Privacy policy

The Newborn List is a personalized baby shopping list generator operated by Jake, sole trader based in the United Kingdom ("we", "us", "our"). This policy explains what personal data we collect when you use www.thenewbornlist.com, how we use it, who we share it with, and the rights UK GDPR gives you over it.

What we collect

Everything below is collected in one of two ways: because you gave it to us, or because it's a technical necessity to run the service.

• Account data. Your email address, a hashed version of your password, and optionally your name. We never store passwords in plain text.
• List content. The answers you give the personalization questionnaire (due date, climate zone, hemisphere, style, budget, feeding intention, and so on) and the items you tick off, add, or remove from your generated list.
• Session cookies. A NextAuth session cookie so you stay signed in, and a CSRF-protection cookie. Both are essential — the site can't function without them.
• Analytics. Vercel Analytics counts page views. It's cookie-free and doesn't identify individuals.
• Error tracking. Sentry captures technical errors so we can fix bugs. Errors may include your browser type, the URL you were on, and a session ID we generate — but not your list content or credentials.
• Advertising cookies (from launch onwards). Google AdSense sets cookies to serve and measure ads. See "Cookies" below and the cookie notice on the site.

Why we're allowed to process it

UK GDPR requires a lawful basis for every use:

• Contract — we need your account data and list content to give you the service you signed up for.
• Legitimate interest — analytics and error tracking help us keep the site working. You can object; see "Your rights" below.
• Consent — advertising cookies. You can accept or reject via the cookie notice at the bottom of the page.

Who we share it with

We use third-party services to run the site. Your data passes through some of them by necessity:

• Neon — database. Stores your account and list data.
• Vercel — hosting + analytics.
• Resend — sends the verification email when you sign up.
• Sentry — error monitoring.
• Google — sign-in if you choose "Continue with Google", and AdSense for advertising from launch onwards.
• Affiliate networks (Amazon Associates UK, Awin, Webgains). We don't hand your personal data to them. When you click a product link on your list, the affiliate network sets its own cookie in your browser to attribute a possible sale back to us. See our affiliate disclosure for detail.

Some of these providers process data outside the UK. We rely on the standard UK GDPR safeguards (adequacy decisions, standard contractual clauses) for those transfers.

Cookies

Three categories:

• Essential. Session and CSRF cookies from NextAuth. Set on every request; you can't opt out and use the site.
• Analytics. Vercel Analytics — cookie-free, so nothing to opt out of.
• Advertising. Google AdSense (post-launch). Only set if you accept the cookie notice. You can change your mind any time via the notice.

How long we keep it

• Active account: for the life of the account.
• Deleted account: we hold the data for 30 days so you can restore it if you change your mind, then permanently erase it.
• Analytics + error logs: retained per third-party defaults (Vercel Analytics: 30 days for the free tier; Sentry: 30-90 days depending on plan).
• Affiliate click / commission records (see affiliate disclosure): kept for as long as needed to reconcile earnings, then anonymised.

Your rights

Under UK GDPR you can, at any time:

• Ask what data we hold about you (access).
• Ask us to correct anything wrong (rectification).
• Ask us to delete your data (erasure — subject to legal retention obligations).
• Ask for a portable copy of your data (portability).
• Object to processing based on legitimate interest.
• Withdraw consent (e.g. advertising cookies) at any time.
• Complain to the Information Commissioner's Office (ico.org.uk) if you think we've handled your data badly.

To exercise any of the above, email hello@thenewbornlist.com. We aim to respond within 30 days.

Children

The service is for adults planning for a baby. We don't knowingly collect personal data from anyone under 16.

Changes

If we materially change this policy we'll email you (if you have an account) and update the "Last updated" date at the top.

Contact

Questions or data-subject requests: hello@thenewbornlist.com.