Consent to Personal Data Processing

1. Person giving consent

By checking the separate consent box during registration or in the application, the User gives this consent freely, specifically, consciously and in an informed manner.

The User confirms that they are an adult with legal capacity or otherwise have the authority required to use the service and manage the relevant data.

2. Personal-data operator

Operator: Individual Entrepreneur Yulia Tsaplina.

Contact email: malishokpro@proton.me.

3. Categories of personal data

• Email, account identifier, authentication and session data.
• Google or Apple identifiers when the relevant sign-in method is selected.
• Access, PRO, promo-code and entitlement data where the feature is enabled.
• Support requests, technical device information and other data voluntarily provided to support.
• Encrypted backup ciphertext and technical encryption parameters that do not reveal the diary contents.
• Technical and pseudonymised analytics events, app version, platform, device model, errors and diagnostics.
• The Operator does not process the decryption key in openly readable form and does not read the contents of an encrypted backup.

4. User Content and children’s data

The application can contain child-care and development records, including health-related information, photos, notes, sleep, feeding, growth, medication, vaccination and doctor-visit data.

These records are stored locally by default. If backup is enabled, they are encrypted on the User’s device before transmission; the server receives only ciphertext that is inaccessible to the Operator.

The User confirms that they have the legal authority to enter and manage the child’s information.

5. Purposes of processing

• Account creation, authentication and security.
• Providing application features and customer support.
• Encrypted backup and restoration at the User’s request.
• PRO access, promo codes and entitlements where enabled.
• Technical diagnostics, abuse prevention and service improvement.
• Compliance with applicable law and lawful requests from authorised bodies.

6. Processing operations

The consent covers collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer where permitted, anonymisation, blocking, deletion and destruction of personal data, by automated and non-automated means as necessary for the stated purposes.

7. Processors, services and third parties

Google and Apple may process information when selected as authentication providers. AppMetrica may process technical and product analytics without child diary contents.

Data may be transferred to processors and third parties only when necessary for the stated purposes, under an agreement or processing instruction, following a User action or when required by law.

8. Limits of consent

This consent does not give the Operator access to readable child diary contents or the decryption key. The Operator receives only the encrypted backup and technical information required to operate it.

The User may withdraw consent at any time by contacting support. Processing performed before withdrawal remains lawful.

9. Consent term and retention

• Consent remains effective until withdrawal, account deletion, the end of service use or completion of the processing purposes.
• Account data is deleted or anonymised within 30 calendar days after account deletion unless a longer period is required by law.
• Encrypted backups, technical logs and archives may be kept for up to 90 calendar days for restoration, incident investigation and protection against accidental loss.
• Anonymised analytics may be retained without a time limit when they cannot identify a particular User.
• Data needed to comply with law, resolve a dispute or protect the rights of the Operator or User may be kept for the applicable statutory periods.

10. Withdrawal and consequences

The User may withdraw consent by contacting malishokpro@proton.me and stating the account email and requested action: account deletion, backup deletion, restriction of particular processing or information about processing.

The Operator may request confirmation of email ownership or additional identification to protect the account.

Withdrawal does not affect the lawfulness of processing carried out before it was received. Refusing required account or technical data may make registration, sign-in, backup, access restoration, support or paid features unavailable.

11. User requests

The User may request information about processing, correction, blocking, deletion or destruction of personal data and other rights provided by applicable law.

Requests are handled within the periods established by law. If a request is incomplete or requires identity confirmation, the period begins when the necessary information is received.