Privacy Policy

1.Introduction

This document sets out the privacy policy of Azhar Pty Limited (ABN 33 624 443 947) trading as Grounded Parenting (referred to in this privacy policy as ‘we’, ‘us’ or ‘our’).

The Privacy Act 1988 (Cth) (Privacy Act) requires entities bound by the Australian Privacy Principles (APPs) to have a privacy policy. This privacy policy explains how we collect, hold, use and disclose personal information, including the sensitive and health information you record about your child.

Because we collect sensitive information (including health information) about children, we comply with the APPs and the Notifiable Data Breaches scheme, and we do not rely on any small-business exemption that might otherwise be available under the Privacy Act.

By providing personal information (including sensitive information) to us, you consent to our collection, holding, use and disclosure of it in accordance with this privacy policy. We may change this privacy policy from time to time by posting an updated copy in the App.

2.Types of personal information we collect

The personal information we collect may include:

1. (a)
   account and identity information, including your email address, password (held securely by our authentication provider and never stored by us in plain text), display name, optional avatar, notification preferences and device push-notification token;
2. (b)
   your child’s profile information, including name, birth date, an optional due date for corrected age, an optional photo and any developmental notes you enter;
3. (c)
   milestone and development records, including milestones with dates and notes, a derived checkpoint status, and photos or videos you attach;
4. (d)
   sleep, feeding and growth records, including logs with timestamps and growth metrics such as weight, height and head circumference;
5. (e)
   notes and memory-book content, including your private notes and any photos you attach;
6. (f)
   questions you submit to our occupational therapy team and any attachments, together with the reply;
7. (g)
   community content, including posts, comments, likes, saves, reports and blocks (your display name and avatar are shown publicly with your posts and comments);
8. (h)
   community-safety records, being a moderation status on your account set by us to enforce our Terms and community guidelines;
9. (i)
   subscription and purchase information, including your account identifier, purchased product, store transaction information, subscription status and relevant trial, renewal or expiry dates. Apple or Google processes your payment; we do not receive or store your card number or store payment credentials. We use RevenueCat to verify and manage subscription access and for subscription reporting; and
10. (j)
    usage and technical information, including notification records, last-active times, your reminder time and device time-zone, support messages, and service logs. Service logs can include your account identifier, IP address and approximate location derived from it, request addresses and search terms, response status and timing. Community search terms are sent to our database provider in the request address. If you enable optional usage analytics, we also collect app-open and activity-completion events linked to your account identifier, with a consent record identifier and relevant content identifiers or event categories. These optional events do not include your child's name, free-text notes, photos or videos.

The information described in paragraphs (b) to (f) above is sensitive information (including health information) that you enter about your child. Sensitive information receives extra protection under the Privacy Act and the Health Records and Information Privacy Act 2002 (NSW).

3.How personal information is collected

We collect your personal information in a lawful and fair way. We will only collect it where you have consented, or otherwise in accordance with the law.

How we collect information from you

We collect personal information directly from you, the account holder, when you create an account, create a child profile, use the App’s features, post in the community, or contact us for support.

How you provide information for someone else

If you are providing personal or sensitive information on behalf of someone under the age of 18 (a Minor), you must be that Minor’s parent or legal guardian, and you must provide consent for the Minor’s personal and sensitive information to be collected, used and disclosed in accordance with this privacy policy. Children do not hold their own accounts.

How we collect information from cookies

Our marketing website may collect personal information through web analytics tools, cookies or similar tracking technologies that allow us to analyse website usage. If you do not wish information to be stored as a cookie, you can disable cookies in your web browser.

4.Sensitive information

Collection of sensitive information

Your child’s developmental and health information is sensitive information. We collect it only where you consent to its collection and where it is reasonably necessary for our functions. By entering it, you confirm you have the authority to provide it.

How we use and disclose sensitive information

We use and disclose your sensitive information only for the purposes set out in clauses 5 and 6, or as permitted or required under applicable privacy laws.

How you can withdraw consent

If you wish to withdraw your consent, you can delete the relevant information, your child’s profile or your account, or contact us using the details below. We will deal with such requests within a reasonable timeframe. Withdrawing consent may mean we can no longer provide some features.

5.Use of your personal information

We collect and use personal information for the following primary purposes:

1. (a)
   to provide and personalise the App and its features to you;
2. (b)
   to securely store your child’s records, logs and media;
3. (c)
   to manage your account, your Subscription and any free trial;
4. (d)
   to deliver the community and the questions-to-our-OT-team features, and to keep the community safe (including by moderating content);
5. (e)
   for record-keeping, administration and support; and
6. (f)
   to comply with our legal obligations, resolve disputes and enforce our agreements.

Optional usage analytics is off by default. If you enable it, we use the account-linked app-open and activity-completion events described above to understand use of the App and improve it. You can change this in Profile or in account options before onboarding or subscribing. Turning it off stops new optional events, clears queued events and requests deletion of earlier optional events from our active database. If the request cannot complete, the App retains the pending change for retry; completed withdrawal also rejects delayed uploads under the earlier consent record.

Subscription verification and reporting are separate from optional usage analytics. RevenueCat processes purchase information and your account identifier to validate purchases, manage access and provide subscription reports. Turning off optional usage analytics does not disable this processing. Operational last-active timestamps and records you choose to save, including activity completions, also support service operation and aggregate service-usage reporting independently of optional event analytics.

We may also use your personal information for secondary purposes closely related to the primary purpose where you would reasonably expect us to, where we reasonably believe it is necessary to lessen or prevent a serious threat to the life, health or safety of any individual or to public health or safety and it is unreasonable or impracticable to obtain your consent, with your consent, or as otherwise permitted or required by law.

6.How we disclose your personal information

We take reasonable steps to keep your personal information confidential and protected. We may disclose your personal information to our third party service providers who help us provide the Service, such as our hosting and storage provider, our subscription-management provider and our push-notification provider, and only for the activities we ask them to perform. We do not sell your personal information.

Our current service providers include Supabase for account authentication, the App's database and uploaded-file storage; RevenueCat for subscription verification, management and reporting; and Resend for authentication emails such as password recovery. Resend processes recipient addresses, message content and delivery records. Open and click tracking is disabled for these authentication emails. Apple and Google process purchases made through their respective stores under their own terms and privacy policies.

Native push notifications use Google Firebase Cloud Messaging and, on Apple devices, Apple's Push Notification service. These providers process installation and push-token identifiers, notification text and the identifiers used to open the relevant screen. Notification previews can include a community member's display name and part of their comment. Firebase can also process device and application details, such as model, language, time zone and software versions, for messaging operation. We save a push token against your account after notification permission is granted. Firebase initialization can occur before that permission decision; refusing visible notifications does not mean that no provider-level identifiers are processed. You can control notification permissions in your device settings and the App's notification categories in Profile. We do not use these identifiers for advertising and have not added Google Analytics for Firebase.

Firebase also uses SDK diagnostic information and unlinked platform metadata to maintain its service and understand platform adoption. This provider processing is separate from the App's optional usage-analytics setting.

We will not otherwise disclose your personal information unless:

1. (a)
   you have consented to us disclosing your personal information;
2. (b)
   as needed in an emergency or in the investigation of suspected criminal activity;
3. (c)
   we are required to disclose under a subpoena, court order or other mandatory reporting requirement;
4. (d)
   we reasonably believe that disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety, and it is unreasonable or impracticable to obtain your consent;
5. (e)
   it is reasonably necessary for the establishment, exercise or defence of a legal claim; or
6. (f)
   it is otherwise authorised or required by law.

7.Storage of your personal information

Some of the service providers we engage store or process personal information overseas, commonly in the United States. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the APPs, principally through our contractual arrangements with them. Where we rely on your consent to an overseas disclosure, we obtain it after informing you that the recipient may not be required to comply with the APPs.

8.Security and data breaches

We take reasonable steps to ensure your personal information is secure and protected from misuse, interference, loss and unauthorised access, modification or disclosure. Our systems use access controls so you can only access your own records, your child’s media and notes are held in private storage, passwords are held by our authentication provider and not stored by us in plain text, and staff access is limited by role and recorded in an internal audit log. However, we cannot guarantee the security of your personal information.

We are covered by the Notifiable Data Breaches scheme. If an eligible data breach occurs, we will notify affected individuals and the Office of the Australian Information Commissioner as required. Because we hold health information about children, we treat any suspected breach with particular care.

9.Retention and deletion

We keep your personal information while your account is active, and we destroy or de-identify it when it is no longer needed for a permitted purpose and we are not required to keep it by law.

You can request account deletion in the App or through https://groundedparenting-app.netlify.app/account-deletion/. The process stops new account activity, removes your uploaded files from active storage, requests deletion of the associated RevenueCat customer record, and then deletes your account and associated data, including your child's records. Deletion completes only after the provider accepts that request or confirms its customer record is absent and account removal succeeds. A failed step can leave deletion pending and require a retry. Provider acceptance does not mean every provider copy is erased immediately.

We keep minimal account-identifier and retry records while a subscription-provider deletion request remains unfinished, solely to complete it. Those pending records are removed when the provider accepts deletion or confirms absence. A separate account-identifier and timestamp record supports a fixed 24-hour reconciliation window for late subscription updates, followed by scheduled cleanup. Retries do not extend that window. An unfinished retry has no automatic expiry and may require support intervention.

Administrative and moderation audit records are held separately for security and accountability. They can contain the action, date, staff role, relevant account or content identifiers, and associated reasons or action details. They are not automatically removed by account deletion and currently have no fixed automatic expiry. We apply the necessity and legal-obligation criteria above; you can contact us to request review of retained information.

Authentication emails and delivery logs held by Resend are retained for 30 days under our current service plan. Deleting your Grounded Parenting account does not immediately remove that email history. Supabase service logs, provider backup copies and store transaction records follow the relevant provider's retention and deletion processes. We do not promise that every provider copy is erased within the App's 24-hour reconciliation window.

Removing the push token associated with your account does not itself delete Firebase's separate installation record. That record follows Google's deletion and retention process; account deletion is not a promise of immediate removal of all messaging-provider identifiers.

Optional usage-event records are scheduled for removal after 180 days, or earlier following completed analytics withdrawal or account deletion. Read notifications are scheduled for removal after 90 days; unread notifications remain available until they are read or the account is deleted.

Deleting your Grounded Parenting account does not cancel an App Store or Google Play subscription. To stop future renewals, cancel separately through the store where you subscribed.

10.Requesting access or correcting your personal information

If you wish to request access to the personal information we hold about you, please contact us using the details below. You can access and correct most of your information yourself in the App, including by exporting it using the in-app data-export feature. The export contains account records in JSON format and a list of uploaded files. Original photo and video files, provider logs and separately held administrative audit records are not included. Contact us using the details below if you need help accessing information not included in the export. We may need to verify your identity, and in some cases we may be unable to provide access, in which case we will explain why. We will deal with requests within a reasonable timeframe. If you think any personal information we hold is inaccurate, please contact us and we will take reasonable steps to correct it.

11.Children’s information

The App is designed for use by a parent or guardian account holder, who must be an adult. Children do not create or hold accounts. You control your child’s information and can review, correct or delete it at any time. We handle children’s information with their best interests in mind.

12.Marketing

We may send you marketing communications in accordance with the Spam Act 2003 (Cth) (Spam Act), using email, in-app messages or push notifications. Every marketing message includes an opt-out facility, which we honour. We do not use your sensitive information for direct marketing without your consent.

13.De-identified information

Where we de-identify the information we have collected, we may use and disclose that de-identified information, for example to understand and improve the App. De-identified information is not personal information under the Privacy Act. We do not sell it or attempt to re-identify it to target you.

14.Complaints

If you wish to complain about how we handle your personal information, please contact us using the details below. We will investigate your complaint promptly and respond within a reasonable timeframe. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Where your complaint concerns health information handled in NSW, you may also raise it with the NSW Privacy Commissioner at the Information and Privacy Commission NSW.

15.Contact us

For further information about our privacy policy or practices, or to access or correct your personal information, or make a complaint, please contact our privacy officer using the details below:

Email: hello@groundedparenting.app

Our privacy policy was last updated on 7 October 2026.