Privacy Policy

Moo's Diary is a private, invite-only application for tracking a child's development, wellbeing and daily life. It began as a single family's tool — a developmental diary that also needed to hold up as a credible record in family court proceedings — and has since been built out to support several unrelated families, each with their own private space, on the same platform.

There is no public registration. Every account exists because someone was invited: by a Family Owner inviting a Contributor, by a platform administrator setting up a new family, or by a Family Owner granting a named professional (a teacher, GP, SaLT, or similar) access to their child's records.

The app has two purposes that sit alongside each other, and where they pull in different directions, accuracy and legal credibility take priority over convenience. That shapes several things in this policy: why entries older than 24 hours can't be silently edited, why deletions are restricted, and why an audit trail exists for actions that in an ordinary app would be invisible.

We collect only what the app needs to do the two things above. In practice, that is:

• Account data — name, email address, password (stored as a salted hash, never in plain text), and account type (Family Owner, Contributor, or Professional).
• Diary entries — text, photos, video and audio you or another family member choose to log, plus any tags, mood rating, and location you attach. Photo and video files keep their original embedded metadata (EXIF), including capture timestamp and GPS coordinates if the device recorded them — we deliberately never strip this, because it is often the detail that makes a piece of evidence verifiable.
• Sleep records — bedtime, settling and night-report entries, including optional fields a family can choose to track (such as whether a child self-settled, or whether they co-slept).
• Food & drink records — what was offered, eaten, refused or partially eaten, and an AI-generated nutritional categorisation of what was logged (see below).
• Communication records — a running dictionary of a child's communication (words, signs, AAC symbols, vocalisations), with consistency ratings and evidence media.
• Medication records — doses given or missed, timing, which household administered them (where a family tracks that), and any observed effects.
• Incidents — a dedicated log for safeguarding-relevant or otherwise significant events, defaulting to private until a Family Owner chooses otherwise.
• Strategies and Wins — approaches a family is trying with a child, and milestones or achievements they choose to record.
• AI-generated insights — daily, weekly and monthly summaries, and on-demand pattern analysis, produced by sending logged data (never anything a family has kept private from that surface) to an AI model. See “How AI is used” below.
• Ask Moo conversations — questions asked of the in-app AI assistant and its answers, kept so a conversation can be picked up again and so it can recall earlier context.
• Messages — where a family has enabled it, messages between separated parents relating to the child, and messages to or from a granted professional.
• Legal/administrative records — EHCP documents, court dates, professional contacts, and exported evidence bundles, where a family chooses to use those features.
• Billing data — subscription tier and payment status, handled by Stripe (we do not store card details ourselves).
• Technical & security data — login timestamps, IP address, device/session information, and an audit log of significant actions (see “Retention and deletion”). This exists for account security and, because of the app's legal-evidence purpose, to make the chronology itself verifiable.

AI is used throughout the app, and every use falls into one of two categories: producing something a family reads (a summary, a suggested tag, a nutritional category, an answer to a question), or extracting text from a document a family uploaded. AI is never used to make a decision about a family or a child that isn't reviewed by a person first — see “Your rights” for how this relates to automated decision-making under UK GDPR.

Specifically, AI is used to:

• Generate tags for a diary entry from its content (the sole source of new tags — there is no manual free-text tagging any more).
• Classify food/drink entries into broad nutritional categories, from the food actually named in the entry.
• Produce daily, weekly and monthly insight summaries, and on-demand “quick check-in” analyses, from a family's own logged data for that period.
• Produce cross-report “meta-analysis” — looking for patterns across a family's own accumulated insight history.
• Power Ask Moo, an in-app assistant that can answer questions about a family's own diary data. Ask Moo can read diary content but can never create or edit a diary entry, sleep log or food record on a family's behalf, and has no access to court messaging under any circumstances.
• Suggest a possible “win” worth recording, which a parent must actively confirm — the AI never creates a Win record by itself.
• Extract text from an uploaded document (such as a Strategy source document) so it can be reviewed and categorised.
• Where a school, clinic or other institution has an account and a professional they employ asks a question spanning several unrelated children, produce an answer drawing only on entries — and, if a family has separately and explicitly agreed, sleep or medication records — each family has agreed to include (see “Who can see what”).
• Convert search phrases and diary content into numerical representations (“embeddings”) so that meaning-based search works across entries, conversations, and legal content.

Which providers process this data: text sent for the uses above is processed by Anthropic (Claude models — the AI features listed above) and, for search embeddings only, Voyage AI (whose service is provided by MongoDB). Both are named again under “Third parties” below. At the time of writing, both providers' standard API terms state that content submitted through their API is not used to train their models — this should be independently verified as part of legal review, and re-verified if either provider's terms change.

What AI does not see: content a family has kept private from a given surface — an entry marked Private that a Contributor cannot see, for instance — is never included in a prompt built for that Contributor's use of the app. Court messaging is never readable by Ask Moo or any other AI feature, under any configuration; this is treated as a permanent, non-negotiable boundary rather than a setting. Safeguarding-relevant material a family hasn't explicitly shared into a cross-institution query is excluded from it even if it would otherwise qualify.

This is the part of the app with the most machinery behind it, because “who can see this child's data” is the single most consequential question the app answers. In outline:

• Family Owner. Sees every child in their family, and every entry — including other people's Private ones, with the exception of another family member's Private Strategy notes and a Contributor's Private sleep/medication records, neither of which the Owner can override. Only a Family Owner can delete anything.
• Contributor (co-parent, grandparent, support worker). Sees only the children explicitly granted to them, and — for those children — Public entries plus their own Private ones, never another contributor's Private material. Safeguarding flags are hidden from Contributors entirely. A Contributor can add entries and comment, but cannot delete or edit someone else's entry, and cannot reach any of the legal/professional features (court dates, evidence bundles, EHCP tools, messaging, audit log, reports).
• Shared access between two families (typically separated parents each running their own account). One family — the granting family — can share a specific, time-windowed slice of a child's Public entries with another family. Private entries never cross this boundary, under any circumstance, and there is no override capable of admitting one. The window (how far back the sharing reaches) is chosen deliberately by the granting family and can be revoked immediately at any time.
• Professional accounts (a teacher, GP, speech and language therapist, or similar, supporting children across several unrelated families). A professional sees nothing until a family explicitly grants them access to a specific child. Even then, six write permissions — covering diary entries, strategy notes, wins, sleep, food, and medication — are set independently by the family, with the clinically sensitive ones (sleep, food, medication) defaulting to off. Reading is broader than writing by design, but a professional is explicitly and permanently excluded from every legal feature (court dates, evidence bundles, EHCP documents, messaging, and related exports) for a child they only reach through a professional grant — this holds even if the same person is separately a parent on a different child's account.
• Cross-child questions (an institution's professional asking one question that spans several children they support). This requires two separate, explicit yes/no decisions from each family: the professional access grant above, and a further, specific consent to be included in a cross-child comparison. A family can allow their child to be looked up individually without allowing a synthesised comparison with other children, and can withdraw either at any time; withdrawing either one immediately removes that child from future cross-child queries. Only Public entries — and, separately, only sleep or medication records a family has explicitly opted in — are ever eligible to be included, and any answer produced this way names which child it is about rather than blending children together anonymously.
• Platform administration. An administrator account exists for running the platform (managing institutional billing, investigating reported problems) but has no content-reading access to any family's diary by virtue of that role alone.

Every one of these boundaries is enforced on the server for every request, not just hidden in the interface, and several have been verified by seeded, adversarial testing designed to surface a scoping mistake rather than assume one hasn't been made.

This app exists to hold information about children, most of whom will never open it themselves — it is a tool for the adults responsible for them, not a service aimed at children as users. Much of what is recorded (sleep patterns, medication, safeguarding-relevant incidents) is what UK GDPR treats as special category data, warranting a higher standard of care, which is why access to it is controlled as described above rather than left open to everyone with an account.

Safeguarding-flag detection. Newly logged entries are automatically scanned by an AI model for language that may indicate a safeguarding concern. A flagged entry is not reported anywhere outside the app, is visible only to the Family Owner (never a Contributor, and never a professional or another family through sharing), and can be reviewed and dismissed by the Owner. This process is entirely internal record-keeping — see the Safeguarding Statement for what the app does and does not do if you have an actual safeguarding concern.

A parent or guardian remains the person with authority over their child's data throughout. If you are a Contributor or a professional and believe data about a child should be corrected or removed, the request goes through the Family Owner, who controls it — the app does not give the platform operator authority to act on a child's behalf independently of the family.

• Structured data (entries, records, accounts) is held in a PostgreSQL database hosted by Neon, a US-based provider, over an encrypted connection.
• Uploaded media (photos, video, audio, documents) is stored via UploadThing, backed by Cloudflare R2. Currently, media files are addressed by an unguessable but not access-controlled URL — restricting this to signed, access-checked URLs is planned but not yet complete, and should be treated as an open item for legal review rather than an assumed protection.
• Passwords are hashed (never stored in plain text), and two-factor authentication is available for an account.
• A database backup runs daily, and uploaded media is separately mirrored to a backup location on a regular schedule, so that data loss from an operational failure is recoverable.
• Sessions expire automatically after a period of inactivity, and a user can review and revoke their own active sessions from Settings.

We do not sell data, and we do not share it with any third party except where necessary to run the service, as follows:

• Anthropic — processes diary and account content to provide the AI features described above (tagging, insights, Ask Moo, document extraction, and related).
• Voyage AI (a MongoDB service) — processes text to generate the numerical embeddings that power meaning-based search.
• Neon — hosts the primary database.
• Cloudflare (R2) — stores uploaded media and database/media backups.
• Vercel — hosts and runs the application itself.
• Stripe — processes subscription payments. Currently operating in test mode only, ahead of the app being offered to real paying customers.
• Twilio — provides WhatsApp messaging integration where a family has it enabled. Currently on a sandbox (non-production) number.
• Resend — sends transactional emails (invites, notifications, alerts).
• UploadThing — manages file upload and delivery on top of the Cloudflare R2 storage above.

Each of these providers only receives the data necessary for the function it performs, and none is permitted to use it for its own independent purposes under the terms we operate on with them.

This is covered in full in the separate Data Retention Policy, which should be read alongside this one. In short: an entry that has been digitally signed, or that is older than 24 hours, cannot be silently edited or deleted — corrections are made through a visible Amendment that preserves the original, because a silently-edited record would undermine the evidential purpose the app exists to serve. Audit log entries recording who did what, and when, are kept for the same reason. Requests to delete an account, or data within one, are handled by the Family Owner and, where the data has been submitted to or referenced in legal proceedings, may be subject to a legal hold that overrides an ordinary deletion request until that hold is lifted.

Under UK GDPR, we rely on the following legal bases, depending on the data and purpose:

• Consent — for optional features a family or individual explicitly opts into, such as sharing sleep/medication records with a professional or in a cross-child query, or enabling WhatsApp messaging.
• Contract — for the core service itself: providing the account, storing what a family logs, and running the features a subscription pays for.
• Legitimate interests — for security logging, fraud prevention, and the audit trail that underpins the app's legal-evidence purpose, balanced against the individual's rights and always kept to what is proportionate.
• Legal obligation — where data must be retained or disclosed to comply with a court order or other legal requirement, including a legal hold on records submitted to proceedings.

No processing described in this policy involves solely automated decision-making that produces a legal or similarly significant effect on a person, within the meaning of UK GDPR Article 22. AI output (insights, suggested tags, suggested wins) is always presented to a human for review, never acted on automatically, and a suggested Win specifically requires active confirmation before it is ever recorded.

Several of the providers listed above (Anthropic, Voyage AI/MongoDB, Neon, Vercel, Stripe, Twilio) are US-based or operate infrastructure outside the UK. Where personal data is transferred outside the UK, this relies on the relevant provider's standard contractual clauses or equivalent safeguard recognised under UK GDPR. The specific mechanism for each provider should be confirmed during legal review, since providers update their compliance posture over time.

Under UK GDPR, you have the right to:

• Request a copy of the personal data held about you (a full data export is available from Settings for your own account's data).
• Request correction of inaccurate data.
• Request erasure of your data, subject to the legal-hold exception above for records forming part of an evidential chronology.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time for anything based on consent (such as a professional grant, a cross-child query consent, or WhatsApp messaging), without affecting the lawfulness of processing before the withdrawal.
• Complain to the UK's supervisory authority, the Information Commissioner's Office (ico.org.uk), if you believe your data has been mishandled.

Because a child is usually the subject of the data rather than the account holder, these rights are ordinarily exercised on a child's behalf by their parent or guardian (the Family Owner). Requests can be made from the Settings page or by contacting us directly (see below).

This policy will be updated as the app changes and as it goes through legal review. Material changes will be reflected in the “Last drafted” date at the top of this page. We may notify users of significant changes directly, particularly where a change affects who can see what.

For any data-related request or question, contact: donnie.eastwood@icloud.com

See also: Terms of Service, Data Retention Policy, and the Safeguarding Statement.