Lullay Privacy Policy
Effective: [DATE] · Draft v1 — requires attorney review before public launch. Plain-English by design; where this summary and the law disagree, we fix the summary, not the promise.
The short version: your baby’s sleep data lives on your iPhone, not on our servers. Voice audio is processed and discarded — never stored. We don’t sell data, we don’t run ads, and there are no third-party ad trackers in the app or on this website. You can export or delete everything, any time.
Who we are
Lullay (“we,” “us”) makes a voice-based sleep coaching app for parents. Contact: [email protected]. Lullay serves families in the United States and Canada.
What we collect, where it lives
On your device (not our servers): your baby’s profile (name, date of birth, birth details you choose to add), all sleep logs and history, coaching session summaries, and your sleep program details. This data is stored locally on your iPhone, protected by iOS encryption. We cannot read it, because we do not have it.
On our systems (the minimum to run the service): your account identifier from Sign in with Apple (you can hide your email), subscription status, and consent records. If you join the waitlist or contact us: your email address.
Voice, precisely: when you talk to Nana, your audio streams to our AI processing partner to power the conversation, along with the minimum context needed for coaching (your baby’s age band and a short text summary of recent sleep — not your full history, not your baby’s full name unless you say it aloud). Audio is transcribed to run the conversation and we never store the audio. Conversations become short text summaries saved on your device.
Our processors
We use a small number of service providers to run Lullay, under data processing agreements: OpenAI (voice AI processing; API data is not used to train their models and is retained by them for up to 30 days for abuse monitoring, then deleted), Apple (sign-in, subscriptions, notifications), Cloudflare (website hosting and security), and Plausible (cookieless, privacy-first website analytics — no personal profiles). We will keep this list current here.
What we never do
- We never sell or rent personal data or your baby’s data. To anyone. For anything.
- We never use your data for advertising, and we do not embed advertising or social-media SDKs or pixels in the app or website.
- We never use your baby’s sleep data to train AI models without your separate, explicit opt-in (which does not exist today — if we ever build it, it will be off by default).
Health-data honesty
Sleep information about your child is sensitive. We treat it as consumer health data under applicable laws (including state health-privacy laws such as Washington’s My Health My Data Act, and PIPEDA in Canada). Collection happens only with your opt-in consent during onboarding, and you can withdraw it in the app at any time. If a data breach affecting your information ever occurs, we will notify you and regulators as required (including under the FTC Health Breach Notification Rule).
Children
Lullay is a tool for parents and caregivers, not for children. We do not knowingly collect information from children, and the baby information in the app is entered and owned by you, the parent.
Your controls
- Export everything — Settings → Privacy → Export my data (JSON).
- Delete everything — Settings → Privacy → Delete everything: wipes device data and our account records, and triggers deletion requests to processors. This is real deletion, not deactivation.
- Withdraw consent — turn off coaching personalization anytime; Nana just gets more generic.
- Residents of certain states/provinces have additional rights (access, correction, deletion, appeal). Email [email protected] and we’ll honor them without making you cite the statute.
Website demo
The “Talk to Nana” demo on this site requires no account. Demo conversations are processed to run the demo and are not linked to you; we don’t store demo transcripts. Basic anti-abuse limits (per-IP session caps) use your IP address transiently.
Changes
If we change this policy in any way that weakens a promise above, we will notify app users directly and in plain English before it takes effect.