Privacy Policy

Effective date: November 11, 2026 · Last updated: November 11, 2026

1. Who we are

Gulu (咕噜) is a baby tracking app for parents and caregivers, with an iPhone app and an Apple Watch app (an Android app is planned). Gulu is developed and operated by Zihan Tong, an individual developer. Zihan Tong is also the seller shown on the App Store and the controller of the personal information described in this policy. "We", "us" and "our" in this policy mean Zihan Tong.

• Email: support@bygulu.com

Gulu has three plans: Free (everything on your device, plus family sync for up to 3 phones or tablets per family); Gulu Family (paid: sync for more than 3 devices, and Apple Watch); and Gulu Plus (paid: everything in Gulu Family, plus AI features).

This policy covers the Gulu app and the Gulu servers it connects to (together, the "Service"). Gulu is not offered in mainland China or the European Union.

2. Without family sync: data stays on your device

• If you use Gulu on one device without family sync, you need no sign-in and no account. The baby profiles and records you enter are stored only on that device. They are not uploaded to our servers, and we cannot see them.
• Once you create or join a family (including a free family), that family's baby profiles and records are uploaded; see Section 3.
• The app may request a public configuration file from our servers (for example, which products are available for purchase). This request contains none of your records or other personal information, but, as with any network request, our hosting provider Cloudflare sees your IP address and other connection details (see "Service logs" in Section 3).
• You decide where CSV exports and JSON backups are saved or shared; we do not receive them. The AI input log and write log that the app keeps on your device leave it only if you export them.
• If you use iCloud Backup or another device backup, data on your device may be included in that backup. Apple or Google handles such backups under its own policies; we have no access to them.
• Deleting the app deletes Gulu's data from your device (other than exports you saved or system backups).

3. Data we collect

We store data on our servers only when you sign in, create or join a family, or buy a subscription. Once you create or join a family, free or paid, that family's baby profiles and records are uploaded and synced between your family's devices. Before you create, join or return to a family, the app explains what will be uploaded, who can see it, where it is stored and how long it is kept, and asks for your explicit consent. If you tap "Not now", nothing is uploaded.

We do not use any advertising, analytics or tracking SDKs, and we do not obtain information about you from data brokers or other third parties.

4. How we use data and our legal bases

We use the data above only for the purposes below. The "Legal basis" column applies in places, such as the UK, that require us to state one.

We do not use your data for advertising, marketing profiles or data mining, we do not sell it, and we do not use it to train AI models.

5. AI features

AI features are available only to families with Gulu Plus (not Gulu Family or the free plan). Before you first use any AI feature, the app explains what will be sent and to whom, and asks for your explicit consent; one consent covers all AI features. If you say no, manual logging and all other features keep working.

5.1 Voice, photo and one-sentence logging

• Voice: your device's built-in speech recognition turns your speech into text (this may be processed by Apple or Google under their own privacy terms). We receive only the text; our servers never receive audio.
• Photos: when you photograph a paper log, the app first reads the text in the photo on your device, then sends the photo (scaled down to 1024 pixels on its long side, with location, capture time, device model and other embedded metadata removed) together with that text over an encrypted connection to our servers, which pass it to Anthropic to read the records. A photo is used only for that one reading and then discarded: our servers handle it in memory only and never write it to disk, a database or logs, and the release app does not keep a separate copy on your phone. Photos go to Anthropic only, never to another AI provider. Anything else in the picture (such as someone else's name or handwriting) is sent too, so please photograph only the log itself.
• The AI provider receives that text (and, for photo logging, the photo) plus a little context: your baby's age in days, any timer currently running, the volume unit you use, and your time zone (so times come out right). The AI turns it into log entries and returns them to the app.

5.2 AI summary, alerts and doctor-visit brief

• What is sent is summary figures (such as the number of feeds and amount per day, hours of sleep and number of diapers); a small number of notable records with their times (temperature, medication name and dose, vaccines, growth measurements, diaper rash and the text of notes); and your baby's age in days, your time zone (to get times right) and language (to pick the output language). The doctor-visit brief also includes the date of birth, due date (to work out age and prematurity correction) and birth weight (if entered). Note text also has the baby's name replaced before it is sent.
• Notes are text you wrote yourself. Apart from your baby's name, which is replaced, notes are sent as written: if a note contains someone else's name or other details, those are sent too.

5.3 What is not sent

• Your baby's real name is not sent to the AI provider. The AI only ever sees a placeholder nickname, and the app swaps the real name back in on your device. Older versions of the app may still send the name to our server; our server removes it before the request reaches any AI provider and does not log it.
• Your email address, device names and other account details are not sent to the AI provider.

5.4 AI provider

• Anthropic, PBC (a US company): by default, AI requests are handled by its Claude models through its API. Under Anthropic's commercial terms, data sent through its API is not used to train models and is deleted within 30 days, except content flagged by its safety systems, which may be kept for up to 2 years. The same retention applies to photos sent for photo logging.
• Cloudflare, Inc. (a US company): AI requests pass through our servers, which run on Cloudflare, and our servers may instead use a model running on Cloudflare Workers AI. Photos are never sent to Workers AI; when it is used, only the text read from the photo is sent.

Before we change or add an AI provider, we will update this policy, notify you in the app and ask for your consent again. We will not send your data to a new provider until you agree.

5.5 Storage and withdrawing consent

• Our servers do not store the content of AI requests or their results; our logs record only status, duration, token counts and the file size of any photo. AI providers handle the data under their service terms with us (see Section 5.4 for Anthropic's retention).
• You can withdraw your consent at any time under More → Account → AI processing consent; AI features then stop and nothing more is sent. Withdrawing does not affect processing that took place before.
• AI output can be wrong and is not medical advice. See the Terms of Use.

6. Service providers and international transfers

These are all the service providers that currently process your data on our behalf:

Apple handles App Store payments and subscription management. Your transactions with Apple are covered by Apple's Privacy Policy; we receive only the information listed under "Purchases" in Section 3.

• Your data is stored and processed in the United States. If you are outside the US, your data is transferred there. US data protection law may differ from the law where you live, and US courts and law enforcement authorities may be able to obtain data under US law.
• We will update this policy before we change or add a service provider. Before changing the AI provider, we will notify you and ask for your consent again, as described in Section 5.4.
• Apart from these providers, we disclose personal information only: when required by law or valid legal process; when necessary to protect the safety of you, other users or the public; or if Gulu as a whole is transferred to another operator (we will tell you in advance, and the new operator must keep to this policy).
• We do not sell personal information, share it for targeted advertising, or deal with data brokers.

7. Retention and deletion

Deleted data may remain in database recovery backups for up to 30 days before it is overwritten.

Deleting your account

Go to More → Account → Delete Account in the app. When you delete your account:

• All devices signed in to the account, including Apple Watch, are signed out at once and stop syncing.
• If no other active member remains in your family, the family and all its babies and records are deleted from our servers immediately.
• If other members remain, the family continues and the records you entered stay visible to them. If you are the owner, ownership passes to another account member of the family. If you want those records deleted, delete them in the app before deleting your account, or contact us.
• Your email is detached immediately; the remaining account record is deleted after 30 days, and revoked device records after 90 days.
• Records on your phone are not deleted.
• Deleting your account does not cancel your Apple subscription. Cancel it on your iPhone in Settings → Apple Account → Subscriptions.

Withdrawing consent to family sync

Go to More → Account → Family sync consent and tap "Withdraw consent". Withdrawing means leaving the family: your devices stop syncing and upload nothing further. Records you entered that have already synced stay in the family, visible to the other members. If you want them deleted, delete them in the app before withdrawing, or contact us. If you later create or join a family, the app will ask for your consent again.

8. Security

• Traffic between the app and our servers is encrypted with HTTPS (TLS).
• Data on our servers is encrypted at rest by Cloudflare.
• Synced data is not end-to-end encrypted. As the operator, we are technically able to access data on our servers. We access it only to operate the Service, to look into a problem you report, or when required by law. Administrative access to the servers is held by the developer alone.
• Device tokens are stored only as hashes, sign-in codes only as HMAC digests, and abuse prevention does not store raw IP addresses.
• No system is perfectly secure. If a data breach affects your personal information, we will notify you and the relevant authorities as required by applicable law.
• Data on your device is protected by your device's own security, such as your passcode. Please keep your device and email account secure.

9. Consumer Health Data Privacy Policy

This section is our Consumer Health Data Privacy Policy. It applies to consumers protected by Washington's My Health My Data Act, Nevada's SB 370 and similar laws, and forms part of this Privacy Policy. For those consumers, this section prevails where it differs from the rest of the policy.

Consumer health data we collect and why

• Your baby's temperature, medication (name and dose), vaccines and growth measurements (weight, length, head circumference); feeds, solids and reactions to food, sleep and diapers (including stool colour, consistency and diaper rash); and anything health-related in notes.
• Pumping records, which may reveal the health of the person breastfeeding.
• AI summaries, alerts and doctor-visit briefs that AI produces from this data (our servers do not store them).

This data reaches our servers only after you create or join a family, free or paid. We collect and use it for two purposes only: syncing it between your family's devices, and, for families with Gulu Plus, producing AI results with your consent. Without family sync this data stays on your device and we do not collect it.

Sources

What you and the other members of your family enter in the app, and log entries the AI produces from text and photos you provide.

Who we share it with

• Members you invite to your family: every member of a family can see all of that family's records.
• Processors: cloud hosting and database services (Cloudflare) and AI processing services (Anthropic, and Cloudflare Workers AI, which our servers may use instead), which process the data only on our behalf and on our instructions.
• We have no affiliates. We do not sell consumer health data and do not share it with any other third party.

Consent

• Before you create, join or return to a family, the app explains what will be uploaded (including health records), who in the family can see it, where it is stored and how long it is kept, and asks for your explicit consent. If you tap "Not now", nothing is uploaded. We collect consumer health data only as necessary to provide family sync.
• Before any AI feature sends data to an AI provider for the first time, we ask for your consent separately (apart from the family sync consent).
• If we ever want to collect or share this data beyond these purposes, we will first ask for your consent, and we will ask separately for consent to collect and consent to share.

Your rights

• To confirm whether we collect or share your consumer health data, to access it, and to receive a list of all third parties and affiliates with whom we have shared it, with their contact details.
• To withdraw your consent at any time: for family sync, under More → Account → Family sync consent (this means leaving the family; see Section 7); for AI features, under More → Account → AI processing consent.
• To have it deleted. We delete it from our servers and instruct our processors to delete it; copies in recovery backups are overwritten within 30 days.
• Not to be treated differently for exercising these rights.

How to exercise your rights

You can delete records or your account directly in the app, or email support@bygulu.com with "Consumer Health Data Request" in the subject line. To confirm it is you, we will ask you to write from the email address you use to sign in to Gulu, or to confirm in the app. We will respond within 45 days of receiving your request. If we need more time, we will tell you why within that period, and extend by no more than another 45 days.

If we decline your request, you can appeal by replying to our response. We will tell you in writing within 45 days what we decided on the appeal and why. If your appeal is denied, Washington residents may contact the Washington State Attorney General and Nevada residents the Nevada Attorney General.

10. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive it in a portable format, withdraw consent, object to or restrict certain processing, and complain to a regulator.

• You can do most of this directly in the app: edit or delete records and baby profiles, rename your device, export a CSV or JSON backup, withdraw consent to family sync, or delete your account.
• For anything else, email support@bygulu.com. To confirm it is you, we will ask you to write from the email address you use to sign in, or to confirm in the app. We usually respond within 30 days (or sooner where the law requires), and we normally do not charge a fee.
• Family records are entered and viewed by all members of the family. When a request concerns family records, we also have to consider the other members' rights.

11. Children

Gulu is for parents and caregivers. It is not directed to children and not intended for anyone under 13. You must be an adult to use Gulu (see the Terms of Use). Information about a baby is entered by you as the parent or caregiver; please create profiles only for children you are entitled to care for. If we learn that a child has created an account, we will delete the account and its data.

12. Changes and contact

• We may update this policy and will change the "Last updated" date on this page. We will tell you about material changes in the app or by email before they take effect.
• If a change involves a new purpose or a new service provider and the law requires your consent (for example, a change of AI provider), we will ask for your consent first.
• Contact: Zihan Tong, email support@bygulu.com.

13. Additional information by region

Gulu is planned to be offered in the United States, Canada, Australia, New Zealand, and Singapore (the United Kingdom is planned for a later release). The following supplements the sections above for users in those places.

United States

• Health data: for Washington, Nevada and other states that protect consumer health data, see Section 9.
• No sale or sharing: we do not sell personal information, share it for cross-context behavioural advertising, use sensitive personal information to infer characteristics about you, or disclose personal information to third parties for their direct marketing.
• Breaches: if a breach involves health data, we will notify you and the relevant authorities as required by the FTC Health Breach Notification Rule and state law.
• Requests: you can exercise any privacy rights your state gives you as described in Section 10. We will not discriminate against you for doing so.

Canada (including Quebec)

• Health information is sensitive. We process it only with your express consent: before family sync starts, and before you first use any AI feature.
• Your data is stored and processed in the United States, where courts, law enforcement and national security authorities may be able to obtain it under US law.
• Person responsible for the protection of personal information: Zihan Tong, email support@bygulu.com.
• You have the right to access and correct your personal information and to withdraw consent.
• You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca); Quebec residents can also complain to the Commission d'accès à l'information (cai.gouv.qc.ca).

Australia

• We handle your personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988.
• Your personal information is disclosed to service providers in the United States (see Section 6).
• You can ask to access and correct your personal information. If you are unhappy with how we handle it, please contact us first; if we have not resolved it within 30 days, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand

• We handle your personal information under the Privacy Act 2020. You have the right to ask for access and correction.
• Your personal information is held and processed on our behalf by service providers in the United States (see Section 6). Privacy protections in the US may differ from those in New Zealand.
• You can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Singapore

• Under the Personal Data Protection Act (PDPA), we collect, use and disclose your personal data with your consent and for the purposes described in this policy.
• Data protection contact: Zihan Tong, email support@bygulu.com.
• When we transfer data outside Singapore, our contracts with service providers require them to provide protection comparable to the PDPA.
• You can withdraw consent and ask to access and correct your data. You can also complain to the Personal Data Protection Commission (pdpc.gov.sg).