Privacy policy

Your child's sleep stays with your family

Last updated 14 November 2026

• Who we are
• With your family
• Google Analytics
• Buying
• This website
• The waitlist
• Writing to us
• Children
• Who else
• How long
• Your rights
• United States
• Canada
• Australia

Who we are

Yawnalot is an iPhone app and this website, made by Ganna Dzyuba Glushchenko, an individual in Spain. "We" and "us" in this policy mean Ganna Dzyuba Glushchenko, who decides how your data is used (the "controller" in data protection law).

Questions or requests about your data: privacy@yawnalot.com.

We'll appoint a representative in the United Kingdom under Article 27 of the UK GDPR, and name them here, before the app is available there. Until then, write to us at the address above about anything in this policy, wherever you live.

What stays with your family

Everything you put into the app is stored on your iPhone, in the app's own storage, and in your own iCloud:

• your children's names and birthdays;
• the sleeps, naps, nights and wake-ups you log, how your child settled, and who logged each one;
• your tags, notes, routine and its steps, the room as you describe it, the changes you try, and your reminder settings.

We never receive any of it. A few things work entirely on the phone too:

• Patterns, nap windows and "Try a change" are worked out on your iPhone from your own logs. No server and no AI service is involved.
• Learn is built into the app; reading it sends nothing.
• Widgets, the Live Activity, Siri and Shortcuts work on your phone; Siri is handled by Apple, under Apple's privacy policy.
• Reminders are scheduled on your phone, and are off unless you turn them on.
• The spreadsheet and the report for the doctor are made on your phone, and you choose who to send them to.
• Bringing your history from another app reads the file you choose, on your phone.

Your iCloud

If your iPhone is signed into iCloud, the app keeps a copy in your own iCloud, so it's safe if you change phones and your other devices stay up to date. It lives in your private iCloud database, under your Apple account: Apple stores it, and we, as the app's makers, can't see or read it. Your child's name and birthday, your notes, your own tags, the steps of your routine and the changes you try are end-to-end encrypted, so not even Apple can read them. The rest, such as the times of sleeps, is protected by iCloud's own encryption, which is end-to-end too if you turn on Apple's Advanced Data Protection. Apple's handling is covered by Apple's privacy policy.

Sharing a child with a partner or carer

You can invite someone, such as your partner, a grandparent or a nanny, to a child. They see that child's log from their own iCloud account and, if you allow it, log sleeps too. You choose who, with Apple's sharing, and you can remove them at any time. Only the people you invite can see a shared child; we can't. The invitation itself carries no name, only "A family on Yawnalot".

Deleting it

Delete everything in the app's Family tab removes it all from the phone and your iCloud, and stops sharing the children you shared: they're removed for everyone you invited. A family someone else shared with you is left as it is for them. Your iPhone's own iCloud backup also includes the app's data until the backup is replaced.

Google Analytics in the app, only if you say yes

After your first sleep is logged, the app asks whether you'd like to help improve Yawnalot by sharing which features are used, through Google Analytics. If you say no, the Google Analytics code in the app is never started and makes no connection to Google, and the app sends nothing about how you use it to anyone.

If you say yes, the app tells Google Analytics when certain things happen in it, so we can see which features help and what to fix. Each event is something like "an onboarding step was passed", "the first sleep was logged", "a history was imported" (with how many sleeps), "the Plus screen was shown" or "the founding price was reserved". Nothing about your child goes into an event: not their name, not their age, not the times of their sleeps, not your notes, tags or anything you type. Night wake-ups, which patterns you look at and which changes you try are never sent, because they could say something about your child's sleep or health.

Google Analytics also collects what it collects for any app, such as the device model, your approximate region from your IP address, and an app instance number of its own. We switched off the advertising identifier, advertising features and Google's ad signals. Google Ireland Limited and Google LLC process the data for us as our processor, and may process it in the United States under the EU-US Data Privacy Framework and Google's standard contractual clauses. Google Analytics keeps it for no longer than 14 months. We use it only as counts and patterns across all families; we never try to work out who you are.

To change your answer: the app's Family tab › Share anonymous usage. Turning it off stops it and resets Google Analytics' number on your phone, so nothing sent later can be joined to what came before; what Google already received is deleted when its retention period ends. Delete everything does the same.

To delete it: Google Analytics data isn't linked to your name or email. Write to us and we'll ask Google to delete it; to find it we need the Google Analytics number from your phone, so write while sharing is still on. If you've already reset sharing or removed the app, we can no longer tell which data was yours (GDPR Article 11), and Google deletes it when its 14-month retention ends.

Buying

During early access the app is free. "Reserve the founding price" doesn't charge you or collect any details: your choice is kept on the phone. When subscriptions start, you'll buy them through Apple. Apple handles the payment and tells the app whether a subscription is active; we never see your card or your Apple ID. Apple tells us about subscriptions (such as a start, a renewal or a refund) through its App Store Server Notifications, without your name or email. Apple's handling is covered by Apple's privacy policy.

This website

The website has no accounts, and its only form is the waitlist (below). Firebase Hosting, run by Google, keeps standard server logs (such as IP address and browser) to deliver and protect the site.

Google Analytics on the website, only if you say yes. The first time you visit, a question at the bottom of the page asks whether we may use Google Analytics cookies. Until you answer, and after a no, nothing from Google loads. With a yes, Google Analytics counts visits and the pages seen, with what it collects for any website: the browser and device, your approximate region from your IP address, the page you came from, and two cookies (listed in the cookies policy). It also notes that a waitlist sign-up happened, never your email or anything you typed. Advertising features and Google signals are off. Google Ireland Limited and Google LLC process it for us as our processor, possibly in the United States under the EU-US Data Privacy Framework and Google's standard contractual clauses, and keep it for no longer than 14 months. Change your answer any time with "Cookie choice" at the bottom of every page.

The waitlist

If you join the waitlist, we keep:

• your email address;
• your little one's age, if you choose one (on the way, under 6 months, 6 to 12 months, 1 to 2 years, or 3 to 5 years);
• which of our posts or links brought you, if any;
• your country, from your connection;
• what the form said and whether you ticked the box, so we can show what you agreed to.

We email you once, when Yawnalot launches, with the founding price. We send news and new Learn decks only if you ticked the box. Every email has a link to unsubscribe in one tap, and we never send to you again for marketing after that.

The form sends your sign-up to our server on Cloudflare, which keeps it in Western Europe only until our own system collects it, usually within minutes and at most a few days. From then on it sits in our own customer records, and nobody else gets it. When we email you, our email provider sends the message.

We keep your sign-up until you unsubscribe or ask us to delete it, and no longer than 12 months after the app launches unless you asked for news. To be removed sooner, use the link in any email or write to privacy@yawnalot.com.

If you write to us

If you email us, we use your address and what you wrote only to answer you. We delete your message and our reply 12 months after the conversation ends, unless we need it for a legal claim. Please don't send your child's name or health details; we don't need them to help.

Children

Yawnalot is made for parents and carers aged 18 or over. It is not directed to children under 13, and we don't knowingly collect personal information from children. The picture cards are shown to a child by a parent holding the phone; there's no mode for a child to use the app alone. What you record about your child stays on your phone and in your own iCloud; we never receive it. If you think a child has sent us personal information (for example by email), write to privacy@yawnalot.com and we'll delete it.

Who else handles data for us

We don't sell personal data, and we don't share it for advertising. Only these companies handle data for us, and only to provide their service:

• Google (Google Ireland Limited and Google LLC): Firebase Hosting, which serves this website and keeps its server logs, and Google Analytics in the app and on the website if you say yes;
• Cloudflare (Cloudflare, Inc.), which receives waitlist sign-ups and keeps them until we collect them, and receives Apple's subscription notifications, under the EU-US Data Privacy Framework and standard contractual clauses;
• Namecheap, which receives the email you send to our addresses and passes it on to us;
• Resend, which sends our emails, such as the waitlist's launch email and our replies;
• Apple, for the App Store, purchases, Siri, iCloud sync, sharing and backups, under Apple's own terms.

We would disclose data only if the law required it.

Outside Europe

Cloudflare, Namecheap and Resend are based in, or may access data from, the United States. Cloudflare and Resend take part in the EU-US Data Privacy Framework and its UK Extension, and these transfers rely on it, with the European Commission's standard contractual clauses (and the UK Addendum) as a fallback. Namecheap isn't part of the framework, so transfers to it rely on standard contractual clauses. You can ask us for a copy.

We make no decisions about you by automated means. You don't have to give us any data: the app works without an account, and the waitlist needs only your email.

Why we're allowed to use it

For people in the European Union and the United Kingdom:

• Server logs for this website: our legitimate interest in delivering and protecting it;
• The waitlist: your consent, given when you join (and for news, when you tick the box), which you can withdraw any time;
• Google Analytics in the app and on the website: your consent, asked in each, which you can withdraw any time;
• Answering your email: our legitimate interest in helping you.

How long we keep it

• What you log in the app: we never have it; it stays until you delete it.
• The waitlist: as described in the waitlist above.
• If you unsubscribe, we keep only your email address on a do-not-email list, so we never email you again.
• What the form said and whether you ticked the box: for as long as we keep your sign-up, and for up to 3 years after, to prove consent.
• Emails you send us: 12 months after the conversation ends, unless we need them for a legal claim.
• Server logs: as long as our host keeps them for running and protecting the service; we don't export or keep them.

Your rights

You can ask us to show, correct or delete the personal data we hold about you, to limit or object to how we use it, or to give it to you in a portable format, and you can withdraw consent at any time. Write to privacy@yawnalot.com. We answer within one month. If a request is complex we may need up to two more months, and we'll tell you within the first month.

You can complain to a data protection authority: in Spain the Agencia Española de Protección de Datos, in the UK the Information Commissioner's Office, or the authority where you live.

If you live in the United States

We don't sell or share personal information, and we don't use it for targeted advertising. We don't receive health information about you or your child; if that ever changes we'll ask for your consent first. Depending on your state, you have the right to know, correct and delete it; write to us and we'll answer within 45 days, without treating you any differently.

Washington, Nevada and Connecticut residents: see our Consumer Health Data Privacy Policy.

If you live in Canada

We handle your personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Québec, the Act respecting the protection of personal information in the private sector. The person accountable for it, and the person in charge of the protection of personal information, is the owner of Yawnalot, Ganna Dzyuba Glushchenko: privacy@yawnalot.com. What we collect and why is described above. Your information is stored and processed outside Canada, in the European Union and the United States, by the providers listed above, and may be accessible to courts and authorities there. You can ask to see or correct the information we hold about you, or withdraw your consent, by writing to us. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Québec, the Commission d'accès à l'information (cai.gouv.qc.ca).

If you live in Australia

We follow the Australian Privacy Principles in how we handle your personal information. The kinds of information we hold, how we collect it and why are set out above: waitlist sign-ups and emails you send us. We don't hold your child's information; it stays on your phone and in your own iCloud. Your information is held outside Australia, in the European Union and the United States, by the providers listed above. You can ask to see or correct the personal information we hold about you by writing to privacy@yawnalot.com; we'll answer within 30 days. If you have a complaint about how we've handled your information, write to us first; if you're not satisfied with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

If we change how the app or website uses data, we'll update this page and its date first. If a change matters, for example a new kind of data or a new company handling it, the app will tell you before it happens.