Lullagram is an independent baby tracking application operated by Christopher O'Callaghan, based in Ireland (the "Data Controller" under GDPR).
Contact for any privacy question, data access request, or deletion request: hello@lullagram.ie.
The following data is classified as "data concerning health" under GDPR Article 9. We collect and process it only with your explicit consent given at signup.
If you choose "Continue with Google" instead of creating a password, Google shares the following with us so we can create or sign you into your Lullagram account:
We do not receive your Google password. We do not request access to your Gmail, Google Drive, Google Calendar, contacts, photos, or any other Google service or data. The OAuth scope we request is the minimum needed to identify you (openid, email, profile).
You can revoke Lullagram's access to your Google account at any time via myaccount.google.com/permissions. Revoking access does not delete your Lullagram account — to delete the account, use More → Delete account inside the app.
We do not collect: device location, contact lists, photos, microphone audio, advertising identifiers, or any behavioural analytics.
| Data type | Purpose | GDPR legal basis |
|---|---|---|
| Account data | Create and operate your account | Contract (Art. 6(1)(b)) |
| Baby health data | Display your tracking history back to you | Explicit consent (Art. 9(2)(a)) |
| Email address | Send transactional emails (verification, password reset, optional emailed reports you request) | Contract (Art. 6(1)(b)) |
| Google sign-in data (name, email, Google ID) | Authenticate you when you choose Google sign-in | Contract (Art. 6(1)(b)) |
| Technical data | Keep the app working (sessions, offline queue) | Legitimate interest (Art. 6(1)(f)) |
We do not use your data for any other purpose. We do not profile you, do not run analytics on what you log, and do not use it to train any AI model.
Your data is stored in an EU data centre operated by Supabase Inc., our database and authentication processor. Supabase uses Amazon Web Services (AWS) infrastructure in the EU as a sub-processor.
Transactional emails (verification, password reset, and any emailed report you request from the app) are sent via Resend (a US company with EU sending infrastructure). Email content contains only your email address and the email subject and body. Emailed reports include the baby tracking data you chose to include when requesting the report; standard transactional emails do not.
If you use "Continue with Google" to sign in, Google LLC processes the sign-in handshake. Google does not receive any of your Lullagram tracking data. Google's own privacy policy applies to their handling of your Google account: policies.google.com/privacy.
All three processors have signed Data Processing Agreements with us or operate under terms that meet GDPR processor requirements. They process data only on our instructions and may not use it for their own purposes.
Your data stays in the EU at rest. Supabase's US-based staff may access EU servers for support and operational reasons under Standard Contractual Clauses (SCCs) approved by the European Commission. Resend and Google both operate under the EU-US Data Privacy Framework.
You have the right to:
To exercise any of these rights, email hello@lullagram.ie. We will respond within 30 days.
If you are unhappy with how we handle your data, you can lodge a complaint with the Irish Data Protection Commission:
Lullagram is a tool for parents and guardians, not for children. You must be 18 or over to register a Lullagram account.
The data Lullagram stores about your baby is provided by you, the parent or legal guardian, in exercise of your parental responsibility. You can delete this data at any time. When your child reaches an age where they have data protection rights of their own (generally 16 in Ireland), you should review what is stored and decide whether to retain it.
Lullagram does not use cookies for tracking. We use your browser's localStorage only to keep you signed in and to hold a queue of offline entries until they sync. This is purely functional, not analytical.
We do not use Google Analytics, Facebook Pixel, or any other tracker.
Lullagram is an independent application and is not affiliated with, endorsed by, or partnered with the Health Service Executive (HSE) or any other Irish government body. We link to publicly available HSE content as an information source for users. Linking to HSE.ie does not imply HSE has reviewed or approved Lullagram.
Lullagram is a logging tool, not a medical device. Information shown in the app, including content summarised from HSE.ie, is for general guidance only and does not replace advice from your GP, public health nurse, or other qualified healthcare provider.
In a medical emergency, call 112 or 999. For non-emergency health advice in Ireland, call HSE Live on 1800 700 700.
If we change this policy in a material way, we'll notify you by email and inside the app, and require you to accept the new policy before continuing. Minor updates (clarifications, formatting) will be posted here with the updated "Last updated" date.
For any privacy question or to exercise your rights, email hello@lullagram.ie. We respond within 30 days, usually much sooner.