Privacy Policy

Last updated: 19 October 2026 · Effective date: 19 October 2026

This policy explains what personal data Mom's Diary processes, on which legal bases, and what your rights are under the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller 2. Data We Collect 3. Purpose and Legal Bases 4. Sharing with Third Parties 5. Retention 6. Security 7. Your Rights 8. Controller outside the EU 9. International Transfers 10. Children's Privacy 11. Changes 12. Contact

1. Data Controller

The controller responsible for the processing of your personal data is Orkut Orbeyi, who operates the Mom's Diary / Anne Defteri app as a sole proprietor (şahıs işletmesi) established in Türkiye (Turkish tax/identification no. 6450487061). For any data protection matter you can reach us at privacy@annedefteri.com.

2. Data We Collect

We collect your data electronically: from what you enter in the app and on our website, from Apple when you choose Sign in with Apple (your name and e-mail address, or Apple's relay address), and automatically from your device (IP address, device information, push token, crash reports). The legal basis for each purpose is given in Section 3.

Account data: name, nickname, e-mail, password (hashed), account creation time (for e-mail sign-up, the time you confirmed the privacy notice; Sign in with Apple shows no separate confirmation screen)
Baby data: name, date of birth, sex, blood type, gestational week at birth (premature babies), weight, height, head circumference, teeth, developmental milestones
Health records: sleep, feeding, diaper, vaccine, medication, allergy and doctor-appointment records, emergency card
Content: photos, community posts and comments, marketplace listings and messages, private messages
AI assistant: your conversations with the assistant (Nina) and what you enter in the other AI features (symptoms, food names, behavior descriptions), which may include health information
Technical data: device type, app version, crash and performance reports (linked to your user ID; your e-mail is not sent), IP address (rate limiting)
Subscription data: subscription status and dates; in-app subscriptions are paid through Apple and no card numbers are stored by us. Payment on our website is currently not offered; if it is introduced, this policy will be updated

3. Purpose and Legal Bases

Your personal data is processed for the following purposes:

Service delivery — baby tracking, reminders, community access. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Health tracking — growth, vaccine, allergy, medication, sleep, feeding, diaper and doctor-appointment records. Legal basis: the processing is carried out to provide the tracking service you request (GDPR Art. 6(1)(b)). Entering records is your choice; you can delete any record you have entered, or your account, at any time.
AI assistant — generating answers to your questions and measuring their quality; also the weekly summary, symptom check, food check, Baby Language Translator and refreshing the daily insight. What you write to the assistant and these features may include health information. Legal basis: the AI features are optional and run only when you use them; the processing is carried out to provide the service you request (GDPR Art. 6(1)(b)). Writing health information to the assistant is your choice; you do not have to. However, to answer, the assistant also uses a summary of your baby's recent sleep, feeding and diaper logs, and the weekly summary uses the latest growth measurement, without you having to write them (see section 4).
Security — abuse prevention, rate limiting, security logs. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
Service improvement — crash reports, in-app usage statistics (linked to your account; no personal content). Legal basis: legitimate interest (GDPR Art. 6(1)(f)).

No automated decision-making with legal or similarly significant effects (GDPR Art. 22) takes place. The assistant's answers, the symptom and food checks, the Baby Language Translator and the daily insights are automatically generated suggestions for information only; they do not make decisions about you or your child, and we do not build a profile of you for any other purpose.

Your data is not sold. It is shared only with the following service providers:

Hosting — App data is hosted on servers located in the European Union that we manage ourselves; the database, file (photo) storage, e-mail and backups all run on this infrastructure of our own. The physical infrastructure of the servers (data centre) is provided by a hosting company in the EU. Service e-mails such as password resets are sent from our own server (annedefteri.com), without a third-party e-mail provider.
Apple — App Store payments, push notifications (APNs)
AI service provider — what you write to the assistant (including earlier messages in the conversation and a short summary of topics you asked about in the last 7 days), together with your country and your baby's name, age, sex and a summary of recent logs (sleep, feeding, diapers), is sent to an AI service provider based in Türkiye to generate the answer. For the weekly summary the latest growth measurement and the milestones reached that week are sent as well; for the symptom check the symptoms you enter, for the food check the name of the food, for the Baby Language Translator the behavior you describe (for these three your baby's age as well), and when you refresh the daily insight your baby's name and age. The language model runs on the provider's infrastructure in Türkiye; your data is not sent to the model's developer. Türkiye is outside the EU/EEA, is not covered by an EU adequacy decision, and we do not use standard contractual clauses or any other safeguard under GDPR Art. 46 for this transfer; it is therefore based on its being necessary for the performance of the service (contract) you request (GDPR Art. 49(1)(b)). Possible risks: data protection law in Türkiye differs from EU law, you may not be able to enforce your rights against the recipient as effectively as in the EU, and public authorities in Türkiye may be able to access the data under Turkish law.
Error monitoring service — crash and performance reports (linked to your user ID; your e-mail is not sent) are processed by a third-party error monitoring service hosted in the EU
Legal obligation — in the case of a court order or legal request, we may share with the competent authority, only to the extent required.

5. Retention

Active account data: for as long as your account is open
Deleted account: when you delete your account you are signed out and your name, e-mail address and phone number are anonymised immediately; the remaining data is permanently deleted after 30 days. Daily backups on our own servers are kept for 30 days. A backup copy kept as disaster protection on the controller's computer in Türkiye is updated at least once a week, and files older than 30 days are deleted at that time. Deleted data therefore disappears from all backups no later than 38 days after permanent deletion
AI conversations: kept while your account is open and used to measure answer quality (for this purpose an authorised person may read them, and every access is logged); deleting a conversation in the app also deletes its archive copy, and deleting your account deletes all of them
Records of the other AI features (symptom check, food check, Baby Language Translator): while your account is open; deleted with your account
Usage statistics and notification logs: while your account is open; deleted with your account
Server logs: application error logs 14 days; security logs (user ID, IP address, device/browser information, sign-ins, data exports and account deletions) 90 days
Support e-mails: 2 years from the last message
Subscription records (status, dates, Apple transaction IDs): while your account is open; deleted with your account. Payment and billing records are kept by Apple

6. Security

All communication between the app or website and our servers is encrypted with TLS (1.2 or higher)
Sensitive fields (e-mail, phone, your baby's name and blood type, growth measurements, allergens and reaction descriptions, medication names and doses, health and contact details on the emergency card) are encrypted with AES-256 in the database; AI conversations are stored encrypted on the server; notes added to records, allergy severity, the specialty and location of appointments, sleep, feeding, diaper and vaccine records, as well as symptom check, Baby Language Translator and food check records, are stored unencrypted on access-restricted servers
Private messages, marketplace messages and the text of community posts and comments are stored encrypted (AES-256) in the database (post titles are not encrypted); this is not end-to-end encryption, and reported content can be reviewed by an authorised person
Passwords are hashed with bcrypt; plaintext is never stored
Daily backups are kept in access-restricted locations; those on the server are deleted after 30 days, those in the copy on the controller's computer no later than 38 days

7. Your Rights

Under the GDPR, you have the following rights:

Right to know whether and how your data is processed (access)
Download a copy of your data in machine-readable JSON format from your account dashboard on our website; for data not included in that file (e.g. photos, community and marketplace content, messages) write to privacy@annedefteri.com (access, data portability)
Right to have incorrect data corrected (rectification)
Right to delete your account (identifying details are anonymised immediately; the remaining data is permanently deleted after 30 days) — from the app or via privacy@annedefteri.com (erasure)
Right to restrict processing and to object to processing
Right to compensation for damage caused by unlawful processing
Right to lodge a complaint with your local data protection authority

8. Controller outside the EU

The controller is established in Türkiye, outside the EU/EEA. For any request under this policy, including the exercise of your rights, contact us directly at privacy@annedefteri.com. We reply in English, German, Italian and Turkish.

9. International Transfers

App data is hosted on servers in the European Union that we manage ourselves (database, file storage, e-mail and backups). Crash and performance reports are processed by an error monitoring service hosted in the EU. Data needed for push notifications and App Store subscriptions (device push token, notification content, subscription transaction data) is sent to Apple, which may process it in the USA; see Apple's privacy policy for the safeguards it applies. The AI service provider is based in Türkiye; that transfer relies on its being necessary for the performance of the service you request, as described in Section 4. The controller is established in Türkiye and accesses the data from there. As protection against disaster, a full copy of the backups (including the key that decrypts the encrypted fields) is also kept on the controller's access-restricted computer in Türkiye (see Section 5).

10. Children's Privacy

Mom's Diary is designed for parents and caregivers aged 18 and over. Baby data recorded in the app is entered by the parent and stored in the parent's name. If we discover that a user under 18 has created an account, the account is deleted immediately.

11. Changes

When we update this policy, we state the new "last updated" date at the top of the page and, for material changes, send an in-app notification.

12. Contact

For questions, requests and complaints: privacy@annedefteri.com

Data controller: Orkut Orbeyi, sole proprietor trading as "Anne Defteri" (Mom's Diary), Türkiye (tax/identification no. 6450487061). Questions about your data protection rights in the EU may be directed to your local supervisory authority.