Chico · yourchico.com
Chico holds health information about your children. This explains exactly what it keeps, why, who else ever sees it, and how to get it back or have it deleted.
Last updated 25 August 2026 · applies to yourchico.com and app.yourchico.com
Chico is operated by Fresh Pages Communications (UEN 53366238M), of 14 Robinson Road, #08-01A, Singapore 048545. In this policy "we" and "us" mean that entity, and "you" means the person who created or joined a family in Chico.
We are the data controller for the information described here. Our data protection contact is baymelody@gmail.com.
This policy is written to meet Singapore's Personal Data Protection Act 2012 (PDPA).
Almost all of it is information you type in yourself. We do not buy data about you and we do not collect anything from other sources.
| What | Specifically |
|---|---|
| Your account | Your name, email address and account identifier, from the Google account you sign in with. We never see or store your Google password. |
| Your children | Name, date of birth, current weight, and whether they are toilet trained or attending school. |
| Health records | Temperatures, symptoms, medications and doses given, illness history, vitamins, and a well / unwell / recovering status. |
| Daily logs | Feeds, naps, diaper changes, meltdowns, night terrors, and anything else you log, each with the time it happened. |
| Emergency information | If you fill this in: allergies, medical conditions, blood type, parents' names and phone numbers, your doctor's name, phone number and clinic address, and insurance details. |
| Routines and school | Daily schedules, packing lists, attire days, projects, homework and term dates. |
| Technical | A notification token for each device you enable reminders on, so we can send them. Standard server logs kept by our hosting provider, which include IP addresses. |
| Billing | Which plan you are on and its status. When paid plans begin, card details are handled entirely by Stripe and never reach our servers. |
Some of this is health information about a child, which is sensitive. We treat all of it that way.
We do not use your information for anything else without asking you first. We do not sell it, and we do not pass your email to anyone else to market to you.
Chico is for parents and caregivers, not for children. You must be 18 or over to create an account.
The information you enter is mostly about your children rather than about you. By entering it, you confirm you have the authority to do so — that you are their parent or legal guardian, or that you have that person's permission.
You can withdraw your consent at any time by asking us to delete your account (see section 10). Withdrawing consent means we can no longer provide Chico to you.
Only the people you invite into your family. When you share your invite code with a partner, a grandparent or a helper, they get the same view of your children that you have.
This is enforced by database security rules, not by hiding things in the app: a request for another family's records is refused at the server, so no amount of poking at the app will reveal them.
Anyone you invite can see everything, and can remove other members. There are two levels of access. A parent can change anything; a helper can log the day and tick lists but cannot edit routines, medicines, settings or what the family pays, and can only delete entries they made themselves. Only the person who created the family can remove anybody from it. Each level has its own invite code — treat both like passwords.
A small number of our staff can technically access stored data when investigating a fault or a security problem. We do so only when necessary, and never out of curiosity.
We use a small number of service providers. They act on our instructions and may not use your information for their own purposes.
| Who | What for | Where |
|---|---|---|
| Google (Firebase & Cloud) |
Sign-in, the database, hosting and notification delivery. | Singapore |
| Anthropic | Answering Chico AI's questions and the pattern analysis. Only if you use those features. | United States |
| Stripe | Payments, when paid plans begin. No payments are taken during the beta. Stripe handles card details directly — they are entered on Stripe's own systems and never reach our servers, so we never see or store a card number. | United States & Singapore |
Chico AI is the family assistant that sits inside Chico — the part you can ask questions of, and the part that writes the pattern analysis. It is the one feature that sends your family's information outside our own systems, so it is worth being precise about what happens.
When you send Chico AI a message, we build a summary of your family's recent entries — your children's names and ages, recent logs, medications, health status and school items — and send it, with your question, to Anthropic's API in the United States. Anthropic returns an answer, which we show you. The same happens when you run the pattern analysis on night terrors or meltdowns.
Under our agreement with Anthropic, your information is not used to train their models. They may retain it for a limited period for safety and abuse monitoring before deleting it.
If you would rather none of this happened, do not use Chico AI or the pattern analysis. Every other part of Chico — logging, schedules, reminders, health tracking, school, lists, timers — works without them, and nothing is sent anywhere.
Your family's records are stored in Google Cloud's Singapore region (asia-southeast1), and the software that reads them runs there too.
The one routine transfer out of Singapore is to Anthropic in the United States, and only when you use Chico AI or the pattern analysis, as described above. We rely on contractual protections with that provider to keep your information protected to a standard comparable to the PDPA.
Under the PDPA you may ask us to:
You can do both yourself, inside the app — Settings, under Account: download your data, or delete your account and everything in it. It takes effect immediately and there is no charge.
If you would rather not do it in the app, email baymelody@gmail.com and we will do it within 30 days. We may ask you to confirm your identity first, so that nobody else can request your family's records.
Deleting your account removes the whole family record, which affects everyone you invited. If you only want to leave a family, ask us and we will remove you without deleting anyone else's data.
No service can promise perfect security, and we will not pretend otherwise. What we can promise is that we will tell you quickly if something goes wrong.
If a breach occurs that is likely to cause you significant harm, or that affects a large number of people, we will notify Singapore's Personal Data Protection Commission and every affected user within 3 calendar days of establishing that it happened, as the PDPA requires.
We will tell you what happened, what information was involved, and what we are doing about it. We will not wait until we have a tidy story.
If we change this policy we will update the date at the top. If a change materially affects how your information is used, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again.
Questions, requests or complaints: baymelody@gmail.com. We would much rather hear from you directly and put something right.
If you are not satisfied with our response, you may complain to the Personal Data Protection Commission of Singapore at pdpc.gov.sg.