Ella privacy policy

Updated 12 November 2026 · Ella is a baby-journal app by Muchita AI

What is stored

• Account: e-mail address and display name, through Firebase Authentication. You can also start a journal without an account: Ella then creates an anonymous account that opens the journal only on that phone, until you save it with an e-mail address or Google. The app says so on the start screen and on Today until the journal is saved. With Google, Firebase also keeps the basic profile Google shares at sign-in. Each account has an account ID. Your name in the family is the one you choose, and you can change it.
• The family journal: the baby's name and optional birth date, due date, sex and feeding style, and the same details for any other baby in the journal, such as twins; feeds (including left and right nursing times), sleep, diapers, solids (food, amount, first time and reaction), milestones, physical activity, measurements and notes the family enters, including who recorded each entry and when; family members' names and roles; and the reminders the family sets.
• Invitations: the family an invitation opens, the baby's name, the inviter's name, who created it, when it expires (at most 7 days later) and, once used, who joined with it.
• Edit history: Your entries stay in your journal and exports until you delete them. When an entry is corrected or moved to Deleted, its original details are kept in its edit history.
• Photos uploaded before September 2026: Ella no longer uploads or shows photos. Photos uploaded before September 2026 are kept privately until you delete your journal or account, or ask us to delete them, and are then removed within 30 days.
• Crash reports and diagnostics: only if you switch them on in settings. Off by default. Firebase processes installation/session identifiers, technical crash details and app-session metrics to help us diagnose problems. We do not attach journal entries or photos and remove common identifiers from error messages before reporting them.
• Sharing policy and reports: we record your policy version and acceptance time. If you submit a report, we store your account identifier, the family and reported item or caregiver reference, your chosen reason and optional details, submission time and review status. Unconfirmed reports are kept privately on your device so retries use the same report.
• Device and security identifiers: Firebase and Google Play Integrity process installation, app and device identifiers to verify the app and protect the journal from abuse. Google processes this information as the provider of these services. The sign-in service also processes basic sign-in metadata, such as IP address and device type, for security.
• For former Android testers, we retain the Ella and Google Play email addresses provided for them and their nominated partner in private Cloudflare and administrator-only Firebase records to honor lifetime access. Other families cannot see them. To request deletion, contact privacy@muchita.ai.

Where it lives and who sees it

The family journal is stored in Cloud Firestore in europe-west1. Firebase Authentication, optional Crashlytics, Google Analytics for Firebase (only as described in Send usage and ad-measurement data) and Google Play Integrity also process information through Google's service infrastructure; their processing is not limited to that journal region. Invited family members can read and change their journal; members invited as view only can read it but not change it. Authorized Muchita AI administrators may access relevant records to investigate reports, handle support or deletion requests, or meet legal obligations. Reports are not visible to other family members. We never sell data and never use it for personalized ads; its only use related to advertising is measuring our own ads, as described below. Keepsakes and journal summaries leave the app only when you choose to share them, through the app you pick.

Once their account is saved, the owner can invite people to add entries or only view the journal. Members who can add entries can invite people to view only, once their own account is saved. Each invitation states the permission it grants. An invitation is a link or QR code for one person, in the form https://ella.muchita.ai/join#CODE, and the message you share also names the baby. The code comes after the #, so browsers do not send it to our website. Until the invitation expires or the owner cancels it, anyone who has the link or code can see the baby's name and the inviter's name on it; after it expires, only the family owner can. If the invited person installs Ella from the invitation page, Google Play receives the code in the store link and passes it to Ella once, when Ella first opens, so the invitation is ready. Ella keeps that code on the phone until it is used or dismissed. If ad measurement is on, Google Analytics also reads the install referrer to learn which ad or link led to the installation.

The web companion at ella.muchita.ai/app/ opens the same family journal in a browser, through the same Firebase services. Our website is served by Cloudflare, which processes standard connection data, such as IP address, to deliver it.

On your phone

A copy of the journal is kept on the device so the app works offline. Signing out removes the local copy, report files and drafts. Android cloud backup is disabled for the app. Pinned buttons, your shortcuts to apps and links, units, night mode, the default bottle amount, which baby you are viewing and when you last caught up on the journal stay on the phone and are not shared with your family. To name a YouTube or Spotify shortcut, the phone asks that service for the title of the link. In a browser, the web companion keeps its offline copy and these settings in the browser's storage. Signing out removes the offline copy, and clearing the site's data in the browser removes everything.

White noise is generated on the phone. Sound settings and the stop timer stay on your phone and are not shared with your family. The optional flashlight asks for Android camera permission only when you choose to enable it. Ella uses this permission to control the light; it does not take photos or record video. These controls do not send sound, images or flashlight usage to our servers.

Voice logging supports Ella's 14 app languages on Android and the web when the phone or browser provides speech recognition. It uses the microphone with your permission while the voice window is open and stops when you close the voice window. On Android, it also stops when you leave the app. Compatible Android phones can recognize English on the device. In other cases, the phone or browser speech service may send audio to its provider, such as Google, for transcription. Ella does not retain audio or upload it to Ella's servers. It shows the recognized text and saves the entry only after you confirm; dictated notes are saved as text.

Home-screen widgets, Quick Settings tiles and the timer notification, which Android may show as a Live Update, show and change the same journal. They collect nothing new, although an entry saved from them counts like any other for ad measurement, if it is on.

With Ella on a paired Wear OS watch, the phone sends the watch a short summary: the baby's name, the last feed with its time, side and amount, the last diaper, sleep and running timers. Taps on the watch go back to the phone and are saved like any other entry. Google's Wearable Data Layer carries this directly over Bluetooth, or end-to-end encrypted through Google's servers when Bluetooth is unavailable. The watch keeps the latest summary and has no analytics of its own. Nothing new is stored on our servers.

On Android, the doctor-visit summary (PDF) and journal export (CSV) are created on the phone and leave it only when you share them, through the app you pick. Questions you write for the visit are kept only on the phone and printed in the summary. Ella deletes these files once they are 24 hours old, the next time it runs, and when you sign out. Shared keepsake images are deleted after an hour in the same way.

Send usage and ad-measurement data

Ella for Android includes Google Analytics for Firebase, which we use only to measure our own Google Ads campaigns. It can run only on a new installation of Ella 1.4.6 or later, never on a phone where Ella was updated from an older version, and only during the first 30 days after installing. Development builds and Google Play's automated test devices never send anything. During those 30 days, the switch "Send usage and ad-measurement data" appears in Family & settings, under Privacy & account.

In India it is on by default, but only when the phone's SIM card, mobile network and time zone all say India. Ella checks this on the phone and never sends these signals anywhere. Everywhere else it stays off unless you turn it on. You can change your choice at any time; turning the switch off stops collection and resets the analytics ID on the phone.

When it is on, Ella reports these actions, with no details about them: the first entry saved on the phone, the journal being shared with a second person, and coming back to Ella 2 or more days after first opening it. Google Analytics also collects some information automatically: first open, sessions, app and Android updates, uninstall, device model, Android version, language, app version, install referrer and campaign data, the app-instance ID, the Advertising ID and an approximate location derived from your IP address. If crash reports are also on, it records that Ella crashed (an app_exception event). It never receives what you record: no entries, names, photos or details about your baby. From version 1.4.7, Ella also reports four setup milestones once per install: opening setup, attempting to create a journal, a failed creation attempt, and reaching Today. No form values or error details are sent. Other screen visits are not reported.

We use this data only to see which of our ads lead to Ella being installed and used. Ella always tells Google that ad personalization is not allowed, so the data is never used for personalized ads, and Google signals is off. For this ad measurement, Google acts as an independent controller of the data; see How Google uses information from sites or apps that use our services.

Google Analytics keeps event-level data for 2 months. Aggregated reports and Google Ads conversion statistics may be kept longer. You can reset or delete your phone's Advertising ID at any time in Android settings.

Health information and children

The journal contains health information about the baby: weight, height, head circumference, temperature, feeds and solids including reactions, milestones, and anything the family includes in notes or reminder titles. The app uses these entries to show the family charts, summaries and patterns from their journal. Growth percentiles from the WHO Child Growth Standards, and corrected age for a baby born early, are calculated on the phone from the birth date, due date and sex you enter, and are not saved to the journal. The common-allergen list only shows when foods containing them first appear in the journal. The app does not provide diagnoses or care recommendations. Data is stored for the family through the Google services described above; sharing outside the family is initiated by you. Ella is intended for adult parents and caregivers; children do not open accounts.

Breach notification

If a breach of security involves health information in Ella, we will notify the affected users without unreasonable delay and no later than 60 calendar days after we discover it, or sooner if the law requires. We will also notify regulators where the law requires.

Account and data deletion

Family owners can remove family members, change whether they can add entries and cancel invitations at any time; whoever created an invitation can also cancel it. Any member except the owner can leave a family journal from People in the family.

Members who do not own the journal can delete their account in the app or the web companion: "Delete account and data" (on Android in Family & settings under Privacy & account) deletes the sign-in, their place in the family journal, their name in its list of people and their consent record right away. Entries they added stay in the family journal with the name shown on them; to have the name removed from those entries too, e-mail privacy@muchita.ai.

A journal owner can delete the whole journal in the app or the web companion with the same "Delete account and data" button, after confirming with their password or Google account. Ella then deletes every entry and its edit history, reminders, custom activities, babies, timers, invitations and the list of people, then the journal itself, the owner's consent record and the owner's account. Everyone else in the journal loses access to it. To keep the journal for the others, the owner can first hand it to another member with a saved account and then delete only their own account. A journal that is not yet saved to an account can be deleted the same way, on the phone or in the browser that holds it. You can also ask us by e-mail from your account's address, or with the account ID shown in the app, and we delete the account, its records and its photos within 30 days. Operational backups are purged within a further 90 days.

Previously uploaded photos

To request a copy or deletion of photos uploaded before September 2026 without deleting your account, e-mail privacy@muchita.ai from your account's address. We handle deletion requests within 30 days. Copies you previously shared through another app are not removed. Moving a journal entry to Deleted is separate and does not erase its edit history.

Our website

Care guides use an optional date of birth only in page memory. It is cleared when you leave, reload or select Clear date and is not sent to Ella. Any previously remembered care-guide birth date is removed when you open a care page. Your chosen units and tummy-time total are saved in this browser until you clear the site's stored data; the tummy-time total restarts each day. These tools are separate from the signed-in journal. The WHO growth reference page asks for nothing about your baby; it only remembers your chosen units in this browser.

Separately, you can opt in to Google Ads registration measurement using the optional checkbox in Cookie settings. Google can then connect an ad click to confirmed creation of an Ella account in the browser, using advertising cookies such as _gcl_aw, a random event ID, browser and device information and your IP address. This happens on a separate confirmation page; journal activity is not measured. We never send names, email addresses, account IDs, baby details or journal content to Google Ads. Personalized advertising and remarketing remain disabled. Previous analytics consent alone does not allow this measurement. You can withdraw consent in Cookie settings.

The Ella home pages at ella.muchita.ai (in each language) use Google Analytics 4 only if you choose Accept in the cookie notice. Google Analytics then sets first-party cookies (such as _ga) and receives the pages you view, the buttons, links, questions and film you choose, your approximate location derived from your IP address, and your device and browser type. We never send it journal content, names or e-mail addresses; Google signals and advertising features are off, and the data is kept for up to 14 months. If you choose No thanks, nothing is measured, and you can change your choice at any time with Cookie settings at the bottom of the page. See also the terms of use and the accessibility statement.

When you choose a language on a Muchita website or in the web companion, we save its language code in local storage and a one-year preference cookie shared by muchita.ai, shopping.muchita.ai and ella.muchita.ai. This remembers your choice across our sites independently of analytics consent. The cookie contains no identifier or journal data. You can choose another language at any time or clear the sites' browser data. Dismissing a language suggestion lasts only for the tab session.

Where Ella is offered

The Ella apps and the web companion are not offered in the European Union, the European Economic Area, the United Kingdom or Switzerland. Our free newborn care guides stay readable everywhere.

Visitors from those countries get no analytics or ad measurement: the website does not load it for them, and our site server discards any usage analytics sent from those countries instead of storing it. Visitors from those countries also cannot sign in to the web companion or open invitations.

If you already use Ella in one of those countries, we will contact you. You can export your journal on Android or ask us for a copy at privacy@muchita.ai. After a notice period, we will delete accounts that remain in those countries.

Who is responsible, legal bases and your rights

Zahi Cohen, operating Muchita AI in Israel, is the controller of the personal data described in this policy. You can reach us at privacy@muchita.ai.

We process account and journal data to provide Ella to you and your family (performance of a contract). Health information about the baby, such as measurements, temperature and feeds, is processed with the explicit permission required for children’s and health information from a parent or legal guardian; you can withdraw it at any time by deleting the entries or the journal. Optional crash reports and website analytics run only with your consent. Outside India, ad measurement in the Android app is also based on your consent: its switch stays off until you turn it on. In India it is on by default, and you can turn it off at any time in Family & settings, under Privacy & account. This default is based on our legitimate interest in measuring our own ads. Records needed to handle reports, support requests and legal obligations are kept on the basis of our legitimate interests and legal duties.

We keep your journal while your account exists; deletion works as described above, and operational backups are purged within a further 90 days. Website analytics data is kept for up to 14 months. For ad measurement in the Android app, Google Analytics keeps event-level data for 2 months; aggregated reports and Google Ads conversion statistics may be kept longer.

Google (Firebase) and Cloudflare process data on our behalf, including outside your country, under their data processing terms. For measuring our Google Ads campaigns, Google acts as an independent controller of the data it receives.

You can ask for access to your data, a copy in a portable format, correction, deletion, restriction of processing or objection, and you can withdraw consent at any time. Write to privacy@muchita.ai from your account's address; we respond within the period required by the applicable law. For Indonesian withdrawal requests, processing based on that consent stops within 3 x 24 hours after receipt. You also have the right to complain to a data protection authority, such as the Israeli Privacy Protection Authority or your local data protection authority.

Contact

privacy@muchita.ai