legal
Privacy, plainly
Last updated: July 2026 · The plain-English summary and the detail below both count.
We collect the minimum. Your answers, your email, your plan. No advertising trackers, ever.
High privacy is the default. Built to the ICO Children's Code - nothing is pre-ticked, and we never nudge you to share more.
It's yours. Export or delete everything from your account, any time, in two taps.
1. Who we are
Coorie Baby Ltd is the data controller for coorie.baby. For anything privacy-related, email hello@coorie.baby - a person answers, usually within two working days.
2. What we collect, and why
Your account: first name and email address - so your plan is saved and you can sign in. Lawful basis: contract.
Your assessment answers:your baby's first name, age band, and your answers about sleep, feeding and routines - the only purpose is building and adjusting your plan. Because this can include health-adjacent information about your child, we treat all of it to the standard of special category data: encrypted in transit and at rest, never sold, never shared for marketing, never used to profile you. Lawful basis: contract, with explicit consent for anything health-related - asked for before the questions begin, never buried in terms.
Payments: handled by Stripe; we never see or store card numbers. What we don't collect: no advertising identifiers, no third-party trackers, no contact scraping, no location. Analytics are anonymous, aggregated and cookie-free, and never run on pages that touch your health answers.
3. The ICO Children's Code
This service holds data about children, so we build to the Children's Code by design: highest privacy settings by default, minimal collection, no nudge techniques to share more, no pre-ticked boxes, and plain-English explanations like this one.
4. Where it lives, and who processes it
Your data is stored with Supabase (database, UK/EU region), and processed by Stripe (payments) and Microsoft 365 (email) - each under a data processing agreement. We keep a record of processing activities and never move your data outside these named processors.
5. How long we keep it
While your account is active. Delete your account and everything goes within 30 days, backups included - no forms, no waiting period.
6. Your rights
Access, correct, export (a readable file, from your account, instantly) or erase your data at any time - no forms, no waiting period, no retention tricks. If we've fallen short, tell us; if we still fall short, you can complain to the ICO at ico.org.uk.