Privacy & Data

What we store — and where it lives

Everything you put into Nuga lives in one of two places: your own device, or our private database (hosted on Supabase, with our API running on Railway, both in the United States). We do not sell your data and we do not use it for advertising.

In our database:

Your account: email, name, profile photo, and sign-in credentials (passwords are stored only as a salted hash — never in plain text)
Your pregnancy details: due date, baby's nickname, number of babies, and birth details you record
Journal entries, mood tags, the week they belong to, and any photos you attach (photos are stored in private, encrypted object storage on Google Cloud)
Keepsake voice recordings — only if you choose to keep one. When you dictate a journal entry, the transcription happens on your device. You can choose to keep the audio as a keepsake; if you do, that recording is stored in the same private object storage as your photos. If you don't, no audio is ever saved.
Logs you choose to keep: kicks, contractions, weight, blood pressure, symptoms, water, appointments, medications, feeding, sleep, diapers, pumping, milk storage, milestones, daily check-ins, and caregiver duties
Your Emergency Medical Profile, if you create one: blood type, allergies, medications, conditions, GBS status, transfusion and organ-donor preferences, provider and insurance details, and a health ID number. Only you and anyone you explicitly share it with can see it.
Your Ask Nuga conversations. Questions you ask and the answers you get are stored on our servers so Nuga can refer back to recent conversations (the last two weeks are used for context; up to the most recent 400 exchanges per thread are kept). You can clear a conversation at any time from the Ask Nuga screen.
What Nuga remembers. From what you log, write, and ask, Nuga keeps a short list of durable facts about your journey — a recurring symptom, a concern, a preference, something you said your provider advised, a question you want to raise at your next visit. Some of these are inferred by the AI model rather than stated by you. You can see every one of them, and delete any of them, on the "What Nuga remembers" screen. Facts about symptoms, concerns and emotional patterns expire automatically after 3–7 weeks; facts you'd expect to last (preferences, medication notes, provider advice) stay until you delete them.
Your push-notification token, so reminders and alerts can reach you
Whether you're a premium subscriber (see "Service providers" below)

What stays on your phone

Face ID / Touch ID, if you enable it, is handled entirely by iOS to lock the app. We never see or store biometric data.
The postpartum mood check-in (EPDS). Your answers and your exact score never leave your device. There is one opt-in exception: you can turn on syncing of a general range (for example "lower" or "talk to someone") so it isn't lost if you change phones. Your score and your individual answers are never synced, on or off — and question 10 is never included.

Voice input

Speech recognition for dictation always happens on your device using Apple's on-device Speech framework. Your voice audio is not sent to a server unless you explicitly choose to keep a recording as a journal keepsake (see above).

For feeding, diaper and sleep entries logged by voice, the resulting text transcript (not the audio) is sent to our backend and to Google's Gemini AI to pull out structured details — amount, duration, type — and pre-fill the entry for you. Voice input only ever pre-fills what you're creating; you always review and tap to confirm before anything is saved.

Ask Nuga and AI features

Ask Nuga, Today's Briefing, and the other AI features use Google's Gemini AI to generate answers, suggestions and summaries. To make them about your journey, we send Gemini relevant context from your account — things like your due date or baby's age, recent logs, journal entries, medications, symptoms, appointments, the names of your care team and emergency contacts, and what Nuga remembers. We never send your Emergency Medical Profile's medical details (blood type, allergies, conditions, medications, birth choices), any of its phone numbers or addresses, or your insurance details to any AI provider — those stay on your Show card. Nothing is sent until you agree to this the first time you open Ask Nuga, and you can simply not use the AI features if you'd rather nothing be sent — the rest of Nuga works the same either way.

This data is sent to Google solely to generate a response and is handled under Google's API terms; it is not shared with anyone else. AI answers are generated by a model, not a medical professional; they can be incorrect or incomplete and are never a substitute for advice from your doctor, midwife or pediatrician.

Safety checks. Before any question reaches the AI, and whenever you save a journal entry, check-in note or duty note, Nuga runs a fixed, on-server check for language that suggests a crisis or an emergency. If it finds any, the app shows you support resources. That check is a simple pattern match: nothing is sent to a third party for it, nothing is stored, and it never changes or blocks what you saved.

Service providers we use

We keep this list short on purpose. These services exist to make the app work and to fix bugs — not to profile you. We don't run ads, use advertising IDs, or share your data with data brokers or marketers.

Google (Gemini) — powers the AI features described above.
Google Sign-In / Apple Sign In — if you use them, they share the name and email you allow at sign-in, used only to create and secure your account.
RevenueCat — processes in-app purchases. Receives your account ID and subscription status so we can unlock premium. Never receives your journal, health or emergency-profile data.
PostHog — product analytics. Receives your account ID and event names with small non-identifying details (for example "onboarding completed", "journal entry created", "feeding logged", which screen a paywall was shown from). It never receives journal text, photos, messages, symptom details, mood-screening results, or anything you wrote. We use it to learn which features are used and where people get stuck.
Sentry — crash and error reporting. Configured to strip personal fields (email, names, notes, medical and emergency-contact details, tokens) before anything is sent; receives a non-identifying account ID for correlation.
Resend — sends our emails: verification codes, password resets, and a weekly letter (through pregnancy and the first twelve weeks after birth) you can turn off in Settings or with the unsubscribe link in the email. The weekly letter can include your next appointment and its title, tasks due that week, and counts of what you logged the week before. Receives your email address and the content of that email.
Expo — delivers push notifications to your device. Receives your device push token and the notification text.
Stripe — takes payment when you order a printed book or buy a premium gift. You enter your card on Stripe's own page; we never see your card number. Stripe also collects the shipping address and phone number for a printed book.
Lulu — prints and ships printed Journey Books. Receives the book itself, plus your name, shipping address, phone number and email so it can be delivered (see "Printed books and gifts" below).
Apple Search Ads attribution — if you installed Nuga after tapping one of our ads in the App Store, Apple's AdServices tells RevenueCat which campaign the install came from, so we can tell whether our ads work. It identifies the campaign, not you, uses no advertising ID and shows no tracking prompt. We record the campaign name against your account in our analytics (PostHog), like any other event.
Supabase, Railway, Google Cloud Storage — host our database, API and file storage.

This website uses Vercel Web Analytics: cookieless page-view counts with no personal identifiers.

Printed books and gifts

Printed Journey Book. If you order a printed hardcover, the book itself — every journal entry, caption and photo you chose to include — is sent to our print partner, Lulu, so they can print it. Lulu also receives your name, shipping address, phone number and email so the book can be delivered, and keeps its own record of the order under its own privacy policy. Payment goes through Stripe: you enter your card on Stripe's page and we never see the number. Before you order you can look through the book, leave out any entry or photo, and choose your own words over Nuga's suggested polish. Nothing is printed until you confirm the price and pay.

In our database we keep the order's status, tracking link and shipping address so we can email you when it ships. Deleting your account removes those, and the files we prepared for printing, from our systems. Records Stripe and Lulu hold under their own policies stay with them; email us and we'll ask them to delete.

Gift codes. If you buy a Nuga Premium gift on our website, Stripe takes the payment and we email the gift code to the buyer. We keep the code with the buyer's email, the recipient's email if one was given, and any note, so the code can be delivered and redeemed. A code is single-use and expires a year after it's made.

Affiliate links in the registry

The baby registry includes "Shop" links to retailers like Amazon, Target and Walmart. Some are affiliate links: if you buy after following one, the retailer pays us a small commission. Your price doesn't change and no item is on the list because it earns a commission. Following an affiliate link tells the retailer the visit came from Nuga; we don't receive your name, payment details, or what you bought — only periodic totals. As an Amazon Associate, Nuga earns from qualifying purchases.

Neighbors — what's visible to others

If you post to Neighbors, that post is visible to other parents due around the same time. Posts and replies show a nickname you choose, or "Anonymous" — never your real name, email or photo. If you're a Premium member, a small Premium mark appears beside it; nothing else about your account is shown. You can delete any post or reply you've made, report others', and block members. Direct messages between connected neighbors are visible only to the two of you.

Partner sharing

If you generate an invite code and share it, the person who redeems it joins your journey in a supporting role. They can see your journal entries, logs, appointments and milestones, and they can also add to them — log a feed, a nap, a diaper change, a caregiver duty, a task, or a journal note of their own. They can use Ask Nuga with the same shared context.

They cannot see your daily check-ins, your postpartum recovery plan, your mood check-in, or facts Nuga has remembered about your own concerns and emotional patterns — those stay private to you. You can revoke their access at any time from Settings, and it ends immediately. If you delete your account, everything in your journey — including entries your partner added to it — is deleted with it.

Deleting your data

You can delete any pregnancy profile and all its data directly from Settings. You can also delete your entire account from Settings, instantly — no waiting period, no email required. Doing so permanently removes your account, all pregnancy and postpartum data, your Emergency Medical Profile, journal entries, photos and keepsake recordings, Ask Nuga conversations, what Nuga remembers, and your push token. We keep a minimal internal record that an account was deleted (for security and abuse prevention); it contains no health or journal data.

Deleting your account removes your data from our systems. Records that third parties hold under their own policies — your purchase history at Apple and RevenueCat, payment and shipping records at Stripe and Lulu, analytics events at PostHog, crash reports at Sentry — are retained by them for their own retention periods; if you'd like us to request deletion there too, email us and we will.

Your photos and recordings

Photos and keepsake recordings are stored in private object storage. They are never publicly accessible, never indexed, and never shared. Only you (and partners you've explicitly invited) can access them, and every access goes through our server, which checks that you own them.