MamaSays is built on one idea: you can say what motherhood really feels like without anyone knowing it was you. This policy explains, in plain language, what data exists when you use MamaSays, why it exists, how long it stays, and what you can do about it. It follows the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
1. Who is responsible
The controller under the GDPR is:
Kristina Petrevska
In den Sälen 24
34590 Wabern
Germany
Email: hello@mamasaysapp.com
MamaSays is run by a sole proprietor. There is no data protection officer, because the legal thresholds for appointing one are not met. Privacy questions go to the email address above.
2. Your anonymous account
When you open MamaSays for the first time and tap Begin, the app generates a random identifier on your device. That identifier is your account. It is not linked to your name, your email address, your Apple ID, your phone number or your device's advertising identifier, and we do not ask for any of those.
This has two consequences you should know about:
- We cannot tell who you are. If you write to us, we cannot look up "your account" from your name or email, because that connection does not exist.
- Your account lives on your device. If you delete the app or move to a new iPhone, the only way back in is with your recovery words (section 3). Without them, your account and your mood history are gone and we cannot restore them. Your subscription is tied to your Apple ID and can be restored through Apple.
Honesty about the limits: the random identifier is still personal data under the GDPR, because it is yours. Our servers see your IP address for a few days (see "Technical data"), and Apple knows which Apple ID bought the subscription. Neither of those is ever joined to what you write, and we have built MamaSays so that we could not do so even if asked. But "anonymous" in this policy means: nothing that names you, not that no data exists.
Legal basis: Art. 6(1)(b) GDPR (providing the service you asked for).
3. Recovery words and app lock
Recovery words. After your account is created, the app shows you six words. They are the only key to your account. If you move to a new iPhone or reinstall the app, entering the six words brings back your account, your mood calendar and your settings. We store only a one-way derived value of your words on our servers (a salted, slow hash), enough to recognise them when you type them in, never the words themselves. Next to it we keep a short unsalted index derived from the words; it is used only to locate the right record quickly and cannot reveal the words. We cannot show them to you again, reset them, or recover an account without them. Please write them down somewhere safe and private; anyone who has your six words can open your account.
Legal basis: Art. 6(1)(b) GDPR.
App lock. You can protect MamaSays with Face ID, Touch ID or your device passcode, and the app hides its content when you switch apps. This runs entirely on your iPhone through Apple's system features. Your biometric data never leaves your device and is never available to us; iOS only tells the app whether the unlock succeeded.
4. What data is processed
Things you write
Posts, replies, reactions and your answers to the daily Together question are stored on our servers so other mothers can see them. They are linked to your anonymous identifier and to nothing else. Every post, reply and answer is deleted 24 hours after you created it (see section 6).
Legal basis: Art. 6(1)(b) GDPR. For anything you write that reveals your health or other sensitive information, see section 5.
Feeling check-ins
When you choose a feeling (for example "overwhelmed" or "peaceful"), that choice is stored with your anonymous identifier so the app can show your mood calendar in the Profile tab. Unlike posts, check-ins are kept until you delete your account, because the calendar is meant to show you the shape of your weeks.
Feelings about your own state can be health data. We store them only with your separate, explicit consent, which the app asks for during onboarding (section 5). You can withdraw that consent at any time in Profile → Legal; the app then stops storing check-ins and deletes the ones already stored. You can also erase everything by deleting your account.
Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR (your explicit consent).
Subscription
MamaSays is a paid monthly subscription after a free trial (the current trial length and price are shown in the app and in the App Store before you confirm). Payment is handled entirely by Apple through the App Store. We never see your payment card, billing address or Apple ID.
What we receive from Apple: your anonymous identifier (which we pass to Apple as the account token for the purchase), the product you subscribed to, and the status and dates of your subscription (trial, active, expired, refunded). We use this to unlock the app and to keep it unlocked.
Legal basis: Art. 6(1)(b) GDPR. Apple's handling of your payment is described in Apple's privacy policy.
Notifications
If you allow notifications, Apple issues a device token that lets us send them. We store that token and your notification preferences (which types you want, and whether quiet mode is on). The token is only ever used to deliver notifications. You can turn notifications off in the app or in iOS Settings at any time, and we stop sending them.
Legal basis: Art. 6(1)(a) GDPR (your consent, given through the iOS permission prompt) and § 25(1) TDDDG for the token stored on your device.
Reports and blocks
If you report a post or reply, we store your anonymous identifier, the identifier of the content and its author, the reason you selected, and a copy of the reported content so it can still be reviewed after it would otherwise have expired. If we remove content or end an account, we keep a short record of the decision and its reason, so we can explain it to the author in the app and handle any complaint. If you block another mother, we store the pair of identifiers so her content stays hidden from you.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is keeping MamaSays safe. Blocks also serve the contract with you (Art. 6(1)(b)).
Technical data
When your phone talks to our servers, the hosting provider records the usual connection data in its logs: IP address, time, the request made, and the app version. We use these logs only to keep the service running, to find errors and to prevent abuse. We do not use them to analyse how you use the app.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a stable and secure service.
A note for us
Profile → "A note for us" lets you send us ideas, bugs or wishes. The note is stored with nothing else: no identifier, no device information, no time zone. We cannot tell who sent it and cannot reply. Notes are read and then deleted within three months.
Legal basis: Art. 6(1)(f) GDPR, our interest in improving MamaSays.
If you email us at hello@mamasaysapp.com, we process your email address and whatever you write, to answer you. Emailing us is the one moment where you choose to step out of anonymity; what you write in an email is never linked to your account unless you include your account ID. We delete support emails three months after the matter is closed, unless we need them longer for legal reasons.
Legal basis: Art. 6(1)(b) and (f) GDPR.
5. Sensitive content and your consent
Mothers write about hard things on MamaSays: exhaustion, anxiety, postpartum depression, loss, their own health and their children's. Under the GDPR, information about health is a special category of data (Art. 9), and so are your feeling check-ins.
We never ask you to share anything sensitive. Because you may choose to, the app asks you during onboarding for a separate, explicit consent, in its own step and apart from accepting the Terms, to store your feeling check-ins and anything you write that may reveal health or other sensitive information, as described in this policy. Using MamaSays without posting does not require that consent for posts; you can still read. You can withdraw the consent at any time in Profile → Legal, by deleting a post, or simply by waiting: posts disappear on their own.
Legal basis: Art. 9(2)(a) GDPR (your explicit consent).
Please remember that other mothers can read what you post. Do not include names, addresses or anything that would identify you or your child.
6. How long data is kept
| Data | Kept for |
|---|---|
| Posts, replies, reactions, Together answers | 24 hours from creation, then permanently deleted by an automatic job that runs every hour |
| Feeling check-ins (mood calendar) | Until you delete your account |
| Anonymous identifier, derived value of your recovery words, subscription status, notification token and preferences, blocks | Until you delete your account |
| Reports (including a copy of the reported content) and moderation decisions | 90 days after the report or decision, or earlier once handled |
| Server connection logs | Up to 7 days |
| Notes sent via "A note for us" | Up to 3 months |
| Support emails | 3 months after the matter is closed |
Backups. Our hosting provider may keep automatic backups of the database for disaster recovery. Where backups exist, a post that has been deleted from the live service may still exist inside one for up to 7 days. Backups are not used for anything other than restoring the service after a failure, and if a backup is ever restored, expired content is deleted again immediately.
Deleting your account. Profile → Delete account removes your anonymous identifier and everything attached to it from the live service straight away. After that there is no way to connect any remaining backup data to you.
7. Who helps us run MamaSays
We use a small number of service providers who process data on our behalf under data processing agreements (Art. 28 GDPR). They may only use the data to provide their service to us.
- Supabase, Inc. (970 Toa Payoh North #07-04, Singapore 318992)
- Hosts the database, file storage and server functions that run MamaSays. Our project is located in the European Union (Ireland, on Amazon Web Services infrastructure). Everything described in section 4 is stored here. Supabase privacy policy
- Apple Inc. / Apple Distribution International Ltd.
- Distributes the app through the App Store, processes your subscription payment, and delivers push notifications through the Apple Push Notification service. Apple is an independent controller for the App Store and payments. Apple privacy policy
We do not use any analytics, crash-reporting, advertising or marketing provider inside the app.
8. Data outside the EU
Your data is stored in Ireland. Supabase is a company based outside the EU and may access infrastructure for support and maintenance; this is covered by the EU Standard Contractual Clauses in our data processing agreement. Apple processes App Store and notification data under its own safeguards, including the EU–US Data Privacy Framework and Standard Contractual Clauses.
9. What other mothers can see
Other mothers can see:
- the text of your posts, replies and Together answers while they exist (up to 24 hours);
- the feeling you attached to a post, if you attached one;
- that a post has received a reaction (a line such as "someone feels this"), never how many and never who reacted.
Nobody can see your mood calendar, your notification settings, your subscription, whom you have blocked, or anything that identifies you. There are no usernames, profile pages, follower lists or direct messages.
10. No tracking
The app contains no analytics SDK, no advertising SDK and no third-party tracking. We do not read your advertising identifier (IDFA), we do not fingerprint your device, and we do not track you across other apps or websites. Our App Store privacy label reflects this.
11. The website
mamasaysapp.com is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit, Vercel's servers record connection data (IP address, time, page requested, browser type) to deliver the page and protect against abuse; these logs are kept briefly. The website counts visits with cookieless analytics, see section 12. Vercel privacy policy
The website sets no cookies. Fonts and all other files are served from our own domain, so apart from our hosting provider (see above), no font provider or other third party receives your IP address when you visit.
12. Website analytics
The website (not the app) uses Vercel Web Analytics to count page views. It sets no cookies and stores nothing on your device.
What is processed: the page URL, the referrer, your browser and operating system type, your device type and your approximate country. Your IP address is used only to derive an anonymous daily visitor count and is not stored.
Purpose: understanding how many people visit and which pages are read. Legal basis: our legitimate interest in running the website, Art. 6(1)(f) GDPR.
Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, acting as our processor under a data processing agreement. Data may be transferred to the USA; the transfer is based on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses.
You can object at any time by emailing hello@mamasaysapp.com.
13. Your rights
Under the GDPR you have the right to access the data we hold about you (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), to object to processing based on legitimate interests (Art. 21), and to withdraw any consent you have given, with effect for the future (Art. 7(3)).
Because your account is anonymous, we cannot find your data from your name or email. This is how the rights work in practice:
- Erasure: Profile → Delete account. Immediate and complete.
- Withdrawing consent: Profile → Legal for the sensitive-data consent; turn off notifications in Settings; delete a post.
- Access and portability: copy your account ID from Profile → Legal → "Your account ID" and email it to us. We will send you everything linked to that ID. Without the ID we have no way to find your data.
- Objection and anything else: email hello@mamasaysapp.com.
You also have the right to complain to a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de. You can also contact the authority where you live.
We do not make automated decisions with legal or similarly significant effects about you, and we do not profile you.
14. Age
MamaSays is for adults. You must be at least 18 years old to use it. We do not knowingly process data of anyone younger. Mothers often write about their children; please do so without names, photos or details that would identify a child.
15. Security
All traffic between the app and our servers is encrypted (TLS). Data is encrypted at rest by our hosting provider. Access to the database is restricted by row-level security rules so that the app can only read and write what the current anonymous account is allowed to. Administrative access is limited to the founder and protected by two-factor authentication. No system is perfectly secure, and we cannot promise absolute protection, but anonymity is our strongest safeguard: there is very little in MamaSays that could identify you even if it were exposed.
16. Changes
If we change this policy in a way that matters, we will show the change inside the app before it takes effect and, where the change needs your consent, ask for it there. We update the date at the top of this page. Older versions are available on request.