Privacy Policy
Last updated: October 7, 2026
Happy Firsts (“Happy Firsts,” “we,” “us,” or “our”) provides a mobile and web application that helps parents and guardians record, organize, and share their child’s developmental milestones. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the Happy Firsts mobile app and website (the “Service”).
By creating an account or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.
Who the Service is for
The Service is intended for parents and guardians who are 18 years of age or older. It is not directed to children, and we do not knowingly allow anyone under 13 to create an account. The information about a child that appears in the Service is provided by the adult account holder. See “Children’s Privacy” below.
Information we collect
We collect the following categories of information:
- Account information. When you register, we collect a username, your email address, and a password (stored only as a salted hash). If you sign in with Google or Apple, we receive a unique identifier from that provider and, where available, your email address and name. We may also store a display name.
- Child profile information you provide. The child’s name, birthdate, gender (optional), and an optional profile photo.
- Content you create. Milestones (title, date, optional notes, category), photos you upload, and comments. This content may include personal details about your child that you choose to enter.
- Sharing information. When you invite family members or caregivers to a child’s profile, we store the invitations you create and the list of people a profile is shared with and their access level (owner, caregiver, or viewer).
- Notification preferences. Your choices for email and push notifications.
- Device and technical information. A device push-notification token (if you enable push notifications), your platform (iOS, Android, or web), your device’s time zone (so reminders and emails arrive at a sensible local hour, and your child’s age is counted on the right day), session tokens that keep you signed in, when your account was last used, and standard log data such as IP address and timestamps used for security and to operate the Service.
- Activity in the app. Reactions you add to milestones, and — where the app offers our store — which store screens and products you viewed or tapped, linked to your account. We use this to operate and improve the Service. We do not use third-party advertising or analytics software.
How we use your information
- To provide, maintain, and secure the Service and your account.
- To store and display your milestones, photos, and comments.
- To enable sharing with the people you invite to a child’s profile.
- To send service and security emails, which every account receives; a weekly digest, milestone-activity emails, and occasional announcements, which you can turn on or off individually in Settings; and — if you allow notifications on your device — milestone reminder push notifications.
- If you enable AI analysis for a child, to estimate a milestone’s relative importance (see “AI features” below).
- To respond to support requests and to detect, prevent, and address fraud, abuse, or technical issues.
AI features
AI analysis is off by default, and turning it on is your choice. Unless you enable it, we do not send any information about your child to our AI provider. With AI analysis off, milestones you create yourself are simply not AI-scored — they keep a neutral importance — and you can use the Service fully without any AI involvement.
For each child, an owner of that child’s profile can give explicit consent to enable AI analysis (and can turn it back off at any time in the app). When it is enabled, we use OpenAI’s API to estimate how significant a milestone is, and we send only:
- the milestone’s title — including titles you write yourself, so please avoid putting your child’s name or other details you would rather not share into a title or notes;
- any free-text notes you add to that milestone; and
- your child’s age in months.
We do not send your child’s name, birthdate, gender, photos, comments, or any other profile information to OpenAI. We send this information through OpenAI’s business API. Under OpenAI’s API data terms as of October 2026, data submitted through the API is not used to train its models, and OpenAI may keep API inputs and outputs for up to 30 days to monitor for abuse. See OpenAI’s policies for its current terms. If you turn AI analysis off, we stop sending anything to OpenAI for that child going forward; turning it off cannot recall information already sent.
How we share information
We do not sell your personal information. We share information only as described here:
- With people you invite. Anyone you grant access to a child’s profile can see that profile and its milestones, photos, and comments, according to the access level you assign.
-
With service providers. We use trusted third parties to operate
the Service. They process information only on our behalf:
- Amazon Web Services (S3 and CloudFront) — stores and delivers uploaded photos.
- Amazon Web Services (SES) — sends transactional and notification emails.
- OpenAI — milestone importance scoring, only for children whose owner has enabled AI analysis, and limited to the data described above.
- Expo, Apple, and Google push services — deliver push notifications to your device. A milestone reminder includes your child’s name and the milestone it is about (for example, “Milestone coming up for Maya!”), so that text passes through these providers and can appear on your lock screen. Turn push reminders off in Settings if you would rather it did not.
- Upstash — provides a hosted data store (Redis) we use to enforce rate limits and prevent abuse of sign-in, sign-up, and email-sending; it processes limited technical data such as IP and email addresses as short-lived counters.
- Google and Apple — also process sign-in if you choose those options.
- Shopify — operates our store (store.happyfirsts.com) and processes orders placed there. If you check out from inside the app, we pass your email address, first name, and Happy Firsts account number to Shopify so that your order can be created and matched to your account.
- Our cloud hosting provider, which runs the Service’s servers and database.
- For legal reasons. We may disclose information if required by law or to protect the rights, safety, or property of our users or the public.
- Business transfers. If Happy Firsts is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you of any change in control of your data.
Data retention and deletion
We keep your information for as long as your account is active. You can delete your account at any time from the app (Settings → Delete account) or by emailing us. Deleting your account removes your personal information and the photos associated with profiles you solely own, including from our photo storage. If a child’s profile has other owners, your access is removed but the shared profile remains for those owners.
Beyond that, we hold each category of information only as long as we need it for the purpose it was collected, or as long as the law requires:
| Information | How long we keep it |
|---|---|
| Your account, child profiles, milestones, notes, comments, and photos | Until you delete them or delete your account. Deletion takes effect immediately; the only copies left are in the encrypted backups described in the next row, until those roll off. |
| Encrypted backups | Up to 35 days on a rolling basis, then overwritten. Deleted content can persist in a backup until it rotates out, but is never restored to the app. |
| Sign-in sessions | Up to 7 days on the web and 60 days on mobile with continued use, and no more than 30 days (web) or 180 days (mobile) in total before you sign in again. Signing out ends a session immediately, and the record of an ended session is deleted within 24 hours. |
| Verification and two-factor codes | 10 minutes, then unusable. Purged within 24 hours. |
| Sharing invitations | An invitation link stops working 24 hours after it is created. We keep the invitation until 30 days after that, so an old link can still tell you who sent it, and then delete it. |
| Push notification tokens | Until you turn off notifications, sign out, or the device token stops working. |
| In-app notifications | Read and archived notifications are deleted once they are 90 days old. Unread ones are kept until you read them, and you can delete archived ones at any time. |
| Email delivery records (bounces and spam complaints) | Kept for as long as we send email. We are required to honour these signals, and deleting them would mean emailing an address that had already bounced or complained. |
| Subscription and payment records | 7 years, to meet tax and accounting requirements. These records are held by our payment processors; we store only the status of your entitlement. |
| Shop activity (which product surfaces were viewed or tapped) | 24 months. |
| Server and security logs | 90 days. |
Where we are required to keep information to resolve a dispute, comply with a legal obligation, or enforce our agreements, we keep only what is needed for that purpose and delete the rest.
Your choices and rights
- Access and update your account details and child profiles in the app.
- Manage notification emails — the weekly digest, milestone activity, profile sharing, and announcements — from Settings at any time. You can also unsubscribe from the digest using the link in the email. Push reminders can be turned off in Settings or in your device’s notification settings.
- Request a copy of your data by emailing support@happyfirsts.com.
- Delete your account and data from Settings, or by contacting us.
California privacy rights
If you are a California resident, you may have the right to know what personal information we collect, to request access to or deletion of that information, to request correction of inaccurate information, and to not be discriminated against for exercising these rights. The categories of personal information we collect are described in “Information we collect” above. We do not sell or share your personal information for cross-context behavioral advertising. To make a request, contact us at support@happyfirsts.com.
Children’s privacy
The Service is for parents and guardians, not for children. We do not knowingly collect personal information directly from children under 13. Information about a child in the Service is provided by the adult account holder, who is responsible for the content they enter and for the people they invite. If you believe a child under 13 has created an account or provided us information directly, please contact us at support@happyfirsts.com and we will delete it.
Data security
We protect your information using measures such as encrypted connections (HTTPS), hashed passwords, and hashed session tokens. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and review our practices.
Who operates Happy Firsts
Happy Firsts is the business responsible for your information under this policy. We operate from the United States, and your information is processed and stored in the United States.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of the Service after an update means you accept the revised policy.
Contact us
If you have any questions about this Privacy Policy or your information, contact us at support@happyfirsts.com.