Privacy policy
Last updated: 29 October 2026
Draft. This text has not yet been approved and some details are still to be confirmed. It will change before Amber is publicly available.
Amber is a baby tracker for feeds, sleep and nappies, for parents and carers. This policy explains what information the Amber apps (iPhone, Apple Watch, Android and Wear OS) and this website handle, why, and what you can do about it. We have tried to write it plainly. If anything is unclear, ask us.
Who we are
Amber is run by [to be confirmed: the owner’s legal name], who is the controller of your personal data under UK and EU data protection law. You can contact us at[to be confirmed: contact email].
In short
- We collect only what Amber needs to keep your family’s record and sync it between your devices.
- We do not sell your data, show advertising, or use your baby’s records to build profiles.
- The Amber apps contain no advertising, analytics or crash-reporting tools.
- Your family’s data is stored in the European Union (Amsterdam, the Netherlands).
- Everyone in your family can see your family’s records. Nobody outside it can.
What we collect in the app
| Information | Why |
|---|---|
| Your email address | To create your account and sign you in. When you sign in by email, we send you a link and a six-digit code. |
| A sign-in identifier from Apple or Google, if you use Sign in with Apple or Sign in with Google | To recognise you next time. We receive your email address (which may be an Apple private relay address) and an account identifier. We do not receive your name or password, and we do not keep any Apple or Google sign-in token. |
| Your baby’s name and date of birth, and whether you are currently tracking them | So that every record belongs to the right baby, and so you can choose which babies voice and quick actions apply to. |
| Your baby’s activity records: feeds (start and end times, and which side), sleep (start and end times) and nappies (wet, dirty or both) | This is the record Amber keeps for you. We also record which family member added each entry, and whether it came from the app, a watch, a widget, a notification or a voice assistant. |
| Technical information: a random identifier for each installation of the app, and your sign-in session (stored by us only in scrambled, “hashed”, form) | To keep your devices in sync, keep you signed in, and protect your account. |
What we do not collect: photos, free-text notes, your location, your contacts, your microphone (voice commands go through Siri or your phone’s assistant, never to us), advertising identifiers. Amber does not record your IP address in its database; our hosting providers handle it briefly to deliver and protect the service.
Information about your baby’s health. Records of feeding, sleep and nappies may count as information about your baby’s health, which the law treats with extra care. We use it only to keep the record you ask Amber to keep and show it to your family. We never use it for anything else, never share it for marketing, and never use it to give advice.
Your family
Amber is shared within a family. Every family member can see, add to and change all of the family’s babies and records. Families are kept strictly separate: nobody outside your family can see your family’s data. Only invite people you trust.
This website
This website uses Google Analytics to count visits and see which pages are useful, only if you allow it. Until you choose “Allow analytics”, the Google Analytics script is not loaded and nothing is sent to Google. If you allow it, Google receives information about your visit (such as the pages you view, your browser and device, and your approximate location derived from your IP address) and sets cookies. We have turned off advertising features. You can change your choice at any time with “Cookie settings” at the bottom of every page. See our cookie policy. The website is hosted by Cloudflare, which processes technical data such as IP addresses to deliver and protect it.
Our legal basis (UK and EU)
- Providing Amber to you (your account, your family’s records, syncing, sign-in emails): to perform our contract with you.
- Keeping Amber secure (limiting sign-in attempts, protecting accounts): our legitimate interest in protecting you and the service.
- Your baby’s activity records, where they count as health information: your explicit consent. Before Amber is publicly available, the app will ask for it when you add your first baby. You can withdraw it at any time by deleting your baby’s records or your account.
- Website analytics: your consent, which you can withdraw at any time.
Who else handles your data
We use a small number of service providers, who act on our instructions and may use your data only to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Railway | Hosting Amber’s servers and database, and their backups | EU (Amsterdam) |
| Mailgun | Sending sign-in emails | EU |
| Apple and Google | Sign in with Apple and Sign in with Google, if you use them; distributing the apps through the App Store and Google Play | Under their own privacy policies |
| Cloudflare | Hosting this website and our domain’s DNS | Global network |
| Google (Google Analytics) | Website visit statistics, only with your consent | Including the United States |
Some of these providers may process data outside the UK and EU. Where they do, they protect it with the safeguards the law requires, such as the European Commission’s standard contractual clauses and the UK’s international data transfer addendum, or an adequacy decision such as the EU–US Data Privacy Framework and its UK extension, for providers certified under it. We do not sell your personal information, and we do not share it for advertising. We will disclose information if the law requires us to.
How long we keep it
- Your account and your family’s records: for as long as your account exists.
- Deleted records and babies: when you delete a record or a baby, it disappears from the app straight away, and is erased from our servers 30 days later. The 30 days let you, or another family member, recover from a mistake. Each family device erases its own copy the next time it syncs with us after that, so a device that has been offline erases it when it next connects.
- Backups: our database backups are kept for up to about one month, so erased data can remain in a backup for up to about one month before it is gone for good. Backups are used only to recover from a failure.
- Sign-in emails: the address a sign-in link was sent to is kept for up to a day, then erased. Links expire after 15 minutes.
- Sign-in sessions: stop working after 90 days, or when you sign out. A record that a session existed (without anything that could be used to sign in) is kept while your account exists.
Keeping it safe
All data travels encrypted (HTTPS). Sign-in tokens are stored on your phone in its secure storage (the iPhone’s Keychain, Android’s Keystore), and only in hashed form on our servers. Every request is checked against your family, so one family can never read another’s data. No system is perfectly secure, but we work to protect yours and will tell you and the authorities about a breach when the law requires it.
On your devices
Amber stores a copy of your family’s records on your phone and watch, so it works without a signal. Signing out removes it. On Android, Amber’s data is excluded from device backups. On iPhone, your device backups (for example, iCloud Backup) may include Amber’s data, protected by your backup’s own security.
Your rights
Under UK and EU data protection law you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; and give your data to you in a portable form. Where we rely on your consent, you can withdraw it at any time. You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority in your country.
If you live in a US state with a privacy law (such as California), you have similar rights: to know what we collect, to get a copy, to correct and to delete it, and not to be treated differently for using these rights. We do not sell or share personal information for targeted advertising.
How to use them: you can correct or delete your babies and their records in the app at any time. To delete your whole account, or to get a copy of your data, email us at[to be confirmed: contact email]. We will answer within one month. Deleting your account and exporting your data from inside the app are coming soon.
Children
Amber is for parents and carers to keep a record about their babies. It is not designed for children to use, and we do not knowingly let children create accounts. The information about your baby comes from you, and you control it.
Changes to this policy
If we change this policy, we will update the date at the top. If the change is significant, we will tell you in the app or by email before it takes effect.
Contact
[to be confirmed: the owner’s legal name],[to be confirmed: contact email].