PRIVACY POLICY
Effective September 26, 2026
This Privacy Notice for Milava LLC ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
- Visit our website at https://milava.app or any website of ours that links to this Privacy Notice
- Download and use our mobile application (Milava), or any other application of ours that links to this Privacy Notice
- Use Milava. Milava is a family childcare coordination app for parents and trusted caregivers. The Services provide tools for family schedule information, caregiver access, calendar subscriptions, and related communications.
- Engage with us in other related ways, including any marketing or events
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@milava.app.
SUMMARY OF KEY POINTS
This summary provides key points from our Privacy Notice.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.
Do we process any sensitive personal information? We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law.
Do we collect any information from third parties? Only what is needed to run the features you use: your name and email from Apple or Google if you sign in with either of them, your subscription status from the App Store via RevenueCat, and public flight schedule information from FlightAware when you add a flight.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
How do we keep your information safe? We use technical and organizational measures designed to protect your personal information, while recognizing that no system is completely secure.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.
How do you exercise your rights? The easiest way to exercise your rights is by visiting https://milava.app, or by contacting us at privacy@milava.app.
TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information we collect may include: names, phone numbers, email addresses, contact preferences, and authentication data; children's names and birth dates; your family's schedule and childcare information, including caregiver schedules, time off, travel, activities and locations; care notes you write; and daily reports an adult caregiver submits, including tap-based care categories and any free-text note.
Children's and health information. A parent or guardian may choose to add a child's allergies and optional emergency-reference information such as pediatrician, preferred hospital, emergency contacts and special instructions. Milava does not request medication information or provide a dedicated medication field. General care notes, daily reports and other free-text fields can contain health information if an adult chooses to write it. Please enter only what the family needs for care coordination and what you are authorized to share. Removing the structured medication field does not make these other categories non-health data.
Authority to provide child information. By adding information about a child, you represent that you are the child's parent or legal guardian, or that a parent or legal guardian has authorized you to provide it for the family's care coordination. Contact us if that authority changes.
Waitlist information. If you join a beta waitlist, we collect your email address, whether you have an iPhone, any optional screening answer you write, and your separate choice about occasional product and launch emails. The waitlist asks for information about adults and care arrangements only, not child names or health details. We use the information to operate the waitlist, select and invite beta participants, and send marketing only if you separately choose it.
Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we process health data and child-associated data that applicable law treats as sensitive.
Payment Data. Milava Premium subscriptions are billed entirely through Apple. We never receive your card number or billing details — that data is governed by Apple's own privacy policy (https://www.apple.com/legal/privacy/).
Social Media Login Data. You may sign in using Sign in with Apple or Sign in with Google. If you choose to do this, we will collect your name and email address from Apple or Google.
Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:
- Mobile Device Access. If you use the photo feature, we may request access to your device's camera or photo library. We use that access only for the photo you choose to share at that moment; we do not scan or upload your photo library.
- Mobile Device Data. We automatically collect device information such as your mobile device ID, model, manufacturer, operating system, browser type, and IP address.
- Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s).
Diagnostics when a save fails. If something you save does not reach our servers, the app keeps a short record: which kind of save it was (for example, a schedule change), a category of error (for example, "no connection"), your platform and app version, and the time. The record is linked to your account and family. It contains nothing you entered and no error text. If your device is offline, the record waits on the device for up to seven days until it can be sent.
2. HOW DO WE PROCESS YOUR INFORMATION?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including: to facilitate account creation and authentication, to deliver services to you, to respond to user inquiries/offer support, to send administrative information, to enable user-to-user communications, to request feedback, to protect our Services, to evaluate and improve our Services, to identify usage trends, and to comply with our legal obligations.
In Short: We may share information in specific situations described in this section and/or with the following third parties.
The service providers that process personal information on our behalf, and what each one does, are:
- Supabase — hosts our database, authentication, and server functions. All of the information you enter in Milava is stored here (Supabase runs on Amazon Web Services infrastructure in the United States).
- Anthropic — provides the AI model behind our AI features, and receives information only after you turn those features on (Section 5).
- Twilio — delivers text messages to caregivers and to parents who have opted in (Section 16), and receives their replies: from caregivers YES, STOP and HELP, and OFFER or DECLINE when a parent has asked them to cover a day, and from parents the verification reply and any text they send to ask about or change the family's schedule.
- Vercel — hosts milava.app.
- Apple — App Store billing for Milava Premium; Sign in with Apple; and delivery of push notifications to iPhones and iPads.
- RevenueCat — manages subscription status between the App Store and Milava. It receives an account identifier and your subscription's status; it never receives your payment details, which stay with Apple.
- FlightAware — when you add a flight to a travel entry, we look up that flight number and date to fill in its times. We send only the flight number and date, never who is flying.
- Resend — sends account emails such as sign-up confirmations and password resets.
- Sentry — error monitoring where it is configured in a released website, web app, or mobile build. We configure it to use opaque account and family identifiers and technical error details. Exception text may also be included when an error is reported.
- Google — Sign in with Google, if you choose it — we receive your name and email address; our support@ and privacy@ mailboxes are hosted on Google Workspace, so anything you email us is processed there; and the web app loads its typeface from Google Fonts, which means Google sees your device's IP address when the page loads.
- Your calendar provider — if you turn on the calendar subscription, see Section 17.
We also may share personal information with other members of your family unit, in connection with a business transfer, or where required by law.
In Short: We don't use cookies for tracking or advertising; our infrastructure providers may set strictly functional cookies.
We don't use cookies for tracking or advertising. Your session is kept in your device's storage; our infrastructure providers may set strictly functional cookies.
5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.
We provide AI features through Anthropic. They are designed for two things: understanding plain language — adding to or asking about your family's schedule in your own words, and short generated previews and summaries — and, when you choose to use it, reading a photo of a schedule.
When you use a language feature, we send Anthropic the information needed to generate the response: your question or request, the names you entered for family members and caregivers, children's names and ages, and schedule and coverage information — who is working when and with which child, the names of any school or daycare program a child attends, days off and the reason for each (such as a sick day or a holiday), which children have no regular plan, travel, and activities (for Premium families, this can include the family's full schedule history). For premium families, this can also include the content of caregiver daily reports — the tap-based categories and any free-text notes a caregiver wrote.
Photos. If you use “Add from a photo” (a Premium feature, available to parent accounts), the photograph you choose or take — for example a camp schedule or a school calendar — is sent to Anthropic, along with your family's names and regular schedule and internal identifiers that let Milava match the people it reads to your family's records, so that Anthropic's model can read it into schedule entries for you to review. We do not store the photo. It is held in memory only long enough to send and is discarded as soon as the response comes back; it is never written to our database, saved to a file, or logged. What we keep is only that an extraction happened (the date and which account), and the entries you yourself confirm afterward. Photos are subject to the same Anthropic terms and deletion schedule described below and are not used to train Anthropic's models. Please only photograph the schedule itself; anything else visible in the photo will be sent along with it.
Anthropic processes this information as our service provider under its Commercial Terms and data processing terms. Those terms require Anthropic to protect your information to the same or an equal standard as this Privacy Notice. Under the standard API terms, Anthropic treats customer content as confidential and does not use API inputs or outputs to train its models. Standard API inputs and outputs are deleted within 30 days, subject to longer retention needed for usage-policy enforcement or legal obligations, or a different written agreement. We do not store AI responses beyond showing them to you. Milava does not currently have a verified zero-data-retention agreement with Anthropic. Anthropic's privacy information is at privacy.anthropic.com.
If you tell Milava whether an answer was right, we keep a copy of that question, the answer, and any note you add, so we can improve the feature. What you tell us there stays with Milava and is not sent to Anthropic.
AI features are off until you turn them on. Before Milava sends anything to Anthropic it shows you what will be sent and asks; nothing is sent until you agree, and each parent decides for their own account. You can turn AI features off again at any time in Account → Privacy & AI. Turning them off stops any further information from being sent to Anthropic; it does not retroactively delete what was already processed, which Anthropic deletes on the schedule above. For data requests, contact us at privacy@milava.app.
In Short: If you choose to register or log in using Sign in with Apple or Sign in with Google, we may have access to certain information about you.
Our Services offer you the ability to register and log in using Sign in with Apple or Sign in with Google. Where you choose to do this, we will receive your name and email address from Apple or Google. We will use the information we receive only for the purposes described in this Privacy Notice.
7. HOW LONG DO WE KEEP YOUR INFORMATION?
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.
How long we keep information depends on the category and whether other people remain in the family. If the last parent deletes their account, Milava deletes the family's active database records, including child records, settings, schedules, care notes and daily reports, subject to limited provider backups and information we must retain for security, fraud prevention, legal obligations or dispute resolution. If another parent remains, the requesting parent's login is deleted and direct person identifiers are removed or replaced where the current deletion process supports it, but shared schedule history, daily reports, care notes and other family records remain available to the remaining family. When a parent removes a caregiver, or a caregiver leaves, access ends and the family keeps its shared work and care history.
We do not currently age out schedule history, care notes or daily reports while a family remains active, and we do not currently provide a self-service hard-delete control for one child. You may request deletion of information about a child by emailing privacy@milava.app. We will authenticate the request and respond within 45 days; if reasonably necessary and permitted by law, we may extend once by another 45 days after giving notice. Where an isolated deletion cannot safely preserve shared record integrity, we may need to delete or de-identify related records or offer whole-family deletion. We will tell you the timing for deletion from archived or backup systems; where Washington's consumer-health-data law applies, that law permits no more than six months for completing that backup deletion.
Waitlist information does not currently expire automatically. It remains until we manually delete it after an invitation, decline, removal request, or waitlist closure. We are developing a fixed retention limit; we will not state or rely on one until the operational deletion process exists. Anthropic's AI retention is described in Section 5, and a calendar provider may keep copies as described in Section 17.
Save-failure records are kept until your account or your family is deleted.
8. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We use technical and organizational security measures designed to protect the personal information we process. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. You should only access the Services within a secure environment.
9. DO WE COLLECT INFORMATION FROM MINORS?
In Short: Milava is a tool for parents and guardians (18+ to create an account); we do not knowingly collect information directly from children under 13 years of age.
You must be 18 or older to create or use a Milava account. Parents and adult caregivers enter information about children for family coordination. Milava is not directed to children, does not provide child accounts, and does not knowingly collect or solicit information directly from a child under 13 or market directly to children. We do not sell personal information. If you believe a child is directly using Milava or has provided information directly, contact privacy@milava.app; we will investigate and delete the directly collected information as appropriate.
10. WHAT ARE YOUR PRIVACY RIGHTS?
In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.
You have the right to withdraw your consent at any time. You can withdraw your consent by contacting us at privacy@milava.app.
Account Information
If you would like to review or change account information or terminate your account, use account settings or email us. A parent or legal guardian may also request access, correction or deletion for information about their child. Shared family history may remain when another parent remains, as described in Section 7, unless applicable law requires a different result.
If you have questions or comments about your privacy rights, you may email us at privacy@milava.app.
11. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.
12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you.
Categories of Personal Information We Collect
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name | YES |
| B. Personal information as defined in the California Customer Records statute | Name, contact information, education, employment, employment history, and financial information | YES |
| C. Protected classification characteristics under state or federal law | Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | YES |
| D. Commercial information | Subscription status and purchase history; payment-card and billing details remain with Apple | YES |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other similar network activity | Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements | YES |
| G. Geolocation data | Device location | NO |
| H. Audio, electronic, sensory, or similar information | Images and audio, video or call recordings created in connection with our business activities | YES |
| I. Professional or employment-related information | Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us | NO |
| J. Education Information | Student records and directory information | NO |
| K. Inferences drawn from collected personal information | Schedule-pattern observations shown through Insights; not used for legal or similarly significant decisions | YES |
| L. Sensitive personal Information | Account login information, contents of communications, and health data. Other state laws may separately classify known-child data as sensitive. | YES |
Washington and Connecticut Consumer Health Data
Consumer health data Milava may collect includes allergies; optional pediatrician, preferred-hospital, emergency-contact and special-instruction details; health information an adult chooses to write in a care note or daily report; and health information independently entered in other free text. We receive it from parents, guardians and adult caregivers. We use it to provide the care-coordination and emergency-reference features the family requests, and we do not sell it.
We make this information available to the family members and caregivers the family authorizes. Supabase stores and processes it for Milava. Anthropic receives the portions described in Section 5 only after the account turns on the relevant AI feature; care notes that are separate from daily reports are not sent to Anthropic. We may also disclose information in a business transfer or where law requires, as described in Section 3. We have no affiliates that receive consumer health data.
Washington and Connecticut residents may request confirmation, access, correction, deletion or withdrawal of consent by emailing privacy@milava.app. We will authenticate and respond within 45 days, subject to a permitted 45-day extension with notice. If we deny a request, our response will explain why and how to appeal by replying to the decision. Washington residents may appeal a second denial to the Washington Attorney General; Connecticut residents may contact the Connecticut Attorney General. A parent or legal guardian may submit a request concerning their child.
Your Rights
You have rights under certain US state data protection laws, including: right to know, right to access, right to correct, right to request deletion, right to obtain a copy, right to non-discrimination, and right to opt out of targeted advertising, sale of personal data, or profiling.
How to Exercise Your Rights
To exercise these rights, you can contact us by visiting https://milava.app or by emailing us at privacy@milava.app.
California "Shine The Light" Law
California Civil Code Section 1798.83 permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes. Please submit your request in writing to us using the contact details in section 14.
13. DO WE MAKE UPDATES TO THIS NOTICE?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.
14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
If you have questions or comments about this notice, contact our privacy contact by email at privacy@milava.app, or contact us by post at:
Milava LLC
Privacy contact
2501 Chatham Rd, Suite N
Springfield, IL 62704
United States
Privacy contact
2501 Chatham Rd, Suite N
Springfield, IL 62704
United States
15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
Depending on applicable law, you may request access to personal information, details about processing, correction, a portable copy, deletion, withdrawal of consent, or an appeal of a denied request. A parent or legal guardian may make a request concerning their child's information. Email privacy@milava.app from the address associated with your account and describe the request without including additional medical details. We will authenticate and respond within 45 days, subject to a permitted 45-day extension with notice. You may also delete your account in Account; the shared-family consequences are described in Section 7. When you delete your account we also ask Apple or Google to disconnect the sign-in you used with Milava.
16. SMS / TEXT MESSAGING
If you are a caregiver whose family enables schedule texts, we send SMS only after you explicitly opt in by replying YES from your own phone (double opt-in) — consent is given by you, the recipient, not by the parent who turns the feature on. We record the date and time of your consent.
We do not share, sell, rent, or provide your mobile phone number, opt-in data, or messaging consent data to third parties or affiliates for marketing or promotional purposes.
Message frequency varies: one opt-in request; a confirmation after YES; at most one clarification after an unrecognized reply; and up to one morning schedule message on each day you are scheduled, and a text when a parent in your family asks you to cover a day, which you can answer by replying OFFER or DECLINE or by opening the link in it. Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help. Full program details: milava.app/sms. Questions: privacy@milava.app.
Parent texts. If you are a parent, you can turn texts on for your own US mobile number in Milava, on the Account page under “Care by text.” Milava sends one verification text to that number, and texting begins only if you reply VERIFY with the code in it within 10 minutes. We record the date and time of your consent. Your mobile number is stored encrypted.
After that, Milava replies only to texts you send — it never texts you unprompted. Answering your questions about the family’s schedule by text, and changing the schedule by text, are both part of Milava Premium: for a Premium family, Milava answers the question you asked, and when you text a change it replies with a preview and, after you reply CONFIRM, a short receipt. Without Premium, it replies to say the feature is part of Premium.
Message frequency depends on use: one message in reply to each message you send, plus the verification exchange. Message and data rates may apply. Reply STOP at any time to stop these texts, or HELP for help. We do not share, sell, rent, or provide your mobile phone number, opt-in data, or messaging consent data to third parties or affiliates for marketing or promotional purposes.
17. CALENDAR SUBSCRIPTION
If you turn on the calendar subscription in Account → Household, Milava creates a private link that publishes your family's schedule as a standard calendar feed. That feed contains schedule facts only: who is scheduled or off and when, parent travel dates, activity names and locations, and a short plain-language description of each event. An activity location can include an address if the family entered one. The feed never contains care notes, medical or allergy information, emergency contacts, phone numbers, pay, or daily reports.
When you subscribe from a calendar service — such as Apple, Google, or Outlook — the schedule information in that feed is delivered to and stored by that service, on that service's schedule, and is then governed by that service's own privacy policy and terms. The same is true of anything you connect to that calendar afterward. Milava does not control those services and cannot delete copies they have already fetched. Anyone who has the link can read the feed, so treat it like a password. You can cut off access at any time by turning the feed off or generating a new link in Account → Household; the old link stops working immediately.
6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?