# Breaststroke — Privacy Policy
### breaststrokeapp.com
Last updated: May 2026
---
## Who we are
Breaststroke is operated by a sole trader registered in the Netherlands (KVK: 88855023). Our website is breaststrokeapp.com and you can reach us at hello@breaststrokeapp.com.
We take your privacy seriously. This policy explains what data we collect, why we collect it, and what we do with it.
---
## What data we collect
### Data you enter into the app
When you create an account and use Breaststroke, we collect and store the following personal data:
- Your name
- Your email address
- Your age
- Your height and weight
- Your goal weight
- Your average daily step count
- Your baby's date of birth and weight
- Your baby's breastmilk intake (as a percentage or in millilitres)
- Your daily calorie logs
- Your weight check-in history
This data is stored securely on our backend database, provided by Convex (see Third parties below).
### Data collected during payment
When you purchase Breaststroke, your payment is processed by Apple (App Store) or Google (Google Play Store) depending on your device. We do not process your payment directly, and we do not receive or store your payment card details.
Purchase entitlements — confirming that you have paid and unlocking the app — are managed by RevenueCat, Inc., a third-party service based in the United States. RevenueCat receives a purchase token from Apple or Google and provides us with confirmation of your entitlement status. RevenueCat does not receive your payment card details.
For more information:
— Apple Privacy Policy: apple.com/privacy
— Google Privacy Policy: policies.google.com/privacy
— RevenueCat Privacy Policy: revenuecat.com/privacy
### Data you provide by contacting us
If you email us at hello@breaststrokeapp.com, we receive and store your email address and the contents of your message in order to respond to you. We do not add you to any mailing list without your explicit consent.
### Data collected automatically
Our website does not currently use analytics tools, tracking pixels, or advertising cookies.
---
## Why we collect it and our legal basis (GDPR)
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account creation, purchase delivery, support | Contract performance |
| Age, height, weight, goal weight | To calculate your personalised calorie target | Contract performance |
| Baby details (DOB, weight, milk intake) | To calculate breastfeeding calorie burn | Contract performance |
| Daily logs and weight check-ins | To show your progress over time | Contract performance |
| Contact emails | To respond to your enquiry | Legitimate interest |
---
## How long we keep your data
- **Account and app data** (email, weight, baby details, logs): stored indefinitely on our backend for as long as you have an account. You may request deletion at any time by emailing hello@breaststrokeapp.com.
- **Payment records**: retained for 7 years as required by Dutch tax law (Belastingdienst).
- **Contact emails**: retained for as long as necessary to resolve your enquiry, then deleted.
We do not currently have an automated account deletion process. If you would like your data deleted, email us and we will action it within 30 days.
---
## Who we share your data with
We do not sell your data. We do not share your data with advertisers or marketing companies.
We share data only with the following trusted third-party processors:
**Convex, Inc.**
Our backend database and application infrastructure is provided by Convex, Inc., a company based in the United States. Your personal data — including your email address, weight, age, and app data — is stored on Convex's servers, which are hosted on Amazon Web Services (AWS) infrastructure in the United States.
Convex processes data on our behalf under a Data Processing Addendum (DPA) in accordance with GDPR requirements. Data transfers to the US are covered by Standard Contractual Clauses (SCCs) as approved by the European Commission.
For more information: convex.dev/privacy
**Revenue.Cat**
Processor Purpose Location
Apple App Store Payment processing (iOS) United States
Google Play Store Payment processing (Android) United States
RevenueCat, Inc. Purchase entitlement management United States
Convex, Inc. Backend database United States
---
## International data transfers
Your personal data is transferred to and stored in the United States via Convex, Inc. This transfer is made under Standard Contractual Clauses (SCCs) as approved by the European Commission, which provide appropriate safeguards for your data.
All payment and entitlement data is processed in the United States by Apple, Google, and RevenueCat under their respective data processing frameworks. App data is stored in the United States via Convex, Inc. All transfers are made under Standard Contractual Clauses (SCCs) as approved by the European Commission.
---
## Your rights under GDPR
As a resident of the European Union, you have the right to:
- **Access** — request a copy of the personal data we hold about you
- **Rectification** — ask us to correct inaccurate data
- **Erasure** — ask us to delete your account and all associated data ("right to be forgotten")
- **Restriction** — ask us to limit how we use your data
- **Portability** — receive your data in a portable format (we will provide a CSV export on request)
- **Object** — object to our processing of your data
- **Withdraw consent** — where processing is based on consent, withdraw it at any time
To exercise any of these rights, email us at hello@breaststrokeapp.com. We will respond within 30 days.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Dutch data protection authority:
**Autoriteit Persoonsgegevens**
autoriteitpersoonsgegevens.nl
Telephone: 0900 2001 201
---
## Security
We take reasonable technical measures to protect your data. Convex provides encrypted data storage and secure API access. We do not store passwords in plain text — authentication is handled via secure token-based methods.
Despite these measures, no system is completely secure. If you have concerns about your account, contact us immediately at hello@breaststrokeapp.com.
---
## Cookies
Our website does not currently set any tracking or advertising cookies. We may use a single functional cookie to maintain your login session. No consent is required for strictly functional cookies under EU ePrivacy rules.
---
## Children
Breaststroke is intended for adults (18+). We do not knowingly collect data from anyone under the age of 18. If you believe a minor has created an account, please contact us and we will delete it promptly.
---
## Changes to this policy
If we make material changes to this policy, we will update the "last updated" date at the top of this page. For significant changes affecting how we use your data, we will notify you by email where possible.
---
## Contact
For any privacy-related questions or data requests:
hello@breaststrokeapp.com
The Netherlands
KVK: 88855023