Last updated: October 19, 2026
This policy explains what information NiniBite collects through the NiniBite iOS app and the website at ninibite.app, how we use it, who we share it with, and the choices you have. NiniBite is for parents and caregivers aged 18 and over.
Questions or requests: privacy@ninibite.app
| Information | What it includes | Why we need it |
|---|---|---|
| Account | Your name, email address, and password. We store only a one-way hash of your password, never the password itself. | To create your account, sign you in, and send account emails |
| Baby profile | Your baby’s first name, date of birth, biological sex, known allergies, dietary notes, and feeding style | To fit guidance to your baby’s age and allergies, and to use the right growth chart |
| Growth | Weight, length or height, head circumference, and the date of each measurement | Growth charts, percentiles, and reports |
| Allergen log | Allergens your baby has tried, when, any reaction notes you write, and re-exposure dates | Tracking introductions and re-exposure reminders |
| Feeding log | Foods offered, meal, food category, whether your baby ate it, times offered, date and time, and any notes. For milk feeds: amount, duration, and side. | Feeding history and insights |
| Doctor visits | Visit, date, pediatrician’s name, notes, reminder timing, and whether it’s done | Your visit schedule and reminders |
| Chat | Your questions and the AI’s answers | Your conversation history |
| Saved recipes | Recipes you save | Your recipe list |
| Caregiver invitations | The email address of the person you invite and the access you give them | Sending and managing the invitation |
Feeding goals stay on your device (or in your browser, on the website) and are never sent to us.
The chat and the AI growth and feeding insights are written by OpenAI’s GPT-4o family of models. You’re talking to an AI, not a person, and the app tells you so before your first chat. AI answers can be wrong and aren’t medical advice.
Nothing is sent until you allow it. The first time you open the chat, the app shows what it sends to OpenAI and asks your permission. If you choose Not now, the chat and AI insights stay off. You can turn them on or off at any time in Settings → Privacy & Data Use.
When you send a chat message, we send OpenAI:
When you open AI growth or feeding insights, we send your baby’s first name, age, and the matching growth or feeding summary.
Before you see an answer, a second OpenAI model checks it for safety, for example against allergies or reactions you’ve logged.
We never send OpenAI your email address, password, payment details, saved recipes, or doctor visits.
OpenAI processes this data for us under its API terms and doesn’t use it to train its models. We tell OpenAI not to store our requests, but OpenAI may keep API data for up to 30 days to detect abuse before deleting it.
We also keep a record of AI requests and answers on our own servers for up to 30 days, to investigate problems with answers. No outside company receives these records.
We don’t sell, rent, or trade your information or your child’s. We share it only with caregivers you invite (section 4) and with these service providers, who handle it on our behalf:
| Provider | What they do for us | What they receive |
|---|---|---|
| Hetzner | Hosts our servers and database in Finland | Everything stored in your account |
| OpenAI | Writes and safety-checks AI answers | What’s listed in section 2 |
| Resend | Sends our emails | Your email address and the email itself: verification and password-reset links, and caregiver invitations (which include the inviter’s name and the baby’s first name) |
| Sentry | Monitors our servers for errors | Error reports and performance samples (section 1) |
| Apple | Handles purchases in the iOS app | Apple’s privacy policy applies to your payment |
| Stripe | Handles purchases on the website | Stripe’s privacy policy applies to your payment |
We may also disclose information when the law requires it.
You can invite a co-parent, grandparent, or nanny to one of your baby profiles in Settings → Caregivers.
NiniBite is for parents and caregivers and isn’t meant to be used by children. The information you add about your child is used only to run NiniBite for you. We don’t sell it, use it for advertising, or share it beyond what this policy describes. You can review, correct, export, or delete it at any time (section 7). We design these practices to meet the U.S. Children’s Online Privacy Protection Act (COPPA) and the GDPR.
| Information | How long we keep it |
|---|---|
| Your account and everything in it | Until you delete your account |
| After you delete your account | Removed from our live database immediately, and from backups within 60 days |
| AI request records on our servers | Up to 30 days |
| Data held by OpenAI | Up to 30 days (section 2) |
| Error reports held by Sentry | Up to 90 days |
| Expired caregiver invitations | 30 days after they expire |
| Security records | Indefinitely, even after an account is deleted, because they show what happened, including that a deletion was requested |
You can’t yet delete a single conversation in the app. Deleting your account deletes all of them, or email us to remove one.
We use your information:
Our servers are in Finland, in the EU. OpenAI, Resend, and Sentry may process data in the United States. OpenAI’s API terms include Standard Contractual Clauses for transfers from the EU.
Data between the app or website and our servers is encrypted in transit (HTTPS), and passwords are stored only as one-way hashes. If a breach affects your personal data, we’ll email you within 72 hours of finding out, explain what happened and what we’re doing about it, and notify regulators where required.
We update this policy when our practices change and change the date at the top. If a change is significant, we’ll tell you in the app or by email before it takes effect.