Privacy, in plain words

A household is private. Only the people who have accepted an invite can see it, and what they can do is set by the invite: a caregiver logs alongside you, a viewer sees the day and changes nothing. There is no public profile, no way to browse other families, and no advertising anywhere in the product.

Five pages of this website may be indexed by a search engine:

• the front page
• Shared tracking
• Works offline
• Moving from Nara
• Privacy

Everything behind the sign-in is marked, and more to the point is protected by the session: a crawler that ignores the instruction sees a sign-in page, not a child.

The ordinary shape of a day: feeds and bottles, sleeps, nappies, meals, drinks, trips to the toilet, routines and the notes you write to each other. With them, what the app needs to draw that day correctly: the household's name and time zone, the child's name and date of birth, chosen units, and which caregiver logged which entry.

It does not ask for clinical information, does not assess a child's development, and does not give medical advice. That boundary holds on the way in as well: when a Nara Baby export contains medication or temperature rows, the import leaves them out and tells you it did.

The pages you are reading now use Google Analytics, once you have agreed to it. Before you press accept, no analytics script is loaded and no request is made to Google at all. There is no pre-consent ping, and no cookieless counting in the background.

When it is on, three things are reported. A page view for each of the five public pages, with the page's address and the name of this site. A count of clicks on the “start tracking” buttons, labelled by where the button was. And, once, when a household has just been set up, the fact that setup finished, never the page that happened on. If you arrived from a search engine we keep the name of that site, not the words you searched for.

We never send a name, an email address, a household or child identifier, a birth date, an entry from anybody's record, or a query string from a URL. Advertising features and Google Signals are switched off, and no user id is ever set.

Like any analytics product, the tag Google runs does collect some standard technical information of its own: the browser and device you used, an approximate location worked out from your IP address, and a cookie identifier, which is how it tells one visit from another. We don't add anything to that, and we can't see a person in it.

Your nursery is never measured. The tracker, the invitations and the sign-in pages load no analytics at all, and moving from a public page into the app leaves the measurement behind with the page. The one exception is the single message that says a household finished being set up.

The choice lives in your browser, not in an account, and it can be changed as often as you like. Saying no changes nothing about the app: setting up a household works exactly the same way either way.

Turning analytics off also expires the Google cookies this site set, and asks the browser to stop reporting for that measurement ID.

The app sets a few cookies of its own: one that keeps you signed in (it lasts a month from the last time you used the app, and “Sign out of every device” in Settings ends it everywhere at once), one that remembers whether you chose light or dark, and a short-lived one while you're finishing setting up. That isn't an exhaustive list, but nothing in it is used to follow you around the web.

Signing out clears what the app kept on this device: the pages it saved for when there's no signal, and anything still waiting to sync. In most browsers it also forgets your analytics choice, so you'll be asked again next time.

If you accept analytics, Google sets its own cookies to tell one visit from another. Declining means they are never written, and turning analytics off expires the ones this site can see.

Export is built in and does not need anybody's permission: CSV for a spreadsheet, JSON for everything the CSV flattens. If any of the wording on this page stops being true, this page changes with the code rather than after it.

A deleted entry is kept for ninety days, so the undo on it is real and a phone that was offline cannot bring it back, and then it is gone. An archived child can be put back, or deleted with everything recorded for them. Your account can be deleted from Settings: a household only you use goes with it, and in a household you share, what you logged stays with the people you logged it for.