Privacy Policy — ioCresco

Last updated: 29 October 2026

ioCresco is a diary for following your baby's growth: measurements and percentiles, daily diary, photos, reminders, vaccines, developmental milestones and shopping list. The app is designed for parents (adults), not for direct use by children.

In short:

• By default all data stays on your phone. The developer does not see it and does not receive it.
• It leaves the phone only if you turn on family sharing (Google Firebase servers in Europe, with your explicit consent) or backup to your Google Drive.
• No advertising, no profiling, no sale of data, no usage statistics.

1. Data controller

The data controller is the developer of ioCresco, a natural person resident in Italy, whose identification details are shown on the app's developer page on Google Play.

For any request about your data: privacy@iocresco.app.

2. Data stored on the phone

The data you enter is stored on your phone, in the app's storage:

• baby profile: name, date of birth, sex, profile photo, weeks of gestation at birth (all optional);
• measurements: weight, length/height, date and notes;
• diary: breastfeeds, bottles, meals, diapers, sleep, pumping, temperature and medicines with times and notes;
• photo of the day with notes and voice memos: photos taken with the app are also saved in the phone's Gallery (folder Pictures/ioCresco); for photos picked from the Gallery the app keeps a copy in its private storage;
• reminders, vaccines given and appointments, developmental milestones, shopping list, lullabies (YouTube links);
• app preferences (theme, language, backup).

Some of these are data concerning the health of a minor. They remain under your control on the phone: the developer has no access to them.

3. Family sharing (optional)

If you turn on sharing with the other parent, and only after your explicit consent (Art. 9(2)(a) GDPR):

• you sign in with your Google account through Firebase Authentication: your email, name and account identifier are processed;
• a copy of the data in section 2 (excluding photos, voice memos and preferences) is saved on Firebase Realtime Database, on servers in Europe (Belgium), and synced between the family's phones;
• the data can be read only by family members: the database security rules enforce this, and joining requires a single-use invite code valid for 24 hours;
• data travels encrypted (HTTPS) and Google also encrypts it on its servers.

Provider: Google Ireland Limited, acting as data processor under the Firebase terms. Some authentication services may involve transfers to the USA, covered by the EU-U.S. Data Privacy Framework and the standard contractual clauses.

Withdrawal: you can withdraw your consent at any time by leaving the family or with "Delete account". If you created the family, the shared data is deleted from the cloud; the other parent keeps the copy on their own phone.

4. Backup to Google Drive (optional)

If you turn on backup, the data and photos are copied to your Google Drive, in the BabyGrowth folder created by the app. The app can only see the files it created itself, and the developer has no access at all to your Drive. You can delete the backups with "Delete account" or directly at drive.google.com, and revoke access from your Google account settings.

5. Other external services

• YouTube: when you add a lullaby, the app asks YouTube for the video title (oEmbed service) and shows its thumbnail; the video opens in the YouTube app. Google's privacy policy applies.
• Notifications: they are local only, scheduled on the phone; no server sends notifications.
• PDF report / QR for the pediatrician: they are created on the phone and shared only if you choose to do so.

6. Purposes and legal bases

• Running the app on the phone: performance of the service you requested (Art. 6(1)(b) GDPR).
• Family sharing in the cloud: explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
• Backup to your Google Drive: performance of the requested service, when you turn it on.
• Replying to your requests: legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).

7. Phone permissions

• Camera: to take the photos of the day.
• Microphone: only to record voice memos, when you ask.
• Notifications and alarms: to alert you to reminders at the right time.
• Internet: for family sharing, backup and lullabies.

The app does not access your whole Gallery: to choose a photo it uses the system picker.

8. Retention

• Data on the phone: until you delete it (Settings → Privacy & data → "Delete all data") or uninstall the app.
• Family sharing data: for as long as you remain in the family; it is deleted when the family is deleted or with "Delete account".
• Backups on Drive: until you delete them.

9. Your rights

You can request at any time access, rectification, erasure, restriction, portability of your data and object to processing (Arts. 15-22 GDPR), and withdraw your consent without affecting processing carried out before. Directly from the app:

• Export my data: Settings → Privacy & data;
• Delete all data (from the phone);
• Delete account (account, family in the cloud and backups on Drive).

You can also request deletion without the app, from the Account deletion page or by writing to privacy@iocresco.app. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

10. Minors

The child's data is entered by the parent or legal guardian, who is responsible for it. The app is not intended for use by minors and does not collect data directly from them.

11. Security

The family database is protected by per-member access rules, invites are single-use and expire, and communications are encrypted. Data on the phone is protected by the device's screen lock: we recommend keeping it on.

12. Changes

Changes to this policy are published here and, if they concern data sharing, you will be asked for your consent again in the app.