Milk Monster
Get the app

Privacy Policy

Last updated October 5, 2026

Milk Monster is a baby-tracking app for parents and caregivers. This policy explains what we collect, why, which companies handle it for us, how long we keep it, and the control you have. We built Milk Monster to be a quiet, private place for your family’s record — we do not sell your data and we do not show you ads.

Who uses the app

Milk Monster is intended for use by parents and adult caregivers. The information in the app is about a baby, but it is entered by the adults caring for that baby. The app is not directed to children and is not intended for use by children.

What we collect

  • Your account: your email address, your password, and the display name you choose. Our authentication provider keeps only a salted, one-way (bcrypt) hash of your password — never the password itself. If you use Sign in with Apple, Apple gives us the name you choose to share and an email address, which can be a private relay address Apple creates for you. For each phone or browser you sign in on, we also keep its IP address and a short technical label: on iPhone and iPad, the app’s build number and your system version; on Android, only the version of the networking library the app uses; in a web browser, the browser’s standard description of itself (its name, version and operating system) (see “Sign-in sessions” under How long we keep it).
  • Your baby’s profile: name, birth date, sex, the time zone the log is kept in, and an optional photo.
  • The log you create: feeds, sleep, diaper changes, pumping sessions, baths and other care, growth measurements (weight, length, head circumference), temperature readings, medicine doses, milestones, optional milestone photos, day notes, questions for your doctor, and any notes you add. Since October 4, 2026, photos you add are stored without the location they were taken at, and we removed it from every photo added before then. If you’re on an older version of the app, please update it.
  • Family sharing: when you invite another caregiver, they join your household and can see and add to the same log. We record who logged each entry so the family can see “who did what,” and we store the invite codes you create. If you leave a family or are removed from it, your name stays on the entries you logged and the changes you made there. Deleting your account removes it. When anyone edits or deletes a feed, sleep, diaper, pumping, care, temperature or medicine entry, we keep a record of the change: who made it, when, and what the entry said before, including its note. (Edits to a timer while it’s still running, and edits to milestones, growth measurements, day notes and questions, aren’t kept this way.) Everyone in the family can see these records in exports, and in the app as an “Edited” label or a recent “removed” line. Without Premium, that’s only for entries from the last 30 days.
  • Notifications: if you allow notifications, we store your device’s push token so we can deliver them. On iPhone, while a timer is showing on your Lock Screen, we also store that Live Activity’s push token so the timer can end when another caregiver stops it.
  • Siri and Shortcuts: on iPhone and iPad, so Siri and Shortcuts can log for you, we store a key for your device, labelled with its model name.
  • Subscription status: if you subscribe to Premium, the purchase itself is handled by Apple or Google — we never see your payment details — and we keep your plan, store and price on your account. Whether or not you subscribe, the app checks with RevenueCat, our subscription service, when it opens. RevenueCat receives your Milk Monster account ID (a random identifier, not your name or email), the store’s record of any purchases, the app’s version, your phone’s model (and, on Android, its maker), its iOS or Android version, your language settings, your App Store or Google Play country and, like any server you connect to, your IP address. On iPhone and iPad, it also receives Apple’s identifier for vendor (an ID Apple gives each app maker for your phone, separate from the advertising ID), and a token from Apple that RevenueCat uses to ask Apple whether the app was installed from one of our App Store ads, and which one.
  • How you found us: until August 2026, we asked one optional question at sign-up (“How did you find us?”). We don’t ask it anymore. If you answered it, we still have your answer, and it’s deleted with your account. We also note when someone joins through a family’s invite. On Android, Google Play tells us which of our own links, if any, led to the install. We use all of this only to see which of our efforts are working.
  • How the app is used: the app records a short list of in-app events in our own database — for example, which sign-up step you reached, when the subscription screen was shown, or when you first logged something — along with your account ID, family ID, app version and build, platform, and your phone’s region setting. We use them to find where the app is confusing. They are not sent to any analytics company, and they are deleted with your account.
  • If you contact us: what you send — an email to us, or a form on our website — including your name and email address.

Apart from RevenueCat’s reports on subscriptions and on which of our ads led to an install (see Subscription status, above), we don’t use outside analytics or session-recording tools, and we don’t track you across other apps or websites. We also don’t add a crash-reporting tool to the app. If it crashes while starting up, Expo receives the error message (see Expo, below), and Apple or Google may pass crash reports on to us if your phone’s settings allow it.

How we use it

  • To run the app: store your family’s log, keep it in sync between your caregivers’ phones, and show it back to you.
  • To tell your other caregivers when someone logs something, and to send the getting-started messages described below.
  • To run subscriptions, and to answer you when you write to us.
  • To choose who gets a product email when it only applies to some people — for example, the members of a family whose subscription has ended.
  • To understand, in aggregate, whether the app is working — for example, how many new families are still logging on their second day.
  • To see how actively nannies, doulas and newborn care specialists, and anyone else who belongs to more than one family, are using the app, along with those families. For this, we see their names and roles, the families’ names and how many people are in each, whether each family subscribes, and how much and how recently they log — not what was logged.

We don’t show ads, we never sell your data, and we never give it to advertisers. We do advertise Milk Monster itself in the App Store. On iPhone and iPad, Apple tells us (through RevenueCat) whether the app was installed from one of those ads, and which one. We use that only to see which of our ads lead to installs, sign-ups and subscriptions.

Notifications and emails

When another caregiver logs. When someone in your family logs an entry, the other caregivers get a notification that names the baby and the caregiver and says what was logged — for example, “Juniper update: Ava gave Tylenol.” Medicine names, temperature readings and activity labels can appear in it. To reach a phone, these notifications pass through Expo’s push service and then Apple (on iPhone) or Google’s Firebase Cloud Messaging (on Android). Notifications can show on a locked screen. You can mute a family with the bell next to it in Settings, or turn off Milk Monster’s notifications in your phone’s settings.

Getting started. In your first days, we send a few automated messages, by email and by notification, to help you get set up. They can include your first name, your baby’s name, a summary of the first day’s log (for example, “6 feeds, 2 diapers and 5h 10m of sleep”) and — in email only, never on a lock screen — your family’s invite code and link. These notifications travel the same way as the ones above, through Expo and then Apple or Google. Emails are plain text with no tracking pixels. We send at most one of these emails every 12 hours and one notification a day, during daytime in your family’s time zone. From time to time, to learn whether these messages actually help, we hold them back from a randomly chosen group of new families. Reply “unsubscribe” to any of these emails, or email us, and we’ll stop all of them — emails and notifications.

Product news. Occasionally Erick, the founder, emails users about meaningful changes to the app. These contain no tracking pixels, and every one includes a way to opt out.

Account emails — confirming your address and resetting your password — are always sent. When you open one, it loads the Milk Monster logo from our website and a font from Google Fonts.

Where your data is stored, and who can see it

Your data is stored with Supabase, our hosting provider, on Amazon Web Services in the United States (Ohio). It travels between your phone and our servers over an encrypted connection and is encrypted at rest by our hosting provider. Your password is never stored in readable form.

Inside the app, access rules on every table in our database mean an account can read only the households it belongs to. Photos are private: the app shows them through links that expire after an hour.

Who can see your family’s data: the caregivers you invite to your household. In addition, Erick, the founder, has administrator access to the database to run and repair the service; the in-app access rules don’t apply to that access. He looks at a family’s log only when it’s needed to answer a question you’ve asked, to fix a problem, or to meet a legal obligation.

We do not sell, rent, or trade your personal information, and we do not share it with advertisers.

Companies that handle data for us

Here is each one, and what it handles:

  • Supabase — hosting, sign-in, the database that holds your family’s log, and photo storage (on Amazon Web Services, in the United States).
  • Expo — delivers notifications to your phone (it sees each notification’s text and your push token) and delivers app updates. When the app checks for an update, it sends Expo a random ID, made the first time the app opened and kept on your phone, so Expo can send the right update. The ID carries over if you restore your phone from a backup. If the app crashed while starting up, the next check also includes the error message from that crash.
  • Apple — the App Store and purchases, Sign in with Apple, notifications and Live Activities on iPhone, and Apple Search Ads attribution.
  • Google — Google Play and purchases, notifications on Android (Firebase Cloud Messaging), and Google Fonts, which our websites and account emails load.
  • RevenueCat — checks your subscription status when the app opens and, on iPhone and iPad, learns whether one of our ads led to the install, as described above.
  • Resend (which sends through Amazon SES) — account emails, getting-started emails and product news, and it emails Erick the idea and feedback forms you send from our website (those are also stored in our Supabase database; the creator sign-up form goes through Formspree, below).
  • Cloudflare — hosts our websites and routes email sent to us. Email you send us is kept in our Google mailbox.
  • On our websites: the password-reset page and our partner kit load files from jsDelivr; our videos are hosted on YouTube, which receives your visit when a video or its preview image loads; and the creator sign-up form is handled by Formspree.

How long we keep it

  • Your account and your family’s log: until you delete them.
  • Change history: the earlier version of an edited or deleted feed, sleep, diaper, pumping, care, temperature or medicine entry stays in the family’s change history until the baby or the family is deleted (or your account, if you’re the only member). Deleting a single entry doesn’t remove its record. Milestones, growth measurements, day notes and questions have no change history: an edit replaces them and a deletion removes them.
  • Photos: when you replace or remove a photo, or delete a milestone, a baby, a family or your account, the photo file is deleted from storage within 48 hours.
  • Backups: our hosting provider takes a backup of the database every day and keeps each one for 7 days. So for up to 7 days after you delete something, it can still exist in a backup, which we would use only to recover the service. Backups hold the log, not photo files.
  • Unsubscribes: if you ask us to stop emailing you, we keep your email address on a do-not-contact list so we can keep honoring it.
  • Emails and website forms you send us: until you ask us to delete them.
  • RevenueCat keeps its record of you — your account ID, any purchases, your phone’s details and, on iPhone and iPad, whether one of our ads led to your install — under its own retention policy. Deleting your Milk Monster account doesn’t delete that record automatically; email us and we’ll ask RevenueCat to delete it.
  • Sign-in sessions: for each phone or browser you’re signed in on, our sign-in system automatically saves its IP address and basic details of the app or browser. We don’t use them day to day, but they could help us look into it if something ever seems wrong with an account. We keep them until you sign out or delete your account; they don’t expire on their own. Signing out of the app (while online) signs you out everywhere and deletes these records. Removing the app from your phone doesn’t delete its record, so sign out first if you want it gone.
  • Our providers also keep their own technical logs (such as IP addresses and request times) to run and secure their services, under their own retention policies.

Deleting your account and data

You can delete your account at any time from Settings → Delete account inside the app, or by email (see Delete your account). Your account — email, display name, sign-in, push tokens and usage events — is deleted immediately. If you’ve asked us to stop emailing you, your address stays on our do-not-contact list so we don’t send it getting-started or product emails again. If you are the only member of your household, your baby’s entire log is deleted with it, including milestones, notes and photos. If other caregivers share the household, the shared log remains for them, and your past entries are simply no longer attributed to you. In that case, our record of a getting-started message we already sent you can keep your first name until the family itself is deleted. Deletion is permanent and cannot be undone; backups expire within 7 days, and photo files are removed within 48 hours.

If you signed in with Apple, Milk Monster stays listed under Sign in with Apple in your Apple Account after you delete. To remove it, open the Settings app on your iPhone or iPad (not Settings inside Milk Monster), tap your name, tap Sign in with Apple, tap Milk Monster, then tap Delete and confirm.

Your choices

  • Edit or delete the entries, milestones and measurements you logged (a parent in the family can edit or delete anyone’s). Without Premium, only the person who set up the family and, if it has since been handed to someone else, the family’s current owner can edit or delete them. Feeds, sleep and other log entries older than 30 days are hidden from everyone in the family, including those two, and only those two can see milestones and growth measurements. Nothing is deleted. Edited and deleted feeds, sleep, diapers, pumping, care, temperature and medicine entries stay in the family’s change history; milestones and measurements don’t have one. Email us to have anything removed.
  • Export the history available to you as a spreadsheet from Settings, to keep or share with your pediatrician.
  • Mute notifications from a family, or turn them off on your phone.
  • Stop getting-started and product emails by replying “unsubscribe” or emailing us.
  • Leave a shared household, or remove your account entirely.
  • Email us to ask what we hold about you, to correct it, or to delete it.

Changes to this policy

If we make material changes to this policy, we’ll update the date above and, where appropriate, let you know in the app.

Contact

Questions about your privacy? Email [email protected]. It comes straight to Erick.