Somilou is an app that helps parents track their baby’s sleep and anticipate naps. This page explains what data we process, why, who it is shared with, how long it is kept and how to exercise your rights.
1. Who is responsible for your data
The data controller is Nicolaï Kasepov, who publishes Somilou as a private individual.
For any question or request about your data: contact@somilou.com.
2. The data we process
Your account
- email address, name and profile picture, provided by Google or Apple when you sign in (with Apple, the address may be a private relay address);
- technical account identifier;
- date and version of the policy you agreed to.
Your baby
- first name, date of birth, sex, avatar colour;
- sleep: naps, nights, wake-up and bedtimes, skipped naps, and the phone’s time zone at the time of each entry;
- meals: time and quantity of bottles.
This information may reveal something about your child’s health. That is why we ask for your explicit consent before processing it.
Sharing between parents
- the list of people who have access to a baby and the invitation codes generated (creation, expiry and use dates).
Technical data
- when the app checks for updates: IP address, operating system, app version;
- on your phone only: your preferences (language, theme, notifications) and a local copy of your data for offline use. They are erased when you sign out or uninstall the app.
If you write to us
- from the app (Settings → “Contact us”): the subject and text of your message, and the screenshot if you attach one. To help us answer, we add your email address, your name, your account identifier, its sign-in method and its dates (creation, last sign-in, agreement to this policy), the identifier and date of birth of the babies you have access to, and technical information: phone model and operating system, app version, language, time zone, app settings and sync status;
- by email: your email address and the content of your message.
The screenshot is optional. It may show your baby’s data: we only use it to answer your request.
What we don’t do
No advertising, no audience measurement, no trackers, no sale of your personal data. Nap reminders are generated on your phone: no notification token is sent to our servers.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account, sign you in | Performance of the service you request (art. 6.1.b) |
| Record your baby’s sleep and meals, predict naps, show statistics | Your explicit consent (art. 6.1.a and 9.2.a) |
| Improve our predictions and better understand babies’ sleep | Your explicit consent (art. 6.1.a and 9.2.a) |
| Produce anonymised statistics and share them with third parties (section 4) | Your explicit consent (art. 6.1.a and 9.2.a) |
| Share a baby with the people you invite | Performance of the service (art. 6.1.b), at your initiative |
| Answer your messages, help you when something goes wrong | Performance of the service (art. 6.1.b), at your initiative |
| Secure the service, distribute updates | Legitimate interest in providing a reliable and secure app (art. 6.1.f) |
You give this consent once, when you first open the app. You can withdraw it at any time by deleting your account (Settings → “Delete my account”). Withdrawal does not affect processing carried out before it, nor anonymised statistics already produced: they no longer contain anything that could lead back to your data.
4. Anonymised statistics
From the data of all users, we produce statistics on babies’ sleep and feeding. Examples: average nap length at 6 months, bedtime by age, how the number of naps changes over the months.
How we anonymise them. Before any calculation:
- we remove everything that directly identifies a person: the baby’s first name, name, email address, photo, technical identifiers;
- we replace the date of birth with an age (in weeks or months) and the time zone with a broad geographical area (country or region of the world);
- we only publish and pass on results calculated over groups of babies, never the data of one particular baby or family.
Once anonymised, these statistics can no longer identify you or your child, even when combined with other information.
What we do with them. We use them to improve Somilou and we may share them with third parties, including for payment: researchers, early-childhood professionals, companies that design products or services for families. These third parties never receive your personal data or your baby’s.
5. Who has access to your data
The people you invite. If you share a baby, each invited person sees its whole history (sleep, meals) and can edit it. They also see your name and email address in the list of members. The owner can remove a member at any time, and anyone can leave a share.
Our technical providers (processors), who act only on our instructions and are bound by confidentiality:
| Provider | Role | Location |
|---|---|---|
| Supabase Inc. | Hosting of the database and authentication | European Union (Ireland) |
| 650 Industries Inc. (Expo) | Distribution of app updates | United States |
| Plus Five Five, Inc. (Resend) | Delivery of messages sent from the app | European Union (Ireland) |
| Infomaniak Network SA | Mailbox where your messages arrive (contact@somilou.com) | Switzerland |
Google and Apple are involved in signing in to your account, as controllers of their own processing, under their own privacy policies.
Recipients of anonymised statistics (section 4) only receive aggregated results, never personal data.
Authorities, only where the law requires it.
Transfers outside the European Union. Your data is hosted in the European Union, but Supabase, Expo and Resend are American companies: Supabase may access it from the United States to provide the service, Expo processes update-related data in the United States, and Resend may process the messages it delivers in the United States. These transfers are governed by the European Commission’s standard contractual clauses for Supabase, and by the EU–US Data Privacy Framework, which Expo and Resend have joined. The messages you send us are stored in Switzerland, by Infomaniak: the European Commission recognises Switzerland as providing an adequate level of protection.
6. How long we keep it
- As long as your account is active, to provide the service.
- When the account is deleted, your data is immediately erased from the database. Babies you were sharing are not deleted: they are transferred to the person you shared them with, who becomes their owner with their full history. Other babies are deleted with all their data.
- We may keep some data longer when the law requires it, or when it is needed to settle a dispute or assert our rights.
- Invitation codes expire after 7 days.
- Messages you send us are kept while we handle your request, then for at most three years after our last exchange. They are not erased with your account: to have them deleted, write to us.
- Anonymised statistics are no longer personal data: they may be kept without time limit.
7. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to withdraw your consent. In practice:
- Access and portability: Settings → “Export my data” produces a CSV file containing your account, your babies and their full history.
- Rectification: all the baby’s data and tracking can be edited in the app. For your account data, write to us.
- Erasure and withdrawal of consent: Settings → “Delete my account”.
- For any other right, write to contact@somilou.com. We reply within one month.
8. Data about your child
Somilou is intended for parents and adults who look after a child, not for children themselves. The child’s data is entered by an adult, under their responsibility, and used only for the purposes described above. We do not knowingly collect data from people under 16: if that happened, we would delete it.
9. Security
Exchanges with our servers are encrypted (HTTPS). Each account can only access the babies it owns or that have been shared with it, which the database checks on every request. Your session is stored in your phone’s secure storage. As no system is infallible, we cannot guarantee absolute security. In the event of a data breach posing a risk to you, we will inform you, as well as the CNIL (the French data protection authority).
10. Links to other services
The app may contain links to third-party sites or services. We are not responsible for their practices: please read their own privacy policies.
11. Complaints to a supervisory authority
If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country. The list of European authorities is published by the European Data Protection Board: https://edpb.europa.eu/about-edpb/about-edpb/members_en.
12. Changes
We may change this policy. The version date appears at the top of the page. If a change is substantial (new data, new provider, new purpose), the app will ask for your consent again.