Last updated: October 2026
In Mama Journey you keep things that are very much your own: your pregnancy, how you feel, your baby's first days. Here we tell you what data we process, what for, who sees it, how long we keep it and how you control it. If anything is unclear, write to us at soporte@mama-journey.com.
This policy applies to the Mama Journey app for Android and iPhone and to the website mama-journey.com, including the app used from the browser.
| Controller | JLS BABY S.L. |
|---|---|
| Tax ID (CIF) | B22801062 |
| Registered address | Calle Ciril Amorós 9, piso 2 · 46004 Valencia (Spain) |
| Contact and privacy email | soporte@mama-journey.com (in English, support@mama-journey.com) |
Data Protection Officer. JLS BABY S.L. has not appointed a Data Protection Officer because it is not required to do so (art. 37.1 GDPR and art. 34.1 LOPDGDD). Any question about your data is handled directly by JLS BABY at the email address above.
Legislation. Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
To create your account we only need your email and a password, or the Google or Apple account you sign in with. Everything else you enter only if you want to: the app works without a last period date, without weight, without photos and without check-ins.
We do not record which screens you visit or how long you use the app.
If you choose this option, we store only that: that you are trying. It is used to show you what is relevant to you now. We do not calculate anything about your cycle, we do not use it for advertising and we do not share it. To store it, we ask you at that moment for a separate explicit consent of its own, different from the one for health data. The person you invite to your family can also see it, and you can remove it whenever you like from Your moment (“Stop trying for now”), which also withdraws that consent.
We explain this separately, in section 3.
The link pages do not use cookies or any measurement tool: the name vote page only stores an identifier in the browser so that nobody votes twice (section 6.2). A link only opens its own list, never those of other families.
Mama Journey is an annual subscription (€29.95 a year, VAT included) with a 7-day free trial that does not ask for a card.
Notifications (for example, the one for each week of pregnancy or the reminders for your daily marks) are scheduled on your own phone using the data you already have stored, and do not go through our servers. They only appear if you give your phone permission, and you can remove it whenever you like in your phone's settings. If you close a pregnancy, the app switches off the notifications on that phone at that moment and, on Android, marks them as private, so that their content cannot be read on the lock screen if you have hiding sensitive content turned on. On your family's other phones they are switched off when the app is opened.
When you sign out, we delete everything the app had stored in the browser or on the phone. On Android, the system backup takes nothing from the app, either to the cloud or when moving to a new phone.
If you decide to provide it, Mama Journey processes certain personal data of your baby: their name, date of birth, daily logs (sleep, feeds, nappies and notes on wellbeing or health) and their developmental milestones. You provide this data, as mother, father or legal guardian exercising parental authority or guardianship, and we process it on the basis of your explicit consent for the special categories of health data, in accordance with article 9.2(a) GDPR.
This data belongs to your baby at all times. At Mama Journey we use it solely to personalise the experience, showing you content adapted to their stage of growth and allowing you to keep track of it. We do not use this data to send advertising, we do not build commercial profiles with it and we do not share it with third parties. If you share the family with your partner or with another authorised person, only that person will be able to access it.
You can access this data, rectify it, download it in a structured format or request its erasure at any time from the Settings section of the app. When you delete your account or withdraw your consent, we erase it within the periods set out in this policy.
In accordance with articles 7 and 12.6 of Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights, while your son or daughter is under 14, you will exercise their rights on their behalf as their legal representative. When they reach sufficient age or maturity to exercise them themselves, we will handle their requests for access, rectification or erasure directly.
| Purpose | What data | Legal basis (art. 6 GDPR) | Health data (art. 9 GDPR) |
|---|---|---|---|
| Creating and managing your account: signing up, signing in, recovering your password and deleting your account | Account (2.1) | Performance of the contract (6.1.b) | — |
| Placing content in your week or your baby's month, and storing and showing you, in order, what you note down | Pregnancy, check-ins, baby, what you write (2.2 to 2.4 and 3) | Performance of the contract (6.1.b) | Your explicit consent (9.2.a) |
| Storing that you are trying to get pregnant | Only that fact (2.5) | Performance of the contract (6.1.b) | Your separate explicit consent (9.2.a) |
| Sharing your family space with the person you invite | What is listed in section 5 | Your consent (6.1.a), which you give when you invite them | Your explicit consent (9.2.a) |
| Letting other people vote for a name or reserve a gift from your links | Vote, optional first name and your first name (2.7) | Legitimate interest (6.1.f) in letting your family and friends take part without creating an account, asking them for the minimum | — |
| Charging and managing your subscription and issuing the invoice | Subscription (2.8) | Performance of the contract (6.1.b) and legal obligation (6.1.c) for the invoice | — |
| Giving you the copy of your data and handling your rights and queries | What you ask us for and the copy (9) | Legal obligation (6.1.c; arts. 15 to 22 GDPR) | The copy includes your health data under the same explicit consent (9.2.a) |
| Being able to prove that you gave or withdrew a consent | Proof of your consents (2.9) | Legal obligation (6.1.c), in connection with art. 7.1 GDPR | — |
| Protecting the service and your data, and fixing faults | Technical and security data (2.9) and backups | Legitimate interest (6.1.f) in information security (art. 32 GDPR) | — |
| Measuring whether our ads work (on the web only and only if you accept) | What is explained in section 6 | Your consent (6.1.a) | Your explicit consent (9.2.a), because it may reveal a pregnancy or a recent birth |
Your consent for health data. We ask for it with a separate tick box, apart from the privacy policy and the terms, after explaining what data it covers, what we use it for and who sees it. We store the version of the text you accepted and when you did so. You can withdraw it whenever you like from Settings, without a password, as easily as you gave it. Without it the app cannot store your log, because that is exactly what it does: if you do not want to give it, you can sign out or delete your account. If we change the text of that consent, we will ask you for it again.
What we do not do. There is no advertising inside the app and no analytics tools. We do not build profiles, we do not use your data to train models and we do not cross-reference it with anything external. We do not take automated decisions that affect you (art. 22 GDPR): no health message is triggered by a threshold on what you note down. We do not sell your data.
If you invite someone to your family, that person can see and add: the pregnancy dates (or that you are trying for one), the baby's log and milestones, medical appointments, contractions and movements, your weight and your bump photos, lists, notes, what you save, the menu and the album.
They do not see your check-ins about how you feel, your daily marks or your consent history.
In the mobile app there are no cookies and no Meta or advertising tools, and nothing is sent to Meta.
On the web we use only what is strictly necessary for it to work. In addition, if you see the “Cookies and advertising” notice on the web and accept, we measure with Meta whether our ads work. If you do not accept, the app works just the same. Until that notice appears on the web, measurement is switched off and nothing is sent to Meta.
Who is responsible. JLS BABY S.L. and Meta Platforms Ireland Ltd. are joint controllers (art. 26 GDPR) for collecting and transmitting this data, under the joint controller agreement offered by Meta, which JLS BABY accepts before switching on measurement. What Meta does with the data afterwards is governed by its own privacy policy. Meta Platforms, Inc. participates in the EU-US Data Privacy Framework.
Legal basis: your explicit consent (arts. 6.1.a and 9.2.a GDPR), which you give by accepting the “Cookies and advertising” notice. Before you accept, that notice tells you that Meta will know you use a pregnancy and postpartum app.
Proof of your choice. If you are signed in, our server stores your choice with the date, the version of the text, your IP and your browser, just like the health consent. If you do not have an account yet, it is stored in your browser and uploaded to your profile when you sign in.
Changing your mind. You can change it whenever you like from Settings (“Cookies and advertising”) or from “Legal and health”. If you switch it off, we stop notifying Meta, remove its code from the page and delete its cookies from our domain in this browser. What Meta has already received, Meta keeps. Your choice is valid for 24 months at most: after that, we will ask you again.
The strictly necessary ones are technical and do not require your consent (art. 22.2 of Law 34/2002 on information society services, LSSI). Meta's are only used if you accept.
| Name | Whose | Purpose | Duration | When |
|---|---|---|---|---|
Session and preferences (local storage, flutter.* keys) | Mama Journey | Making the website work: session, language, whether you have completed the introduction and other settings | Until you delete them; when you sign out we delete the ones that hold data from your account | Always (strictly necessary) |
| firebase-app-check-database (IndexedDB) | Google (Firebase), on our domain | Storing the App Check credential that shows requests come from our app | Each credential is valid for 7 days at most and renews itself | Always (strictly necessary) |
| firebase-heartbeat-database (IndexedDB) | Google (Firebase), on our domain | Technical record of how the Firebase SDK is working, with no data about you | Managed by the Firebase SDK | Always (strictly necessary) |
| _grecaptcha (local storage) and, according to Google, the _GRECAPTCHA cookie on its domain | Google (reCAPTCHA Enterprise, loaded from www.google.com and www.gstatic.com) | Risk analysis and security for App Check | Managed by Google | Always (strictly necessary) |
| mj_voter_id and mj_vote_* (local storage) | Mama Journey | Stopping the same person from voting twice in the name vote | Until you delete them | Only if you open a name vote link |
| ads_consent (local storage) | Mama Journey | Remembering whether you accepted or rejected ad measurement | Until you change your mind; 24 months at most | After you choose |
| _fbp | Meta, on our domain | Recognising the browser to measure ads | 90 days | Only if you accept |
| _fbc | Meta, on our domain | Storing the click on the ad that brought you here | 90 days | Only if you accept and arrive from an ad |
| fr | Meta, on facebook.com | Meta advertising to people signed in to Facebook | 90 days | Only if you accept; Meta sets it on its own domain and we cannot delete it |
We do not sell your data. Outside JLS BABY, the only ones who see it are: the person you invite to your family (section 5); anyone with your gift or name links, as explained in section 2.7; Meta, only if you accept on the web (section 6); the providers that keep the app running, listed below; and the authorities, when a law requires us to give it to them.
They all work under a data processing agreement under art. 28 GDPR and may only use the data to provide their service to us.
| Provider | Purpose | Where | Safeguard if data leaves the EU |
|---|---|---|---|
| Google (Cloud Firestore, Firebase Storage and Cloud Functions) | Database, photos, copy of your data and server functions | European Union (europe-west1) | Does not leave the EU |
| Google LLC (Firebase Authentication) | Account and sign-in: email and identifier | May involve a transfer to the US | EU-US Data Privacy Framework and standard contractual clauses |
| Google LLC (Firebase Crashlytics, mobile only) | Crash reports, without health data | May involve a transfer to the US | As above |
| Google LLC (App Check) | Checking that requests come from our app (reCAPTCHA Enterprise on the web, Play Integrity on Android and Apple's App Attest on iPhone), without health data | May involve a transfer to the US | As above |
| Google (Cloud Logging) | Technical server logs | Global location: may involve a transfer to the US | As above |
| Stripe Payments Europe, Limited | Subscription payment on the web | European Union (Ireland). To provide the service, data is transferred to Stripe, LLC, in the US. | Stripe's Data Transfers Addendum, which forms part of its data processing agreement and applies the GDPR transfer mechanisms: the EU-US Data Privacy Framework or the Commission's standard contractual clauses (Commission Implementing Decision (EU) 2021/914) |
| Microsoft Ireland (Microsoft 365, contracted through GoDaddy) | The support mailbox where we handle your queries and your rights | European Union | Does not leave the EU |
| Technical development and maintenance service for the app | Maintaining the app, with no routine access to your data: only for maintenance or to handle a rights request | Spain | Does not leave the EU |
About transfers to the US. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission declared adequate on 10 July 2023, and we also apply the Commission's standard contractual clauses in its data processing agreement. Your email and identifier may leave the EU through authentication. Your web payment data goes to Stripe, LLC with the safeguards of its transfers addendum, as shown in the table. None of the health data you note down in the app leaves the EU.
Neither the app nor the website loads fonts or any other resource from third-party servers to display itself: everything is built in.
| What | How long |
|---|---|
| Your account and everything you store | For as long as your account exists. When you delete it, it disappears from the database straight away. |
| Database backups | We make a weekly backup that is kept for 35 days. Backups are not edited record by record: anything you delete disappears from them when they expire, at most 35 days later. |
| Health data if you withdraw your consent | If you do not give it again within 30 days, we delete it: your check-ins, your daily marks, your weight, your contractions and movements, and your pregnancy dates. If you are the family account holder, we also delete the family's health data, even if your partner can see it: the baby's log and milestones, medical appointments, your bump photos, contractions and movements, the baby's dates and, if you had indicated it, that you closed the pregnancy or that you are trying for one. Your partner keeps their account without that data, and we let them know. If you are the invited person, we only delete yours. The following are kept: your baby's name, your notes, lists and favourites, the record of when you gave and withdrew consent — because the law requires us to be able to prove it — and the copy of your data, if you had requested one, until it expires. |
| If you stop using the app | After 24 months without signing in, we notify you by email. If after 30 months you still have not signed in, and at least 30 days have passed since the notice, we delete the account and everything stored. If your partner is still signing in, we wait. We never delete without prior notice. |
| If you close a pregnancy | What you had noted is kept, without being shown, for as long as your account exists. From Your moment you can download it or delete the dates, the baby's name and the shortlisted names, the bump photos, the movements, the contractions and the appointments. Your notes and check-ins stay until you delete them yourself. The fact that the pregnancy is closed is kept until you reopen it or delete your account. |
| The copy of your data (“Download my data”) | 7 days (8 at most). Only one exists at a time: requesting another deletes the previous one. |
| Email of an invited person who does not accept | 90 days. |
| Votes and reservations from your links | The reservation, until you free the gift or delete the list. The vote, until you close the vote or delete your account. If you close a pregnancy, you can close both links at once from Your moment. |
| Proof of your consents | For as long as your account exists. It is deleted with it. |
| Your choice about ad measurement | 24 months at most; after that we ask you again. Meta's cookies, 90 days (section 6.2). |
| Billing data | 6 years (art. 30 of the Spanish Commercial Code), which also covers the 4 years under the General Tax Law (art. 66). |
| Emails you send to our support mailbox | 2 years. |
| Record that an account has been deleted | No time limit. It does not store your email or your name, only a hash of the identifier, the role in the family, the date and the number of incidents, and it is used to prove that the deletion was carried out. |
| Internal summaries of the retention task | 12 months, with the account identifier as a hash, never the email. |
| Server logs | 30 days. Audit logs for project administration, 400 days. |
| Crash reports (Crashlytics) | Google keeps them for 90 days. |
| App Check | Google does not keep the verification material; each credential is valid for 7 days at most. |
| Firebase Authentication | Google keeps sign-in IP addresses for a few weeks and the rest of the account data until you delete the account; after that it removes them from its systems and backups within 180 days at most. |
You can exercise your rights of access, rectification, erasure, restriction of processing, portability and objection at any time, and withdraw your consents. You have most of them in the app itself:
We will reply within one month at most of receiving your request; if the case is complex, we may extend this by two further months, and we will tell you so within the first month.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es). It helps us a lot if you write to us first, in case we can put it right.
We apply the measures of art. 32 GDPR and data protection by design and by default (art. 25):
If there were a security breach affecting your data, we would notify the Spanish Data Protection Agency within 72 hours at most of becoming aware of it and, unless it is unlikely to pose a risk to you, we would also tell you, in plain language.
Mama Journey is for people over 18. You are the one who enters your baby's data, as explained in section 3; your baby does not use the app.
If we change anything important in this policy, we will tell you with a notice in the app before it applies. If the change affects what you consented to, we will ask for your consent again. You will always see the date of the last update at the top of this page.
Mama Journey is a support and information app. Its content is for guidance only and does not replace advice, diagnosis, or treatment from a healthcare professional. If you have any concerns or symptoms, consult your midwife, doctor, or pediatrician.