Ella privacy policy

Updated 28 September 2026 · Ella is a baby-journal app by muchita.ai

What is stored

• Account: e-mail address and display name, through Firebase Authentication. You can also start a journal without an account: Ella then creates an anonymous account that opens the journal only on that phone, until you save it with an e-mail address or Google. The app says so on the start screen and on Today until the journal is saved. With Google, Firebase also keeps the basic profile Google shares at sign-in. Each account has an account ID. Your name in the family is the one you choose, and you can change it.
• The family journal: the baby's name and optional birth date, due date, sex and feeding style, and the same details for any other baby in the journal, such as twins; feeds (including left and right nursing times), sleep, diapers, solids (food, amount, first time and reaction), milestones, physical activity, measurements and notes the family enters, including who recorded each entry and when; family members' names and roles; and the reminders the family sets.
• Invitations: the family an invitation opens, the baby's name, the inviter's name, who created it, when it expires (at most 7 days later) and, once used, who joined with it.
• Edit history: Your entries stay in your journal and exports until you delete them. When an entry is corrected or moved to Deleted, its original details are kept in its edit history.
• Photos uploaded before September 2026: Ella no longer uploads or shows photos. Photos uploaded before September 2026 are kept privately until you delete your journal or account, or ask us to delete them, and are then removed within 30 days.
• Crash reports and diagnostics: only if you switch them on in settings. Off by default. Firebase processes installation/session identifiers, technical crash details and app-session metrics to help us diagnose problems. We do not attach journal entries or photos and remove common identifiers from error messages before reporting them.
• Sharing policy and reports: we record your policy version and acceptance time. If you submit a report, we store your account identifier, the family and reported item or caregiver reference, your chosen reason and optional details, submission time and review status. Unconfirmed reports are kept privately on your device so retries use the same report.
• Device and security identifiers: Firebase and Google Play Integrity process installation, app and device identifiers to verify the app and protect the journal from abuse. Google processes this information as the provider of these services. The sign-in service also processes basic sign-in metadata, such as IP address and device type, for security.
• Closed-test access: if you ask to test Ella, we keep your Ella account email, the Google Play email you provide, and your partner's Play email if you nominate one in a private Cloudflare request queue. We email the request to Ella's administrator. After approval, the Play addresses go into the Play tester list and an administrator-only Firebase record so we can arrange access and honor the promised lifetime free access. Other families cannot see these records. You can ask privacy@muchita.ai to remove them; if you return later, we may need to verify your eligibility again.

Where it lives and who sees it

The family journal is stored in Cloud Firestore in europe-west1. Firebase Authentication, optional Crashlytics and Google Play Integrity also process information through Google's service infrastructure; their processing is not limited to that journal region. Invited family members can read and change their journal; members invited as view only can read it but not change it. Authorized Muchita AI administrators may access relevant records to investigate reports, handle support or deletion requests, or meet legal obligations. Reports are not visible to other family members. We do not sell data or use it for advertising. Keepsakes and journal summaries leave the app only when you choose to share them, through the app you pick.

The owner and members who can add entries can invite, once their account is saved. Each invitation says whether the person can add entries or only view the journal. An invitation is a link or QR code for one person, in the form https://ella.muchita.ai/join#CODE, and the message you share also names the baby. The code comes after the #, so browsers do not send it to our website. Until the invitation expires or the owner cancels it, anyone who has the link or code can see the baby's name and the inviter's name on it; after it expires, only the family owner can. If the invited person installs Ella from the invitation page, Google Play receives the code in the store link and passes it to Ella once, when Ella first opens, so the invitation is ready. Ella keeps that code on the phone until it is used or dismissed.

The web companion at ella.muchita.ai/app/ opens the same family journal in a browser, through the same Firebase services. Our website is served by Cloudflare, which processes standard connection data, such as IP address, to deliver it. The web companion has no analytics or advertising.

On your phone

A copy of the journal is kept on the device so the app works offline. Signing out removes the local copy, report files and drafts. Android cloud backup is disabled for the app. Pinned buttons, your shortcuts to apps and links, units, night mode, the default bottle amount, which baby you are viewing and when you last caught up on the journal stay on the phone and are not shared with your family. To name a YouTube or Spotify shortcut, the phone asks that service for the title of the link. In a browser, the web companion keeps its offline copy and these settings in the browser's storage. Signing out removes the offline copy, and clearing the site's data in the browser removes everything.

White noise is generated on the phone. Sound settings and the stop timer stay on your phone and are not shared with your family. The optional flashlight asks for Android camera permission only when you choose to enable it. Ella uses this permission to control the light; it does not take photos or record video. These controls do not send sound, images or flashlight usage to our servers.

Log by voice uses the microphone only while its window is open, after you allow microphone access, and stops when you leave the app. In English, on phones that support it, speech is turned into text on the phone. Otherwise, and always in Hebrew, Ella uses the phone's speech service, which may send the audio to its provider, such as Google, to turn it into text. Ella does not keep or send any audio. It shows what it heard and saves an entry only when you confirm; a spoken note is saved as text.

Home-screen widgets, Quick Settings tiles and the timer notification, which Android may show as a Live Update, show and change the same journal. They collect nothing new.

With Ella on a paired Wear OS watch, the phone sends the watch a short summary: the baby's name, the last feed with its time, side and amount, the last diaper, sleep and running timers. Taps on the watch go back to the phone and are saved like any other entry. Google's Wearable Data Layer carries this directly over Bluetooth, or end-to-end encrypted through Google's servers when Bluetooth is unavailable. The watch keeps the latest summary. Nothing new is stored on our servers.

The doctor-visit summary (PDF) and journal export (CSV) are created on the phone and leave it only when you share them, through the app you pick. Questions you write for the visit are kept only on the phone and printed in the summary. Ella deletes these files once they are 24 hours old, the next time it runs, and when you sign out. Shared keepsake images are deleted after an hour in the same way.

Health information and children

The journal contains health information about the baby: weight, height, head circumference, temperature, feeds and solids including reactions, milestones, and anything the family includes in notes or reminder titles. The app uses these entries to show the family charts, summaries and patterns from their journal. Growth percentiles from the WHO Child Growth Standards, and corrected age for a baby born early, are calculated on the phone from the birth date, due date and sex you enter, and are not saved to the journal. The common-allergen list only shows when foods containing them first appear in the journal. The app does not provide diagnoses or care recommendations. Data is stored for the family through the Google services described above; sharing outside the family is initiated by you. Ella is intended for adult parents and caregivers; children do not open accounts.

Account and data deletion

Family owners can remove family members, change whether they can add entries and cancel invitations at any time; whoever created an invitation can also cancel it. Any member except the owner can leave a family journal from People in the family.

Members who do not own the journal can delete their account in the app or the web companion: "Delete account and data" (on Android in Family & settings under Privacy & account) deletes the sign-in, their place in the family journal, their name in its list of people and their consent record right away. Entries they added stay in the family journal with the name shown on them; to have the name removed from those entries too, e-mail privacy@muchita.ai.

A journal owner can delete the whole journal in the app or the web companion with the same "Delete account and data" button, after confirming with their password or Google account. Ella then deletes every entry and its edit history, reminders, custom activities, babies, timers, invitations and the list of people, then the journal itself, the owner's consent record and the owner's account. Everyone else in the journal loses access to it. To keep the journal for the others, the owner can first hand it to another member with a saved account and then delete only their own account. A journal that is not yet saved to an account can be deleted the same way, on the phone or in the browser that holds it. You can also ask us by e-mail from your account's address, or with the account ID shown in the app, and we delete the account, its records and its photos within 30 days. Operational backups are purged within a further 90 days.

Previously uploaded photos

To request a copy or deletion of photos uploaded before September 2026 without deleting your account, e-mail privacy@muchita.ai from your account's address. We handle deletion requests within 30 days. Copies you previously shared through another app are not removed. Moving a journal entry to Deleted is separate and does not erase its edit history.

Our website

The Ella home pages at ella.muchita.ai (in each language) use Google Analytics 4 only if you choose Accept in the cookie notice. Google Analytics then sets first-party cookies (such as _ga) and receives the pages you view, the buttons, links, questions and film you choose, your approximate location derived from your IP address, and your device and browser type. We never send it journal content, names or e-mail addresses; Google signals and advertising features are off, and the data is kept for up to 14 months. If you choose No thanks, nothing is measured, and you can change your choice at any time with Cookie settings at the bottom of the page. The web companion, the apps and the invitation pages have no analytics. See also the terms of use and the accessibility statement.

When you choose a language on a Muchita website or in the web companion, we save its language code in local storage and a one-year preference cookie shared by muchita.ai, shopping.muchita.ai and ella.muchita.ai. This remembers your choice across our sites independently of analytics consent. The cookie contains no identifier or journal data. You can choose another language at any time or clear the sites' browser data. Dismissing a language suggestion lasts only for the tab session.

Who is responsible, legal bases and your rights

Muchita AI is the controller of the personal data described in this policy. You can reach us at privacy@muchita.ai.

We process account and journal data to provide Ella to you and your family (performance of a contract). Health information about the baby, such as measurements, temperature and feeds, is processed because you choose to record it after agreeing to the journal terms (explicit consent); you can withdraw it at any time by deleting the entries or the journal. Optional crash reports and website analytics run only with your consent. Records needed to handle reports, support requests and legal obligations are kept on the basis of our legitimate interests and legal duties.

We keep your journal while your account exists; deletion works as described above, and operational backups are purged within a further 90 days. Website analytics data is kept for up to 14 months.

Google (Firebase) and Cloudflare process data on our behalf under their data processing terms, which include standard contractual clauses for transfers outside the European Economic Area.

You can ask for access to your data, a copy in a portable format, correction, deletion, restriction of processing or objection, and you can withdraw consent at any time. Write to privacy@muchita.ai from your account's address; we answer within 30 days. You also have the right to complain to a data protection authority, such as the Israeli Privacy Protection Authority or the supervisory authority in your EU country.

Contact

privacy@muchita.ai