Effective 9 September 2026
Firstful is a shared timeline for two parents to record what their child just did — a photo, a video, or a short note. It is local-first: an entry saves to your device first, then syncs.
Syncing means Firstful does have a server, unlike some of our other apps. Your household's entries, your child's name and birth date, and any photos or videos you attach are stored on infrastructure we operate, entirely within the EU.
We run no analytics, no advertising, and no third-party tracking of any kind. Nothing about your use of the app is measured or sold. The only people who can see a household's entries are the members of that household.
Responsible for data processing within the meaning of Article 4 (7) GDPR is Nicolas Mehlei, whose full details are in the imprint.
Everything below is stored on servers we operate in the European Union — Germany for identity and media, West Europe for the application database — and nowhere else:
A local copy of your timeline (so the app works with no signal) and your sign-in tokens, held in the operating system's secure credential store (Android Keystore / iOS Keychain). Neither leaves your device except as described above.
Nobody outside your household, and no third party. We run no analytics SDK, no advertising SDK, and no crash-reporting service — there is nothing installed in the app to share data with even by accident.
The only systems the app talks to are the ones we operate ourselves:
Firstful is used by parents to record memories about their child; the child is never a user of the app and never signs in.
The data described above — a first name and birth date — exists to give milestone ages context, never as a score, and is never used for anything but showing it back to the household that entered it. See docs/PROJECT-CONTRACT.md's product commitments for what Firstful deliberately does not build: growth percentiles, comparisons, or any screening claim.
Processing your account, your child's name and birth date, and your timeline entries is necessary to provide the service you asked for, and rests on Article 6 (1) (b) GDPR — performance of a contract and steps taken at your request.
Storing credentials in the operating system's secure store is technically necessary to provide the service and is likewise covered by Article 6 (1) (b) GDPR.
You can delete an individual entry from within the app at any time.
Deleting your whole household, or exporting everything it holds, is not yet a self-service action in the app. Until it is, see https://firstful.nm-sites.de/data-deletion for how to request it — we carry it out by hand, and aim to complete it within 30 days.
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21). Contact the address in the imprint to exercise any of them.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in the member state of your residence, place of work, or the place of the alleged infringement.
Camera and photo library — used only when you choose to attach a photo or video to an entry.
Network access — required to sync your timeline and to sign in.
This notice was last updated on 9 September 2026. Where the application changes what it stores or whom it contacts, this notice is updated in the same change.