Privacy policy
Draft – to be checked by a lawyer before launch.
Lampion holds some of the most personal things a family has: how a baby sleeps, eats and grows, and when they were ill. This page says what we keep, why, where, for how long, and how you take it back. The short version comes first.
- We don't sell dataNot to anyone, not in any form. We have no data business.
- No ads, no trackersThe app has no advertising, analytics or crash-reporting tools, and no AI reads your data.
- Your data stays in the EUOur one server is in Germany. The e-mail service that sends sign-in codes is in France.
- You decide on health dataMedicines, temperatures, vaccinations and growth are stored only with your explicit consent.
- Carers see only what you allowA parent chooses which areas a nanny or grandparent sees, and can remove them at any time.
- Download or delete any timeIn the app: Settings → Your account. No e-mail to us needed.
1. Who we are
Lampion is made by Point Cloud Solutions SRL, Str. Lăcrămioarei 46, Bl. 6, Sc. 1, Et. 3, Ap. 23, Sector 3, Bucharest, Romania, trade register number J40/11423/2021, CUI 44529845. We are the “controller” of the data in the app: we decide how it is handled and we answer for it.
For anything about your data, write to privacy@getlampion.com. A person reads every message.
This policy covers the Lampion app for iPhone, its Apple Watch app and Home Screen widget, the server the app talks to (api.getlampion.com) and this website (getlampion.com). An Android app will follow; this page will say what changes when it does.
2. What we keep
In the app
- Your account: your e-mail address, the name you choose to show, and your language.
- Your family: the family’s name, country and language, who belongs to it and in what role (parent or carer), and, for a carer, the areas they may see and an end date if you set one.
- Each child: name, date of birth, sex if you give it, allergies, the formula they drink, and notes.
- The journal: sleep, feeds and nappies with their times, day notes, and the care sheet for carers (routine, naps, foods to avoid, reheating, emergency contacts).
- Food: foods tried and how they went, reactions, the week plan, the shopping list, what is in the freezer and fridge, favourite recipes, ratings and what you cooked.
- Health: medicines given, temperatures, vaccinations, and growth measurements (weight, length, head).
- Settings: how your home screen is arranged for each child, and which areas of the app the family uses.
- Invitations: the e-mail address of the person you invite, their role and areas.
- Signing in: the 6-digit code we e-mail you and your sessions (one per phone or watch). We keep these only in scrambled (hashed) form, never the code or token itself.
- Protection against abuse: to slow down anyone guessing sign-in codes, a hashed form of the internet address that asked for a code, kept for one day.
Whatever you write in free-text fields (notes, emergency contacts, recipe comments) is kept as you wrote it. Please don’t put in more about other people than the people looking after your child need.
What we don’t keep
- No location, contacts, photos, microphone or advertising identifier.
- No usage analytics, no crash reports, no access logs of what you do in the app.
- No payment details.
On your phone and watch
Everything you log is saved on your phone first, so it works without a signal, and then sent to our server. Your session key is kept in the iPhone’s Keychain. The Apple Watch gets its own session from your phone over Apple’s encrypted link and keeps it in the watch’s Keychain. The widget keeps only the latest sleep, feed and nappy times. Reminders for medicines, vaccinations and the freezer are set and shown by your phone; they do not pass through our server. When you sign out, the family’s data is removed from the phone.
If you add vaccination dates to your calendar, the app writes them into your phone’s calendar, and only when you press “Add to my calendar”.
3. Why, on what basis, for how long
The law (GDPR, Article 6 and Article 9) asks us to name a “legal basis” for each use. Here they are.
| What | Why | Legal basis | How long |
|---|---|---|---|
| E-mail, name, language | To create your account, sign you in and show the app in your language | Contract: we need it to give you the app (Art. 6(1)(b)) | Until you delete your account |
| Family, members, roles, invitations | To share one child’s record between the people who look after them, each seeing only what they may | Contract (Art. 6(1)(b)) | Until the family is deleted; an unused invitation expires after 7 days |
| Child profile, journal, food, notes, care sheet | To keep the record you write and show it back to you and your carers | Contract (Art. 6(1)(b)); for allergies and reactions, which are health data, your explicit consent (Art. 9(2)(a)) | Until you delete the entry’s family |
| Medicines, temperatures, vaccinations, growth | To keep the child’s health record and build the summary you can show a doctor | Your explicit consent (Art. 9(2)(a)), alongside the contract | Until you withdraw consent or delete the family |
| Sign-in codes | To sign you in | Contract (Art. 6(1)(b)) | Valid 15 minutes, erased within the hour |
| Sessions (phone, watch) | To keep you signed in | Contract (Art. 6(1)(b)) | 90 days after last use, at most one year; erased when you sign out or delete your account |
| Hashed internet address | To stop people guessing sign-in codes | Our legitimate interest in keeping accounts safe (Art. 6(1)(f)) | One day |
| Backups of all the above | So a broken disk never loses a family’s history | Our legitimate interest, and yours, in not losing data (Art. 6(1)(f)); Art. 9(2)(a) for health data | Up to 21 days (see section 9) |
We never use your data for advertising, profiling, selling, or training AI. The app makes no automated decisions about you or your child.
4. Health data and your consent
Information about a child’s health – medicines, temperatures, vaccinations, growth, allergies and reactions to food – is “special category” data under the GDPR. We keep it only if you give your explicit consent, which we ask for in the app before you first record health information [owner: this consent step is not in the app yet; it must be built before launch].
You can withdraw your consent at any time, as easily as you gave it: delete the health entries, or delete the family in Settings → Your account. Withdrawing doesn’t make what we did before unlawful, but from then on we keep no more health data for your family. [owner: decide whether withdrawal also needs a switch in the app]
Lampion is not a medical device and gives no medical advice. It shows what you recorded and restates official guidance, with its source. It never works out a dose or a diagnosis.
5. Children
Lampion is for adults who look after a child from birth to three. Children don’t use it and can’t have an account. The data about a child is entered by their parents or by carers the parents invited.
A parent who creates the family decides what is recorded about the child, gives the consent for health data on the child’s behalf, and can download or delete it all. Please record only what helps you look after your child.
6. Carers and other family members
A family has parents and, if you want, carers such as a nanny or grandparents. Each has their own sign-in. The family’s owner sends the invitation by e-mail and can change or remove anyone in Settings → Family and people.
- Parents see everything about the family’s children.
- Carers see only the areas a parent allows: the journal, recipes, medicines and temperatures, food. They never see growth, vaccinations, the doctor summary, ratings or what you cooked.
- When a carer is removed or their end date passes, their access stops and their sessions end. What they logged stays in the family’s record, because it is part of your child’s day.
When you invite someone, we use their e-mail address only to send the invitation and sign them in.
7. Who else handles data
We use a small number of companies to run Lampion. They work only on our instructions, under a data processing agreement, and may not use your data for themselves.
- Hetzner Online GmbH (Germany) runs the server and its backups in its data centre in Nuremberg, Germany. Everything the app stores lives there. [owner: sign Hetzner’s data processing agreement]
- Brevo (Sendinblue SAS) (France) sends our e-mails: sign-in codes and invitations. It sees the recipient’s address and the e-mail’s text. [owner: sign Brevo’s data processing agreement; check how long Brevo keeps sending logs]
- Apple delivers the app through the App Store and TestFlight, and carries the link between your iPhone and Apple Watch. Apple handles your Apple account under its own privacy policy. If you allow it in your iPhone’s settings, Apple may share anonymous crash and usage reports with app developers; you can switch that off there.
- Google, when the Android app arrives, will deliver it through Google Play and, if we add push notifications, Firebase Cloud Messaging. Today the app sends no push notifications through Apple or Google: reminders are made on your phone.
We don’t give your data to anyone else, unless a court or authority makes a lawful demand we have to obey. Then we share only what is required, and tell you if the law allows.
8. Where your data is
Your data is stored in the European Union: on our server in Germany, and in e-mails passing through Brevo in France. We don’t move it out of the EU. If that ever changes, we will only use a provider covered by an EU adequacy decision or the EU’s standard contractual clauses, and we will update this page first.
Apple and Google are global companies; when you download the app, what they handle is covered by their own policies.
9. How long we keep it, and backups
We keep your family’s data for as long as the family exists, because a child’s history is only useful if it stays. Removing a single entry hides it everywhere; it is erased for good when the family is deleted. [owner: decide whether removed entries are erased sooner]
- Delete your account and we erase your e-mail address, name, sessions, sign-in codes and invitations. If you were the family’s only member, the whole family goes too. Entries you made in a family that carries on stay there, no longer linked to you.
- Delete the family (the owner can) and we erase every child, every entry and every member’s link to it.
Backups. Every night we copy the database and keep each copy for up to 14 days. Our server provider also backs up the whole server daily and keeps each of those for 7 days. So after you delete something, it can remain in backups for up to 21 days before it is gone everywhere. Backups are only used to restore the service after a failure, never read for any other reason. If we ever had to restore one, we would delete again what you had already deleted.
10. How we protect it
- Everything between the app and the server is encrypted (HTTPS).
- Sign-in codes and session keys are stored scrambled, so even someone reading the database could not use them.
- Each family’s data is kept apart: every request is checked against the family it belongs to and the person’s role.
- The server is locked down: key-only access, a firewall, automatic security updates, and no access log of your requests.
- Only [owner: who has access to the server] can reach the server.
If a breach ever put your data at risk, we would tell the supervisory authority within 72 hours and tell you without delay if it is likely to harm you.
11. Your rights
You can, at any time and for free:
- See and download your data: Settings → Your account → Download my data. The family’s owner can also download the whole family: Download family data. You get a file you can open or take to another service.
- Correct anything, right in the app.
- Delete your account (Settings → Your account → Delete account) or, as owner, the family (Delete family).
- Withdraw consent for health data, as section 4 explains.
- Object to, or ask us to restrict, a use based on our legitimate interest.
- Ask us anything about your data at privacy@getlampion.com. We answer within one month.
If you think we got something wrong, please tell us first. You can also complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal): B-dul G-ral Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest; anspdcp@dataprotection.ro; dataprotection.ro. If you live in another EU country, you can complain to the authority there.
12. This website: no cookies
getlampion.com sets no cookies, has no analytics and loads nothing from other companies: fonts, pictures and scripts all come from our own server. The app icons shown for comparison are copies saved on our server, so your browser doesn’t contact anyone else to show them.
When you press the RO/EN switch, your browser remembers your choice under the name lang in its local storage. It never leaves your device, we can’t read it, and you can clear it in your browser’s settings. Because it only keeps a choice you asked for, the law doesn’t require a consent banner for it (ePrivacy Directive, Article 5(3); Romanian Law 506/2004, Article 4(5)).
Like any website, the server sees your internet address to send you the page, but keeps no log of visits.
13. Changes to this policy
When we change this policy, we update the date at the top. If a change matters – a new kind of data, a new company handling it, a new use – we tell you in the app before it takes effect, and ask again for consent where the law needs it.
14. Contact
Point Cloud Solutions SRL, Str. Lăcrămioarei 46, Bl. 6, Sc. 1, Et. 3, Ap. 23, Sector 3, Bucharest, Romania
E-mail: privacy@getlampion.com