Information you provide
The website stores your name, email address, password hash, billing address, current country, and optional profile photo. Billing addresses are collected for account and future purchase records; checkout is not active.
When you submit a review, we store your rating, comments, recommendation, name, and profile photo. New or edited reviews are private to the owner until approved for public display. With your consent, a published review includes your name and photo; your email is not included in the public review response.
Baby and family records
The app stores family-linked bottle records, baby profiles and profile photos, medication and vitamin information, growth records, appointments, and vaccine records in its database. App requests use the signed-in family to access those records, so invited family members can share family information.
The Memories photo book is stored in your browser’s local database on that device. It is not currently shared with family members or synchronized across devices. Clearing browser data or losing the device may remove those local pages. Protect access to the device and browser profile, especially if several people use it.
Connection information and browser storage
Cloudflare hosts the website and database. The website uses the connection country reported by Cloudflare for regional pricing and language defaults, and records daily visit totals by country. For signed-in accounts, it records the latest connection country and activity time. Connection country is approximate, not proof of residence.
The website uses a sign-in session cookie and saves your language preference in browser storage. It stores hashed IP and email identifiers with attempt counts to limit repeated sign-in attempts. The hosting provider also processes connection information to deliver the service.
Google Fonts supplies fonts used by the website; your browser contacts Google’s font servers to load them.
Billing and PayPal
PayPal checkout is not active on this website. Registration does not connect PayPal, begin a trial, or collect a payment. The website does not ask for your PayPal password or card number. The privacy information will need to be reviewed before live checkout is enabled.
Security measures in use
- The public site is served over HTTPS.
- Passwords are stored as salted PBKDF2-SHA-256 hashes rather than readable passwords.
- Website session cookies use Secure, HttpOnly, and SameSite=Lax attributes. Session tokens are stored as hashes on the server and expire.
- Account APIs require sign-in, and owner dashboard and review moderation APIs check the owner identity on the server.
- State-changing website requests check the request origin. Sign-in attempts are rate-limited.
- Website responses use browser security headers, and account API responses are marked private and not cached.
These measures reduce risk; they do not guarantee that every device or transmission is free from risk. We do not claim end-to-end encryption, medical privacy certification, or an independent security audit.
Support and deletion requests
Support messages include your full name, contact email, selected plan, topic, and message. They are stored in the database and available only to the owner and the signed-in customer who submitted the request. Public visitors and other customers cannot read the thread. Support requires sign-in, and replies and updates appear in that customer’s website inbox.
The website’s Account Settings includes a Delete My Account option that submits a request after you re-enter your password and confirm. It does not immediately delete information or cancel a subscription. You may also request deletion through Contact Support; we need to verify your identity before acting on a support request.
We are implementing deletion of account information and associated baby profiles, feeding and medication records, photos, and other personal records. Shared-family data requires a scope review so another family member’s records are not accidentally removed. Device-saved Memories must be removed on each device; the website cannot remotely erase another browser’s local storage.
A 30-day deletion target has been requested but is not yet promised: automated deletion, family ownership handling, backup restoration safeguards, and any required transaction retention still need implementation and validation. This does not limit rights or deadlines required by applicable law.
Retention and operator
Vandx is an independent digital brand operated by Christopher Roza, based in California, United States. Use Contact Support for privacy questions or deletion requests.
No fixed retention period has been adopted. Payment or transaction records should be retained only where necessary for legal, tax, accounting, or fraud-prevention obligations; the exact records and retention process must be established before live payments begin.
Deleting active database records does not immediately erase historical recovery copies. Cloudflare D1’s recovery history depends on the hosting plan. Other exports or copies, if present, must also be accounted for before a complete deletion commitment is made.
You can edit website profile details and remove your profile photo in your account. The app includes controls for editing or removing individual records and memory pages. The Delete My Account option is a verified request flow; it does not yet perform automatic erasure.