Privacy Policy

1. Children's information

Milkstop does not allow children to create accounts. The registered account holder is always an adult parent or legal guardian (18+) who voluntarily records information concerning a dependent infant (such as given name/nickname, date of birth, sex/colour theme preference, feeding amounts, nappy records, sleep periods, and physical growth measurements).

All infant data is processed solely to calculate rolling 24-hour summaries, render local charts, and synchronise records across authorised members of your private household.

2. Categories of Information We Collect

Caregiver Account Data: We collect the minimum identity information necessary to create and authenticate your caregiver account. The data collected depends on your chosen sign-in method:

• Google Sign In: Email address, given name, family name and Google subject identifier (sub), supplied via Google Identity Services OAuth 2.0. We don't store your Google profile photo, and we never handle or store raw passwords.
• Sign in with Apple: Apple subject identifier (sub), and (where you choose to share it) your email address, given name, and family name. Apple permits you to hide your real email address using Apple's Private Email Relay service, in which case we receive and store a system-generated proxy address ending in @privaterelay.appleid.com for the sole purpose of account identification and communication. We cannot access or identify your real email address when you use this option. We never handle or store raw passwords.
• Email Verification (OTP): Your email address, used exclusively to dispatch a one-time passcode for passwordless authentication via Resend, Inc. We never handle or store raw passwords.

Infant care and growth records: Feeding logs (breastfeeding feed notes (and, for older entries, the earlier feed code kept with that entry), expressing side/volume in ml, bottle milk volume and type, NGT checks where enabled), sleep logs (start time, end time, and duration of sleep periods entered retrospectively or as routines occur by caregivers), nappy outputs (wet, dirty, stool consistency), physical growth measurements (weight in grams, length in cm, head circumference in cm), and personal care notes.

Timezone: each entry records the timezone your phone was set to when you logged it (for example Australia/Perth). This shows the region, not your exact location, and everyone in your household can see it. It's deleted with the entry.

Language preference: your chosen app language (or your device's language, if you haven't chosen one), so we can show Milkstop and send emails in your language. It's stored on your account and follows you to every device you sign in to.

Feed and sleep sessions: when you start a session, we store its type, side, start time, pauses and who started or changed it on our servers (hosted by Cloudflare), so the other caregivers in your household can see and update it. When the session is saved it becomes a normal care entry. If it's discarded, it's deleted. Unsaved sessions are deleted after 24 hours.

Routines you create, including the name you give each one and when, and for how long, each was logged.

Infant feeding, nappy, sleep and growth records are health information, which is sensitive information under the Privacy Act 1988 (APP 3.3) and special category data under GDPR Article 9. We collect it only with your explicit consent, which you give separately from our Terms during sign-up, and you can withdraw it by deleting your account.

Technical and network data: IP addresses, device user-agent headers and security logs collected at the Cloudflare edge for DDoS prevention, rate-limiting and troubleshooting errors.

3. Google User Data Policy & Limited Use Disclosure

Milkstop supports caregiver authentication via Google Identity Services OAuth 2.0. We adhere to data minimisation and protection regarding Google user data.

You can also sign in with Google in the Milkstop iPhone app. We receive the same details as on the web (your name, email address and Google account ID) and use them only to sign you in.

Google Data Accessed: When you sign in using Google, Milkstop requests access strictly to basic identity scopes (openid, email, profile). We access your Google account email address, given name, family name, and Google subject identifier (sub). Milkstop never requests or accesses sensitive or restricted Google APIs, including Google Drive, Gmail, Google Contacts, Google Calendar, or device location data.

How Google User Data is Used: Google user data is used solely and strictly to authenticate your identity and create your caregiver user profile, display your name to other authorised household members so everyone knows who logged a feed or nappy change, and deliver critical security and policy notifications regarding your account.

Sharing, Advertising & AI Training Prohibitions: We never sell, rent, or trade Google user data to any third party. We never transfer or share Google user data with data brokers, ad networks, or third-party marketing companies. We never use Google user data to serve retargeted or behavioural advertisements, or to build, train, or fine-tune generalised machine learning or artificial intelligence models. Google data is transferred only to our secure technical infrastructure sub-processors (Cloudflare D1 database and Cloudflare Workers compute) solely to host and execute the application.

4. Apple Sign In & Apple Data Disclosure

Milkstop supports caregiver authentication via Sign in with Apple, available both through the web browser and natively within the Milkstop iOS application. We adhere to data minimisation and protection regarding Apple user data.

Apple Data Accessed: When you sign in using Apple, Milkstop requests your Apple subject identifier (sub) and, where you consent, your email address and name. Apple's name and email fields are only transmitted by Apple on your very first sign-in; subsequent sign-ins provide only your stable Apple sub identifier for account recognition.

Apple Private Email Relay: Apple offers you the option to hide your real email address by generating a unique, system-assigned proxy address ending in @privaterelay.appleid.com. If you choose this option, Milkstop stores and uses this relay address solely to identify your account and send transactional communications (such as account security notices) through Apple's Private Email Relay infrastructure. We never receive, store, or have access to your underlying Apple ID email address when this option is selected.

How Apple User Data is Used: Apple user data is used solely and strictly to authenticate your identity and create or access your caregiver user profile, display your name to other authorised household members, and deliver critical security and policy notifications regarding your account.

Apple Data Sharing & AI Training Prohibitions: We never sell, rent, or trade Apple user data to any third party. We never transfer or share Apple user data with data brokers, ad networks, or third-party marketing companies. We never use Apple user data to serve retargeted or behavioural advertisements, or to build, train, or fine-tune generalised machine learning or artificial intelligence models. Apple identity data is transferred only to our secure technical infrastructure sub-processors (Cloudflare D1 database and Cloudflare Workers compute) solely to host and execute the application.

5. Cookies & Client-Side Storage

Milkstop uses storage mechanisms solely for essential operational, security, and offline synchronisation functions:

Storage Type	Purpose	Classification
HTTP-Only Cookie (nourish_session)	Maintains cryptographic session token over HTTPS; inaccessible to JavaScript.	Strictly Necessary
HTTP-Only Cookie (oauth_state)	Short-lived HMAC-signed CSRF state token set during Apple and Google OAuth flows; automatically cleared upon authentication completion or expiry (15 minutes). Required by Apple's response_mode=form_post cross-site callback.	Strictly Necessary (Security)
IndexedDB (idb)	Stores cached care events and offline outbox queue for network resilience.	Core Functional
LocalStorage	Stores active tab view and theme preferences. No tracking IDs.	Functional Preference
Cloudflare Turnstile	Security verification and automated bot mitigation on login and registration endpoints.	Strictly Necessary (Security)

We count visits to our public website pages as daily totals, by page and, when you arrive from one of our social media links, by platform (for example, 'Instagram: 12 visits'). We also keep daily totals of sign-up steps: how many times the sign-in screen is shown, how many sign-ins are attempted and accounts created (by email, Google or Apple), and how many households and first babies are added. These counts don't use cookies and don't include your IP address, device details or anything else that could identify you. Apart from these sign-up totals, we don't count anything you do inside the Milkstop app.

6. Third-Party Sub-Processors

We rely on enterprise sub-processors bound by strict confidentiality and data protection agreements:

• Cloudflare, Inc.: Global edge network, web hosting (Pages), serverless execution (Workers), managed encrypted relational database (D1), and Cloudflare Turnstile bot verification (analysing non-identifying browser and device signals and proof-of-work checks to defend against automated abuse without interactive CAPTCHAs).
• Google LLC (Google Identity Services): OAuth 2.0 authentication to verify caregiver credentials without password storage. See Section 3 for full Google data disclosures.
• Apple Inc. (Sign in with Apple): OAuth 2.0 and native iOS identity authentication via Apple's identity platform. Apple processes your Apple ID credentials and transmits a verified identity token and subject identifier to Milkstop's servers for account authentication. Where you elect to hide your email, Apple's Private Email Relay service relays transactional communications on your behalf. Apple's data handling is governed by Apple's Privacy Policy. See Section 4 for full Apple data disclosures.
• Resend, Inc.: Transactional email delivery service used to dispatch one-time passcode (OTP) verification emails when logging in via email.

7. Data Retention, Self-Service Erasure & Identity Data Deletion

Retention Duration: We retain your account details and care logs only for as long as your account remains active and registered, or as required to fulfil the purposes set out in this policy.

Unsaved sessions are deleted after 24 hours. Login and email-change codes expire after 10 minutes, and expired codes are deleted within a day, together with short-term rate-limit records (which can include your IP address). Security and error logs are kept for up to 30 days. If an account has no sign-in for 24 months, we'll email you, then delete it 30 days later unless you sign in.

Self-Service Deletion: You can delete your personal data, identity provider data (Google and/or Apple), and care records at any time:

• In-App Self-Service: Navigate to Settings > Danger Zone > Delete Account and confirm by typing DELETE.
• Sole-Member Households: If you're the only caregiver in your household, account deletion removes your account, linked Google or Apple identifiers, your babies and all their records. Milkstop deletes it from our live database straight away. Copies in Cloudflare's recovery history and service logs are removed automatically within 30 days.
• Shared Households: If you share a household, entries you logged stay with your baby's records for the other caregivers, marked as logged by a former member. Notes you typed stay as written, so delete any you want removed before deleting your account.
• Client Wipe: Executing account deletion immediately wipes your browser's IndexedDB offline storage, local storage, and expires your authentication session cookie.
• Manual Request by Email: You may also email hello@milkstop.app at any time to request the complete deletion of your account and all associated identity provider data. Deletion requests are processed and confirmed within 30 days.

8. International Data Transfers & Cross-Border Processing

Your account and care records are stored in Cloudflare's database in its Oceania region, and may pass through Cloudflare data centres in other countries. Login-code emails are sent through Resend in the United States. We use providers whose contracts require them to protect your information, and we remain responsible for it under the Privacy Act.

• Cloudflare, Inc. (Global Edge & Storage): under Cloudflare's data processing terms, which include Standard Contractual Clauses for EU and UK transfers.
• Resend, Inc. (United States): Used exclusively to deliver transactional one-time login passcodes via email. Only your email address and authentication code are transmitted to Resend's secure US servers.
• Google LLC (Authentication): Identity tokens and OAuth authentication are processed globally under Google's enterprise privacy framework and Data Privacy Framework certifications.
• Apple Inc. (Authentication & Private Email Relay): Apple identity tokens and sign-in credentials are processed globally under Apple's enterprise privacy framework. Where you use Apple's Hide My Email feature, Apple's Private Email Relay service processes relay communications globally. Apple's international data handling is governed by Apple's own privacy commitments and applicable data transfer frameworks.

For Australian users, we take reasonable steps to ensure overseas recipients handle your personal information in accordance with Australian Privacy Principle 8. For European and UK visitors, all transfers to third countries are governed by the European Commission's Standard Contractual Clauses (SCCs) under GDPR Article 46.

9. Security Safeguards

We implement rigorous technical and organisational safeguards designed to protect personal and infant care data against unauthorised access, loss, alteration, or disclosure:

• TLS/HTTPS Everywhere: All data in transit between your browser and our edge servers is encrypted using HTTPS (TLS) with HSTS enforcement.
• Zero-Trust Edge Architecture: Compute and storage are managed on Cloudflare's serverless infrastructure with strict principle-of-least-privilege access controls.
• Signed Session Tokens: Authentication tokens are signed with HMAC-SHA256 and stored in secure, HttpOnly, SameSite=Lax cookies inaccessible to third-party client scripts.
• No Password Storage: By utilising Google Identity OAuth 2.0, Sign in with Apple, and passwordless email OTPs, Milkstop never collects, stores, or handles plaintext or hashed user passwords.
• Apple Identity Token Verification: All Apple identity tokens received from the iOS application or web OAuth flow are cryptographically verified against Apple's published JWKS public keys before any account access is granted.
• When you sign in with Google, we check Google's sign-in token to confirm it's you, then discard it. We don't store Google tokens or access your Google account.

If a data breach is likely to cause you serious harm, we'll tell you and the OAIC as the Notifiable Data Breaches scheme requires.

10. Your Rights & Contact Information

Under the Australian Privacy Act 1988 (Cth), the European GDPR, and international privacy frameworks, you possess rights to access, correct, delete, or request data export of your records.

You can correct or delete any entry in the app at any time, and download your baby's records from Export as a CSV spreadsheet file or a printable PDF. The PDF is made on your device and goes only where you choose to save or send it. For anything else, email hello@milkstop.app. We may ask you to confirm the request from your account email, and we'll respond within 30 days.

For privacy inquiries, data export requests, identity provider data queries (including Google or Apple data), or complaints, contact our Privacy Officer at hello@milkstop.app.

• Milkstop is operated by William Kendall, a sole trader in Queensland, Australia. Contact: hello@milkstop.app.
• Official Website: https://milkstop.app
• Jurisdiction: Queensland, Australia
• Supervisory Authority: Office of the Australian Information Commissioner (OAIC): oaic.gov.au

Legal basis

We rely on contract to provide the app and account (Art 6(1)(b)), explicit consent for feeding, nappy, sleep and growth entries and notes (Art 9(2)(a)), and legitimate interest in security and error logs (Art 6(1)(f)).

Account emails

We only email you about your account, such as login codes and security or policy notices. We don't send marketing. If that changes, we'll ask first and every message will include an unsubscribe link.

Questions, access and complaints

Privacy contact: William Kendall, hello@milkstop.app, PO Box 259, Moffat Beach QLD 4551. To make a complaint, email us with details. We'll acknowledge it within 7 days and aim to respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992). If you're in the EU or UK, you can also complain to your local data protection authority or the UK ICO (ico.org.uk).