Privacy Policy

Last updated: 22 August 2026

This policy explains what we collect, why, and what you can do about it. We have tried to write it so you can actually read it.

1. Who is responsible for your data

BrainCode Sp. z o.o., ul. Floriańska 6/2, 03-707 Warszawa, Poland (KRS 0000593431, NIP 5911697936) is the data controller for the personal data described here.

Contact us about anything in this policy at contact@sleepybabydoctor.com.

We have not appointed a Data Protection Officer, as we are not required to under GDPR Article 37.

2. What we collect

When you take the quiz

About your baby

• Date of birth
• Current sleep pattern: wake time, number of naps, nap length, bedtime, how long they take to fall asleep, how often they wake at night
• How they settle back to sleep — feeding, rocking, a pacifier, patting, or on their own
• Anything you write in the free-text field at the end

About you

• Your email address
• How much sleep you get and how you describe your mornings
• What you want back once the nights settle
• What is prompting you to change things now

When you use your plan

• What time your baby fell asleep and woke, and how many night wakings, for each day you log

Automatically

• Standard technical data: IP address, browser and device type, pages viewed, and how you arrived at our site
• Whether you opened our emails and whether links in them were clicked

When you pay

We do not see or store your card details. Payment is handled entirely by Paddle — see section 6.

3. Why we use it, and on what legal basis

We do not sell your personal data. We do not share it with anyone for their own marketing.

4. Sensitive information

Our quiz has a free-text field where some people mention a medical detail — reflux, prematurity, a diagnosis. We do not ask for this, and we do not need it, but if you choose to write it, we store it as part of your plan.

Where that information counts as a special category of data under GDPR Article 9, we rely on your explicit consent, given by choosing to write it and submitting the quiz. You can withdraw that consent at any time by asking us to delete it — see section 8.

Please only tell us what you want us to have. We use the free-text field to adjust your plan and for nothing else.

We never ask for your child’s name, sex, photographs, medical records or anything from a health professional.

5. Cookies and tracking

We use three kinds, and they are treated differently.

Necessary. Keeping you signed in, remembering your quiz answers as you move through it, and keeping the site secure. These cannot be turned off without breaking the service.

Our own measurement. We count how far people get through the quiz, so we know which questions confuse and which pages lose people. What is counted is which step you reached and how long it took, tied to the same visit identifier we already need to carry your answers from one question to the next. We do not learn who you are from it, and it is never used to advertise to you. Our reason for doing this is our legitimate interest in knowing whether our own product works.

On the quiz this measurement runs from the first screen - there is no banner to answer there, because the quiz exists to be measured and half a measurement answers nothing. Elsewhere on the site, declining in the cookie banner stops it. You can object at any time by writing to us.

Advertising. These identify you to companies other than us, and none of them run until you say yes:

• TikTok pixel and its server-side equivalent, to understand which of our ads bring people who find the product useful
• Meta pixel, for the same purpose as the TikTok one
• Google Analytics, to see which pages people read and where they leave

This means each of these receives a record of your visit and, if you buy, of the purchase. Your email address is shared with them only in hashed form, if at all.

We ask for your consent before setting anything in the last two categories on your device, and you can change your mind at any time through the cookie settings link in our footer.

6. Who else processes your data

We use a small number of providers. Each acts on our instructions and only for the purpose listed.

Where a provider is outside the European Economic Area, transfers are covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.

About the model provider: the short message on your Today screen is written by Google’s Gemini model, which we reach through Kie.ai. What we send it is a summary of the night you logged — how many times they woke, how long the longest stretch was, how long settling took, how much you slept — together with your baby’s age and the one change we are making today. We use a paid tier under which your data is not used to train Google’s models.

The model never calculates anything. Every number it is allowed to use is worked out by our own software first, and its answer is checked against those numbers before you see it; if it invents one, you get our own wording instead and never learn the difference. The rest of the product — your schedule, the times in it, the text on the pricing page — involves no model at all.

7. How long we keep it

Your plan stays available to you indefinitely because that is what we promised — but “indefinitely” means “until you ask us to delete it”. If your account has been inactive for three years, we will email you before deleting it.

8. Your rights

Wherever you live, you can ask us to:

• Show you what we hold about you
• Correct anything that is wrong
• Delete your account and everything in it
• Export your data in a portable format
• Stop or limit how we use it
• Withdraw consent you previously gave, including for the free-text field and for advertising cookies

Write to contact@sleepybabydoctor.com. We respond within 30 days, usually much sooner. We will not ask you why, and asking will never affect your plan or your refund rights.

If you think we have handled your data badly, you can complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) or to the authority where you live.

9. If you are in Canada, Australia, the UK or the US

The rights above are what we offer everyone, regardless of where you are. Depending on where you live you may also have specific statutory rights — for example under PIPEDA in Canada, the Australian Privacy Principles, UK GDPR, or US state privacy laws. Write to us and we will honour them.

We do not sell or share personal information as those terms are defined under California law.

10. Children

Our service is for parents and guardians. It is not for use by anyone under 18, and we do not knowingly collect data from anyone under 18.

We do collect information about a baby — their date of birth and sleep pattern — provided by their parent or guardian. If you are not that child’s parent or guardian, please do not use our service.

11. Security

Sign-in is by emailed one-time link, so there are no passwords to leak. Data is encrypted in transit and at rest. Access to production data is limited to the people who need it to run the service.

No system is perfectly secure. If a breach ever affects your data, we will tell you and the relevant authority as the law requires.

12. Changes

We will post any update here with a new date. If a change materially affects how we use your data, we will email you before it takes effect.

13. Contact