Privacy Policy

UpPapa™ is operated by UP PAPA, LLC, a company registered in the United States. We design parenting products and run the UpPapa Club — a free digital companion for parents to track memories, milestones, and family moments.

Privacy contact: privacy@uppapa.com

• To provide and personalize your UpPapa Club experience
• To display your journal entries, growth charts, and memories
• To send memory notifications ("On This Day" reminders)
• To verify e-commerce purchases for Verified Buyer status
• To improve our products and services
• To send transactional emails (magic links, account updates)
• To respond to your support requests

If you are located in the European Economic Area (EEA) or the UK, we process your data under the following legal bases:

• Consent — When you create an account, you consent to us storing and processing your data to provide the service
• Optional marketing — Meta Pixel is enabled only after a separate, explicit choice in Cookie settings; creating an account does not enable it
• Contract — Processing necessary to deliver the UpPapa Club features you signed up for
• Legitimate interest — Service improvements, security monitoring, and memory notifications (you can opt out anytime)

If you are in the EU or UK, you have the following rights:

• Right to access — Request a copy of all data we hold about you
• Right to rectification — Edit or correct your profile and content at any time
• Right to erasure ("right to be forgotten") — Delete your account and all associated data
• Right to data portability — Export your data in a machine-readable format (JSON)
• Right to restrict processing — Ask us to limit how we use your data
• Right to object — Opt out of emails or specific processing activities
• Right to withdraw consent — You can withdraw marketing consent anytime in Cookie settings without deleting your account

To exercise any of these rights, email us at privacy@uppapa.com. We will respond within 30 days.

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know — What personal information we collect, use, and share
• Right to delete — Request deletion of your personal information
• Right to correct — Request correction of inaccurate personal information
• Right to opt out of sale or sharing — Refuse optional marketing in Cookie settings, or contact us about your personal information
• Right to non-discrimination — We will not treat you differently for exercising your rights

To exercise your CCPA rights, email privacy@uppapa.com with the subject line "CCPA Request."

We take children's privacy very seriously. Here is how UpPapa handles child-related data:

• UpPapa does NOT collect data directly from children
• All child profile data is entered by the parent or guardian
• Children under 13 cannot create accounts
• Child profiles contain only: first name, date of birth, gender, and nickname — the minimum needed to display milestones
• Parents can edit or delete child profile data at any time

If you believe a child under 13 has provided us personal information without parental consent, please contact us immediately at privacy@uppapa.com and we will delete it promptly.

• All data is stored on a secure cloud database (PostgreSQL hosted on AWS)
• Data is encrypted in transit using TLS 1.3
• Data is encrypted at rest using AES-256
• Row-level security (RLS) ensures each user can only access their own data
• Photos are stored in secure cloud storage with authenticated access — no public URLs
• Authentication uses secure, token-based sessions (no passwords stored)

While no system is 100% secure, we follow industry best practices to protect your family's data.

We use a limited number of third-party services to run UpPapa. Here is a description of each category and what data they may access:

• Account data — kept for as long as your account is active
• Content (journals, photos, etc.) — kept until you delete it or delete your account
• After account deletion — all personal data is permanently removed within 30 days
• Anonymized analytics data — may be retained indefinitely (cannot be linked back to you)

UpPapa is a US-based company, and your data is stored on servers located in the United States (via AWS infrastructure).

If you are located in the EU, UK, or another country with data protection laws, please be aware that your data will be transferred to the US. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure your data receives an adequate level of protection during transfer.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will notify you by email and update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Continued use of UpPapa after changes constitutes acceptance of the updated policy.