Privacy Policy

Last updated: 28 July 2026

Saylings ("we", "us") helps you capture your child's first words. This policy explains what we collect, what we don't, and the choices you have. Where a claim is worth being precise about, we've tried to be precise rather than reassuring.

Who is responsible for your data

Saylings is run by an independent developer. You can reach us at [email protected] with any question about your data, or to have it deleted. The data controller for the purposes of the GDPR is identified in the Contact section at the end of this policy.

Our principles

• Your child's words and recordings are private to you and to anyone you invite.
• We show no ads.
• We never sell your personal data.
• The app itself contains no third-party analytics, advertising, attribution or crash-reporting SDK. Nothing your child says is ever used for advertising.
• This website carries one advertising measurement tag, so we can tell whether an ad we paid for actually brought someone here. It is described in full under Cookies and tracking below, and in the EU it does nothing at all unless you say yes.

What stays on your phone

Photos and videos you attach to a word are saved on your device only. They are never uploaded to our servers, and they are not included in a share link. If you delete the app, they go with it.

Voice recordings behave differently, because they need to sync. See below.

Information we collect

• Content you create: the words, meanings, dates and languages you add, and your child's name and birth date.
• Voice recordings. Audio of your child saying a word is uploaded to our storage so it can sync across your devices and play for anyone you share with. It is stored in a private bucket and served only through short-lived signed links.
• Account identifier. The app signs you in anonymously. There is no email address, password or social login. Your account is a random identifier held in your device's Keychain, used to sync your data and to connect a partner.
• Device identifiers. A per-vendor device identifier is stored alongside each word, so the app can reconcile edits made on different devices. If you enable notifications, we store your device's push token so Apple can deliver them.
• Activity within your family. To power the family feed and partner notifications, we record when a word is added, edited or deleted, and by whom. These records include the word itself. We also record whether a caregiver is currently active or editing, so the app can show presence.

Waitlist

The waitlist is for adults, 18 or over. If you join it, we store the email address you give us, along with your browser's language setting, the page you signed up from, the referring website, and any campaign parameters that were in the link you followed.

Why: to email you when Saylings launches, and to understand which channels bring people here. Legal basis: your consent, given when you submit the form. How long: until the app launches and the announcement is sent, or until you ask us to remove you, whichever comes first.

We do not store your IP address or your name. We do not share the list with anyone, and we do not sell it.

Leaving is one click. Every email we send carries an unsubscribe link. Following it deletes your row outright: your address, and how you found us. We keep no record that you were ever on the list, so nothing is left behind to suppress. You can also email [email protected] and we'll do it for you.

How we use it

We use your information solely to provide the app: to store and sync your journal, celebrate milestones, generate your keepsake book and videos, enable partner sharing, send the notifications you ask for, and provide support.

Who processes it

We use Supabase for our database, authentication and file storage, Resend to deliver waitlist emails from an EU region, and Apple's Push Notification service to deliver notifications. This website and the share viewer are served by our hosting provider. These companies process data on our behalf, under contract, and do not use it for their own purposes.

Google is the exception, and it is worth stating plainly. Where you have allowed the advertising tag described below, Google receives that measurement data as an independent controller rather than as our processor, which means it decides for itself what to do with it under its own terms. It receives nothing about your child.

Some of these providers operate outside your country, so your data may be transferred internationally under the safeguards in their data-processing agreements.

Access is restricted by database security rules, so that only you and anyone you explicitly invite can read your family's content.

Sharing with family

You can invite a partner with a code, or create a read-only link for grandparents.

Be aware of how the read-only link works: anyone who has the link can open it, without signing in. It shows your child's name, age, every word you've saved, and plays the voice recordings. It does not show your photos or videos. Treat it like a house key. You can revoke it at any time from the app, which immediately breaks the old link.

Children's data

Saylings is intended for use by parents and caregivers, who must be adults. It is not directed at children and children do not use it.

The content, however, is about a child: their name, their date of birth and their voice. You enter it, you control it, and you can delete it. We do not use it to build a profile, we do not use it for advertising, and we do not disclose it to anyone other than the processors named above and the people you choose to share with.

Cookies and tracking

We run search ads to find parents who are looking for something like Saylings. To know whether that money is doing anything, this website carries Google's advertising measurement tag. It tells us that someone who clicked an ad later joined the waitlist. It does not tell us who you are, and it is never connected to your child's words, recordings or photos, which never leave your phone in the first place.

If you are in the EU, the UK or Switzerland, that tag is switched off before you arrive. It sets nothing and stores nothing on your device unless you press Accept on the banner. Press "No thanks", or simply ignore it, and it stays off for good. You can change your mind by clearing this site's data in your browser, which forgets your answer and asks again.

Outside those regions the tag is active by default, which is the ordinary practice under local law. If you would rather it were not, most browsers can block third-party cookies for a site, and that is sufficient to stop it.

We also count page views ourselves, in a plain database table, to see which articles people read. That count records the page, the referring site, any campaign tag on the link, and your browser's language setting. It sets no cookie, stores no IP address, and does not identify you.

Google acts as an independent controller for the advertising data it receives. What it does with that data is governed by Google's own privacy terms.

Your choices

You can edit or delete any word, disconnect a partner, revoke a share link, and turn off notifications. You can delete your account and its server-side data from within the app. Photos and videos, being local, are removed when you delete the word or the app.

To ask a question about your data, or to have your waitlist entry removed, contact us.

Your rights

If you are in the EU, the UK, or a place with comparable law, you have the right to ask what data we hold about you, to correct it, to have it deleted, to receive a copy of it, to restrict or object to how it is used, and to withdraw consent at any time. Withdrawing consent does not undo anything done before you withdrew it.

Email [email protected] to exercise any of these. We will respond within one month. If you think we have handled your data badly, you can complain to your national data-protection authority.

Changes

If we change this policy in a way that materially affects you, we'll take reasonable steps to let you know before it takes effect.

Contact

Questions about this policy? Email [email protected].

For the purposes of the GDPR, the data controller is Berbeca Dumitru, an individual developer, reachable at the address above with any question about your data, or to have it deleted.