Privacy Policy - CriApp
NOTICE: Reviewed by the internal legal audit (2026-05-02) and completed with the owner's details on 2026-08-20. Sign-off by counsel licensed in Peru (governing law) is recommended before a large-scale launch campaign.
Version: 2.0.0
Last updated: 2026-08-20
Data Controller: Jose Giancarlo Palacios Loli ("CriApp", "we", "us").
Address: Huaraz, Áncash, Peru.
Data Protection Officer (DPO): dpo@criapp.smarthuaraz.cloud.
EU Representative (Art. 27 GDPR): Not applicable to CriApp v1.0 — the Service is NOT offered in the European Union, EEA, United Kingdom, or Switzerland (see §1.1 "Scope v1.0 — covered markets"). Should the Service expand to the EU in the future, CriApp will appoint a representative under Art. 27 GDPR.
1. Introduction
CriApp is a free mobile and web application supporting parents and caregivers during pregnancy and the upbringing of children aged 0-5. Privacy of your family - especially the minors in your care - is central to the Service.
This Policy describes what data we collect and why, how we protect it, with whom we share, your rights, and how to exercise them. It applies to version 1.0 of the Service in the markets listed under "Scope v1.0 — covered markets" below, with specific mentions for Peru, Mexico, Colombia, Chile, Argentina, Uruguay, Dominican Republic, Panama, Paraguay, Bolivia, Honduras, Guatemala, El Salvador, Nicaragua, Puerto Rico, and the United States (including California).
Minimum age: 18 years (or legally documented emancipation). By using CriApp you accept these practices.
1.1 Scope v1.0 — covered markets
Last scope review: 2026-05-03. This Service (CriApp v1.0) is offered exclusively in the following territories:
Included in v1.0: United States (including California) · Peru · Mexico · Colombia · Chile · Argentina · Uruguay · Dominican Republic · Panama · Paraguay · Bolivia · Honduras · Guatemala · El Salvador · Nicaragua · Puerto Rico, plus any other LATAM territory whose national data-protection compliance is zero-cost (no registration fee, no mandatory external DPO/DPD, no paid local representative).
Excluded from v1.0 (no users knowingly accepted): the European Union and the European Economic Area, the United Kingdom, Switzerland, Brazil, Ecuador, Costa Rica, Cuba, Iran, North Korea, Syria, and sanctioned territories (Crimea / Donetsk / Luhansk).
At sign-up, users whose declared country or geolocated IP falls within an excluded territory may receive a "service unavailable" notice. Residual presence of a user from an excluded territory does not imply Service recognition in their jurisdiction nor assumption of additional local obligations beyond contractual ones.
Future re-activation: the per-country annexes for excluded territories are retained at the bottom of this Policy as "Pending future expansion" so legal counsel can re-activate them without rewriting the document.
2. Categories of personal data
2.1 Adult account holder
Email, display name, optional avatar, date of birth (age verification), language, timezone, theme, notification preferences, family type (self-declared), session and refresh tokens (Better-Auth in expo-secure-store).
2.2 Children's data (entered by you)
Special category reinforced by COPPA (USA, FTC amendments April 2025), GDPR Art. 8 (children), LGPD Art. 14 (Brazil), INAI Guidelines (Mexico), Decree 1377/2013 + 090/2018 (Colombia), Law 25.326 (Argentina) and Law 29733 + DS 016-2024-JUS (Peru).
- Identification: name or nickname, date of birth or due date, gender, prematurity, family situation.
- Health (GDPR Art. 9): weight, height, head circumference, vaccinations, illnesses, allergies, medications, dosage, prenatal records (symptoms, kicks, contractions, gestational weight).
- Behavioral: sleep, feeding, diapers, developmental milestones (CDC Learn the Signs).
- Media: photos of the child or bump, scanned medical documents, drawings.
2.3 User-generated content (UGC)
Recipes, posts, comments, votes, bookmarks. Posted under your adult name; never under a child's name.
2.4 Technical data
Device model, OS, app version, system language, Expo Push token, IP at API call / login, error events (Sentry). We do not collect advertising identifiers (IDFA/GAID) because CriApp v1.0 has no advertising.
2.5 Data we do NOT collect
We do NOT collect: phone number, financial data, browsing history outside the app, device contacts, precise GPS location, biometric data (fingerprint, iris, voiceprint, facial template), genetic data, or the child's voice. The 2025 amendment to COPPA expands "personal information" to biometrics: we confirm we do NOT collect them.
3. Lawful bases (GDPR Art. 6, 9; LGPD Art. 7, 11; Peru Law 29733 Art. 13-15)
| Processing | Lawful basis |
|---|---|
| Account + auth | Contract (Art. 6.1.b GDPR) |
| Core tracking | Contract (Art. 6.1.b) |
| Health data | Explicit consent (Art. 9.2.a GDPR; Art. 11 LGPD; informed consent Peru Art. 14) |
| Children's data | Parental consent (Art. 8 GDPR; LGPD Art. 14; COPPA §312.5; Peru DS 016-2024-JUS) |
| Push notifications | Consent (Art. 6.1.a) |
| Community UGC | Consent (Art. 6.1.a) + legitimate interest (Art. 6.1.f) |
| Security / fraud logs | Legitimate interest (Art. 6.1.f) |
| Consent records / compliance | Legal obligation (Art. 6.1.c) |
No automated decision-making with significant effects (GDPR Art. 22; LGPD Art. 20). Nap predictions, pediatric dose suggestions and growth curves are informational suggestions, not diagnoses. CriApp is NOT a high-risk AI system under the EU AI Act (Reg. 2024/1689).
4. Purposes
- Provide the Service.
- Proactive reminders (vaccines, doses, milestones, weekly content).
- Service improvement (anonymized technical analytics, error monitoring).
- Security (fraud and impersonation prevention).
- Legal compliance (data subject rights, export, erasure).
CriApp v1.0 does NOT engage in any advertising activity. See §10.
5. Storage and protection
5.1 Infrastructure
CriApp runs self-hosted infrastructure on a Hostinger VPS (Lithuania, EU). PostgreSQL, object storage (Garage S3) and authentication (Better-Auth) run on our servers. We do NOT use Supabase, Firebase, or third-party Backend-as-a-Service. We do NOT integrate Google Health Connect nor Apple HealthKit; the only health data is what you manually enter.
5.2 Encryption
- Transit: TLS 1.3.
- At rest: AES-256 (disk + restic backups).
- Tokens:
expo-secure-store(iOS Keychain / Android EncryptedSharedPreferences).
5.3 Access
Authorized staff under NDA, SSH bastion + signed keys. Admin logs retained 90 days.
5.4 Retention
| Category | Term |
|---|---|
| Active account | Lifetime of account |
| Post-deletion | Full purge within 30 days |
| Behavioral logs (sleep/feed/diaper) | 2 years from creation |
| Consent records | 5 years |
| Security logs | 90 days |
| Encrypted backups | Rolling 7d + 4 weekly + 6 monthly |
| Inactive push tokens | 90 days |
| Export file | 7 days after generation |
| UGC after deletion | Anonymized ("Deleted user") or removed on request |
6. Subprocessors
We do NOT sell your data. We share only with subprocessors strictly necessary under DPAs compliant with GDPR/LGPD/CCPA. Full list at /legal/subprocessors (see 12-subprocessors-list-final.md).
| Subprocessor | Role | Data | Region |
|---|---|---|---|
| Hostinger Intl. | VPS infra | All | Lithuania (EU) |
| Google / Apple OAuth | Login | Email + name | USA |
| Expo (650 Industries) | EAS Build / OTA / Push relay | Push tokens, build metadata | AWS US |
| Sentry | Error monitoring | Stack traces, optional user ID | Frankfurt (EU) |
| Resend | Transactional email | Recipient email, content | EU/US |
| Backblaze B2 / Hetzner Storage Box | Encrypted off-site backups | Encrypted data (key on our servers) | USA or EU |
NEVER shared: child data with ad networks (CriApp v1.0 has no advertising); health data with third parties for commercial purposes; child photos with third parties beyond infra.
7. International transfers
CriApp v1.0 is NOT offered in the European Union (see §1.1). Notwithstanding, because controller infrastructure sits in EU territory (Hostinger, Lithuania), we apply, as a best-practice baseline: Standard Contractual Clauses (Decision 2021/914) for non-EU subprocessors, Transfer Impact Assessments where applicable, and EU-US Data Privacy Framework (2023 adequacy decision) where applicable. For users of v1.0 markets (LATAM + USA), transfers are additionally governed by the standard clauses and adequacy mechanisms detailed in the LATAM Annex.
8. Your rights
| Right | How to exercise |
|---|---|
| Access | Settings - Data - Export |
| Rectification | In-app edit |
| Erasure / right to be forgotten | Settings - Account - Delete (30-day purge) |
| Portability (JSON/ZIP) | Settings - Data - Export |
| Objection / restriction | dpo@criapp.smarthuaraz.cloud |
| Withdraw consent | Settings - Privacy |
| Lodge complaint | See §14 |
Response time: 30 calendar days (GDPR Art. 12.3; LGPD Art. 19; Peru Law 29733 Art. 19 - 20 working days in Peru).
8.1 United States — federal and state
- COPPA (FTC, April 2025 amendments): CriApp is not directed to children under 13. The account holder must be an adult. We do not knowingly collect information directly from minors.
- CPRA / California AADC: Right to Know / Delete / Correct / No Discrimination. CriApp v1.0 does not sell or share personal data with third parties for advertising purposes. No opt-out control ("Do Not Sell or Share" / "Limit Use of Sensitive PI") is required at this time. We comply with California AADC (CIVIL §1798.99.28-.40) per its enforceable scope after the Ninth Circuit ruling of 2026-03-12: high default privacy settings for minors, although CriApp is not directed to minors. If this policy changes in a future version, we will notify users and provide a clear control.
- CCPA-like states (CO, CT, VA, UT, IA, MT, OR, TN, TX, IN, FL): same baseline rights of access, deletion, and portability. Opt-out of sale or sharing does NOT apply to CriApp v1.0 (we do not sell or share personal data for advertising purposes); if this changes, we will notify and provide a clear control. The remaining rights are exercised through the same channel as California.
- CA "Shine the Light" (CIVIL §1798.83): we do not share personal information with third parties for direct marketing.
- Georgia and other states with breach-notification statutes: notification to affected users without undue delay if the risk is high, per the local statute.
- Minors under 18 (CA "Eraser" Right, CIVIL §1798.99.28): exercised by deleting the account or the minor's profile from Settings.
8.2 Brazil (LGPD) — Pending future expansion (NOT in v1.0)
CriApp v1.0 does not operate in Brazil. LGPD requires an Encarregado (DPO) absent the small-business exemption under Res. CD/ANPD 2/2022; the cost of an external Encarregado (~USD 2,000/year) exceeds the v1.0 free model. To be re-activated when Phase B is evaluated. Reference text: confirmation, access, correction, anonymization/blocking/erasure, portability, deletion of consented data, information on sharing, withdrawal. Encarregado: dpo@criapp.smarthuaraz.cloud.
8.3 Mexico (LFPDPPP)
ARCO rights. Requests to dpo@criapp.smarthuaraz.cloud.
8.4 Peru (Law 29733 + DS 016-2024-JUS)
Information, access, update, inclusion, rectification, suppression, opposition, objective treatment, judicial protection (tutela), portability. Requests to dpo@criapp.smarthuaraz.cloud. Response time: 20 working days.
9. Children's data
See 05-children-privacy-notice-final-en.md. Summary:
- Adults only create accounts. We do NOT collect data directly from minors.
- Verifiable parental consent required before first child profile.
- Children's data NEVER goes to advertising networks.
- You may delete it any time from Settings.
10. Advertising
CriApp v1.0 is 100% free and ad-free. We do not display advertisements and do not collect data for advertising purposes. We do not integrate third-party ad SDKs, do not use advertising identifiers (IDFA/GAID), and do not participate in personalized advertising networks. If this changes in a future version, we will notify you in advance and request consent.
11. Security
PKCE (Better-Auth), 15-min tokens, per-row authorization by account_id, Zod validation, rate-limiting, restic off-site backups, HSTS/CSP/X-Frame-Options. Incident notification: <72h to authority (GDPR Art. 33; LGPD 3 business days - 6 for small-scale; equivalents elsewhere) and to data subjects if high risk.
12. Changes to this Policy
Material changes: in-app banner before next login + email + policy_version_accepted bump. Re-acceptance required when purpose or legal basis changes. Public versions at /legal/privacy-policy.
13. Cookies
Mobile app: no cookies. Web build: see 07-cookie-policy-web-final-en.md.
14. Supervisory authorities
Listed only the authorities of the v1.0 covered markets (see §1.1). Authorities of excluded markets (EU, UK, Switzerland, Brazil, Ecuador, Costa Rica, Cuba) will be re-listed when expansion is decided.
| Jurisdiction | Authority | URL |
|---|---|---|
| Peru | ANPD / MINJUSDH | gob.pe/anpd |
| US federal | FTC | reportfraud.ftc.gov |
| California | CPPA | cppa.ca.gov |
| Mexico | INAI | inai.org.mx |
| Colombia | SIC | sic.gov.co |
| Chile | Personal Data Protection Agency (eff. 1-Dec-2026) / Consejo para la Transparencia | consejotransparencia.cl |
| Argentina | AAIP | argentina.gob.ar/aaip |
| Uruguay | URCDP | gub.uy/unidad-reguladora-control-datos-personales |
| Panama | ANTAI | antai.gob.pa |
| Dominican Republic | (no general authority) | — |
| Paraguay | (forming after Law 7593/2025) | — |
| El Salvador | (forming after LPDP Nov-2024) | — |
| Bolivia / Honduras / Guatemala / Nicaragua | (no general authority) | — |
| Puerto Rico | DACO + FTC (federal) | daco.pr.gov |
15. Contact
| Topic | |
|---|---|
| Privacy / DPO | dpo@criapp.smarthuaraz.cloud |
| Support | support@criapp.smarthuaraz.cloud |
| Security | security@criapp.smarthuaraz.cloud |
| Legal | legal@criapp.smarthuaraz.cloud |
Address: Huaraz, Áncash, Peru. EU Representative: Not applicable — Service not offered in the EU in v1.0.
Authoritative version: Spanish. In case of translation conflict, the Spanish version signed by counsel prevails.
LATAM Annex — jurisdiction-specific provisions
This annex supplements the Privacy Policy and prevails over the rest only where local law is more protective of the data subject.
Argentina
- Authority: Agencia de Acceso a la Información Pública (AAIP) — Av. Pte. Gral. Julio A. Roca 710, CABA, Argentina. Web: https://www.argentina.gob.ar/aaip
- Framework: Law 25.326 + Decree 1558/2001.
- Response window for ARCO rights: 10 calendar days.
- Complaints: filed online with the AAIP.
- Registration: CriApp's database will be registered with the RNBD if the legal threshold is met. Registration will be filed once the operation reaches that threshold.
Bolivia
- Framework: DS 1793/2013 (limited to digital certification) + constitutional principles (Art. 21).
- No specific supervisory authority. General principles and this Policy apply on a supplemental basis.
Chile
- Authority (effective 1-Dec-2026): Personal Data Protection Agency — created by Law 21.719. The Agency will publish its official contact channel once it becomes operational.
- Transitional framework (until 30-Nov-2026): Law 19.628.
- Definitive framework: Law 21.719 (published in the Official Gazette on 13-Dec-2024).
- Response window: 30 calendar days.
- Children under 14: processing requires express, verifiable parental/guardian consent and respect for the best interests of the child principle. CriApp applies this rule across Chile from launch (does not wait for the effective date).
Colombia
- Authority: Superintendencia de Industria y Comercio (SIC) — Carrera 13 No. 27-00, Bogotá. Web: https://www.sic.gov.co
- Window: 15 business days, extendable.
Costa Rica — Pending future expansion (NOT in v1.0)
- CriApp v1.0 does not operate in Costa Rica. Pending PRODHAB registration and the annual fee; to be re-activated when this market is to be covered.
- Historical annex (legal-team reference): Authority PRODHAB (Min. of Justice and Peace, https://prodhab.go.cr); ARCO window 5 business days; mandatory annual fee (~USD 200/year). Framework: Law 8968/2011 + Regulation (Decree 37554-JP/2013).
Cuba — Pending future expansion (NOT in v1.0)
- CriApp v1.0 is not distributed in Cuba due to OFAC restrictions and to Apple App Store / Google Play distribution practice (the stores do not operate fully in Cuba).
- If a user resides in Cuba and accesses the Service through unofficial channels, we do not recognize Service scope in their jurisdiction; without prejudice, Policy rights apply under general principles.
- Historical annex (legal-team reference): Framework Law 149/2022 + Decree-Law 35/2021; no fully operational independent authority.
Ecuador — Pending future expansion (NOT in v1.0)
- CriApp v1.0 does not operate in Ecuador. SPDP requires a Data Protection Delegate (DPD) for processing children's sensitive data; the cost of an external DPD (~USD 2,000/year via consultancy) exceeds the v1.0 free model. To be re-activated when Phase B is evaluated.
- Historical annex (legal-team reference): Authority SPDP (https://spdp.gob.ec); framework LOPDP (RO Supplement 459, 26-May-2021) + Regulation (RO Supplement 23, 13-Nov-2023); window 15 days + 15 days extension.
El Salvador
- Framework: Personal Data Protection Law (passed Nov-2024). Regulation pending.
- ARCO rights per LPDP.
Guatemala / Honduras / Nicaragua / Venezuela
- No general operative law as of 02-May-2026. CriApp applies the principles of this Policy on a supplemental basis.
Mexico
- Authority: INAI — Web: https://home.inai.org.mx
- Window: 20 business days.
- Relevant subprocessor: Resend Inc. (USA) acts as processor for transactional email delivery.
Panama
- Authority: ANTAI — Web: https://antai.gob.pa
- Framework: Law 81/2019 + Executive Decree 285/2021.
- Window: 15 business days.
Paraguay
- Framework: Law 7593/2025 (passed 5-Nov-2025, promulgation pending as of 02-May-2026). Regulation pending.
- Until full effective date, constitutional principles and the most protective Policy provisions apply. This Policy will be updated when the implementing regulations are published.
Peru
- Authority: Autoridad Nacional de Protección de Datos Personales (ANPD), MINJUSDH. Web: https://www.gob.pe/autoridad-nacional-de-proteccion-de-datos-personales
- Framework: Law 29733 + Regulation DS 016-2024-JUS (effective 31-Mar-2025).
- Window: 20 business days + 20 business days extension.
- Registration: personal data bank registered in SIPDP.
Puerto Rico
- Federal framework: COPPA (<13) + Citizen Information on Data Banks Security Act + Cybersecurity Act 40/2024.
- HB 1548 also applies once in force.
Dominican Republic
- Framework: Law 172-13. No general data privacy authority outside the banking sector.
- ARCO window: 10 days.
Uruguay
- Authority: URCDP — Web: https://www.gub.uy/unidad-reguladora-control-datos-personales
- Framework: Law 18.331/2008 + Decree 414/009 + Decree 64/020.
- Window: 5 business days.
- Registration: CriApp's database registered with URCDP.
International transfers (LATAM)
- Personal data is stored in controller infrastructure in the European Union (Lithuania / Netherlands / Germany / Finland) via Hostinger.
- Mechanisms applied:
- Argentina and Uruguay: reciprocal EU adequacy + AAIP/URCDP adequacy. No additional clauses required.
- MX/CO/CL/PE/EC/CR/PA/DO: standard contractual clauses + user consent on Policy acceptance.
- Brazil: ANPD standard clauses (Res. CD/ANPD 15/2024) + consent.
- Advertising: not applicable in v1.0 (CriApp is free and ad-free).
Geographic availability
CriApp is not distributed in Cuba, Iran, North Korea, Syria, or Crimea / Donetsk / Luhansk, due to OFAC sanctions and Apple/Google global policies.