Privacy policy

Niblet helps families keep a diary of their baby’s first foods. That means looking after information that matters a great deal to you, including information about your child’s health. We collect only what Niblet needs to work, keep it secure, never sell it, and never use it for advertising.

Who we are

Niblet is run by Sarah Mahoney, a sole trader trading as Niblet, of 38 Greenvale Road, Eltham, London, SE9 1PD, United Kingdom. Sarah is the “data controller”, the person responsible for your information under UK data protection law. You can contact her about anything in this policy at [email protected].

Niblet will register with the Information Commissioner’s Office (ICO) before the app launches.

The short version

• The website collects your email address only if you join the waitlist. It uses no advertising or tracking cookies.
• The app stores your account, your baby’s profile and your food diary so it can work, and shares the diary only with people you invite.
• Reactions and allergy notes are health information. We only store them with your explicit consent, and you can delete them at any time.
• Photos of a plate or label are used once to suggest foods and are not kept.
• You can see, download, correct or delete your information whenever you like.

On this website

Joining the waitlist

If you join the waitlist we store your email address, when you joined, which sign-up form you used, and which version of the sign-up wording you saw. We use this only to tell you when Niblet launches and to send occasional updates about it. Our lawful basis is your consent, which you can withdraw at any time by unsubscribing or emailing us.

Your email address is stored with Cloudflare, which hosts this website. We delete it when you unsubscribe, or 12 months after Niblet launches if you haven’t created an account, whichever comes first. We don’t store your IP address with your sign-up.

Visit statistics

We use Cloudflare Web Analytics to count visits and see which pages are useful. It doesn’t use cookies, doesn’t track you across other websites and doesn’t identify you. Our lawful basis is our legitimate interest in understanding how the website is used.

Cookies

This website doesn’t set any cookies.

In the Niblet app

You add your baby’s information as their parent or carer, and we use it only to provide the diary. Niblet is for adults aged 18 or over. It isn’t designed for children to use themselves.

Photos, labels and links (AI features)

When you ask Niblet to recognise a plate, read an ingredients label or import a recipe from a link, we send that photo, page or text to our AI provider, Anthropic, to suggest foods. You check every suggestion before anything is saved. We don’t keep these photos, and the AI never sees your diary or anything about your family. Anthropic doesn’t use data sent through its commercial service to train its models, and keeps it only for a limited period under its commercial terms.

Family sharing

If you invite a partner, relative or carer with an invite code, they can see and add to your shared diary, including reactions and allergy notes. Only invite people you trust with this information. If one of you deletes their account, the shared diary stays for the others. When the last person leaves, the diary and everything in it is deleted.

Who we share it with

We never sell your information or share it for advertising. We use a small number of trusted providers, under contracts that require them to protect it:

• Cloudflare: hosts this website, the waitlist and visit statistics.
• Our app hosting provider: runs Niblet’s server and database in the UK (London).
• Anthropic: provides the AI that recognises photos, labels and recipe links.
• Apple: if you choose Sign in with Apple.
• Resend: sends our emails, such as account messages and launch news. It handles your email address in the EU (Ireland).

Some of these providers are based in, or may process information in, the United States. Where that happens, the transfer is protected by safeguards approved under UK law, such as the UK International Data Transfer Agreement or Addendum.

We may also share information if the law requires it, or to protect someone’s safety.

How we keep it safe

• Passwords are never stored in a readable form, and accounts lock after repeated wrong guesses.
• On your phone, your sign-in is kept in the secure Keychain and is never copied to backups.
• Your family’s information can only be reached through your own account.
• Photos are only shown through private links that expire.
• All connections use encryption (HTTPS).
• Only Sarah, who runs Niblet, can access the systems that hold your information.

If something ever went wrong, we would tell the ICO within 72 hours where the law requires it, and tell you directly if you were affected.

How long we keep it

• Your account and diary: until you delete your account. If you don’t sign in for 2 years, we’ll email you, then delete the account if we don’t hear back.
• Photos used to recognise food: not kept.
• Backups: encrypted, and kept for no longer than 30 days.
• Waitlist emails: as described above.

Your rights

Under UK data protection law you can:

• ask for a copy of your information
• ask us to correct it
• delete it: you can delete your account in the app at any time (More › Account), or ask us
• ask for it in a format you can take elsewhere
• object to or restrict how we use it
• withdraw consent at any time, for example for reactions and allergy notes, or for emails

Email [email protected] and we’ll reply within one month. If you’re unhappy with how we’ve handled your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes to this policy

If we make important changes, we’ll tell you by email or in the app before they take effect. The date at the top shows when this page was last updated.