Privacy Policy

The service is operated by FirstSteps, [Registered business address], [Country / state of governing law]. We are the data controller responsible for your information. For any privacy question, contact info@firststepsco.com.

FirstSteps exists to help parents track a child’s development, and to support parents through pregnancy. That means we handle information that many laws treat as sensitive or special category, including a child’s health and development records and, where you use those features, pregnancy and reproductive health details. We handle this data with heightened care, we ask for your explicit consent where the law requires it, and we never use it for advertising. See also our Children’s Privacy notice.

Account details you give us: your name, email address, password (stored only as a secure hash), language preference, and any profile photo you choose to upload.

Information you add about your child: name, date of birth, sex, growth measurements, feeding, sleep, milestones, activities, assessments, vaccinations, appointments, observations and any health notes you record. You choose what to enter.

Pregnancy and reproductive data (optional features): due dates, cycle and period entries, symptoms and related notes, only if you use those tools.

Community, connections, messages and media: if you use the parent community, your display profile (your name, an optional bio and photo, and your community level and reputation), the posts, comments and reactions you create, the parents you connect with (friends), and the direct messages you send, including text, voice recordings and images.

Purchases: subscription status and events, provided through our payments partner. We do not receive or store your full card number.

Technical and security data: device and app version, and a limited security log of sign-in activity including IP address (used to protect your account, and mapped to an approximate country only).

We use your information only to run and improve the service you asked for:

• To provide, personalise and secure the app and to track your child’s journey (legal basis: performance of our contract with you).
• To power AI features such as your Lumi coach and summaries, and community safety moderation (legal basis: our legitimate interest in offering the feature, and your consent for health related content).
• To let you connect and communicate with other parents, including friends, profiles, direct messages, voice notes and photos, and to keep the community safe through moderation (legal basis: performance of our contract with you, and our legitimate interest in a safe community).
• To handle sensitive and children’s health data (legal basis: your explicit consent, which you can withdraw at any time by turning off the feature or deleting the data).
• To meet legal, tax and security obligations (legal basis: legal obligation and legitimate interest).

We do not sell your personal data. We do not run third party advertising, and we never use health or children’s information for ads or profiling.

The parent community lets you build a profile, connect with other parents as friends, and send private direct messages that can include text, voice recordings and images. Direct messaging is only available between parents who have accepted a friend connection.

What others can see. Your display profile and the posts you make are visible to other members. A direct message is visible only to you and the parent you send it to. When you are in a chat, we share your active status, typing indicator and read receipts with that parent so the conversation feels live.

How messages and media are handled. Messages, voice notes and images are stored securely on our servers so they can be delivered reliably, and are encrypted in transit and at rest. Direct messages are not end to end encrypted, because we need to deliver them and to review content that is reported to us for safety. Voice notes use your microphone and photos use your camera or photo library, only when you choose to record or attach; you can decline or withdraw these permissions in your device settings at any time.

Your controls. You can delete your own messages, remove a friend, and block another parent, which stops messaging and friend requests in both directions. You can report a specific message or a whole account to our team.

Safety and moderation. To keep parents safe, our team reviews content that is reported and may remove content or restrict accounts that break our community rules. Reports about child safety are prioritised. When something is reported, we process the reported content and limited account details of the people involved so we can investigate and act. We do not use your messages, voice notes or images for advertising, and we do not use them to train AI models.

A note for your family. A direct message is visible to the parent you send it to. Please take care before sharing a child’s photos, full name, location or health details with other members.

To answer your questions and generate summaries, the relevant context you provide is sent securely to our AI processing partner, Anthropic (Claude), which processes it on our behalf under contract and does not use it to train its models. We send the minimum information needed to be helpful. Lumi provides educational guidance only. Because responses are generated by AI, they may occasionally be incomplete or inaccurate and should never replace professional medical advice.

We share data only with the service providers (sub-processors) needed to run FirstSteps, under contracts that limit them to our instructions:

• Anthropic: AI processing for the Lumi coach and summaries.
• RevenueCat, with Apple and Google: to manage and verify subscriptions and purchases.
• Our email provider: to send account emails such as verification and password resets.
• Our hosting provider: to store data securely and operate the service.

We may also disclose information if required by law, or to protect the safety of a child or another person. We do not use third party analytics or advertising SDKs.

Our providers may process data in countries other than yours. Where that happens we rely on appropriate safeguards, such as standard contractual clauses, to keep your data protected to the standard described here.

We keep your information while your account is active. Community posts, direct messages and any media you send are kept while your account is active and the conversation exists; you can delete your own messages at any time, and they are removed when you delete your account. When you delete your account, your personal data, child profiles and tracked entries are removed from our active systems immediately. Content that has been reported may be kept for a limited period so we can investigate and act on it. A small amount of data may be retained only where the law requires it, for example billing records for tax purposes, and de-identified, aggregated data that can no longer identify you. See Delete Account & Data.

Data is encrypted in transit and at rest. Access is restricted to what is strictly necessary to operate the service, and is logged and audited. We design AI and other features to use the minimum information needed.

Depending on where you live, you have the right to access, correct, export or delete your data, to withdraw consent, to object to or restrict certain processing, and to lodge a complaint with your local data protection authority. You can access and correct your data in the app at any time, delete your account from your Profile, or contact info@firststepsco.com to make a request. We do not discriminate against you for exercising these rights.

FirstSteps is intended for parents and guardians (adults), not for direct use by children. Information about a child is added by the adult who controls the account. Our full approach, including how we treat children’s data under laws such as COPPA and the GDPR, is set out in our Children’s Privacy notice.

We use only essential storage needed to sign you in and run the app. We do not use tracking or advertising cookies. Details are in our Cookies & Storage notice.

If we make material changes we will update this page and, where appropriate, notify you in the app. The date above shows when this policy last changed.

Privacy questions or requests: info@firststepsco.com. General help: info@firststepsco.com.