Privacy at napnap

Who answers for this

The data controller is Daniel Cimorra. For anything on this page —questions, rights, complaints— write to hola@napnap.es and a person will answer you.

What data is here

Your email address, which is what you get in with, and optionally your name.

What you record: the sleeps, the feeds, the meals, the measurements of weight, length and head circumference, the notes you write, and the baby's name, date of birth and sex. Also the photos of food, if you upload any.

If you turn alerts on, the technical address your browser receives notifications at. It is not your phone number or anything that identifies you outside your own browser.

If you take part in the questions between homes: your handle, what you write and your baby's age in weeks.

And little else: there are no analytics, no pixels, no trackers and no advertising. We do not know which pages you visited before arriving here.

What they are used for, and on what basis

To give you the service you asked for —keeping what you record, working out the hours, showing it to you and to whoever shares your home—: the basis is the contract between us when you use the application.

To send the sign-in link to your inbox: the same contract.

For the alerts on your phone and for publishing a thread outside the application: your consent, which you can withdraw whenever you like and separately for each. Withdrawing it takes nothing else away.

To keep the forum from filling up with rubbish and to stop anybody giving dangerous advice: legitimate interest in keeping the service safe for everybody.

For the aggregate sums —«babies this age stay awake between this and that»—: legitimate interest, and only with figures from which nobody can be identified. A number that comes from fewer than twenty homes is never shown.

The baby's data

The data you record is about a child, and that obliges us to be more careful, not less: it is used for nothing other than showing it back to you, it is not passed on, it is not cross-referenced with anything and it does not leave your home.

When you take part in the forum, the only things that can leave with your baby are their age in weeks and the rhythm of their naps, if you authorise it. Never their name, their date of birth, their weight, their length, their centile or any photo.

Who it is shared with

Nobody who is not needed for this to work. Today that is four: the server where the application and its database live, in Spain; the outgoing mail service that sends the sign-in link; the store where the food photos are kept, encrypted and reachable only through links that expire; and Cloudflare, which the traffic passes through on its way to the server.

If you turn alerts on, the notification is delivered through your own browser's service —Apple, Google or Mozilla, depending on which you use. That is unavoidable: it is how web notifications work. What reaches them is your browser's technical address and the text of the alert.

There is no other third party. Nothing is sold, nothing is handed over for advertising and nothing is used to train models.

How long they are kept

What you record, for as long as your account is open. It is a history and its value lies in being long.

Deleting the account deletes everything belonging to your home. Anything you posted in a public thread stays, but anonymised: your handle becomes «somebody».

Hidden messages are kept for ninety days in case hiding them was a mistake, and then deleted.

Moderation decisions are kept so that they can be reviewed.

Your rights

You can access everything of yours, correct it, delete it, take it elsewhere, object to some use of it or ask for it to be restricted.

The first two do not even have to be asked for: in Settings, «Your data», you download all of it as JSON or as spreadsheets, and any record is corrected by tapping it.

For the rest, write to hola@napnap.es. And if you think we have not dealt with you properly, you can complain to the Spanish Data Protection Agency (aepd.es).

Cookies

One, and it is a technical one: the cookie that keeps your session open so you do not have to sign in every time. Without it you could not use the application, so there is no banner to accept.

There are no analytics or advertising cookies. There is nothing to track.

Security

Everything travels encrypted. The sign-in links run out in fifteen minutes, work once and are stored hashed, not in the clear. API keys are stored hashed too and are only shown once.

Photos are kept in a private store and the browser only ever receives signed links that expire.

None of this makes a system infallible. If there were ever a breach that affects you, you would be told.

If this changes

When something on this page changes, notice is given inside the application, and if the change affects something you consented to, you are asked again.

Last updated: 19 September 2026.

Questions

Do you use what I record to train an artificial intelligence?

No. Neither yours nor anybody else's.

What happens if I withdraw permission to publish a thread?

The public page stops being visible at that moment and comes out of the site's index. If what you withdraw is your answer, that answer disappears; if you are the one who asked, the whole page disappears.

Can I use napnap without giving my email?

No. The address is the only thing that keeps you from losing the history if you change phone, and it is how you get in. It is used for nothing else: there is no newsletter and no announcement emails.