FirstNom
Last updated: 11 October 2026
This Privacy Policy explains how MOBILAPP Solutions d.o.o. ("we", "us", "our") handles personal data when you use the FirstNom mobile application (the "App") and the website at firstnom.app (the "Site"). FirstNom is built local-first: your baby's profile, food log and allergen history are stored on your device, and the App works without an account.
1. Who we are
MOBILAPP Solutions d.o.o.
Kralja Krešimira 53, 34000 Požega, Croatia
Email: [email protected]
Phone: +385 34 281 697
Director: Dinko Marinac
For data protection purposes, we are the data controller for personal data processed in connection with the App and the Site.
2. Data we process
2.1. Stored only on your device
- Baby profiles: name, birth date and the answers you give during setup.
- The food log, allergen exposures and any reactions you record, notes, and your try-list.
- Scan history: barcode, product name and time of scan.
- App settings: language, your answer to the usage-sharing question, and Pro status.
This data lives in a local database on your phone. We have no access to it, and it is never uploaded. The food database, recipes and guides ship inside the App; reading them sends nothing. If you delete the App, this data is deleted with it.
2.2. Processed by third parties on our behalf
- Open Food Facts — when you scan a packet, the App asks the public Open Food Facts database for that barcode. The request contains the barcode and standard request metadata (IP address, user agent), nothing about you or your baby. Open Food Facts is run by a French non-profit and is an independent controller for the requests it receives. The scanner reads barcodes from the live camera view; it takes no photos and stores none.
- RevenueCat — if you buy FirstNom Pro, RevenueCat, Inc. (USA) validates the purchase and tells the App whether Pro is active. It assigns an anonymous user ID and processes the receipt the App Store or Google Play returns. See the RevenueCat Privacy Policy.
- Apple App Store / Google Play — the store you buy through processes your payment, identity and tax information directly. We never see your payment details. See Apple's Privacy Policy and Google's Privacy Policy.
- Firebase Crashlytics — when the App crashes, it sends Google LLC (USA) a crash report: the error and where in the App's code it happened, the App version, device model, operating system version and a random installation identifier Crashlytics creates. It contains nothing you entered. We use it only to find and fix crashes. See Firebase's privacy information.
- PostHog, only with your consent — after setup, the App asks once whether you want to share anonymous usage; you can change your answer at any time in Settings → Privacy. If you say yes, the App starts PostHog's SDK (PostHog, Inc., USA), which stores a random identifier on your device and sends events such as a screen opened, a food logged or opened (the food, the meal and your baby's age in whole months), a recipe or guide opened or read to the end, an allergen exposure logged (the allergen and whether there was a reaction), a scan made, and purchases and restores. Until you say yes, or if you say no, the SDK never starts and nothing is stored on your device for analytics. PostHog never receives your baby's name, a note or anything else you type. See the PostHog Privacy Policy.
- Setup steps, without an identifier — before you answer the usage question, the only events sent are the setup steps a parent reaches and the setup being finished, with the device's region and the setup answers that are not health information (your baby's age in months, feeding approach, worries, who else feeds your baby, goal, confidence, and how many allergies were diagnosed, not which). They are sent to PostHog without an identifier that survives the App closing, with no IP-based location, and are never linked to a person.
- Google's barcode reader — on Android, Google's on-device barcode reader (ML Kit) may send Google anonymous diagnostics about its own performance.
2.3. The pediatrician PDF
The allergen report is generated on your device and is not uploaded anywhere. Where it goes after that (email, print, a messaging app) is your choice and out of our hands.
2.4. Site data
The Site is a static website. Our hosting provider may process technical request data (IP address, user agent, requested URL) to deliver pages and protect against abuse. We do not run analytics or advertising trackers on the Site and set no marketing cookies. The food search runs in your browser; a search ends up only in the URL of the page you open.
3. Why we process this data (legal bases)
- To deliver the App's functions you ask for — looking up a scanned barcode, the food database, the log and tracker (Art. 6(1)(b) GDPR — performance of a contract you initiate by using the App).
- To deliver and bill the optional Pro subscription (Art. 6(1)(b) GDPR).
- To find and fix crashes through Crashlytics, and to understand how setup is used through the anonymous setup events (Art. 6(1)(f) GDPR — our legitimate interest in a working App).
- Usage analytics, only if you say yes (Art. 6(1)(a) GDPR — consent). Allergen exposures and reactions are health information, so for those events your yes is explicit consent under Art. 9(2)(a) GDPR. You can withdraw it at any time in Settings → Privacy.
- To meet our tax, accounting and consumer-protection obligations (Art. 6(1)(c) GDPR).
- To keep the Site online and prevent abuse (Art. 6(1)(f) GDPR — legitimate interests).
4. Data we do not collect
- We do not require an account.
- We do not run advertising SDKs.
- We do not collect the IDFA or Advertising ID. PostHog is used only for product analytics within the App, so iOS App Tracking Transparency (ATT) does not apply.
- We do not take or store photos.
- Your baby's name and your notes never leave your device.
- We do not sell personal data to anyone.
5. International transfers
RevenueCat, PostHog and Google (Firebase) are based in the United States. Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (Art. 46 GDPR) or equivalent safeguards, which their data processing agreements include.
6. Retention
Data on your device is kept until you delete it in the App (a food log can be cleared in Settings) or uninstall the App. Crash reports are kept by Crashlytics for 90 days. Usage events are kept by PostHog according to its retention settings and are deleted on request. Subscription records held by RevenueCat and the stores are kept according to their own policies and applicable tax law. Emails you send us are kept as long as needed to answer them.
7. Your rights
Under the GDPR and the Croatian Act on the Implementation of the GDPR, you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent at any time without affecting the lawfulness of processing before it.
Because most of your data never leaves your device, most rights are exercised in the App itself: remove a baby, clear the food log, turn usage sharing off, or uninstall. For anything that falls on us, write to [email protected] and we will answer within 30 days.
You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka — AZOP, azop.hr) or your local supervisory authority.
8. Children
FirstNom is for parents and carers, not for children. We do not knowingly collect data from anyone under 16 as a user. What you record about your baby stays on your device, apart from the usage events described in 2.2 if you agree to them.
9. Security
App data is stored on your device and protected by the operating system's standard sandboxing. Network requests use HTTPS. We take reasonable technical and organisational measures to protect the data we process.
10. Changes to this policy
We will update this page if our practices change. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated in the App or on the Site.
11. Contact
Questions about this policy? Write to [email protected].