BIOT privacy policy

Effective October 18, 2026

BIOT is a feeding and diaper log that parents share with each other. It runs as an Android app, an iPhone app and a web app. This page explains what the app stores, where, who can see it, and how to delete it.

Not medical advice: BIOT is a record-keeping tool, not medical advice. Ask your doctor, midwife or nurse about feeding and your baby's health.

Signing in

You sign in with your Google account or your Apple ID through Firebase Authentication. The app receives your name, your email address and an account ID. With Sign in with Apple you can choose not to share your name, and to share a private relay address from Apple instead of your email. The app uses your name to show who logged an entry (you can change it in Settings), and your email to match invitations. It never sees your password.

What the app stores

• The log: the baby's name that you enter, feeds (start and end time, side or bottle, bottle amount), diapers (time, wet or dirty), sleep and tummy time (start and end time), supplements given (time and the name you chose, such as vitamin D), weight checks (time and weight), the mother's urine output if you log it (time and amount in ml), which member logged each entry, and the feeding schedule and supplement list you set.
• Members and invitations: the account IDs and names of the people who share the log, and the email addresses you invite.
• Join codes: if you invite someone with a code, the code, the baby's name and when the code expires. A code is deleted when it is used, and within about a day after it expires (it works for 48 hours).
• Devices: an installation ID for each phone or browser signed in to the log, so a change on one phone can update the others and so feed reminders can be sent. It is not an advertising ID.
• On your phone only: the running timer and your settings, so the home-screen widget and notifications work.
• Crash reports (Android and iPhone apps): when the app crashes or hits an unexpected error, it sends Firebase Crashlytics the error and where in the code it happened, the app version, the phone model and system version, free memory and storage, and a random ID for this installation of the app. Reports don't contain your log, your name or your email. Crashlytics keeps them for 90 days.

Checking that requests come from BIOT

To keep other programs from reaching the data, Firebase App Check confirms that requests come from the real BIOT app: through Google Play Integrity on Android and Apple's App Attest or DeviceCheck on iPhone, which check the app and device without sending any of your data to BIOT. The web app and read-only link pages use Google reCAPTCHA Enterprise, which looks at information about the browser and device and sends it to Google for this check. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

The app does not use your location, contacts, photos, microphone or camera.

Where it is stored

The data is stored in Google Firebase (Cloud Firestore, Cloud Functions, Cloud Messaging, Hosting, Crashlytics and App Check), which runs on Google Cloud in the United States. Google processes it on our behalf under the Firebase data processing terms. It is encrypted in transit and at rest. Security rules allow only the members of a log to read or change it.

Who can see it

• Members: the people you invite by email who then sign in and join. Every member can see and edit the whole log.
• Read-only links: if you create one in Settings, anyone with the link can see the baby's name, when the next feed is due and the last 7 days of entries, without signing in. Member names are not included. Turning the link off deletes that copy right away.
• No one else. We don't sell or share the data, and we don't use it for advertising.

No ads or tracking

The app has no ads, no analytics and no third-party tracking. Crash reports are used only to find and fix bugs.

Children

BIOT is meant for adults, the parents or carers who record a baby's feeds. It is not directed at children, and children cannot use it to sign in or share information.

Deleting your account and data

In the app: open BIOT on your phone, or sign in at biot.web.app, then tap Settings (the gear icon) → Account → Delete my account, and confirm. You may be asked to sign in once more to prove it's you. This deletes right away:

• every log you are the only member of: its entries, feeding schedule, read-only links, join codes, device records and reminder records;
• your membership and name in logs you share with others. Those logs stay available to the other members, without your name;
• the join codes you created and this device's installation ID;
• your BIOT sign-in account. If you used Sign in with Apple and delete from the iPhone app, BIOT's access to your Apple ID is revoked too. From elsewhere, you can remove it in your Apple ID settings under Sign in with Apple.

Nothing is kept afterwards, apart from Firebase's own short-lived operational logs and backups, which expire on Google's schedule.

Other ways to delete data:

• You can edit or delete any entry in the app at any time.
• Settings → Leave removes you from a shared log. Signing out removes that device's installation ID.
• If you can no longer sign in, email the developer contact address shown on BIOT's App Store or Google Play page from the email you signed in with (or tell us your Apple relay address). We delete your account and data within 30 days and confirm by email.

Changes

If this policy changes, the new version is posted on this page with a new effective date.

Contact

Questions about privacy: email the developer contact address shown on BIOT's App Store or Google Play page.