Privacy Policy

Last updated: November 8, 2026

Bimilo is a care log for parents and the people who help them look after a baby. Bimilo is made by Perroquet (Alexandre Sauvé-De Guise), Québec, Canada ("we", "us"). This policy explains what we collect, why, who processes it, how long we keep it and how you can delete it. It applies to the Bimilo apps for iPhone and Android and to the website baby.perroquet.io.

The short version

• Your family's records are visible only to the members of your family.
• We use your information only to run Bimilo. We do not sell it, and we do not show ads.
• Bimilo contains no advertising, analytics or tracking tools.
• You can delete your account at any time, in the app, on the web or by email.

Who Bimilo is for

Bimilo is for parents and caregivers aged 18 or older. It is not directed to children. Babies do not use Bimilo; the information about a baby is entered by the adults in the family.

What we collect

Account information

• Your email address and the name you choose.
• If you sign in with Google: your name, email address, Google account ID and profile picture link.
• If you sign in with Apple: your Apple account ID, your email address (or an Apple private relay address) and, the first time you sign in, your name.
• Your settings: language, time zone, date and number format, notification preference, usual feed method and the order of your navigation bar.

Family information

• The family name, the members and their roles, and the province or territory you choose so that Bimilo can show the right vaccination schedule.
• Invites: when you invite someone by email, their email address and the invite's role and status.

Baby and care records (entered by you and the other members of your family)

• Each baby's name, birth date, colour and photo.
• Feeds (time, bottle amount or breastfeeding duration and side), diapers, medications given, notes and reminders.
• Vaccination records (vaccine, product, dose, date, lot number, clinic, notes) and photos of vaccination booklet pages.
• If head-turn tracking is turned on for a baby: each put down recorded (the time the baby was laid on their back and which way their head was turned). Turning tracking off keeps past put downs until a family member deletes them.
• Who logged each entry, and when.

Some of these records are health information about your baby. We use them only to provide Bimilo to your family.

Device and technical information

• If you turn on notifications: a push token for your phone or browser, the platform (iPhone, Android or web) and the app version.
• When you sign in: your IP address, your browser or device type and the time, stored with your sign-in session.
• Our hosting provider records each request (including the IP address, the time and the page requested) for security and troubleshooting.

Photos

Photos are resized on your device before they are uploaded, which removes location data and other photo metadata. Photos are stored privately and shown only to the members of your family.

What we do not collect

We do not collect your location, your contacts, advertising identifiers or your activity on other apps and websites. Bimilo uses cookies only to keep you signed in and to remember your language.

How we use your information

• To create your account and sign you in, including emailing you sign-in codes.
• To share babies and records with the members of your family, and to send the invites you ask us to send.
• To send reminder notifications to the family members who turned them on.
• To keep Bimilo secure, prevent abuse (for example by limiting repeated sign-in attempts) and fix problems.

We process your information to provide the service you asked for, with your permission for notifications, and in our legitimate interest in keeping Bimilo secure. We do not sell personal information, use it for advertising or build profiles. Health information is never used for advertising or marketing.

Who can see your information

• Members of your family see the family's babies, records, photos and reminders, and each other's name, email address and profile picture.
• Service providers process data on our behalf, only to run Bimilo:
  • Vercel: hosting, server processing, photo storage and request logs (United States and Canada);
  • Supabase: database (United States);
  • Resend: sign-in code and invite emails (United States);
  • Google Firebase Cloud Messaging and the Apple Push Notification service: notifications on the iPhone and Android apps;
  • your browser's push service (for example from Google, Mozilla, Apple or Microsoft): notifications on the web.
• A notification's text (the reminder title and the baby's name) passes through these push services on its way to your device.
• Google or Apple, when you choose to sign in with them. Their own privacy policies apply to your account with them.
• Authorities, only when the law requires it.

We do not share your information with anyone else.

Where your information is stored

Your information is stored and processed in the United States (database and servers, in the Washington, D.C. area) and in Canada (photos, in Montréal). If you live elsewhere, including in Quebec, your information is transferred to these countries.

How we protect your information

All connections use encryption (HTTPS). Sign-in codes and invite links are stored only as secure hashes, and sign-in tokens from Google and Apple are stored encrypted. Photos are never public: every request for a photo is checked against your family membership.

How long we keep your information

• Account information: until you delete your account. Deleting your account removes it from our database immediately.
• Babies, records, reminders and photos: as long as the family exists, unless a family member deletes them sooner. Deleting an entry, a photo or a baby removes it from our database immediately. Photo files are deleted from storage at the same time; if storage is briefly unavailable, Bimilo retries automatically until they are gone. Our storage provider may keep serving a cached copy to our servers for up to 60 seconds, but our servers stop showing a deleted photo immediately. Photos already viewed may remain in the app or browser cache of the devices where they were viewed until that cache is cleared.
• Sign-in codes: valid for 10 minutes and stored only as a hash. A code and the email address it was sent to are deleted when the code is used; expired codes are deleted automatically during later sign-ins.
• Sign-in sessions: a session ends when you sign out or after 7 days without use. Signing out deletes the session record. Records of sessions that ended on their own, with their IP address and device type, are kept until you delete your account.
• Sign-in attempt limits: to slow down repeated sign-in attempts, we keep a counter for each IP address and sign-in step. It is not linked to your account, and we do not currently delete these counters automatically.
• Invites: an invite expires after 7 days. The invite record, including the invited person's email address, is kept until the person who created it deletes their account or the family is deleted.
• Notification devices: removed when you sign out on that device, when you delete your account, when the push service reports that the device is no longer valid, or after 5 failed deliveries with no successful delivery in 30 days.
• Request logs at our hosting provider (Vercel), which include IP addresses and browser type: 1 day.
• Our email provider (Resend) keeps a record of each email it sends, including the recipient's address and the message, for 30 days, plus up to 7 days in its backups.
• Backups: our database plan does not include backups, so deleted data cannot be restored from a database backup. Our photo storage keeps no backup copies.

Deleting your account

You can delete your account at any time: in the app or on the web (Profile, then Delete account), or by email. The account deletion page explains what is deleted, what happens to a family you share with others, and how long deletion takes: https://baby.perroquet.io/delete-account

Your rights and choices

You can see and correct most of your information directly in the app. You can also ask us for a copy of your information, or ask us to correct or delete it, by writing to alex@perroquet.io. We complete these requests within 30 days. Depending on where you live (for example Quebec, the rest of Canada, the European Union or the United Kingdom), you may have other rights, such as data portability or objecting to processing, and you may complain to your data protection authority (in Quebec, the Commission d'accès à l'information).

You can withdraw permissions at any time: turn off notifications in the app or in your phone's settings, and remove Bimilo's access in your Google or Apple account settings.

Contact

For questions or requests about your information, write to alex@perroquet.io. The person in charge of the protection of personal information is Perroquet's owner, Alexandre Sauvé-De Guise, reachable at the same address.

Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we tell you in the app before it applies.