Nanapp Privacy Policy

Last updated: 17 July 2026

This Privacy Policy describes what information Nanapp collects, how we use it and the rights you have as a user. We recommend reading it carefully. If you have any questions, write to us at [email protected].

1. Who we are

Nanapp is a mobile app that lets adults (parents or guardians) create personalised lullabies for their babies using artificial intelligence. The app is developed and maintained by Pablo Lozano Tercero (referred to as "we"), reachable at [email protected].

2. Who the app is for

Nanapp is intended exclusively for people over 18 years of age who want to create lullabies for their babies or other family members. The app is not designed for use by minors, and we do not knowingly collect personal data from minors.

If we discover that we have received information from a minor without verifiable parental consent, we will delete that data immediately.

3. What information we collect

We designed Nanapp to collect as little information as possible. We only process what is strictly necessary for the app to work:

3.1. Anonymous device identifier

The first time you open Nanapp, we generate an anonymous identifier (UUID v4) that is stored in your device's local storage. We use it to apply your generation quota and to keep aggregate usage counters that help us operate the service.

This identifier:

• Is completely random.
• Is not linked to your name, email, phone or any other information that identifies you.
• Is not shared with third parties for advertising or tracking purposes.
• Is lost if you uninstall the app — we cannot recover it or link you to a previous session.

Associated with this UUID, we keep the following aggregate usage counters on our servers:

• Number of lullabies generated in your current quota period (monthly on the Plus plan).
• Number of free (gift) lullabies already used. Unlike the other counters, this one is kept indefinitely (as long as your UUID exists) so we don't offer you the free lullabies again once used up.
• Approximate date of your first Plus purchase (if any).
• Active plan (Free, Plus, Plus Pack, Plus Lifetime).
• Occasional operational events (trial cancellation, block for abnormal use, etc.).

We use these counters to: (a) detect and mitigate abnormal or abusive use of the service as described in the Terms, (b) make product decisions based on aggregate data (usage trends, plan adjustments), and (c) meet our legal and accounting obligations.

We DO NOT track your behaviour within the app (we don't record which screens you visit, which buttons you tap, how long you spend in each part, or in what order you navigate). We DO NOT integrate third-party behavioural analytics SDKs (Google Analytics, Mixpanel, Firebase Analytics, Amplitude, PostHog, etc.).

3.2. Content you enter voluntarily

To generate a lullaby, you may enter:

• The baby's name (optional).
• Keywords selected from the catalogue or written by you (favourite toy, pet, etc.).
• Your chosen mode (sleep / play / automatic) and your preferred language (Spanish variants or English).

This information is sent to our servers to process the lullaby generation and is not stored on our servers beyond the time needed to process the request (seconds).

3.3. Usage preferences

The app stores on your device (without sending them to our servers):

• Your generated lullabies (audio + lyrics).
• Your preferred mode and language.
• Your remembered baby names for future lullabies.

All of this information stays only on your device and is deleted if you uninstall the app.

4. What information we DO NOT collect

To be absolutely clear, Nanapp does not collect:

• Your real name, email, phone or any direct personal data.
• Your geographic location.
• Your contacts, photos, microphone or camera.
• Sensitive data such as health, religion, sexual orientation, etc.
• Information about your baby beyond the name you voluntarily type (when you do).
• Device advertising identifiers (IDFA, GAID).

5. Third-party providers

To generate the lullabies, Nanapp uses two artificial intelligence services:

• Anthropic (Claude): generates the lullaby's lyrics. It receives only the keywords and the baby's name (if you provide it), without any identifier of yours. Privacy policy: anthropic.com/privacy.
• ElevenLabs: generates the sung audio. It receives only the already-generated lyrics to synthesise the voice. Privacy policy: elevenlabs.io/privacy.

Both Anthropic and ElevenLabs process the content only for as long as needed to return the result. They comply with their own retention and privacy policies, over which we have no direct control.

Our own backend is hosted on Cloudflare Workers, which processes requests on its edge servers without retaining them. Cloudflare privacy policy: cloudflare.com/privacypolicy.

To manage Plus subscriptions (monthly, 3-month) and the Lifetime purchase, we use RevenueCat as an intermediary between the store (App Store or Google Play) and our backend. RevenueCat receives:

• Your anonymous identifier (UUID), used only as an internal reference to associate your subscription with the device (not with your personal identity).
• The product identifier you purchased (for example, nanapp.plus.mensual).
• The transaction identifier issued by Apple or Google.

RevenueCat uses this information exclusively to validate your subscription status and notify our backend of changes (renewal, cancellation, expiry). It does not receive your name, email, card details or the content of the generated lullabies. RevenueCat privacy policy: revenuecat.com/privacy.

Additionally, we use Sentry as an error-detection (crash reporting) service. When the app suffers an unexpected failure, Sentry automatically receives:

• Technical device information (model, operating system version, interface language, app version).
• The technical error trace (stack trace) and the immediate technical context (which function failed, in which file).

Sentry does not receive your Nanapp UUID, the content of the generated lullabies, the baby names, or any personal data of yours. We use this information exclusively to detect and fix errors in the app. Sentry privacy policy: sentry.io/privacy.

6. Cookies and tracking

Nanapp does not use cookies, does not track across apps, does not integrate behavioural analytics services (Google Analytics, Mixpanel, Firebase Analytics, Amplitude, PostHog, etc.) and does not include advertising tracking pixels.

The aggregate usage counters described in Section 3.1 and the technical error information sent to Sentry (Section 5) are not behavioural tracking tools: they do not record which screens you visit, which buttons you tap, or how you navigate the app.

7. Advertising

Nanapp contains NO advertising of any kind. We decided not to include ads in order to preserve the app's intimate, calm experience.

We do not use or integrate:

• Advertising networks (Google AdMob, Meta Ads, etc.).
• Device advertising identifiers (IDFA on iOS, GAID on Android).
• Tracking pixels or cross-app tracking.

If in the future we decide to include any advertising, we would update this Privacy Policy at least 14 calendar days in advance and notify you through the app itself.

8. Your rights

Under the General Data Protection Regulation (GDPR) and other applicable regulations, you have the following rights:

• Access: you can ask us what information we hold about you. Since we only store an anonymous UUID not linked to your identity, we cannot identify your account without the UUID. If you can provide it (you'll find it in the app's "About" section), we will tell you which counters we have associated with that UUID (lullabies generated per month, active plan, approximate date of first Plus purchase if any) — that is all the information associated with the UUID in our systems.
• Rectification: if you find incorrect data, write to us.
• Erasure: you can uninstall the app at any time. That deletes all local data. To delete your UUID and all the aggregate counters associated with it from our systems before their automatic expiry, follow the procedure detailed at nanapp.app/eliminar-datos: you'll find your UUID in Settings (by tapping the version number three times) and you send it to us by email at [email protected]. We will delete it within a maximum of 30 days.
• Objection and restriction: you can request the restriction or cessation of the processing of your data at any time.
• Portability: you can request a copy of your locally saved lullabies (they are already on your device).

To exercise any of these rights, write to us at [email protected]. We will respond within a maximum of 30 calendar days.

If you believe we have not respected your rights, you can file a complaint with the Spanish Data Protection Agency: aepd.es, or with the data protection authority in your country of residence.

9. Data retention

• Free plan: can generate up to 2 free lullabies (for life). An anonymous counter of already-used free lullabies is kept indefinitely, associated with your anonymous device identifier, so we don't offer them again once used up.
• Aggregate usage counters per UUID (Section 3.1): up to 180 days, which lets us detect temporal patterns without accumulating information indefinitely. After that period they are deleted automatically.
• Technical error information sent to Sentry: up to 90 days, in line with its standard retention policy.
• Content sent to Anthropic and ElevenLabs: processed in real time, not stored by us.
• Data on your device: under your control; deleted when you uninstall the app.

10. Security

We take reasonable measures to protect the information:

• All communication between the app and our servers travels encrypted with HTTPS.
• Our access keys to Anthropic and ElevenLabs are stored as encrypted secrets in Cloudflare Workers, never in the app's code.
• Information on your device is stored using the operating system's secure mechanisms (AsyncStorage and the app-protected file system).

No security measure is absolute. If at any point we detect a security breach that may affect you, we will notify you within a maximum of 72 hours, as required by GDPR.

11. Changes to this policy

If we change this Privacy Policy, we will update the "Last updated" date at the top of the document and communicate the changes through the app itself if they are material (affecting your rights or the data we collect). Changes take effect 14 calendar days after publication.

12. Governing law and contact

This Privacy Policy is governed by applicable Spanish and European law, in particular the General Data Protection Regulation (GDPR).

For any query, exercise of rights or privacy-related complaint, contact us at:

[email protected]

This English text is a translation of the original Spanish Privacy Policy for your convenience. In the event of any discrepancy, the Spanish version prevails.