← Back to home

Privacy Policy

Last updated: September 2026

At a glance

A short summary for parents and caregivers in a hurry. The full policy is below.

We are Novie, a parenting support app built in Sydney. Looking after your information, and information about your children, is part of what we do.

  • What we collect: information you give us when you set up your account and your household, information you log about your child, the messages you send to our AI chat, and a small amount of technical information from your device.
  • Why we collect it: to provide the personalised guidance the app exists for, to keep your account secure, and to improve the Service.
  • Who we share with: a small list of carefully chosen service providers, including Amazon Web Services, which powers our infrastructure and the AI chat. We do not sell your information.
  • Children’s information: we do not collect information directly from children. The information about your child is provided by you. We treat that information as sensitive and apply higher protections.
  • Location and microphone: the app does not use location at all. It uses the microphone only if you choose to use voice input in the chat. Both are explained in section 2.
  • Your rights: you can see, correct, delete, or export your information at any time. You can clear your AI chat history.
  • Where to ask questions: privacy@novie.life.

1. About this policy

This Privacy Policy explains how Novie Holdings Pty Ltd (ABN 79 688 622 906, ACN 688 622 906) (Novie, we, us, or our), the operator of the Novie app and the novie.life website (the Service), collects, uses, discloses, and protects personal information.

1.1 Who we are

Novie is a privately held Australian company based in Sydney. We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles. When we offer the Service to people in the European Economic Area, the United Kingdom, or other regions with their own privacy laws, those laws also apply to our handling of personal information about people in those regions.

1.2 Who this policy applies to

  • Adults who use the Service as account holders or invited caregivers.
  • Children whose information is recorded in the Service by an authorised caregiver.
  • Visitors to novie.life.
  • People who contact us at any of our published email addresses.

1.3 How to contact us about privacy

  • Privacy contact: privacy@novie.life
  • Postal address: Novie Holdings Pty Ltd, PO Box 154, Erskineville NSW 2043, Australia

2. Information we collect

2.1 Information you give us when you set up your account

  • Your name.
  • Your email address.
  • A password, which we never store in plain text (see section 6 on security).
  • Your role in the household, for example parent, partner, grandparent, nanny, or babysitter.
  • The household and children you create or are invited to access.
  • Your time zone.
  • Authentication information. Sign-in is handled by Clerk, our authentication provider. If you sign in with Google, that provider passes us your authentication details. If you sign in with email and password, we store your email and a secured hash of your password.

2.2 Information about your child or children

You provide information about each child you add to your household. That information may include:

  • Name or a nickname.
  • Date of birth and, where the child was born premature, due date and prematurity status.
  • Sex.
  • Birth weight and length.
  • Bedtime routine duration.
  • Known allergens, recent allergen introductions, and reactions.
  • Tracking entries you log under categories such as sleep, feeding, nappy, activity, solids, growth, and health.
  • A profile picture for each child, if you choose to add one.
  • Developmental milestones.
  • Calendar entries you create, which may include appointments, locations, and notes.
  • Chat conversations and questionnaire responses related to that child.

We treat this information as sensitive personal information under the Australian Privacy Act, as special category data under the GDPR where it relates to health, and as the most highly protected category of information under the US Children’s Online Privacy Protection Act and the forthcoming Australian Children’s Online Privacy Code.

2.3 Information about your household and other caregivers

If you invite another caregiver to your household, we collect their email address and the role they will hold. If they accept the invitation, we collect their account information as described in section 2.1. We rely on you to confirm that they consent to receive the invitation and to be added.

2.4 Information from your interactions with the Service

  • Messages you send to the AI chat feature, and the responses generated. You can type these messages or, if you choose, dictate them using your device microphone. Voice input is converted to text by Apple’s speech recognition, which may process your voice on your device or on Apple’s servers under Apple’s privacy terms. Novie receives only the resulting text. We never receive, store, or process an audio recording.
  • The questionnaires you complete and the toolkits you use.
  • Schedules and plans generated for your child.
  • Trends and analytics derived from your tracking entries (see section 4 on automated processing).

2.5 Location information

The app does not collect location information. It does not ask for location permission and it does not access your device location at any time. Your household time zone comes from your device settings, and you can change it in the app.

2.6 Technical and usage information

  • Device type, operating system, and app version.
  • IP address, used at sign-in for security and for approximate region detection.
  • App usage events, collected through PostHog, our product analytics provider, to understand which features are used and to improve the Service. PostHog processes this information in the European Union. We have turned off automatic activity capture, screen tracking, and session recording, so the only events sent are the specific ones we have chosen.
  • Crash and error reports, collected through Sentry, so that we can find and fix problems in the app. A report includes technical details of the problem together with your user ID and IP address, so that we can connect it to your account if you contact us about it.
  • Push notification tokens, where you have enabled push notifications. These are handled by Amazon Simple Notification Service and delivered through Apple.
  • Cookies and similar technologies on novie.life. We use a small number of strictly necessary cookies to make the website work. We do not use advertising or cross-site tracking cookies.

2.7 Payment and subscription information

If you subscribe to Premium, your payment is collected and processed by Apple under your Apple ID. We do not see, store, or process your payment card details. Your subscription status comes to us directly from Apple, through the App Store Server API and Apple’s server notifications, so that the app knows whether your subscription is active. We receive subscription start date, current period, and renewal status.

2.8 Information from third parties

  • Authentication identity from Google, where you choose to sign in with Google.
  • Subscription status from Apple, as described in section 2.7.
  • We do not buy data from advertising or data-broker companies.

2.9 Information we do not collect

  • Location of any kind, precise or approximate. The app has no location permission, as described in section 2.5.
  • Contact lists.
  • Audio recordings. Voice input in the chat is converted to text, as described in section 2.4.
  • Camera access. You can select a photo from your photo library, but the app does not use your camera.
  • Biometric information. The photo moderation described in section 5.1 uses content classification only. Facial recognition is switched off at the infrastructure level and our systems have no permission to use it.
  • Government identifiers.
  • Financial account numbers.

3. How we use information

3.1 To provide the Service

To create your account, set up your household, deliver content modules, generate personalised guidance and schedules, run the AI chat, deliver tracking and trends, and make the Service work the way you expect. Our lawful basis is performance of our contract with you and, for information about children, the consent you give as a parent or authorised caregiver, including explicit consent for health information.

3.2 To keep the Service secure

To verify your identity, prevent unauthorised access, detect abuse, and respond to security incidents. Our lawful basis is our legitimate interest in the security of the Service, balanced against your rights.

3.3 To improve the Service

To analyse usage in aggregate, fix bugs, improve content, and develop new features. We do not use individual chat content to train AI models. Our lawful basis is our legitimate interest in operating and improving the Service.

3.4 To communicate with you

To send transactional emails such as welcome messages, account changes, security notifications, billing receipts, and important Service updates, and, with your consent, optional product and educational emails. Every marketing email includes an unsubscribe link.

3.5 To meet legal obligations

To comply with applicable law, respond to lawful requests from authorities, defend legal claims, enforce our Terms, and discharge any safeguarding responsibilities.

3.6 What we do not do

  • We do not sell, rent, or trade your personal information.
  • We do not share your personal information with advertisers or data-broker companies.
  • We do not use your information for behavioural advertising.
  • We do not use your child’s information, your chat content, or any of the information you log to train any AI model, our own or anyone else’s.
  • We do not run facial recognition, face detection, age estimation, or any other biometric processing on the photos you upload.

4. Automated decision-making and profiling

The Service uses some automated processing to provide trends, schedules, milestone comparisons, and AI-generated chat responses. None of this processing produces a legal effect or similarly significant effect on you or your child.

The AI chat feature uses an AI model accessed through Amazon Web Services. AI responses can be inaccurate. Do not rely on them for safety-critical decisions. You can clear your chat history at any time. If we ever introduce automated processing that does have a legal or significant effect, we will update this policy and request your consent.

5. Sharing your information

We share your information only with the service providers listed below. Each is a contracted provider bound by a written data-processing agreement. We update this list when our providers change.

5.1 Our service providers

  • Amazon Web Services (AWS): our core cloud infrastructure, hosted in Australia. This covers our database, application hosting, photo storage, push messaging, secrets management, and the AI chat, which runs on AWS Bedrock using Anthropic’s Claude models within Australian regions.
  • An automated content-moderation service, running inside our AWS infrastructure in Australia, which checks photos when they are uploaded so that unsafe images can be quarantined. It classifies image content and does not use facial recognition.
  • Clerk: user identity and authentication. United States.
  • PostHog: product analytics. European Union.
  • Sentry: crash and error reporting. United States.
  • Langfuse: monitoring the quality and safety of AI chat responses. United States.
  • Apple Inc.: the App Store, in-app purchase, and push notification delivery.
  • Google LLC: Google Sign-In authentication.
  • Resend: transactional email from the app. This is currently used to send you your data export when you request one.
  • Brevo (Sendinblue SAS): email from the novie.life website, including the waitlist. European Union.

5.2 Other parties we may share with

  • Law enforcement and regulators, where we are legally required to disclose information, or where we believe disclosure is necessary to protect the safety of a child or another person. We respond only to lawful requests.
  • Professional advisers, including lawyers, accountants, and auditors, under confidentiality.
  • A successor in interest, in the event of a merger, acquisition, or sale of assets, with notice to you and a continuation of equivalent privacy commitments.

5.3 We do not sell your information

We do not sell or share your personal information for cross-context behavioural advertising as defined under the California Consumer Privacy Act, and we do not engage in any practice that would constitute sharing under that law.

6. Security

We protect your information using a combination of technical and organisational measures, including:

  • Encryption in transit using industry-standard TLS.
  • Encryption at rest for the production database, which runs in a private network with no direct public access.
  • Photo storage in a private, encrypted store that is never publicly readable. Photos are reached only through short-lived links that expire, and deletion protection and version history are switched on.
  • Your session is verified on every request to our servers, including the AI chat.
  • Least-privilege access controls for staff and contractors.
  • Managed secrets storage for credentials and keys, with encryption keys held by our cloud provider.
  • Password storage as a secured hash, never in plain text.
  • Audit logging of access to sensitive data.
  • Vulnerability monitoring and a written incident response plan.
  • Privacy and security training for staff who handle personal information.

No method of transmission or storage is perfectly secure. We cannot guarantee absolute security, but we work continuously to reduce risk.

7. International transfers

The Service is operated from Australia, and your information is stored in Australia. Our database, your photos, our application servers, and the AI chat all run in an Australian cloud region. A small number of supporting providers are located overseas, as set out in section 5.1: Clerk, Sentry, Langfuse, and Resend in the United States, PostHog in the European Union, and Apple in the United States and Ireland.

For users in the European Economic Area or the United Kingdom, transfers to providers rely on adequacy decisions where they exist, including the EU-US Data Privacy Framework, and otherwise on Standard Contractual Clauses with additional measures where appropriate. You can request details of the transfer mechanism that applies to a specific transfer at privacy@novie.life.

For users in Australia, our cross-border disclosures comply with Australian Privacy Principle 8. We take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles.

8. Children’s information

This section is in addition to the rest of the policy. It explains how we treat information about children, and how we approach the Children’s Online Privacy Protection Act in the United States, Article 8 of the GDPR in the European Union, the UK Age Appropriate Design Code, and the forthcoming Children’s Online Privacy Code in Australia.

8.1 Novie is for adults

The Service is intended for use by parents and caregivers aged 18 or over. We do not knowingly allow children under 13 to create an account.

8.2 Information about children is provided by you

Information about your child is provided by you, the parent or authorised caregiver. By providing that information, you confirm that you are the parent or have legal authority to consent on behalf of the child, that where parental responsibility is shared you have the consent of any other person who shares it, and that you consent to the processing described in this policy on behalf of the child.

8.3 Verifiable parental consent

Where verifiable parental consent is required, we combine the App Store account as one signal of adult status with explicit in-app consent screens that require you to acknowledge that you are providing consent on behalf of the child.

8.4 The right to delete a child’s information

A parent or authorised caregiver, or a child of sufficient maturity, can ask us to delete all information about a child. We will delete that information from production systems within 30 days, with up to a further 30-day window for residual deletion from backups. You can also delete a child’s profile yourself in the app, which removes their information and photos. Because a child’s information belongs to the household rather than to one caregiver, a caregiver deleting their own account does not remove it. It is removed when the child’s profile is deleted or when the household is deleted.

8.5 Best interests of the child

We design the Service with the best interests of the child as a primary consideration. This includes high-privacy default settings, data minimisation in the information sent to the AI provider, no behavioural advertising or profiling, and no techniques designed to nudge you into lowering privacy protections.

8.6 Sharing among caregivers

When you invite a caregiver to your household, that caregiver gains the access level you grant. Removing a caregiver removes their future access. Records of past actions remain in the household history.

8.7 What we will not do with children’s information

  • We will not sell or share children’s information for any commercial purpose unrelated to operating the Service.
  • We will not use children’s information to train AI models.
  • We will not use children’s information for advertising.
  • We will not disclose children’s information except as described in section 5 or with parental consent.

8.8 How we handle photos of children

Your child’s profile picture is among the most sensitive information the Service holds. We handle it with additional care.

  • When you upload a child’s photo for the first time, we ask you to specifically confirm your consent for photo storage, separately from the general consent you gave at signup.
  • Photos are stored privately on Amazon Web Services with encryption at rest.
  • Access is restricted to the caregivers you have invited to the household. Access uses short-lived signed links, not public URLs.
  • We do not run facial recognition, face detection, age estimation, or any other biometric processing on your photos. Ever.
  • We do not use photos to train any AI model.
  • When a photo is uploaded, we remove the location and camera details stored inside the image file.
  • We do not share photos with any third party outside the storage provider and the content-safety service described below.
  • You can delete a photo at any time. Deletion is immediate in production, and photos are removed from backups within 30 days.

To meet our obligations to protect children, every photo is checked automatically by a content-moderation service before anyone in your household can see it. The check looks at what the image contains. It does not identify who is in it. If a photo is flagged, it is blocked from view, kept securely for as long as child-safety law requires, and handled under our written child-safety process, which can include a report to the eSafety Commissioner in Australia or the National Center for Missing and Exploited Children in the United States. Because the check is automated, it can occasionally block an ordinary photo. If an upload fails and you think that is why, contact us at privacy@novie.life. No other feature of the Service uses the content-moderation service.

9. Retention

We keep information for as long as we need it for the purposes described in this policy, or as required by law. Our default retention periods are:

  • Active account information: while your account is active.
  • Tracking entries: 24 months from the entry date, with shorter retention available on request.
  • Chat conversation history: 90 days from the last message in the conversation, unless you explicitly save the conversation.
  • Child profile pictures: until the photo is deleted, the child’s profile is deleted, or the household is deleted. Because photos belong to the household rather than to one person, deleting your own account does not remove them, and they stay available to the other caregivers in that household. Uploading a new profile picture deletes the previous one. Once a photo is deleted, remaining copies are purged within 30 days.
  • Account deletion: full deletion from production systems within 30 days, with backup deletion within a further 30 days.
  • Financial records: 7 years, as required by Australian tax law.
  • Audit logs: 12 months.
  • Server logs, which record technical details of requests to our systems: 90 days.

Two things sit outside these periods. Where a photo is quarantined by the moderation check described in section 5.1, we keep that image and the associated record for as long as we are required to under Australian online safety law and equivalent obligations elsewhere, and it is not accessible to any user during that time. We also keep material for longer where we are required to preserve it for a legal proceeding or an investigation.

10. Your rights

10.1 Rights you have

Subject to the law that applies to you, you have the right to ask us what personal information we hold about you and obtain a copy, correct inaccurate information, ask us to delete your information, restrict or object to certain processing, receive your information in a machine-readable format and ask us to transmit it to another service, withdraw any consent you have given, and complain to a privacy regulator.

10.2 How to exercise your rights

Email us at privacy@novie.life. We will respond within 30 days for Australian users, within one month for users in the EU and the UK (extendable for complex requests), and within 45 days for California users (extendable by a further 45 days). We may need to verify your identity before processing your request. We will not charge you for exercising your privacy rights, and we will not treat you differently for doing so.

10.3 If you live in the United States

If you live in California or another US state with a comprehensive privacy law, you also have the right to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we have shared it with, to opt out of the sale or sharing of your personal information (we do not sell or share your information for cross-context behavioural advertising), to limit the use and disclosure of your sensitive personal information, and not to be discriminated against for exercising your rights.

10.4 If you live in the EEA or the UK

You also have the right to lodge a complaint with the supervisory authority in your country. A list of EU supervisory authorities is available at edpb.europa.eu. The UK supervisory authority is the Information Commissioner’s Office at ico.org.uk.

10.5 If you live in Australia

You can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10.6 Authorised representatives

You can authorise a representative to make a request on your behalf. We will ask for proof of authorisation.

11. Direct marketing and your choices

11.1 Marketing emails

We send marketing emails only with your consent. You can withdraw consent at any time by clicking the unsubscribe link in any marketing email or by contacting us at privacy@novie.life.

11.2 Push notifications

If you enable push notifications in the app, we send notifications related to your child’s stage, the Service, and, with your separate opt-in, educational content. You can disable push notifications in your device settings or in the app at any time.

11.3 Advertising and tracking

We do not use your information for advertising and we do not sell it. We use PostHog to understand how the app is used so that we can improve it, as described in section 2.6.

Novie does not track you across other companies’ apps and websites. The app declares that it does not track, it sends no data to advertising or tracking networks, and it does not show you Apple’s App Tracking Transparency prompt, because there is no tracking to ask you about.

11.4 Cookies on novie.life

We use a small number of strictly necessary cookies to operate the website. We do not use cookies for advertising or cross-site tracking.

12. Notifying you of a data breach

We follow a written incident response plan. If a data breach is likely to result in serious harm to you or your child, we will notify you and the relevant regulator within the timelines required by law. In Australia this means notifying the Office of the Australian Information Commissioner within 30 days of becoming aware of an eligible breach. In the EU and the UK it means notifying the lead supervisory authority within 72 hours. In the United States, where a breach affects identifiable health information, it means notifying affected individuals and the Federal Trade Commission as required by the FTC Health Breach Notification Rule.

13. Changes to this policy

We may update this policy from time to time. When we make changes we update the date below. For material changes we notify you in advance through the Service or by email and, where required by law, we ask you to acknowledge the new policy before continuing to use the Service.

14. How to contact us

  • Privacy: privacy@novie.life
  • General: hello@novie.life
  • Postal: Novie Holdings Pty Ltd, PO Box 154, Erskineville NSW 2043, Australia

If you would prefer to contact a regulator directly: the Office of the Australian Information Commissioner at oaic.gov.au, the Information Commissioner’s Office in the UK at ico.org.uk, a list of EU supervisory authorities at edpb.europa.eu, or the California Attorney General at oag.ca.gov/privacy.