Chuloh legal

Privacy Policy

Effective date: October 2, 2026 · Last updated: October 2, 2026

Effective date: October 2, 2026 Last updated: October 2, 2026

Controller / business: Codexgig Web Services LLC ("Codexgig," "we," "us"), c/o Northwest Registered Agent LLC, 700 Narragansett Park Dr, Ste 100, Pawtucket, RI 02861 Privacy contact: info@cgw.services

Chuloh is a shared baby-tracking app. Parents and caregivers use it to record feeds, diapers, sleep, growth, health notes, photos, and more. Because the information in Chuloh is about babies and families, we treat all of it as sensitive and we keep it private.

The short version

We do not sell your data or your baby's data, and we do not "share" it for advertising. We do not run ads in Chuloh and we do not build advertising profiles.
Only you and the caregivers you invite can see your baby's information and photos. Our service providers handle it only to run Chuloh for us.
You can export your data and delete your baby profiles or your whole account in the app (More > Your data), or ask us at info@cgw.services.
Chuloh is for adults. Children cannot have accounts. Information about a baby is entered by a parent, guardian, or an adult they authorize.
We protect your information with access controls and trusted providers, but no online service is perfectly secure.

Part A below is our general privacy policy. Part B is our Consumer Health Data Privacy Policy (for Washington, Nevada, Connecticut, and similar laws). Part C covers rights by region.

Part A. General Privacy Policy

1. Information we collect

1.1 Information you give us or create in Chuloh

What	Examples
Account information	Your name, email address, and password (stored by our authentication provider in hashed form), or, if you use "Continue with Google," the name, email address, and profile picture Google gives us. Your account ID.
Baby profile information	Baby's name, birth date or due date, optional sex, and profile photo.
Care logs	Feeds (type, time, amount, duration, which side, milk type), diapers (wet, dirty, both), sleep (naps and nights, times and durations), pumping (amounts, sides, durations), medicine (name, dose), mood, health notes (temperature, symptoms), milestones, and free-text notes.
Growth records	Weight, length, head size, measurement dates, and notes.
Appointments, reminders, and supplies	Appointment titles, locations and dates, reminder schedules, and inventory and shopping-list items.
Photos	Scrapbook photos and a baby profile photo you upload, with captions and dates. Location and camera metadata (EXIF) is removed from photos when they are uploaded; photos uploaded before October 2, 2026 were cleaned on October 2, 2026.
Caregiver and family information	Who has access to which baby, each person's role (Owner or Caregiver), an optional relationship label, and invitation codes and their status.
Subscription information	Your trial and subscription status, plan (monthly or yearly), number of extra people, renewal and trial dates, whether you have used a one-time trial offer, and identifiers that link your account to Stripe. We do not receive or store your full payment card number; Stripe does.
Your messages to us	Emails you send to info@cgw.services and what you include in them.

Information about you as a parent or caregiver. Some of what you enter, such as pumping logs, is also information about your body or health. We treat it with the same protections as baby information.

1.2 Information collected automatically

Sign-in and device storage. To keep you signed in and remember app preferences, Chuloh stores a session token and preferences in your browser's local storage. These are necessary for the app to work. Chuloh's own code does not load advertising or tracking SDKs.
Technical logs. Our hosting and database providers automatically log technical information such as IP address, browser and device type, pages requested, and error details, for security, abuse prevention, and troubleshooting.
Error reporting. If the app crashes, error details such as the page and error message may be sent to Lovable to help us fix it.
Public-site visitor statistics. Lovable provides aggregate page-view and visitor statistics for the public website, such as page, referrer, country, and device type. This collection happens at the platform level rather than through an analytics script controlled by Chuloh.
Security cookie. Cloudflare fronts the site and may set the short-lived, strictly necessary __cf_bm cookie (about 30 minutes) for bot management and security. It is not used for advertising.

1.3 Information from other sources

Google, if you choose "Continue with Google": your name, email address, profile picture, and Google account ID. We do not request access to your Gmail, Drive, contacts, calendar, or any other Google data.
Your Owner or other caregivers, who may add entries and photos to a baby profile you can access.
Stripe, which tells us whether a payment succeeded and subscription status.

1.4 What we do not collect

We do not collect your precise location, contacts, microphone or camera streams, advertising IDs, or biometric identifiers. If we add native apps, we will update this Policy. We do not knowingly collect personal information directly from children.

2. How we use information

Purpose	Examples
Provide the Service	Create and secure your account; show and sync care logs, charts, insights, reminders, and photos among caregivers you invite; calculate times since last feed, diaper, or sleep; run the scrapbook.
Subscriptions and billing	Run your free trial, manage plans, seats, renewals, receipts, and cancellations through Stripe.
Communicate with you	Show account, security, billing, and service messages in the app and respond to support. Renewal reminders and receipts are sent by Stripe, our payment processor, where required or enabled; Chuloh itself does not send emails. We send only service, security and billing emails. We don't send marketing email; if that changes we will ask for your opt-in first.
Security and integrity	Detect and prevent abuse, fraud, unauthorized access, and violations of our Terms; troubleshoot problems.
Maintain and improve Chuloh	Fix bugs and keep the app reliable. We don't use your baby's data, your photos or your content to train AI models, and we don't sell or share it for advertising.
Legal reasons	Comply with law, respond to valid legal process, and enforce our rights.

We do not use information about babies or children for advertising, marketing, or profiling, and we do not use health-related information for any purpose other than the ones listed above.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months.

We disclose information only:

With caregivers you invite. They can see the baby profile's information and photos, can add, edit, and delete entries and photos, and can see each other's display names and profile pictures. The Owner controls invitations.
With service providers ("processors") who process data for us under contract and only to provide their service. They are listed in Section 9.
For legal and safety reasons, if required by law or valid legal process, to protect the rights, safety, or property of you, us, or others, or to report suspected child exploitation as required by law.
In a business transaction such as a merger or sale, where the buyer must honor this Policy or give you notice and a choice before any material change.
With your direction or consent, for example when you share an invitation link.

We do not disclose information about babies to advertisers, data brokers, or analytics companies.

4. Photos and storage

Photos are stored in a private storage bucket. Only authenticated Caregivers of that baby profile can request them, and the app uses time-limited links (about 1 hour for viewing; up to 7 days in data exports). Anyone who has an unexpired export link can open the photo, so protect your export files. Deleting a photo, a baby profile, or your account removes the stored files.

When you invite a Caregiver, they get access to that baby's information as described in our Terms. Invitation codes work for one person once, expire after 14 days, and anyone holding a valid code can use it, so share only with people you trust. An Owner can make other Caregivers Owners. If a Caregiver leaves or deletes their account, entries they created typically remain in the baby's shared record unless the Owner deletes them.

6. Children's and babies' information (COPPA)

Chuloh is for adults. You must be 18 or older to create an account. It is not directed to children and we do not knowingly collect personal information directly from children under 13 (or under 16 where the law sets a higher age).
Parents are the account holders. Information about a baby or child is entered by a parent, legal guardian, or an adult caregiver they authorize. There are no child accounts.
We use baby information only to provide Chuloh to the family. We do not use it for advertising and we do not disclose it to third parties other than the providers in Section 9.
By adding a baby's information, you confirm that you are the baby's parent or legal guardian or have the parent's or guardian's permission.
If you believe a child has given us personal information directly, email info@cgw.services and we will delete it.

7. Retention and deletion

Active data is kept while your account is open.
Delete a baby profile (Owners): all logs, growth records, reminders, appointments, scrapbook photos, invitations, and caregiver links for that baby are deleted, and the stored photos are removed.
Delete your account: your data is purged within 30 days. We delete your profile and account. Baby profiles for which you are the only person with access are deleted with their data and photos. If other Caregivers still use a baby profile and you are its only Owner, you must first make another Caregiver an Owner or delete the baby profile.
After a trial or subscription ends: we keep your data for 12 months so you can come back and will give 30 days' notice before deletion. You can export or delete at any time. Automatic deletion of lapsed accounts is not turned on yet; if it is turned on we will notify you first.
Backups: backups are overwritten on our providers' rolling schedule; we do not promise a fixed number of days.
Records we may keep longer: we keep a minimal billing and consent log for 3 years once billing starts, and records of privacy requests, for legal compliance and dispute handling. The minimal log contains user ID, consent type, document version and timestamps, and Stripe customer/subscription IDs, but no baby data or content.
Inactive accounts and data minimization: we do not keep personal information longer than needed for the purposes in this Policy.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including: access controls so that only a baby's Caregivers can read or change that baby's data (enforced in our database); private photo storage with time-limited links; encryption in transit (TLS); restricted internal access; and contracts with service providers. Our database and storage providers encrypt data at rest. No online service can guarantee absolute security. Use a strong, unique password, keep invitation codes private, and tell us right away at info@cgw.services if you suspect unauthorized access.

Data breach notice. If we learn of a security incident that affects your personal information, we will investigate promptly and notify affected users and regulators as required by applicable law, without unreasonable delay and within the time limits set by law (which vary by state, and are commonly 30 to 60 days). Notices will describe what happened, what information was involved, what we are doing, and what you can do.

9. Service providers (subprocessors)

Provider	Role	Data involved	Location
Lovable Cloud / Supabase	App hosting, managed backend, database, private photo storage, authentication, and authentication emails	All app data, account and technical data, baby and care data, photos	[region to confirm]
Cloudflare, Inc.	CDN and security; sets the strictly necessary `__cf_bm` cookie	Technical data	United States and elsewhere
Stripe, Inc.	Payments, subscriptions, receipts	Name, email, payment details (held by Stripe), subscription data	United States and elsewhere
Lovable analytics	Aggregate visitor analytics	Page, referrer, country, and device type	United States and elsewhere
Google LLC	"Continue with Google" sign-in	Name, email, profile picture	United States

Authentication emails (verification, password reset) are sent from Lovable Cloud's default sender.

We do not allow providers to use your information for their own advertising or to sell it.

10. Where information is processed; international transfers

Chuloh is currently offered only in the United States. Information may be processed in the United States [region to confirm]. Where required, we rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework (where a provider is certified) or Standard Contractual Clauses.

11. Cookies, "Do Not Track," and Global Privacy Control

Chuloh uses only browser storage that is strictly necessary to sign you in and run the app. Cloudflare may set the short-lived, strictly necessary __cf_bm security cookie (about 30 minutes). We do not use advertising or cross-site tracking cookies.
Lovable provides aggregate visitor statistics for the public website at the platform level. Chuloh does not load an optional analytics script, so there is no optional app-controlled analytics script to disable.
We detect Global Privacy Control (GPC) and confirm in our notice that it is honored for choices Chuloh controls. We do not sell or share personal information for cross-context behavioral advertising, so GPC and Do Not Track do not change any sale or sharing. Chuloh cannot selectively disable Cloudflare security cookies or platform-level statistics from app code.

12. Your choices

In the app (More > Your data): export your data (JSON or CSV), delete a baby profile, leave a baby profile, or delete your account. Settings: manage caregivers and reminders; edit or delete entries and photos.
By email: info@cgw.services for any request in this Policy.
Emails: you can't opt out of essential account, security, and billing messages while you have an account.
Withdraw consent: where we rely on your consent (for example, for health-related information about your baby), you can withdraw it at any time by deleting the relevant entries, baby profile, or account, or by emailing us. Withdrawal does not affect earlier lawful processing. If you withdraw consent needed to run the Service, we may not be able to provide it.

13. Changes to this Policy

We will post changes here with a new "Last updated" date. For material changes, we will notify you by email or in the app at least 30 days before they take effect, and, where the law requires, ask for your consent again. The current version is always at https://chuloh.app/privacy; earlier versions are available on request at info@cgw.services.

14. Contact us

Contact us: info@cgw.services, or by mail at c/o Northwest Registered Agent LLC, 700 Narragansett Park Dr, Ste 100, Pawtucket, RI 02861. We aim to reply to support emails within 3 business days.

Part B. Consumer Health Data Privacy Policy

(Washington My Health My Data Act, Nevada SB 370, Connecticut, and similar laws.)

This Part B is also published as its own page at /consumer-health-data and linked from the homepage footer, in addition to being included here.

Who we are: Codexgig Web Services LLC, c/o Northwest Registered Agent LLC, 700 Narragansett Park Dr, Ste 100, Pawtucket, RI 02861, info@cgw.services.

Much of what you enter in Chuloh can be "consumer health data" about your baby or about you, because it relates to health status, bodily functions, or symptoms. We treat it as sensitive.

B.1 Categories of consumer health data we collect: feeding and sleep patterns; diaper output; growth measurements (weight, length, head size); temperature, symptoms, and other health notes; medicine names and doses; mood; milestones; appointments with health providers; baby's date of birth and optional sex; photos; and your pumping/lactation logs.

B.2 Sources: directly from you and from caregivers you invite. We do not buy health data and do not collect it from other websites or apps.

B.3 Why we collect and how we use it: only to provide the Chuloh features you ask for (record keeping, charts, reminders, sharing among your caregivers), to keep the Service secure, to bill you, to comply with law, and to respond to your requests. We do not use health data for advertising, profiling for marketing, or to build external profiles, and we do not sell it.

B.4 Who we share it with: (1) the Caregivers you invite; (2) our service providers that process it for us (Section 9 above), under contract; and (3) government authorities or others only as the law requires. We do not share consumer health data with any third party for their own purposes, and we do not sell it. We do not use geofencing around health facilities. You can withdraw consent to health-data processing at any time in Settings or by email; we then stop processing and delete it, except where law requires us to keep it.

B.5 Consent. We will ask for your separate, opt-in consent to collect and use a baby's health information before you add it ("I'm this baby's parent or legal guardian, or I have their permission, and I agree that Chuloh may collect, store, and share with the caregivers I invite the health-related information I enter, as described in the Consumer Health Data Privacy Policy"). We will ask for separate written authorization before we ever sell consumer health data (we do not). You can withdraw consent at any time (Section 12).

B.6 Your rights. You can (a) confirm whether we collect your consumer health data and access it, including a list of third parties and affiliates we've shared it with or sold it to (we do not sell it; third parties are our service providers), (b) withdraw consent, (c) delete your data, and (d) appeal our decision (Section 17 of Part C). Make a request in the app (More > Your data) or at info@cgw.services. We acknowledge privacy and deletion requests within 10 days and complete them within 45 days (extendable once as the law allows). Deletion applies to our systems and service providers. Deleted data may remain in our providers' encrypted backups until overwritten on their normal schedule; we do not promise a specific number of days.

B.7 Your rights: access, deletion, withdrawal of consent, and appeal. We don't sell consumer health data and don't use geofencing. Washington residents can also contact the Washington Attorney General. Nevada residents may make a request to info@cgw.services and may contact the Nevada Attorney General. State-specific sections of this Policy take effect on the same date as the Policy. Related documents: Privacy Policy, Terms of Service, Health Disclaimer, and Delete account.

Part C. Your Rights by Region

We give these rights to everyone in the United States who uses Chuloh, whether or not a particular law technically requires us to. Where your state's law gives you stronger rights, those apply.

15. U.S. state privacy rights (California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and others)

Depending on where you live, you may have the right to:

Know / access the personal information we have about you, the categories, sources, purposes, and the third parties we disclose it to;
Obtain a copy of your data in a portable format (use the in-app export);
Correct inaccurate personal information (you can edit most entries yourself);
Delete your personal information;
Opt out of (i) sale of personal information, (ii) sharing/targeted advertising, and (iii) profiling that produces legal or similarly significant effects. We do none of these, so there is nothing to opt out of;
Limit the use of sensitive personal information (California). We use sensitive personal information only to provide the Service you request and for other purposes the law permits without a "limit" right (such as security and legal compliance), so we do not offer a "Limit the Use of My Sensitive Personal Information" link;
Withdraw consent to processing of sensitive data;
Be free from discrimination for exercising your rights. We will not deny service, charge different prices, or give a different level of service because you exercise your rights;
Appeal our decision (see 17).

15.1 How to make a request

Use More > Your data in the app, or email info@cgw.services with the subject "Privacy Request" and tell us what you want and the email address on your account. You may use an authorized agent; we may ask for proof of the agent's authority and may need to verify your identity directly. To protect your family's data, we verify requests by confirming control of the account email or by signing in. We can't honor a request if we can't verify it. Requests are free; we may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive, as the law allows.

15.2 Our response time

We acknowledge privacy and deletion requests within 10 days and complete them within 45 days of receiving a verifiable request. If we need more time, we may extend once by up to 45 more days (90 total; some states allow 60 days for an extension) and will tell you why.

15.3 California notice at collection (CCPA/CPRA)

Categories of personal information collected in the last 12 months, purposes, whether sold/shared, and retention:

CCPA category	What we collect (examples)	Sensitive PI?	Sold/Shared?	Disclosed for business purpose to	Retention
Identifiers	Name, email, account ID, IP address (in logs), Stripe customer ID	No (account log-in credentials are sensitive)	No	Service providers (Sect. 9)	Life of account + 12 months after lapse; logs: see Section 7
Customer-records / personal information (Cal. Civ. Code §1798.80(e))	Name, email	Account log-in = sensitive	No	Service providers	Same
Characteristics of protected classifications	Baby's optional sex; baby's age	Not sensitive unless noted	No	Service providers; Caregivers you invite	Until deleted
Commercial information	Subscription plan, trial and renewal dates, extra seats	No	No	Stripe, service providers	Minimal billing and consent log for 3 years once billing starts
Internet or network activity	Server and security logs (IP address, device/browser type): collected for security and reliability; not sold or shared.	No	No	Service providers	See Section 7
Audio, electronic, visual information	Photos you upload	No	No	Service providers; Caregivers	Until deleted
Health-related information (sensitive PI)	Baby (and parent) feeding, sleep, diaper, growth, medicine, temperature, symptoms, mood, appointments	Yes	No	Service providers; Caregivers	Until deleted by you; see Sect. 7
Inferences	Computed statistics shown to you (averages, time since last feed). We don't create profiles to predict preferences.	No	No	None	Not stored beyond the app
Geolocation	Not collected. Location and camera metadata (EXIF) is removed from photos when they are uploaded; photos uploaded before October 2, 2026 were cleaned on October 2, 2026.	n/a	No	n/a	n/a

Sources: you; Caregivers you invite; Google (if you use Google sign-in); Stripe. Purposes: Section 2. We do not sell or share (for cross-context behavioral advertising) personal information, including that of consumers under 16. We use sensitive personal information only for purposes that the CCPA allows without a right to limit (providing the Service you request, security, and compliance). Our California privacy request methods are in 15.1. We do not offer financial incentives for personal information.

15.4 California "Shine the Light" (Civil Code §1798.83)

We do not disclose personal information to third parties for their direct marketing purposes. California residents may request confirmation of this by emailing info@cgw.services.

15.5 California Online Privacy Protection Act (CalOPPA) / Do Not Track

See Section 11. We don't track you across websites.

Where state law requires consent to process sensitive data (such as health data or data of a known child), we ask for it when you add a baby and rely on it. You can withdraw it at any time (Section 12).

15.7 Minors

Our Service is for adults. We don't knowingly sell or share personal information of minors.

Chuloh is currently offered only in the United States; this section is provided for transparency and applies only if that changes.

Controller: Codexgig Web Services LLC (contact above).
Legal bases: Contract (to provide your account and the Service); Consent (to process special-category health data about a baby or you, Article 9(2)(a), and for any optional emails; withdraw any time); Legitimate interests (security, fraud prevention, and service improvement, balanced against your rights); Legal obligation (tax, accounting, legal requests).
Your rights: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent; and to lodge a complaint with your local data protection authority (in the UK, the ICO). We don't make decisions based solely on automated processing that produce legal or similarly significant effects.
International transfers: see Section 10. Contact us for a copy of the safeguards.
Children: you must be 18+ to hold an account; information about babies is provided by their parent or guardian, who consents on the baby's behalf.
Retention: see Section 7.

17. Appeals

State-specific sections of this Policy take effect on the same date as the Policy. Related documents: Privacy Policy, Terms of Service, Health Disclaimer, and Delete account.

We acknowledge privacy and deletion requests within 10 days and complete them within 45 days (extendable once as the law allows). If we deny or only partly fulfill your request, you may appeal by emailing info@cgw.services with the subject "Privacy Appeal" within 60 days or the period required by your state of our decision, explaining why you disagree. We will respond in writing within 45 days (up to 60 days where the law permits), tell you what we did, and explain the reasons. If we deny your appeal, you may contact your state attorney general: the Rhode Island Attorney General (riag.ri.gov) [CONFIRM Rhode Island Attorney General URL], the California Attorney General or the California Privacy Protection Agency, the Connecticut Attorney General, the Washington Attorney General, the Nevada Attorney General, or your own state's attorney general.

18. Other disclosures

Data broker: We are not a data broker.
Automated decision-making: We do not use automated decision-making or profiling that produces legal or similarly significant effects.
Financial incentives: None.
Accessibility: To receive this Policy in another format, email info@cgw.services.

Want your account deleted? Request account deletion