Privacy Policy

Last updated: 2 June 2026

This policy explains what personal data the Ahhlo app (“the app”) collects, how it is used, and the choices you have. The app is provided by Bean Studio Apps (“we”, “us”), the data controller, located at 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051.

Summary

• We collect your account email and the baby activity you choose to log.
• Data is stored on your device and synced to a cloud database. Access rules are enforced at the database level so that a baby’s log is available to its owner and the caregivers invited to it.
• The app includes no third-party advertising or analytics SDKs.
• We do not sell your data or use it to train machine-learning or AI models.
• You can export your activity logs (CSV or PDF), and delete your account and its data, at any time.

Who this policy is for

The app is used by parents and caregivers to record information about their children. The account holder is an adult. The data you log may describe an infant or child (for example, sleep and feeding times), but it is created and controlled by you, the account holder. See Children’s data below.

What we collect

Account information. When you sign up we store your email address and an authentication record so you can log in and so caregivers can be invited by email. You can sign in using Apple or Google; in that case, Apple or Google handles the sign-in and provides us your email address. We do not require your name, phone number, or postal address.

Data you create in the app. The information you choose to enter, which may include:

• Baby profiles you create (such as name and birth date)
• Sleep, feeding, and other activity events you record
• Schedules and routines you set up
• Caregiver invitations and team membership (the email addresses of people you invite to share a baby’s log)

Purchase records. If you buy the one-time Pro unlock, payment is processed by Apple’s App Store or Google Play — we do not receive or store your payment-card details. We store a record of whether your account has unlocked Pro, validated through the store.

Technical data. Our hosting provider processes standard connection information (such as IP address) to deliver the service and protect against abuse.

Usage data. We record a small number of basic in-app events — for example, when the upgrade screen is shown or which feature prompted it — to understand what people find useful and improve the app. This is first-party only: it is stored in our own database, never shared or sold, and we use no third-party analytics SDKs to collect it.

Where your data is stored

The app keeps a copy of your data on your device (in local storage) and syncs it to a cloud database provided by Supabase, our database, authentication, and sync provider. Supabase processes this data on our behalf, on cloud infrastructure located in the Asia-Pacific (Tokyo) region.

Access is governed by row-level security — rules enforced by the database so that a given baby’s log is accessible to its owner and the caregivers explicitly invited to that baby. Data is encrypted in transit and at rest.

International data transfers

If you use the app from the EEA or the UK, your data is transferred to Japan to be hosted there. Japan is recognised by the European Commission and by the UK as providing an adequate level of data protection, which provides the legal basis for this transfer.

Third parties that process data for us

We use the following service providers (“sub-processors”). They process data only to provide their service to us, not for their own purposes:

• Supabase — database, authentication, and real-time sync hosting.
• Apple and Google — sign-in (if you choose Apple or Google sign-in) and processing of the Pro purchase through their app stores.

The app does not include third-party advertising, analytics, or attribution SDKs.

How we use your data

We use your data to:

• Provide the app’s features (logging, schedules, reports, and caregiver sync)
• Authenticate you and keep your account secure
• Validate your Pro purchase
• Respond to your support requests

We do not sell your data, and we do not use it for advertising or to train machine-learning or AI models.

Legal basis for processing

Where the GDPR (or UK GDPR) applies, our legal bases are: performance of our contract with you, to provide the account and features you sign up for and to validate your Pro purchase; and our legitimate interests in keeping the service secure and preventing abuse, for limited technical and connection data. Where we ever rely on your consent, you can withdraw it at any time.

Caregiver sharing

The app lets you invite other caregivers to share a baby’s log. The caregivers sharing a baby can see the activity logged for that baby and the email addresses of the other caregivers on that team. Invitations expire 15 minutes after they are created and can be used once. You can remove a caregiver at any time, which revokes their access.

Data retention and deletion

Your data is kept while your account is active. If an account remains inactive for 12 months — with no sign-in and no logged activity — we may delete the account and all of its associated data so that we don’t retain stale records. We may first send a reminder to the email address on the account, and signing in at any time resets the 12-month period.

You can also delete your account and its associated data — baby profiles, logged events, schedules, and account record — at any time from within the app, or by emailing us (see Support). After deletion, residual copies in routine encrypted backups are purged within 30 days as those backups age out of our provider’s normal rotation.

Your rights

Depending on where you live (for example, under the EU/UK GDPR), you may have the right to:

• access the personal data we hold about you;
• correct data that is inaccurate;
• delete your data;
• export a copy of your data (data portability);
• object to or restrict certain processing.

Much of this is available directly in the app — you can export your activity logs and delete your account at any time. For anything else, email us and we will respond. You also have the right to lodge a complaint with your local data protection authority (in the EEA or UK, your national supervisory authority).

Children’s data

The app is intended for use by adults to record information about their own children. Accounts may only be created by adults. We do not knowingly collect personal information directly from children. The app is not directed to children under 13 (or the equivalent age in your jurisdiction) and is not part of Apple’s Kids Category. Information about a child that appears in the app is entered and controlled by the parent or caregiver who owns the account, and can be deleted by them at any time. If you believe a child has created an account with us, please contact us and we will remove it.

Security

We protect data with encryption in transit, database-level access rules (row-level security), and authentication on every request. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities as required by applicable law.

Changes to this policy

If we make material changes to this policy, we will update the date at the top and, where appropriate, notify you in the app.

Contact

Questions about privacy or your data? Email support@bean-studio.com or see our Support page.