Bibful logo

Bibful — Privacy Policy

Effective date: 12 October 2026 · Deutsch

Bibful (“the app”, “we”, “us”) is a baby-weaning app published by Bibful, an individual developer. The short version: everything you tell Bibful about your baby stays on your device. A few things do leave it: signing in, if you choose to (section 3); anonymous crash reports, which you can turn off (section 5); subscription management (section 6); and, only if you allow it, a few app events used to measure our advertising (section 7). This policy is written with the EU General Data Protection Regulation (GDPR) and Turkey’s Personal Data Protection Law (KVKK) in mind — see section 9 if you’re in Turkey. This page is about your data; for the rules of using the app itself (including subscription terms), see our Terms of Use.

1. Who is responsible

The person responsible for the app (the “data controller” under the GDPR) is:

Because we do not receive any of your data (see below), our role as a controller is limited. We are still happy to answer any privacy question you send to the address above.

2. The data the app stores on your device

To do its job, Bibful saves the following on your phone or tablet only, using the device’s local app storage:

You are not required to create an account, sign in, or give an email address to use the app.

The app also periodically checks bibful.com (a server we control) for updated recipe content and photos, so recipes can improve between app-store releases without you needing to update the app. This is a one-way download of public recipe content only — no personal information about you or your baby is included in these requests, and nothing about you is sent to us as part of this check.

3. If you choose to sign in

Signing in with Apple or Google is entirely optional — nothing about the app changes if you skip it. If you do sign in, Bibful uses Firebase Authentication (a Google service) to verify your identity. Firebase receives the identity information Apple or Google shares during sign-in (typically your email address and, if you allow it, your name). As of this version, signing in does not yet sync your baby’s profile, food log, or any other app data anywhere — that remains local to your device exactly as described in section 2. We’ll update this policy again before that changes, per section 13 below.

Deleting your account: if you’ve signed in, you can permanently delete your account (the name/email identity record held by Firebase) at any time from Settings → Account → Delete account, in the app. This is separate from your baby’s profile, allergies, and food log, which stay on your device either way — deleting your account doesn’t touch them. If you no longer have the app installed, email hello@bibful.com with the subject “Delete my account” and the email address you signed in with; we’ll delete the account within 30 days and confirm by email.

4. What we do not do

This section is about the data listed in section 2 above — the information the app itself asks you for. Sections 3, 5, 6, and 7 describe narrower exceptions where a specific feature you use (or, for subscriptions, the app’s billing itself, or ad measurement if you allow it) sends limited data off-device.

The information listed in section 2 stays on your device and is under your control. If you delete the app, or clear its data in your device settings, that information is removed.

5. Crash reporting

When the app catches an unexpected error, it automatically sends a report — the technical error only, no personal data, no device identifiers, no IP address — to Sentry, a third-party error-monitoring service, to help us find and fix bugs. This is one exception to section 4 above. You can turn this off at any time in Settings; doing so means nothing changes from the rest of this policy.

6. Subscriptions and purchases

If Bibful offers a paid subscription in your version of the app, we use RevenueCat, a third-party subscription-management service, to process purchases and check what you’re entitled to. Unlike sign-in (section 3), this is not optional — it runs automatically each time you open the app, for every user, whether or not you ever subscribe, so that a paying subscriber’s access is recognised correctly.

What RevenueCat receives: an anonymous identifier generated by the app (not your name, email, or any other identity you’ve entered — a random ID tied to your install of the app), and, if you do subscribe, your purchase and subscription history. RevenueCat processes this on our behalf, under its own privacy policy (revenuecat.com/privacy), solely to manage subscriptions and entitlements. It is not used for advertising, and we don’t sell or share it with anyone else.

7. Analytics and ad measurement (only if you allow it)

We advertise Bibful (for example on the App Store and Instagram), and to see which ads actually bring parents to the app we’d like to measure a few app events. This only happens if you say yes:

What’s sent, if you allow it: app events such as opening the app, each onboarding step you reach, matching ingredients (how many you picked and how many recipes matched), opening a recipe (which one), logging a meal (only how many you’ve logged, not what or when), generating a meal plan, signing up, viewing the subscription screen, and starting, buying, or cancelling a subscription (with price and currency). Google Analytics (Google’s Firebase SDK in the app) also records its standard usage measurements once you allow it: first open, sessions, and time spent in the app, together with a Firebase app-instance ID (random, not your name or email), device model, operating-system version, language, and an approximate location (country and city) worked out from your IP address. For the events passed to Meta (opening the app, signing up, trials and purchases), Meta receives the app’s random install ID, the app and operating-system version, device model, language, time zone, screen size, and the IP address and network “user agent” of the request, which it needs to match installs to ads. On Android, the Google Play “install referrer” (which link or ad led to the install) is included with the app-open event. We don’t collect advertising IDs on Android, and on iPhone the advertising identifier is only available if you allow tracking. Nothing from section 2 — your baby’s name, date of birth, allergies, food log, or plans — is ever included.

Who receives it: Google (Google Analytics, policies.google.com/privacy) and Meta (via its Conversions API, through a small relay we run on Google Cloud that forwards the event and doesn’t store it; facebook.com/privacy/policy). They keep it according to their own retention settings and policies. We use it only to measure and improve our advertising and to count how the app is used; we don’t sell it.

Changing your mind: on Android, go to Settings → Privacy → Share app events for ad measurement in the app. On iPhone, go to the iPhone’s Settings → Privacy & Security → Tracking → Bibful. Turning it off stops anything further being sent.

Separately, on iPhone, Apple’s SKAdNetwork may tell an ad network, in aggregated and anonymous form, that an install came from one of its ads. It works without identifying you and isn’t controlled by the choice above; see Apple’s privacy policy.

8. Legal basis for processing (GDPR)

Most of what Bibful does happens entirely on your own device, to provide features you asked for, and is based on your consent and on the performance of the service you have chosen to use (Article 6(1)(a) and (b) GDPR). You can withdraw this at any time by not entering the information, deleting it in the app, or removing the app. Crash reporting (section 5) relies on our legitimate interest in keeping the app working reliably (Article 6(1)(f) GDPR) — the data is anonymous, and you can turn it off at any time in Settings. Subscription processing (section 6) relies on performance of a contract (Article 6(1)(b)) — it’s necessary to provide the paid service you’ve subscribed to, so it isn’t something you separately opt into or out of while subscribed, though it stops if you cancel. Analytics and ad measurement (section 7) rely only on your consent (Article 6(1)(a) GDPR, and the ePrivacy rules on accessing information on your device), which you can withdraw at any time as described in section 7; withdrawing doesn’t affect anything sent before.

9. Turkey (KVKK)

If you’re using Bibful in Turkey, this section explains how the sections above apply under Turkey’s Personal Data Protection Law (KVKK, Law No. 6698) — in addition to, not instead of, everything above.

The on-device data described in section 2 never reaches us, so KVKK’s processing rules don’t apply to it — there’s nothing for us to process. The personal data we actually receive is what’s described in sections 3, 5, 6, and 7: sign-in if you opt into it, anonymous crash reports (unless you turn them off in Settings), subscription processing (an anonymous device ID, plus purchase history if you subscribe) whenever you use the app, and ad-measurement events only if you allow them.

Legal basis: for sign-in, we rely on your explicit consent (KVKK Art. 5), given by actively choosing to use that feature — withdraw this at any time by signing out or deleting the app. For crash reporting, we rely on our legitimate interest in keeping the app working reliably (KVKK Art. 5) — the report is anonymous, limited to the technical error, and you can turn it off at any time in Settings. For subscription processing, we rely on it being necessary to perform the contract you enter into by subscribing (KVKK Art. 5) — this applies for as long as you’re subscribed. For analytics and ad measurement, we rely on your explicit consent (KVKK Art. 5), given by choosing “Allow” — withdraw it at any time as described in section 7.

Data transferred abroad: Firebase and Google Analytics (Google), Meta, Sentry, and RevenueCat are all providers that may process data outside Turkey, so signing in, sending an automatic crash report, using the app’s subscription features, or allowing ad measurement means that specific data is transferred abroad. Under KVKK Article 9, we rely on your explicit consent (sign-in and ad measurement), our legitimate interest (crash reporting, which you can turn off), or contract necessity (subscriptions) as the legal basis for these transfers.

Your rights under KVKK (Article 11): you can ask whether we’re processing your data, ask for details about that processing and its purpose, ask us to correct or delete it, ask us to notify anyone we shared it with about a correction or deletion, object to a decision made about you based solely on automated processing, and claim compensation for damage caused by unlawful processing. To exercise any of these, contact us at hello@bibful.com.

We’re a very small team processing a limited amount of data — what’s described in sections 3, 5, 6, and 7 — and based on our current understanding of KVKK’s VERBİS data-controller registry thresholds, we don’t believe registration is currently required. We’ll revisit this as the app and team grow.

10. Children’s privacy

Bibful is a tool for parents and carers. Any information about a child (such as a name, date of birth, allergies, or foods tried) is entered by the responsible adult and is stored only on that adult’s device. We never receive or process children’s data on any server.

11. App stores

You download Bibful from the Apple App Store or Google Play. Those stores may collect their own information (for example, download statistics, purchase records, and crash diagnostics) under their privacy policies, which are separate from this one and outside our control:

12. Your rights

Under the GDPR you have rights including access, rectification, erasure, and portability of your personal data. Because your data lives only on your device, or — if you’ve signed in — in the Firebase account described in section 3, or — for subscription data — with RevenueCat as described in section 6:

If you believe your data-protection rights have been breached, you have the right to lodge a complaint with your local supervisory authority (your national Data Protection Authority in the EU, or the KVKK Board in Turkey — see section 9).

13. Changes to this policy

If we add features in the future that change how data is handled — for example, optional cloud backup — we will update this policy and, where required, ask for your consent before any such data leaves your device. The “Effective date” at the top will always show the latest version.

14. Contact

For any question about this policy or your privacy, contact: hello@bibful.com