October 26, 2026 · United States · Adult-operated app

Privacy Policy

This Privacy Policy explains how the YouGotThis mobile app and its account services handle information. YouGotThis is published by You Got This App LLC. The public release is for parents, guardians, and clinicians age 18 and over in the United States. Only these adults operate the app; children do not operate its controls or create YouGotThis accounts.

Intended use

YouGotThis supports adult-operated feeding sessions. It is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. It is not an emergency service or a substitute for professional advice, diagnosis, or treatment. Consult a qualified healthcare professional for medical advice and appropriate feeding activities.

Our device-only boundary

Child or client profiles, age labels, target foods, support focus, notes, feeding-session activity, progress, reward photos, and reports are stored only in an encrypted local vault on the authorized device. YouGotThis does not intentionally collect, receive, synchronize, back up, analyze, or provide support access to that information.

The app may use the camera when an adult chooses to capture a reward photo. The resulting image is normalized and stored in the local encrypted vault. The app does not collect audio or location for this feature. Reports and other exports are created locally and leave the app only when the adult deliberately chooses a destination.

Adult account and security information

To create, secure, and operate an adult account, our services process:

• the adult's email address and stable authentication identifier;
• the adult's name or other profile information if the adult chooses a sign-in provider that supplies it; this is held by that provider or Identity Platform rather than the YouGotThis backend;
• the selected Parent or Guardian or Clinician role;
• sign-in provider information and, when required, a linked mobile number processed by Google Firebase Authentication or Identity Platform for one-time SMS verification after primary sign-in;
• phone-verification policy status, a keyed phone fingerprint, and bounded authentication outcomes in the YouGotThis backend. The backend reads the mobile number from the signed authentication token to check verification, but does not store the raw number. It does not receive or store the SMS verification code;
• provider-managed account and security metadata, such as linked sign-in methods, account creation and recent sign-in times, and token or session status;
• the accepted terms version, app build, and acceptance time;
• bounded account-security records such as request identifiers, app build, sign-in provider, authentication stage and outcome, an opaque support code, and a keyed subject pseudonym; and
• limited request metadata, such as an IP address, used for rate limiting, security, reliability, and abuse prevention.
• limited authentication-SDK data disclosed by Google Sign-In and Firebase Authentication, which may include a device identifier, coarse location, other usage data, and diagnostic data for app functionality, security, and provider service analytics. The app does not request device location permission for this processing.

Designated app-store reviewers use separate email-and-password credentials verified by Firebase Authentication or Identity Platform. The mobile app does not save the password, and the YouGotThis application API does not receive it. The review-access owner securely manages these dedicated credentials. Only server-designated reviewer accounts are exempt from linked-phone setup; the same terms and role steps still apply. Designated reviewers may evaluate the app from their review location using invented data only.

Generic step and reward catalogs contain no child or session information.

Free session access

The initial launch is fully free. Every admitted adult can start unlimited sessions. The app has no session quota, paywall, in-app purchase, subscription, billing SDK, or session-usage ledger.

How we use information

We use adult account and security information only to:

• authenticate the adult and prevent unauthorized account access;
• operate adult account access, linked-phone verification, terms, and role onboarding;
• provide generic app configuration and catalogs;
• protect the service, diagnose coarse authentication failures, and prevent abuse; and
• complete account deletion and meet applicable legal obligations.

We do not sell personal information. The app contains no advertising, marketing, general-purpose product analytics, session replay, or support-chat SDK. Google Sign-In and Firebase Authentication perform the limited authentication-service analytics described above.

Service providers and disclosures

Google Cloud and Google Firebase or Identity Platform process adult authentication, linked-phone SMS verification, and account-service infrastructure. Apple or Google processes information under its own policy when an adult chooses that company as a sign-in provider. A receiving app, service, or person controls a report or image after the adult deliberately exports it.

For ordinary accounts, a mobile number is linked after Apple, Google, or email-link primary sign-in and is used for one-time SMS verification. A phone number cannot be used as the primary sign-in method. The linked number is managed by Firebase or Identity Platform; the YouGotThis backend keeps only a keyed fingerprint and policy/security state.

Google also receives and stores authentication phone numbers to improve spam and abuse prevention across Google services, including Firebase. The app asks for consent before sending a verification text. See Google's phone authentication information.

We may disclose limited adult account information when required by valid law or legal process, or when reasonably necessary to protect users, the service, or others. We do not intentionally disclose child or session data because our services do not receive it.

Security

The local vault uses authenticated encryption and is excluded from app backup and device transfer. Network requests use HTTPS. Cloud account data is protected with access controls, private database connectivity, managed secrets, and minimized application logs. No security measure can guarantee absolute protection.

Retention and deletion

We keep adult account information while the account is active and as needed for the purposes described above. Signing out closes but does not delete the encrypted local vault, so the same adult can reopen it on that device.

In-app account deletion requests deletion of the adult sign-in identity, removes direct identifiers and account-security state from the application database, and cryptographically erases the local vault on that device. We may retain de-identified security or audit records that can no longer be connected to the deleted sign-in identity. Limited information may remain temporarily in restricted logs or backups until their ordinary lifecycle expires, or longer when law requires it. Copies an adult previously exported are not deleted by YouGotThis.

During a closed beta, an invitation email may also be held in a separate app-store tester roster and server access allowlist. In-app deletion does not remove those invitation records automatically. A verified off-app request also starts beta offboarding so those records can be removed through the controlled operator procedure.

For designated store reviewers, separate credentials and reviewer-access records are kept by the review-access owner for review and retired through controlled offboarding. In-app deletion does not automatically remove those separate records or recreate the deleted account.

See Delete a YouGotThis account for the in-app path and the external request process.

Children's privacy

Only adults operate YouGotThis; children do not operate its controls or create accounts. A parent, guardian, or authorized clinician may enter information about a child only into the local device vault of a release designated for real device-only use. Synthetic-test builds must use only fictional information. The company does not intentionally collect that child information through its account services. Do not send child or client information in support, feedback, email, screenshots, or recordings.

Changes

We may update this policy when the app or its data practices change. We will update the date above and provide additional notice when required.

Privacy contact

Email privacy questions or start an off-app account-deletion request at info@yougotthisapp.com. Do not include child or client information, passwords, sign-in links, verification codes, full phone numbers, screenshots, recordings, or exports. This address is not an emergency channel.

Our internal team monitors this address and provides a first response to support, privacy, and account-deletion requests within 24 hours. Completing a deletion or resolving an issue may take longer; deletion requires account-control verification and the stated deletion process.

Legal, privacy, or security correspondence may also be sent by post to the address below. The postal address is not an account-deletion request path.