The Mama Years

Privacy policy

Version 2026-10-06.4. In effect from 6 October 2026.

This policy is pending review by our lawyer and may be updated.

This policy explains what The Mama Years collects, why, who helps us run it, and the choices you have. It covers the app on iPhone and Android, app.themamayears.com and themamayears.com.

In one sentence

We store only the data you give us. We never sell your personal information or share it with third parties for advertising. Your health data is yours.

That is the same sentence you will find inside the app, under Me, Privacy and data. The rest of this page is the detail behind it.

Show your working

Six things that are true of the app

We do not record what you tap
Analytics autocapture is switched off. In most apps it is on by default, and it sends the text of the element you touched. Ours does not send it, because the label on that button might be the most private word you typed all year.
Nobody can watch your session back
Session recording is off. You might be logging a loss. That is not a thing anyone gets to replay.
Analytics never learns who you are
We do not send your name, email or account id to any analytics service. Our app analytics sees a random device number and which broad area of the app was opened, and we tell it not to work out where you are. Not you. Not what you logged.
Even the page address is blurred first
In this app a page address can give away a diagnosis. “/trackers/pregnancy” would tell a third party you are pregnant. So page addresses are cut down to the broad area, like “/trackers”, before analytics or error reports see them. On our website, every Journal article is reported as just “a Journal article”, never which one.
You can only ever read your own rows
Row-level security is on every table in the database. It is not a policy we promise to follow; it is the database refusing, at the row, to hand your data to anyone else.
Deleting your account deletes your data
Your account, your logs, and the photos and screenshots you uploaded are deleted thirty days after you ask. Anything you posted in the community loses your name and stays. The few things we keep, and why, are listed below under “How long we keep it”.

The policy

The full detail

Operated by CNG IP Pty Ltd (ABN 73 632 716 646).

Who we are

The Mama Years is operated by CNG IP Pty Ltd (ABN 73 632 716 646), an Australian company. You may also know us as Mama Linc, the name this service had before. In this policy, "we", "us" and "our" mean CNG IP Pty Ltd.

We are responsible for your personal information under Australia's Privacy Act 1988 and the Australian Privacy Principles. If you live in the European Union or the United Kingdom, we are the "controller" of your personal information.

Questions, requests or complaints about privacy: write to hello@themamayears.com, or use the form on our support page. A person reads both.

What we collect

We collect only what you give us, what the app needs to work, and a small amount of technical information. Almost everything in the app is optional.

About you and your account:

Your email address, the name you give us, and a profile photo if you add one.
If you sign in with Apple or Google, the name and email address they share with us.
Your settings: your region, your units, your stage (trying, pregnant or baby), and your notification and email choices, including whether you said yes or no to tips and news by email and when.
How you found us: the link or campaign you arrived from, the referring site, the first page you landed on and your platform. We store this with your account.
When you last opened the app.

Health information you choose to log. This is sensitive information and we treat it that way:

Your cycle: period dates, flow, temperature, cervical mucus, ovulation tests and, if you choose to log it, intercourse.
Your pregnancy: due date and dates, symptoms, weight, notes, kick counts, contraction timings, letters you write, and a loss if you tell us about one.
Your mood, if you log it.
Anything you type into the consult.

Information about your children, which you enter as their parent:

Their name, date of birth and sex.
Feeds, sleep, nappies, growth measurements and milestones.

Things you write or share:

Community posts, replies, photos, likes, poll answers, and anyone you block or report.
Partner or carer invitations, including the email address of the person you invite.
Messages to our support team, feedback notes and problem reports. A problem report includes the page you were on, your device and browser type, your screen size, technical error messages and, if you add one, a screenshot.

Purchases:

Your subscription status and the purchase records Apple or Google send us. We never see your card details.

Technical information:

Your internet (IP) address, device and browser type, and the date and time of requests, which our hosting provider logs to run the service.
The country your connection comes from, worked out by our hosting provider. We use it on the sign-up screen only, to decide whether the email box starts ticked, and we do not store it.
If you turn on notifications on your phone: a notification token for that phone, whether it is an iPhone or Android, when it was added and last used, and whether notifications are on.
Anonymous app analytics and error reports, described below.
If you join our waitlist: your email, first name, country and stage.

How we use it

To run the app for you: your trackers, your stage, your week by week content, your insights and your reminders.
To work out patterns from your own logs, so the app can show them back to you. This runs on our servers, for you alone.
To run the community and keep it safe, including acting on reports.
To let a partner or carer you invite see what you have chosen to share.
To give you Premium, check your subscription and handle store refunds and renewals.
To answer you when you contact us, and to fix problems you report.
To send you emails about your account, like confirming your email or resetting your password.
To send you tips and news from Courtney by email, if you want them. You choose this separately when you sign up. In the UK, the EU and anywhere outside Australia, New Zealand, the United States and Canada, the box starts unticked and we send them only if you ask for them. In those four countries it starts ticked. If you have never chosen, they are on if your region in the app is one of those four, and off otherwise. You can stop at any time. Some of these emails are matched to your stage.
To send notifications to your phone, only if you turn them on. A notification never says anything about your health on your lock screen.
To understand, in broad and anonymous terms, which parts of the app are used, and to find and fix errors.
To protect the service, our members and our rights, and to meet legal obligations.

We do not use your health information for advertising. We do not use it to decide what anyone else sees. We do not sell your personal information. We do not make automated decisions about you that have legal or similarly serious effects.

Our legal reasons (EU and UK)

If the EU or UK GDPR applies to you, we rely on these legal bases:

Contract: to provide the app and Premium you signed up for.
Explicit consent: for health information you choose to log, which you agree to when you create your account, and for questions you send to the Premium consult. You can withdraw consent at any time by deleting the entries, stopping the consult in Me, Privacy and data, or deleting your account.
Consent: for tips and news by email. In the UK and the EU the box starts unticked, so we send them only if you tick it. You can stop at any time.
Consent: for analytics and advertising cookies on our website, through the cookie banner.
Legitimate interests: for anonymous app analytics, error reports, security, preventing misuse, and keeping the community safe. We have weighed these against your rights and kept them as light as we can.
Legal obligation: where the law requires us to keep or share something, such as tax records.

Who we share it with

We never sell your personal information. We never share it with third parties for advertising, and no advertising code runs inside the app.

Like every app, we use other companies to run parts of the service. They handle your information only to do that job for us, under their own security and privacy terms. Here is the whole list:

Supabase: our database and sign-in. Holds your account and everything you log. Stored in Tokyo, Japan.
Vercel: hosts the app and the website and runs our servers, in Tokyo, Japan. Sees requests as they pass through, including your IP address, and keeps short-lived logs.
Delphi: the AI behind the Premium consult. Receives what you type into the full consult, and the technical information any website sees, like your IP address. We do not send it your name, email or logs. Nothing is sent until you agree in the app, and you can stop it any time in Me, Privacy and data.
PostHog: anonymous app analytics. Receives a random device number and the broad area of the app opened. We tell it not to work out your location from your IP address, which it sees when your device connects, like any website. Never your name, email, account id or anything you logged.
Sentry: error reports. Receives technical details of a fault, with page addresses blurred and with no name, email, account id or IP address attached by us. Stored in the EU.
Resend: sends our emails. Receives your email address and name and the content of each email, including support replies and partner invitations. Problem reports and feedback you send from the app are not copied into any email: our team gets a notice with no content and reads them in our own system.
Cloudflare: stores files privately, such as community photos, screenshots in problem reports and lesson PDFs. Files are served through short-lived private links.
Vimeo: plays lesson videos. Sees your IP address and which video you watch, with Vimeo's tracking turned off.
Apple and Google: sign in with Apple or Google, in-app purchases and subscription notices. They handle payment. We receive your subscription status and purchase identifiers.
Apple and Google, for phone notifications you turn on: an iPhone's notification token goes to Apple, and an Android phone's goes to Google (Firebase Cloud Messaging), with the notification's title, text and the screen it opens.
Google (Google Analytics 4) and Meta (the Meta Pixel): on our marketing website only, and only if you accept cookies there. See "Cookies and analytics" below.
Our app developer, Birdcage Group, who build and maintain the app for us. They receive a notice of each waitlist sign-up (your name, email address and country, not your stage), and can access our systems to keep them running.
Our email inbox provider, which holds the messages you send us.

Other people you choose to share with:

Other members can see your display name, your profile photo and what you post in the community. Posts are visible only to signed-in members, not to the public.
A partner or carer you invite can see what the app shares with them, including the children you share. You can remove them at any time.

We may also share information if the law requires it, to protect someone from serious harm, or as part of a sale or restructure of the business, in which case this policy would continue to apply.

Cookies and analytics: website and app

On our website (themamayears.com), we use:

Vercel Web Analytics, which counts page visits without cookies and without identifying you. Every Journal article is counted as one page, not by name.
PostHog, as described above.
Google Analytics 4 and the Meta Pixel, only on the marketing website and only to measure our advertising, and only if you accept in the cookie banner. Until you accept, their code does not load at all and nothing is sent to Google or Meta. If you decline, it never loads. If you accept, they can set cookies and record your visit.
One cookie to remember your choice, for a year.

Even when you accept, Google is told only that you read "a Journal article", never which one, and the Meta Pixel never runs on our Journal pages. You can change your choice by clearing cookies for our site.

Inside the app, there are no advertising cookies, no advertising code and no Google Analytics or Meta Pixel. The app uses only what it needs to keep you signed in and remember your settings, plus the anonymous PostHog analytics and Sentry error reports described above.

Where your information is stored

Your information is not stored in Australia. Our database and servers are in Tokyo, Japan. Some of the companies listed above are based in, or process information in, the United States, and our error reports are stored in Germany. Other countries may be involved where those companies run their services.

Before we send personal information overseas, we take reasonable steps to make sure the company receiving it protects it in a way that is consistent with the Australian Privacy Principles. Where the EU or UK GDPR applies, we rely on adequacy decisions (Japan has one from the EU and the UK) or on standard contractual clauses offered by our providers.

How long we keep it

We keep your information while you have an account.

You can delete your account at any time, in the app under Me, Privacy and data, or on our delete your account page. We keep your data for 30 days in case you change your mind, then delete it. Deleting your account does not cancel an App Store or Google Play subscription. Please cancel that with Apple or Google first.

When your account is deleted, your profile, your logs, your children's records, your pregnancies, your letters, your saved items, your sign-in details, your phone notification tokens, and the photos and screenshots you uploaded are deleted. A few things are kept:

Community posts and replies stay, without your name and without your photo, because other members replied to them.
A child you shared with a partner or carer stays in their account.
Reports about posts or members: 2 years, without the name of the person who reported.
A record that your account was deleted: 7 years. The date only, with no name, email or content.
Purchase records from Apple and Google: kept without your name, so purchases can be reconciled. Store notifications are kept for 2 years.
Database backups: overwritten within 30 days.
Emails you have sent us stay in our inbox until we delete them. Ask us and we will.
Anonymous analytics and error reports are kept for the period our providers keep them.

Your rights and choices

Wherever you live, you can:

See and correct most of your information in the app.
Download a copy of your core data (profile, children, cycles, pregnancies and saved items) in Me, Privacy and data. For a copy of everything else, including your tracker logs, ask us.
Delete individual entries, or your whole account.
Stop sending consult questions to Delphi, in Me, Privacy and data.
Choose whether to get tips and news by email, in Me, Notifications. You can stop them there, or with the unsubscribe link in any of them.
Turn off notifications in Me, Notifications or in your phone's settings.

To ask for anything else, write to hello@themamayears.com. We will reply within 30 days. We may need to check it is really you first.

In Australia, you can ask to access or correct your personal information under the Australian Privacy Principles. If you are unhappy with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

In the EU and UK, you also have the right to have your data erased, to restrict or object to our use of it, to receive it in a portable format, and to withdraw consent at any time without affecting what happened before. You can complain to your local data protection authority. In the UK that is the Information Commissioner's Office (ICO) at ico.org.uk.

In the United States, depending on your state, you may have the right to know what we collect, to access, correct and delete it, and to opt out of its sale or of sharing for cross-context behavioural advertising. We do not sell your personal information and we do not share it for cross-context behavioural advertising. We will not treat you differently for using any of these rights.

Consumer health data notice (United States)

Some US state laws, such as Washington's My Health My Data Act, give extra rights over consumer health data. This is our notice under those laws.

What we collect: the health information listed under "What we collect", including your cycle, fertility, pregnancy, symptoms, mood, and your children's feeding, sleep, nappies and growth, and anything you type into the consult.
Where it comes from: from you, when you choose to log it.
Why we use it: to run the features you use it for, as described under "How we use it". Never for advertising.
Who we share it with: only the service providers listed under "Who we share it with" that need it to run the service (our database and hosting providers, and Delphi when you use the Premium consult with your agreement), and the partner or carer you choose to share with.
We do not sell consumer health data.
Your rights: you can access it, delete it, and withdraw your consent by deleting entries, stopping the consult in Me, Privacy and data, or deleting your account. Write to hello@themamayears.com. If we refuse a request, you can appeal by replying to our answer, and you can contact your state attorney general.

Children

The Mama Years is for parents and parents to be, not for children.

You need to be 16 or over to open an account on your own. If you are younger, a parent or guardian needs to agree to our terms with you. The app is not designed for children under 13, and if we learn that a child under 13 has an account, we will delete it.

Information about your children is entered by you, as their parent or carer, and you control it. You can correct or delete it at any time, and it is deleted with your account unless you have shared that child with another carer.

How we protect it

Row-level security on every database table, so each account can only read its own rows and what has been shared with it.
Encryption in transit everywhere, and encryption at rest by our database and storage providers.
Private file storage, served only through short-lived links.
Analytics and error reports with names, account ids and detailed page addresses removed before they leave.
Access to production systems limited to the few people who run the service.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the regulator as the law requires.

Changes to this policy

If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect. The version and date at the top of this page tell you which version you are reading.

Contact us

CNG IP Pty Ltd, operator of The Mama Years.

Email hello@themamayears.com, or use the form on our support page.