you’re signed out everywhere and your invitations, device registrations and calendar links are removed right away. If you were a partner, you leave the shared family, and the entries you added stay with it. A family admin needs to remove their partner before deleting their account.
• The 30 days after deleting: your account is locked: you can’t sign in, and nothing in it can change. If you deleted it by mistake, email us within 30 days and we can restore it. After 30 days we delete your email address, password and account.
• Anonymized records: at the same time, we anonymize your private family’s records. We remove names, notes and other free text, food, medicine and vaccine names, allergies, medical notes, your pediatrician’s details, calendar events, checklists and who added each entry, and we move all dates, including birthdays, by the same random number of weeks, so the real dates can’t be recovered. What remains, such as feeding amounts, sleep times, growth and temperatures, no longer identifies anyone, and we keep it to improve Bamboo.
• Short-lived details: verification codes expire after 15 minutes, password reset links after 30 minutes, invitations after seven days, and device registrations after 30 days without activity or when you sign out.
• Subscriptions: Apple and RevenueCat keep purchase records for as long as billing, tax and other laws require.
• Feedback: for as long as we need it to follow up and improve Bamboo.

12Keeping it safe

Your data travels encrypted over HTTPS. Passwords and password reset links are stored only as one-way hashes, sign-in tokens are short-lived, and every request is checked so only members of a family can reach its records. The app talks only to our own servers, never directly to our database.

No system is perfectly secure, so please use a strong password and keep your devices locked.

13Children

Bamboo is made for adults caring for a baby or expecting one. It isn’t meant to be used by children, and we don’t knowingly let children create accounts. Information about your baby is added by you, as their parent or caregiver.

14Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it,
• correct it, or have it deleted,
• restrict or object to how we use it,
• receive it in a portable format,
• withdraw your consent at any time, without affecting what happened before.

You can edit or delete entries right in the app, and delete your account in Settings → Account. For anything else, email us at office@kdincubator.com and we’ll reply within one month.

You can also complain to a data protection supervisory authority, for example the one where you live or the one responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

15Changes to this policy

When we change this policy, we’ll update the date at the top. If a change is significant, we’ll let you know in the app or by email before it takes effect.