Tumble · Zero2Five

Privacy Policy

Effective date: 12 November 2026

1. Who we are

Tumble is a baby tracker from Zero2Five. It is provided by Virgin Gates, Cairo, Egypt ("we", "us" or "our"). We decide how the personal data described here is used, so we are responsible for it (the "data controller").

This policy covers the Tumble iPhone app, its online services (accounts and backup, family sharing, AI features, Baby Passport links, notifications and emails) and this website. For any question or request, email support@tumblebaby.app.

2. Your account

From version 1.5, Tumble asks you to create a free account the first time you open it. You sign in with Apple, or with a six-digit code we send to your email address. There are no passwords. Earlier versions of the app work without an account.

What we store	With Sign in with Apple: a code Apple gives us to recognise you (not your Apple ID itself) and the email address Apple shares with us, which is a private relay address if you choose "Hide My Email". With an email code: your email address. Also your name if Apple gives it to us or you type it, your app language, the country you signed up from, and when and from which phone you signed in.
Why	To know that it's you, to keep your logs backed up, and to give them back to you on a new or replaced phone.
The backup	Once you're signed in, the children you add (name, birth or due date, gender and Baby Passport details), their logs, running timers, plans and medicine list are copied to Tumble's server as you record them.
Where	On Tumble's server, which runs on Cloudflare Workers with a Cloudflare D1 database whose main copy is in the European Union.
Who can see it	You, and the people you invite to your family (see Family sharing). The small team that runs Tumble has a dashboard that shows account details and counts of how the app is used; it doesn't show the contents of your logs.
How long	Until you delete your account.

A sign-in code is six random digits, works once and expires after 10 minutes. We store only a keyed fingerprint of it, never the code.
Signing in creates a session key that is kept in your iPhone's Keychain. Our server stores only a one-way fingerprint of it (a SHA-256 hash). Signing out ends it, and you can ask us to sign out all your phones.
If signing in fails several times in a row (for example with no internet), the app lets you continue without an account for the day, so you are never kept from logging. Nothing is backed up until you sign in.
If a different person signs in on the same phone, the phone starts fresh first: one parent's logs are never copied into another parent's account.

3. What stays on your phone

Everything you record is also saved on your phone, so Tumble works without a connection: your child's name, birth or due date and gender; sleep, breastfeeds, bottles, pumping, solids, nappies, growth, temperatures, doctor visits, symptoms, medicines, milestones ("firsts"), contractions and notes; the Baby Passport; and your reminders and settings.

The app creates a random id on your phone so our server can tell phones apart. Once you sign in, it is linked to your account.
Reminders are scheduled on your phone and are not backed up. The Lock Screen timers show information from your phone only.
When you export a CSV file or share the Baby Passport "as text", you choose where it goes. It doesn't pass through our server.
Depending on your settings, your iPhone may include Tumble's data in your own iCloud Backup or computer backup. Those backups are controlled by you and Apple.

4. Family sharing (optional)

Your account's backup is a family with one member: you. Family sharing starts when you invite someone or join with an invite code. Then:

What we store	The children in the family (name, birth or due date, gender and Baby Passport details), their logs, running timers and medicine list, and each member's display name, role (owner, caregiver or view only) and when they were last active.
Why	So the phones you invite see the same logs and timers as they happen.
Where	On Tumble's server, which runs on Cloudflare Workers with a Cloudflare D1 database whose main copy is in the European Union.
Who can see it	Only the members of your family.
How long	While the family exists (see below).

Connections are encrypted (HTTPS). Each phone gets its own secret key, and we store only a one-way fingerprint of it (a SHA-256 hash).
An invite code works once and expires after 3 days.
The owner can remove a member. A removed member's phones keep what they already have but receive nothing new.
When you delete a log, it is removed from every phone in the family.
If you leave a family while others stay, the shared logs stay with the rest of the family, because they are the family's shared record. You keep your own copy, which is then backed up to your account on its own.
When the last member leaves or deletes their account, the family's copy is deleted from our server.

5. AI features (optional, with your permission)

Chirp (the chat helper), Growing today and Prepare for the visit use AI to write their answers. Tumble asks for your permission before it uses any of them, and they stay off until you agree.

What is sent

Only what the answer needs, put together on your phone each time you use the feature:

Chirp: your question and the last few messages of the chat, your child's first name, age and gender, and a short summary of recent logs (for example the last 24 hours, 7-day averages, the latest weight, medicines in the last 48 hours and recent firsts).
Growing today: your child's first name, age and gender, the day's milestone and a few signals from the logs.
Prepare for the visit: your child's first name, age and gender, Baby Passport essentials (such as allergies and medical history), recent doctor visits, what was logged since then, and the worries you type.

Who processes it

Cloudflare Workers AI. It runs open AI models on Cloudflare's own servers: currently models from DeepSeek and Qwen, with OpenAI's open-weight gpt-oss model as a backup for Chirp. The companies that made the models don't receive your data.

What happens to it

The request is used only to write the answer and send it back to your phone. Tumble doesn't store your questions, the summaries or the answers on its server, and Cloudflare doesn't use them to train AI models. We only count how many answers are written each day, without any content.

Your choice

You can turn AI features off at any time in the app (Family), and everything else keeps working. AI answers can be wrong and are not medical advice (see section 17).

6. Baby Passport links (optional)

A Baby Passport link is created only when you tap "Private link" on the Baby Passport screen.

The app sends the passport sections you chose, already written in the language you picked. Our server stores them under a long random link that isn't listed in search engines.
Anyone who has the link can open the page, so share it only with people you trust, such as a new doctor or the grandparents.
The link turns off by itself after the period shown in the app (never more than 90 days). You can tap "Turn the link off" at any time: the page stops working at once and its copy is deleted from our server. Copies of expired links are deleted too.
We count how many times a link is opened, without recording who opened it.

7. App check-in and statistics

When you open the app, it sends a short check-in to our server. We use it to count how many people use Tumble, to see which app versions and languages are in use, and to send notifications and tips that suit your child's age and your language.

A check-in contains: the random app id, the platform (iOS), the app version and build, the app language, your time zone, whether notifications are allowed and whether you said yes to tips and offers, whether you're expecting a baby, the youngest child's age in whole months (not the birth date), and your family id. When you're signed in, the check-in is linked to your account. It contains no children's names and no logs.

We also note roughly where a check-in came from: the country, region and city, which Cloudflare works out from your connection's internet address. This is approximate (a phone network can place you in its nearest big city), it is not GPS, and Tumble never asks for your location. We keep the place of your latest check-in, not the address itself, and use it to count where Tumble is used and to choose who gets a notification or an email (see Notifications and Emails).

We also record the days on which the app was used, and simple daily totals (such as how many Baby Passport links were made).

We don't use this to build advertising profiles or to track you across other apps or websites.

8. How the app is used

From version 1.5, the app counts what is done in it, so we can see which parts help and which are never found: for example "a sleep was logged", "Trends was opened" or "a question was asked in Chirp". It sends the name of the action and how many times it happened that day.

It never sends what you recorded or wrote: no names, no times or amounts of feeds, no questions and no notes.

The counts are kept per day and per phone, linked to your account when you're signed in, so we can understand how families use Tumble and help you if you contact support. Per-phone counts are deleted after 4 months. Daily totals, which contain no personal data, are kept as statistics.

9. Notifications

Reminders you set up are scheduled on your phone and don't need our server.
If you allow notifications, the app sends your phone's push token (an address Apple gives your phone for notifications) to our server, so we can send you notifications. They are delivered through Expo's push service and the Apple Push Notification service, which receive the token and the text of the notification.
We may occasionally send service messages, such as news of an important app update, to phones that allow notifications.
Tips, news and offers from Zero2Five are sent only if you said yes to them. You can turn them off at any time in the app (Family → "Tips and offers notifications").
We may choose who gets a notification by app language, your child's age, how recently you used Tumble, or roughly where you are (a country or a city, from your latest check-in). For example, a tip about a local holiday, or an offer that can only be delivered in one country.
When we send you a notification, we record that it was sent to your phone, whether it was delivered and whether you tapped it, so we can see which messages are useful.
You can turn off all notifications in iPhone Settings → Notifications → Tumble. The app works without them.

10. Emails

If you sign in with an email code, we email you the code. That is the only email you get unless you ask for more.
Tips, news about Tumble and Zero2Five offers are emailed only if you said yes to them. You can change this at any time in the app (Family → Your account → "Tips and offers by email"), and every such email has an unsubscribe link that works with one click.
We may choose who gets an email in the same way as notifications, including by country or city.
To see which emails are useful, we record whether an email was delivered, whether it was opened (a small image in the email tells us) and whether a link in it was clicked. If your email app blocks images, opens aren't recorded.
Emails are sent through our email delivery provider, Resend, which receives your email address and the email's content in order to deliver it.
If you use Apple's "Hide My Email", we only have the relay address. Apple forwards our emails to you, and you can turn the forwarding off in your Apple ID settings.

11. Tumble Plus purchases

Tumble Plus is bought through Apple. Apple handles the payment; we never see your card details.

To unlock Tumble Plus, our server receives the purchase information signed by Apple: the product, the purchase, renewal and expiry dates, the status (such as free trial, active, expired or refunded), whether it will renew, the price and currency, and the App Store country. We link it to a random purchase id created by the app and to the app's random id (which is linked to your account when you're signed in, and to your family).

Your subscription also unlocks Tumble Plus for the other members of your family. They can see that Plus comes from the family's subscription, but never your payment details. Apple's own use of your data is described in Apple's privacy policy.

12. Technical data and security

Like any online service, our server sees your phone's IP address when the app connects. We use it to protect Tumble from abuse, for example by limiting how many invite codes or AI requests can come from one address in an hour. These counts are deleted within 7 days. Cloudflare also reads an approximate country, region and city from it (see App check-in). We don't keep the address itself with your account.
Cloudflare keeps short-term technical logs (such as times, addresses and error messages) for a few days, to keep the service working and secure.
App updates are downloaded from Expo (EAS Update). Like any download, Expo sees your IP address and the app version.
All connections are encrypted (HTTPS), secret keys are stored only as fingerprints, and access to the server is limited to the small team that runs Tumble.
No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

14. Where your data is processed

The main copy of our database is in the European Union. Cloudflare and Expo run networks around the world, so data may pass through or be processed in other countries, including Egypt and the United States.

When data is transferred outside Egypt or the European Economic Area, we do so in line with Egypt's Personal Data Protection Law and the GDPR, relying on providers that offer an adequate level of protection and on safeguards such as standard contractual clauses.

15. How long we keep data

Data	How long
Logs and settings on your phone	Until you delete them, delete your account or delete the app
Your account (the code from Apple or your email address, and your name)	Until you delete your account
The backup of your logs	Until you delete your account; if you share a family, while the family exists
Sign-in codes	10 minutes
Sessions (the phones you are signed in on)	Until you sign out, or 400 days after the phone last used it
AI requests and answers	Not stored; used only to write the answer
Baby Passport links	Until the link turns off by itself or you turn it off
Check-ins and days of use	Until you delete your account, or 12 months after your phone last checked in
Counts of how the app is used, per phone	4 months
Records of notifications and emails we sent you	Until you delete your account
Push token	Until you turn off notifications or delete your account, or 12 months after your phone last checked in
Unused invite codes	Stop working after 3 days and are deleted soon after
Abuse-prevention counts (IP address)	Up to 7 days
Cloudflare technical logs	A few days
Purchase records	While your subscription is active, then as long as accounting and tax law requires
Daily totals (no personal data)	Kept as statistics

16. Why we're allowed to use your data

Your consent, for the health and children's information that is backed up to your account, shared with your family, sent to the AI features or put in a Baby Passport link, and for tips and offers. Health data and data about children are sensitive data under Egyptian law, so we process them only with your explicit consent, which you give by creating your account and by turning each optional feature on. You can withdraw it at any time, by turning the feature off or by deleting your account.
Providing the service you asked for (a contract with you), such as keeping your account, backing up and syncing your family's logs, or unlocking Tumble Plus.
Our legitimate interests in keeping Tumble secure, preventing abuse, and knowing how many people use it and which parts of it they use, in ways that don't override your rights.
Legal obligations, such as keeping purchase records for accounting and tax.

17. Your rights

Under Egypt's Personal Data Protection Law (Law No. 151 of 2020) and, if you live in the European Economic Area or the UK, the GDPR, you have the right to:

know what personal data we hold about you and get a copy of it;
correct or update it;
have it deleted;
withdraw your consent at any time, without affecting what was done before;
object to processing, or ask us to limit it;
be told if a data breach affects your data;
receive your data in a portable format (in the app: Family → Export data as CSV);
complain to a data protection authority: in Egypt, the Personal Data Protection Center; in the EEA or the UK, your local authority.

You can do most of this yourself in the app (section 18). For anything else, email support@tumblebaby.app. We may ask you to confirm that it's you, for example by writing from your account's email address. We reply within 30 days, and requests are free.

18. How to delete your data

Your account and everything in it: in the app, open Family → Your account → "Delete my account". This deletes your account, your sign-ins, the backup of your logs, your phones' check-in records and push tokens, the counts of how you used the app and the records of what we sent you, and turns off your Baby Passport links. If you share a family and others remain, the family's shared copy stays with them. The logs on the phone you delete from are erased too.
On your phone only: delete any log or remove a child. Deleting the app erases what is on that phone; your account and its backup stay until you delete the account.
To leave a shared family: Family → "Leave this family". You keep your own copy.
Sign in with Apple: after deleting your account you can also remove Tumble in iPhone Settings → your name → Sign-In & Security → Sign in with Apple.
Without an account (older versions of the app, or if you continued without signing in): Family → "Delete my data from Tumble's servers" removes your phone's check-in record and push token, takes it out of family sharing and turns off your Baby Passport links.
AI: turn AI features off in Family at any time.
By email: write to support@tumblebaby.app.

Deleting your account or the app doesn't cancel a Tumble Plus subscription. To cancel, go to iPhone Settings → your name → Subscriptions. We keep purchase records only as long as accounting and tax law requires, linked to the random purchase id.

19. Children

Tumble is made for parents, parents-to-be and the carers they invite. It isn't made for children and isn't meant to be used by them.

Information about a child is entered by their parent or guardian, or by a carer the parent invited, and the parent decides which optional features to turn on. If you believe a child has used Tumble and sent us information, contact us and we'll delete it.

20. Not medical advice

Tumble is not a medical device and doesn't give medical advice, diagnose or treat. Tips, predictions and AI answers are general information. Always check with your doctor before making medical decisions.

In an emergency in Egypt, call 123 (ambulance) or go to the nearest emergency department. Outside Egypt, call your local emergency number.

21. Changes to this policy

If we change this policy, we'll update this page and the effective date. If a change is important, such as a new kind of data or a new use of it, we'll tell you in the app and, where needed, ask for your consent again.

22. Contact us

Virgin Gates
Cairo, Egypt
Email: support@tumblebaby.app

This policy is available in English and Arabic.