In short
Elio asks you for an account, and everything you log is saved to it: that is how you get your baby’s history back on a new phone and share it with your family. On the phone, your data is kept in encrypted storage. On our servers, it is hosted in the European Union and can only be read by you and the people you invite. Nothing is sold, nothing is used for advertising, and the app contains no analytics tool.
Who is responsible for your data
Samuel Rodriguez-Lozano, publisher of Elio. For any question, or to exercise your rights: support@eliobebe.com.
The data involved
- Your account: your email address, your password (stored in a form nobody can read back), your first name, and, if you give them, your date of birth and your relationship to the child.
- Baby: first name, date of birth, sex, country, birth details (prematurity, caesarean, weight), feeds, pumping and milk stock, sleep, diapers, weight and height, solids (foods, textures, reactions), milestones, photos, and the health appointments in your calendar.
- You, as a parent: your evening check-ins (mood, anxiety, mental load, sleep) and your journal.
- Family: the people you invite, their relationship to the child and their level of access. For a care day: the first name of the person looking after the baby, the planned moments, your instructions, and your phone number if you choose to add it.
- Formula watch: the formula you watch (name or barcode), and the reports you send (product, batch, source).
- Subscription: your account ID, passed to RevenueCat, and your purchase history. Never your card details, which we do not see.
- Technical: your phone’s notification token if you allow notifications, the number of questions asked to the assistant so quotas can apply, and error reports.
A baby’s health data and a parent’s state of mind are sensitive data. They are used only to make the app work: to show your logs, to share them with the people you chose, and to answer your questions.
Where it is stored
On the phone, in an encrypted database (MMKV) whose key is held by the system (iOS Keychain, Android Keystore). In your account, on our Supabase project hosted in Ireland, in the European Union (region eu-west-1). Row-level access rules decide who can read what. Photos go to private storage, never public. When you sign out, the data leaves the phone and stays in your account.
Sharing with your family
An admin of a child can invite other people with a code: a co-parent, a grandparent, a nanny. They choose a level of access for each (read only, daily care, or full access) and can remove it at any time. Anyone can also leave a family.
- The whole family sees the baby’s logs, milestones, photos and daily notes, with the first name of whoever logged each entry.
- Your evening check-ins can be seen by the other admins of the children you share, usually the co-parent. Someone invited without that role never sees them, whatever their access.
- Your journal, your settings and your calendar are read by you alone.
- A care day is read only by the people you give it to, and by those with full access to the child. If you send it as a PDF, it leaves Elio and lives in the messages or printer of whoever receives it.
The assistant
When you ask a question, the app prepares a summary of your recent data on the phone (the baby’s age, feeds, sleep, how you are), then sends it with your question to our server, which queries Google’s Gemini model. The daily tip, the evening recap and the little anniversaries are written the same way. This processing takes place in the United States, and the key to the model is never inside the app.
The conversation stays on your phone: on our servers we keep only the number of questions and tokens, for quotas. The daily tip and the evening recap are saved to your account and can be seen by the child’s family.
Notifications and widgets
- Reminders (vitamin D, evening check-in, time between feeds, little anniversaries) are scheduled on the phone. Nothing is sent anywhere to deliver them.
- If you allow notifications, your phone’s token is saved with your account. It is used to warn you about a recall on a formula you watch, and, when someone in the family logs a feed or a sleep, to send your phone a silent notification. That notification carries nothing about the baby: it only asks the app to refresh.
- On iPhone, widgets show a short summary (the baby’s first name, last feed, sleep, diaper, totals for the last few days, milk stock). That summary is copied to a shared area of the phone, protected by the device’s encryption but not by Elio’s, and a Lock Screen widget can be read without unlocking. It never leaves the phone.
The formula watch
If you watch a formula, we keep its name or barcode with your account, so we can warn you by notification, or by email to your account’s address, if a recall concerns it. A report you send is read by no other parent: when several families report the same product, the families watching it are warned, without knowing who reported it.
Error reports
If Elio runs into an error, it sends us a technical report: the error message, where in the code it happened, which screen, the app version and the system (iOS or Android). It never includes your baby’s data, your entries or anything you typed. It is linked to your account so we can check that a fix worked, and deleted with it. No third-party service is involved: reports go to our own database, in the European Union.
Who else is involved
- Supabase: hosting of accounts, the database and photos, in the European Union.
- Google (Gemini): the assistant’s answers.
- RevenueCat: subscription management.
- Apple and Google: distribution of the app, payment for purchases, and delivery of notifications.
- Expo: sending notifications.
- Resend: sending account emails (confirmation codes, forgotten password) and recall alerts by email.
- Cloudflare: hosting this website. The contact form passes your message on to our support inbox and keeps nothing of it.
- Google (Gmail): the inbox that receives messages sent to support@eliobebe.com and through the contact form.
Each acts on our behalf, only for this service. No other recipient, no resale, no advertising network.
Transfers outside the European Union
Several of these providers are based in the United States, and the assistant is processed there. These transfers rely on the EU-U.S. Data Privacy Framework where the provider takes part in it, and otherwise on the European Commission’s standard contractual clauses.
On what basis
Your explicit consent, which you give by logging them, for your baby’s health data, your state as a parent and your journal. Performance of the contract for your account, family sharing and the subscription. Our legitimate interest for error reports, assistant quotas and the trace a deleted account leaves, which keep the service running and prevent abuse. You can withdraw your consent at any time by deleting your account in the app, or by asking us to erase part of your data.
How long
- In your account: as long as it exists. An entry you delete disappears from the app at once, and from our servers when the account is deleted, or sooner if you ask us.
- On the phone: until you sign out, delete your account or delete the app.
- Assistant counters and error reports: as long as the account exists. They are deleted with it.
- After an account is deleted: a pseudonymous trace (a one-way fingerprint of the address, the dates and a few counts) is kept for three years, so we can answer a question about the account and notice repeated sign-ups and deletions.
Your rights
Access, rectification, erasure, portability, restriction, objection, and withdrawal of consent. You can correct your entries in the app, and delete your account there from Settings, in the Account section. For anything else, write to support@eliobebe.com and we answer within one month. The deletion procedure is set out on this page. The app also exports a summary as a PDF, over 7, 14 or 30 days. If our answer does not satisfy you, you can complain to the CNIL, the French data protection authority, or to the authority where you live (the ICO in the UK).
Children
Elio is meant for adults. A baby’s data is entrusted to us by a person with parental responsibility, who consents on the child’s behalf, and entered by them or by the people they invite.
Changes
Any change will be published here, with a new date. A significant change will be pointed out to you in the app.