Midnight Mums Club

1. Introduction

Midnight Mums Club ("we", "us", "our", or the "App") is operated by Afiniti Global Ltd ("the Company"). We are committed to protecting the privacy and personal information of mothers, mothers-to-be, and caregivers who use our mobile application and related services (collectively, the "Service").

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have in relation to your personal data. By downloading, installing, registering for, or using the App, you acknowledge that you have read and understood this Privacy Policy.

This policy complies with the UK Data Protection Act 2018, the UK/EU General Data Protection Regulation (GDPR), the Children's Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA), and the Google Play Developer Program Policies.

2. Data Controller & Contact Information

The data controller responsible for your personal data is:

For any privacy-related questions, requests, or complaints, please contact us using the details above. We aim to respond to all enquiries within 30 days.

3. Age Restrictions

Midnight Mums Club is intended for use by adults aged 18 and over. The App is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information as soon as possible.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at the email address above.

4. Information We Collect

4.1 Information You Provide Directly

• Account Information: name, email address, password (hashed), date of birth, phone number, profile photo.
• Profile Content: biography, user-selected tags (e.g. "New Mum", "TTC", "Working Mum"), and any other information you choose to add to your profile.
• Baby & Pregnancy Data: baby names, dates of birth, growth measurements (height, weight), pregnancy due dates, and monthly activity logs — all of which you choose to enter.
• Wellness Data: mood check-ins, selected emotions, activity logs, sleep hours, and personal affirmations (including audio recordings and images you upload).
• Forum & Social Content: posts, comments, replies, images, videos, voice notes, polls, and any other content you create or share through the App.
• Chat Messages: text, images, voice notes, and video messages sent within forum chat rooms and SOS emergency requests.
• Reports & Moderation: reports you file about other users, posts, or messages, including reason categories and optional details.

4.2 Information Collected Automatically

• Device Information: device model, operating system version, unique device identifiers, language settings, and time zone.
• Usage Data: last active timestamp, screens visited, features used, and interactions with chats and posts (to improve user experience and power our notification system).
• Presence Data: information about whether you are actively viewing a specific chat at any given time (used to avoid sending duplicate push notifications).
• Technical Data: IP address (processed transiently by Firebase and not stored long-term by us), crash logs, and diagnostic information.
• Push Notification Tokens: Firebase Cloud Messaging (FCM) tokens so we can deliver in-app notifications, community alerts, and re-engagement messages.

4.3 Permissions We Request

• Camera & Photo Library: to allow you to share photos and videos in posts, chats, and your profile.
• Microphone: to record voice notes and affirmations.
• Notifications: to deliver push notifications (you may decline or disable these in your device settings).
• Storage: to save downloaded content (e.g. meditation audio) and cached images.
• Location (Coarse/Fine): only when expressly used by a feature you enable. We do not track your location in the background.

4.4 Sensitive Categories of Data

Some information you voluntarily provide (such as pregnancy status, pregnancy loss, mood, or emotional state) may constitute special category data under UK/EU GDPR. We process this data only with your explicit consent (provided when you use the relevant feature) and only for the purpose of delivering the wellness and community features you request.

5. How We Use Your Information

We use your personal information for the following purposes:

• To Provide the Service: create and manage your account, display your profile and content, enable chat and social features, and deliver wellness tools.
• To Communicate With You: send push notifications, broadcast messages from administrators, service announcements, re-engagement reminders, and respond to your enquiries.
• To Personalise Your Experience: show relevant posts, suggest topics, and tailor wellness content based on your preferences and activity.
• To Ensure Safety & Moderation: review reported content, enforce community guidelines, detect inappropriate content through automated keyword filters, and take action against users who violate our terms (including muting, banning, or account termination).
• To Manage Subscriptions: process in-app purchases via Apple App Store and Google Play, track subscription status, and provide premium features to paying users.
• For Analytics: measure daily and weekly active users, identify inactive users for re-engagement, and understand feature usage in aggregate to improve the App.
• For Legal & Security Purposes: comply with legal obligations, enforce our Terms of Service, prevent fraud, and protect the rights, property, and safety of users.

6. Legal Basis for Processing (UK/EU GDPR)

Under UK/EU data protection law, we rely on the following legal bases to process your data:

• Contract: processing necessary to provide the Service you signed up for (account, chat, posts, subscriptions).
• Consent: for special category data (pregnancy, loss, mood), push notifications, and any optional features you enable. You can withdraw consent at any time.
• Legitimate Interests: to keep the community safe, prevent abuse, improve the App, and communicate important service updates — balanced against your rights and freedoms.
• Legal Obligation: where we are legally required to retain or disclose data (e.g. safeguarding, regulatory requests).

7. Who We Share Your Information With

We do not sell your personal information. We share data only with the following categories of recipients and only where necessary:

7.1 Service Providers (Processors)

• Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Analytics) — to host your account, store your data, and deliver push notifications. Data is processed in Google data centres under Google's Data Processing Terms. See the Firebase Privacy Policy.
• Apple App Store & Google Play — for in-app purchases and subscription processing. We do not receive or store your payment card details.

7.2 Other Users

Content you post publicly (posts, comments, forum chat messages, profile photo, name) is visible to other users of the App. You can post anonymously ("Incognito" posts) where supported. Private profile fields (email, phone) are not shared with other users.

7.3 Administrators & Moderators

Authorised administrators of the Company can access user profile details, subscription status, posts, chat messages, and reports for moderation and support purposes.

7.4 Legal Disclosures

We may disclose your data when required by law, such as in response to a valid court order, subpoena, or government request, or to protect the safety of our users or the public.

7.5 Business Transfers

If Afiniti Global Ltd is involved in a merger, acquisition, or asset sale, your data may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

8. International Data Transfers

Firebase servers are located in the United States and other countries. By using the App, you consent to the transfer of your data to these jurisdictions, which may have different data protection laws than your country. Transfers are protected by appropriate safeguards including Google's Standard Contractual Clauses and the EU-US Data Privacy Framework.

9. Data Retention

• Account Data: retained while your account is active. If you delete your account, we delete your personal data within 30 days (see Section 10).
• Chat Messages: messages automatically expire and are deleted 7 days after being sent to protect ongoing privacy.
• Posts, Comments & Wellness Data: retained until you delete them or delete your account.
• Reports & Moderation Logs: retained for up to 2 years for safety audit purposes.
• Analytics Snapshots: aggregated daily analytics are retained for up to 2 years. These do not contain personally identifiable information.
• Legal & Financial Records: retained for 6 years as required by UK tax and accounting law.

10. Your Rights

Under UK/EU GDPR, CCPA, and other applicable laws, you have the following rights:

• Right of Access: request a copy of the personal data we hold about you.
• Right to Rectification: correct inaccurate or incomplete information (most fields can be edited directly in the App).
• Right to Erasure ("Right to be Forgotten"): delete your account and all associated data via Profile → Delete Account in the App, or by emailing us.
• Right to Restrict Processing: ask us to temporarily stop processing your data.
• Right to Data Portability: receive your data in a portable, machine-readable format.
• Right to Object: object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: withdraw your consent at any time where processing is based on consent.
• Right to Lodge a Complaint: complain to your local data protection authority. In the UK, this is the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, contact us at teamafinitiglobal@gmail.com.

11. Data Security

We take data security seriously and implement technical and organisational measures to protect your personal information:

• All data is transmitted over encrypted HTTPS/TLS connections.
• Passwords are securely hashed by Firebase Authentication and never stored in plain text.
• Firestore Security Rules restrict access so users can only read and write their own data (except for public posts and forum messages).
• Administrative access to the backend is protected by authentication and audit logs.
• Automated profanity and keyword filters help identify harmful content.

Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but we will notify affected users and authorities of any data breach as required by law.

12. Cookies & Tracking Technologies

The App itself does not use cookies. Our administrative web panel (used only by staff) uses essential cookies for authentication. Firebase Analytics uses device identifiers to measure app performance in aggregate; you can opt out of analytics collection via your device settings.

13. Third-Party Links & Content

The App may contain links to third-party websites or resources. We are not responsible for the content or privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

14. California Privacy Rights (CCPA)

If you are a California resident, you have the right to request what personal information we collect, why we collect it, and with whom it's shared. You have the right to request deletion of your personal information and to opt out of the sale of personal information. We do not sell personal information. To exercise these rights, contact us at the email above.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy in the App and on this page, and updating the "Last Updated" date. For significant changes, we will also send an in-app notification. Your continued use of the App after the effective date constitutes your acceptance of the revised policy.

16. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us: