1. Data Controller

P'wee is developed and operated by Gridnorth® ("we", "us", "our"). All intellectual property rights in the P'wee application, including but not limited to source code, design, branding, and documentation, are the exclusive property of Gridnorth®.

2. No Third-Party Data Sharing

We do not sell, trade, rent, licence, or otherwise disclose any personal data, usage data, baby tracking information, photographs, or any other user-generated content to any third party under any circumstances. Your data remains exclusively within the P'wee platform and is accessible only to authenticated members of your family group.

3. Data We Collect

P'wee collects only the data you voluntarily provide:

• Account credentials (username and securely hashed password)
• Baby profiles (name, date of birth)
• Tracking entries (feeding, sleep, diaper, pumping, play, bath records)
• Photographs uploaded to entries
• Application preferences and settings

We do not use analytics, tracking pixels, advertising SDKs, or any form of behavioural monitoring.

4. Data Security Measures

All user data is protected using industry-standard security practices implemented with PHP 8.5:

• Password hashing — All passwords are hashed using bcrypt (via password_hash() with PASSWORD_DEFAULT), making them irreversible even in the event of a database breach.
• Prepared statements — All database queries use PDO prepared statements with parameterised binding, preventing SQL injection attacks.
• Session security — Sessions are configured with httpOnly, secure, and SameSite=Lax flags. Session IDs are regenerated periodically to prevent session fixation.
• Input validation — All user input is validated and sanitised server-side before processing or storage.
• HTTPS transport — All data in transit is encrypted via TLS/HTTPS.
• Auth-gated media — Uploaded photographs are served through an authenticated PHP proxy, preventing direct URL access by unauthenticated parties.
• Multi-tenant isolation — All data queries are scoped to the authenticated user's family group, enforced at the database query level.

5. Data Retention & Deletion

Your data is retained for as long as your account exists. You may export your data at any time via the CSV export feature. Account and data deletion requests can be directed to the application administrator.

6. Children's Privacy

P'wee is designed for parents and caregivers to track infant care. The application does not collect data directly from children. All data is entered by authenticated adult users.

7. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected in the "Last updated" date above. Continued use of P'wee after changes constitutes acceptance of the revised policy.

8. Contact

For privacy-related enquiries, please contact Gridnorth® via the application administrator.