Privacy policy

Last updated September 24, 2026

BabyMilk (“the app”, “we”) is made by Dillon Harms. This policy explains what data BabyMilk handles, where it is stored, and the choices you have. In short: BabyMilk works entirely on your phone unless you choose to create an account and put a baby online.

1. Data stored only on your phone

By default, everything you enter is stored only on your device. That includes your name, your babies’ names, birthdays, photos, colors and feeding style, and every feed and pump with its amount, time, milk type and notes. It is never sent to us unless you turn on online backup and sharing.

2. Data stored online (only if you choose)

If you create an account, we store on our server:

• Account: username, email address, display name, and your password as a salted scrypt hash (we never see or store your actual password).
• Sign-in sessions: a hashed session token, the time it was created and last used. Sessions expire after 180 days without use.

If you turn on Back up & share online for a baby, we also store that baby’s profile (name, birthday, feeding style, color and photo) and all of their feeds and pumps, including who added or changed each entry.

If you share a baby, we store the share codes you create, the permission (read-only or can-edit), and the name the other person entered when they joined. We keep an activity log of every addition, edit and deletion so owners can see who changed what.

3. Who can see online data

• You, in the app and on babymilk.site.
• People you share a baby with, for that baby only, until you revoke their access or stop sharing.
• The developer of BabyMilk can access data stored on the server in order to operate, secure, back up and support the service. We do not look at your data for any other purpose.

We do not sell your data, show ads, or use third-party analytics or tracking.

4. How we use data

Only to provide BabyMilk’s features: backup, syncing between devices, sharing with family, your web dashboard, and protecting accounts (for example, rate-limiting sign-in attempts). Your email is used to identify your account; we may use it in the future to verify your address or help you recover your account. We will not send marketing email.

5. Security

Data travels over HTTPS. Passwords are hashed with scrypt and session tokens are stored only as hashes. Access to the database is restricted to the BabyMilk server.

6. Keeping and deleting data

Online data is kept until you delete it. You can:

• Stop sharing one baby in the app (Settings → Online & sharing → Stop Sharing Online). This deletes that baby’s online copy; it stays on your phone.
• Delete your account in the app (Settings → Account → Delete Account) or on the data deletion page. This permanently deletes your account, every baby you own online, their entries, share codes and activity, and removes you from babies shared with you.

Deletion is immediate and cannot be undone. Copies may remain in encrypted server backups for up to 30 days before they are overwritten.

7. Children

BabyMilk is meant for parents and caregivers. It stores information about infants that adults enter. It is not directed at children, and children should not create accounts.

8. Not medical advice

BabyMilk is a tracker. Suggested amounts are general averages. Always follow your pediatrician’s guidance.

9. Changes

If we change this policy we will update the date above, and for significant changes we will let you know in the app.

10. Contact

Questions or requests: [email protected]