Privacy Policy

Effective date: October 24, 2026 · Version 1.6

This Privacy Policy explains how GYST Baby LLC, the owner and operator of the GYST Baby application ("GYST," "we," "us," "our"), handles information. By using GYST you agree to this policy.

The short version

The information you enter stays in your hands: on your device and, if you're signed in to iCloud, synced through your own private iCloud account so your plan appears on your other devices. We do not operate accounts, we do not sell your information, and we do not use it for advertising. If you buy GYST Baby Unlock, Apple handles the payment; we never see your payment details or who you are. We don't read your private iCloud data, and nothing we run does.

Two optional features work differently, because they have to. GYST Family sends requests between people you invite and, if you each choose to, shares your GYST Log, visits, lists and the rest of your plan with them — through Apple's own sharing, never through us. The baby shower wish list publishes items you pick to a web page we run, so guests can see them without an app. Both are off until you turn them on, and both are described in full below. If you share with your GYST Family, your entries are also kept in the iCloud of whoever runs the family and on the phones of the people you share with, who can change or delete them and keep their own copy. Turning either feature off stops it, but what you already shared with your GYST Family stays with the people you shared it with, apart from what you choose to take back when you leave or erase (see below). Separately, if you set up GYST as the one expecting, you can review and send a single symptom entry to a partner you pick, as a read-only copy no one else in the family receives; taking that copy back needs a connection, and your partner may already have read it.

What is stored on your device

When you set up and use GYST, the following is stored locally on your device:

• Your due date, or your child's or children's birthdays, and a name or nickname for each baby (optional with one baby; once you add more than one, each needs a name so GYST can tell them apart).
• Your plan: generated tasks, appointments, milestones, and the items you check off.
• Events, notes, and questions you add.
• Your GYST Log: what you record about your pregnancy and your baby. While you're expecting that can include water, vitamins, medications, activity, symptoms, moods, weight, blood pressure, blood sugar, kick counts, contractions and sleep; after the birth, feeds, pumping, bottles, diapers, potty, naps, tummy time, temperature, illness, medicines, growth measurements, and the foods your baby tries and any reaction. It also holds the notes you write in the Log, on their own or on any entry. Wellness check-ins — how you feel, and where — are kept here too. This is health information about you and your baby, so we list it in full.
• Your birth plan, your hospital bag, and your GYST at Home lists.
• Shopping-list details you enter (stores, links, prices, who's buying). Stores, links, prices, and your own notes are never published to a wish list.
• Family members and caregivers you add (a name and role only — used to organize buying and sharing; we never contact them and they are not accounts).
• Developmental milestones you mark as observed.
• Your baby name finder choices: the names you loved, passed on, or saved.
• The pictures, emoji and colours you choose for your baby.
• The baby info card, if you fill it in: your pediatrician's name and number, any known allergies, and emergency contacts. This is health information about your child or children, so we name it here rather than leaving it to the general description above.
• Your reminder, notification and display preferences (for example units, sounds, App Lock, and how your Log is laid out).
• The content choices you make in Make it yours (which topics GYST shows you). They stay on this device: they are not synced to your other devices or shared with your GYST Family.

This information stays on your device and within your device's own backup/sync (for example, an encrypted device backup you control). We do not receive any of it, apart from the two optional features you turn on yourself: a baby shower wish list you choose to publish, and — if you use GYST Family — the short invite code records described below. If you choose to share with your GYST Family, the parts described below also go to the people you share with, through Apple, not through us.

Three things are deliberately kept on one device only and are never synced anywhere or shared with your GYST Family: your own meds & vitamins list, any passcode you set for a published wish list, and the pictures, emoji and colours you choose for your baby.

iCloud sync

If you are signed in to iCloud, GYST stores your information in your private iCloud database using Apple's CloudKit service, so the same plan appears on your iPhone, iPad, and Mac. This includes the baby info card described above — so the allergy line you type on your phone is there on your iPad when someone else is holding it. The baby info card is never shared with your GYST Family; see below for what can be, and only if you choose to. If you share with your GYST Family, the entries the others share with you are stored in your private database too. Your private database lives in your Apple Account, is protected by Apple's iCloud security (encrypted in transit and on Apple's servers), and is accessible only to you — not to us — apart from any GYST Family areas kept in it, described below. We don't read your private database, and nothing we run ever touches it. If you sign out of iCloud or disable iCloud Drive for GYST in your device settings, your information simply stays on the device. Apple's handling of iCloud data is governed by Apple's own privacy policy.

GYST also keeps a few small settings in iCloud's key-value storage for your Apple Account, so they follow you between your own devices: your name and role, whether GYST is paused, which visits are still waiting for a confirmed time, your family invite code, any keys your devices use to read requests to join your family, and whether invites are turned off, your answers about family sharing; for each of your devices, which version of GYST it last ran, whether it is an iPhone, iPad or Mac, and the day it last opened GYST; and, if you publish a wish list, its link code, host name, message, which items it put up and the scrambled form of its password. Only your own devices can read them, and "Erase all data" clears them, apart from your other devices' version notes (each device removes its own when it is erased, and a note nobody has renewed for 180 days is dropped). The version notes are there so that adding a second baby can never be undone by an older version of GYST on another of your devices: each device that opens GYST 2.0 or later writes its version number, its kind (iPhone, iPad or Mac) and the day it last opened there. A note holds a random number for that install, never the device's name or a hardware identifier. A device that has never opened GYST 2.0 leaves no note, which is why GYST also asks you whether GYST is on any other device before you add a baby. A few technical markers that hold nothing you typed can stay there after an erase, such as the date your account first ran a GYST update that changed how the Log stores entries, and the flags and counters that keep your devices in step.

GYST Family (optional)

If you start or join a GYST Family, Apple's own sharing creates a shared area of iCloud, held in the iCloud account of whoever started the family, that every member can read. What goes there is anything you assign — the task or event title, its details, its date, and who it is for — plus your name, your role, and a short record of who finished what. Members join with the Apple Account already on their device, there is no GYST account, and we never see a password. The family is invite-only: Apple's sharing admits only the accounts whoever runs the family has let in, so holding a link to it is not enough. One deliberate exception: if you turn on "Let my GYST Family know I checked in" in a wellness check-in, the family activity feed records that you checked in and whether it was a good day or a rough one — "Checked in — feeling good today" or "Checked in — not feeling great today". Which symptom you picked, which part of your body you tapped, and anything you wrote down never leave your private database. Turning the toggle off stops even that. Browsing the symptom body map does not save or share anything.

Sharing your plan, only if you each say yes. GYST Family can also share much more than requests. Sharing is arriving in stages, so your copy of GYST may not offer it yet; until it does, nothing in this part applies to you. Until you say yes, nothing of yours is shared (if you are a view-only member, see the note on your colour under "Where shared entries are kept"). Whoever runs the family chooses whom to share with, and nothing is shared until they confirm it and each of those people taps "Start sharing" on their own phone. If whoever runs the family later turns someone else on, GYST asks you first, on your own phone. Nothing the family shares goes to them until everyone who is sharing has said yes to them. GYST Family shows who you're sharing with, and you can stop sharing what you add at any time. GYST never shows the shared entries to view-only members, or to anyone the family's owner has not turned on, and iCloud enforces that too: the shared entries are open only to the people the family's owner has turned on. Even so, invite only people you trust, because everyone you share with can see, change and keep what you share. Once you are sharing, the people you share with see your GYST Log, your visits and their questions and notes, the GYST List, your calendar, your shopping list and wish list (including prices, stores, links, notes and who's buying), your birth plan and hospital bag, milestones, GYST at Home, your baby's name, due date and birthday, and, from the name finder, the names you marked "Love it" or "Maybe yes", your saved name combinations and the names you picked in Match — and you see theirs. If you have more than one baby in GYST, twins included, GYST Family shares one baby's entries: whoever runs the family picks which when sharing starts, and GYST names it on each other baby's page in Settings. Anything filed under another baby stays on your devices. Everyone you share with can add, change and delete these entries, not only read them. GYST shows who added or changed a shared entry, with a colour for each person.

What is never shared. Wellness check-ins (beyond the one line above, and a symptom entry you choose to send to a partner, described under "Selected symptom entries" below), the baby info card, your meds & vitamins list, your babies' pictures, emoji and colours, the names you passed on in the name finder, your Make it yours choices and the rest of your settings stay yours. (A name you picked in Match stays one of your picks, and is shared, until you undo the pick, even if you later pass on it.)

Your two choices. Before any of your entries is shared, GYST asks you two questions on your own phone. The first is whether to share the symptoms and moods you log or keep them to yourself. Only symptoms and moods follow this choice (blood-sugar readings and contraction timings are stored as symptoms). Everything else in your Log is shared once you start sharing, including blood pressure, weight, temperature, medications and vitamins you log, kick counts, sleep, illness, feeds and diapers, and any note you write in the Log or type on an entry. (Your meds & vitamins list — the list you log from — stays on this phone.) The second is whether to share what you've already logged, or only what you log from today. This choice is about your GYST Log only. Your visits, questions, lists, birth plan and the rest are shared as they are, including what you added before. You can turn "Keep my symptoms and moods to myself" on later in GYST Family; GYST then takes them off the other phones as each one next syncs, but it cannot reach anything someone already exported, copied or sent.

Where shared entries are kept. What your family shares — we call it the shared plan, and it is kept apart from the family's shared area of requests and activity — is stored in the iCloud account of whoever runs the family and counts against their iCloud storage, even if they never open the shared entries themselves. Each person you share with also keeps a copy on their own devices and in their own private iCloud, and it is included in anything they export from GYST. Your answers to the two questions, with whom your yes covers, are kept in the family's shared area, where every member's app can read them. Once you say yes, two small things go there too: the colour GYST shows for you, and, unless you are a view-only member, your wish list's guest link. If you are a view-only member, only the family's owner can pick your colour, and it goes there when they do. So once you share, a published wish list's guest link is kept where everyone in the family can see it, view-only members included. Each shared change carries an identifier for the person and the device that made it, so the phones can put edits together in the right order. Sharing moves only through Apple's iCloud: it never passes through anything we run, and we don't read it.

Stopping. Whoever runs the family can stop sharing or turn a person off, and you can stop sharing what you add or leave the family. New changes then stop being shared. What has already been shared stays on the other people's phones and in their iCloud. When you leave, GYST asks first whether to keep everything as it is, take your symptoms and moods off the other phones, or also remove everything you added; it cannot reach anything someone already exported, copied or sent. If you run the family, there is no take-back: stopping sharing leaves everyone their copy. Erasing asks the same, if you are a member who shares: see "Your choices and rights" below.

So that someone can join by typing a short code instead of opening a link, the app keeps a few small records in the public area of our iCloud container. The code's own record holds the six-character code and a key that lets your devices read requests to join; it never holds your family's join link. Someone who types the code sends a request with the first name they give, sealed so that only the devices of whoever runs the family can read it, and nobody gets in until whoever runs the family taps "Let … in". The answer that lets them in is sealed so that only their own devices can read it. A family's first code is made when the family is created, and stays live until you change it or turn invites off. Because these records sit in our container, we could see that they exist and which account made each one, but not what is sealed in them; we don't look, and nothing we run does. Rotating the code, turning invites off, or ending the family in Settings deletes the code's record and its answers, and the code stops working. A request stays until the device that sent it hears back, takes it back or asks again; one sent from a device that never opens GYST again stays, holding only the sealed name. A family set up with an earlier version of GYST, whose code's record held the family's join link, is switched to this the next time whoever runs it opens GYST 2.0 or later, and its code stops holding the link. You can also invite someone by message, through Apple's own sharing; that never touches our container. Turn invites off once everyone has joined.

Selected symptom entries (optional)

If you use GYST as the one who's expecting (or who gave birth), you can save a symptom from the wellness body map to your own GYST Log. Only me is the default. A saved symptom entry is a wellness check-in: it is never part of the whole-family sharing above, whatever you chose for symptoms and moods. You can choose to share one entry at a time with a partner, but only while you are sharing your plan with your GYST Family, you have not chosen to keep your symptoms and moods to yourself, and that partner is in your family with the Partner role and shares with you. Before anything is sent, the app shows who will receive it and the exact symptom, body area, stage, time, the details you selected and your note, and asks you to confirm that your partner can see all of it.

The reviewed copy goes through a separate, invite-only CloudKit connection, kept in your own iCloud. The selected partner receives read-only access; other family members do not receive the symptom entry. An invitation link is stored in the family's shared area of requests and activity, but possession of that link does not grant access to the protected symptom connection. GYST Baby LLC does not receive the symptom contents. Your partner sees the copy in their GYST Log while the connection lasts; GYST does not save it into their own Log or their exports. Your private original stays in your own GYST Log and iCloud; pending sharing and withdrawal records are also stored on your device. If sending fails, you must review the copy again before retrying. Editing the private Log entry does not silently update a shared copy.

You can make a shared copy private again or delete the entry, which requests removal of the shared copy. Removal needs a connection and may remain pending while offline. If you later turn on "Keep my symptoms and moods to myself", stop sharing, or that partner stops sharing or leaves, GYST removes the connection the next time it can check. Leaving the family or erasing your data first removes all your symptom connections, and stops without leaving or erasing if it cannot. A partner may already have read, copied or captured an entry; revoking access cannot undo that. Shared entries are not monitored by GYST or a clinical provider, do not send an emergency alert, and do not confirm that a partner has read them.

Baby shower wish list (the one thing you publish)

GYST includes an optional baby shower wish list. If you publish one, the items you include leave your device and go onto a web page that anyone with the link can open. It is the only feature that works this way, so here is exactly what happens.

Where it goes. Publishing copies the list into the public area of GYST's own iCloud (CloudKit) container — ours, not yours. That is what lets guests open a page without an app or an account. While a list is published its contents are not private: anyone with the link can open them, and because the records sit in our container we could technically read them too — nothing in GYST does.

What is published. The host name and message you enter, and for each item you include: its name, the short description GYST shows for it, its category, the quantity, and how important it is — which is what shows guests a “Most wanted” tag. If you set a password, only its scrambled form (a SHA-256 hash) is published — never the password itself.

What is not published. Prices, stores, links, your own notes on an item, and who you had noted as buying it are never published, and neither is anything else in GYST: your plan, calendar, visits, questions, GYST Log, milestones, birth plan, baby info card, meds, and baby names. (If you share with your GYST Family, the people you share with see your shopping list, prices and notes included. Guests never do.)

Which items go up. Shopping items carry a gift toggle that starts switched on, so a published list is everything you still need unless you switch individual items off. Nothing is published until you publish it, and you can review and change the list first.

The page and the relay. The page lives at gystbaby.com/wishlist and is reached only by a random twelve-character code. It is not listed anywhere and not linked to, and the page asks search engines not to index it, so nobody finds it by browsing. To serve it we run one small piece of server-side code — the only server GYST operates. It fetches your published list from iCloud when a guest asks for it and passes it straight back. It keeps nothing of its own: no database, no accounts, no analytics, and no copy of your content. Like any website, the service that hosts gystbaby.com keeps its own standard request logs. If you set a password, a guest's browser remembers it for that visit and forgets it when the tab closes.

What guests do. A guest who buys something types a first name and taps "I got this." That name is saved with the item, shown to every other guest so nobody doubles up, and pulled back into your app the next time it syncs — and, if you share with your GYST Family, to the people you share with. Guests are not asked for anything else and never create an account.

Taking it down. Unpublishing in the app deletes the list and every item record, and the link stops working immediately. Settings → "Erase all data" takes a published list down first, and stops without erasing anything if it cannot. Deleting the app does not take a published list down — that only happens from inside the app, so unpublish before you delete.

Notifications

If you enable reminders, GYST schedules local notifications on your device through the operating system. They can show a visit's title, your baby's name, the week, or what someone in your GYST Family asked of you on the Lock Screen; with App Lock on, reminders and weekly notes stop naming the visit or the week. If you are in a GYST Family, GYST also asks Apple to wake it quietly in the background when something in the family changes and, once your copy of GYST offers sharing, checks for changes before a visit reminder and overnight, so that requests and shared entries arrive. You can change or revoke notification permission at any time in your device settings.

Widgets, Siri, Apple Watch and Live Activities

GYST's widgets, Control Center and Action Button controls, Siri and Shortcuts, Live Activities and Apple Watch app show and log things on your own devices. To do that, GYST keeps a small summary on the device for them — for example your baby's name, the week, the next appointment, the time of the last feed, and whether GYST Baby Unlock is on and how many free one-tap logs are left — and sends a shorter one to your paired Apple Watch. A log you make from a widget, a control, Siri or Shortcuts waits on the device until you next open GYST. What you say to Siri is handled by Apple, under Apple's privacy policy. With App Lock on, Lock Screen widgets stay hidden until the device is unlocked, and Live Activities and Siri leave out your baby's name. None of this passes through anything we run.

What we do not do (current version)

• Apart from the two optional features described above — a baby shower wish list you publish, and a GYST Family invite code with the requests to join that it brings — we do not collect, transmit, or store your personal information on our servers. Taking the list down, or turning invites off, deletes the records you put there. Sharing with your GYST Family moves between your family's own iCloud accounts through Apple, and never reaches us.
• Purchases are processed by Apple. On your device, GYST asks Apple whether your Apple Account bought GYST Baby Unlock, and when your Apple Account first downloaded GYST and which version, so that earlier buyers keep everything. The answer stays on your device, is not synced to iCloud, and never reaches us. GYST also counts on your device how much of each free preview you've used; the counts hold nothing you typed. We receive no payment details and no purchase record that identifies you: Apple's sales reports to us do not say who bought.
• We do not sell or rent your information.
• We do not use third-party advertising or tracking SDKs.
• We do not knowingly build profiles about you or your child or children.

Children's privacy

GYST is intended for adults (18+) organizing their own pregnancy or parenting journey. It is not directed to children, and we do not knowingly collect personal information from children. Information you choose to record about your child or children is stored on your device and in your own private iCloud, under your control — and, if you share with your GYST Family, with the people you share it with, who then keep their own copies. The one exception is a baby shower wish list: the host name and message you type there appear on a public page, so leave your children's names out of them unless you mean to share them. If you believe a child has used GYST to provide information to us, contact us and we will address it.

Share-sheet exports

GYST includes share buttons that hand a summary to your device's standard share sheet. Most are plain text — a shopping list, your to-do list, a weekly update, milestone progress, today's log, contraction timings, a names shortlist. Three are PDF documents you ask for by name and that contain health information: the visit summary you share with a provider, which carries the vitals, symptom check-ins and answered questions from the period you pick; your baby's immunization record; and your birth plan. GYST Log reports — a day and night, the last 24 hours, a week, or dates you pick — contain health information too, and you can share one as a PDF, as plain text, or as a spreadsheet (CSV) file; the Log can also be saved as a spreadsheet of every entry. "Copy" on a report line puts that line on your device's clipboard, like anything else you copy. There is also a shareable image of the week's baby-size card.

Settings has one more, larger than any of those: Export, which writes a copy of your data — as a readable document, or as a data file holding every field. It carries what the rest of this policy describes, health information included, and if you share with your GYST Family it also includes what the others shared with you, along with the first names guests typed on your wish list. Treat the file the way you would treat a medical record. A Log report can also include entries other people in your GYST Family logged. Like every other share button these run only when you ask, they are never automatic, and the files GYST writes for them are kept in your device's temporary storage and removed on the next launch. GYST cannot read an export back in. Nothing is exported automatically, and nothing you send this way passes through our servers — the content goes only where you send it (for example, Messages or email), under the terms of the app you send it with. Think before you share information about your child or children, and get permission before sharing information about other people.

Emailing us

If you email us — from the app's support button or any other way — we receive your email address and whatever you write. The support button also adds the app's version and build and your device's operating-system version, so we can help. We use what you send only to answer you, and we keep it only as long as we need it to do that.

Future features (products, sponsors)

As GYST grows, we may add features such as optional analytics, product links, affiliate programs, or sponsored content. Before any feature that changes how information is collected, used, or shared takes effect, we will update this policy, update the version and effective date, and ask you to review it. When affiliate or sponsored features are added, we will disclose material connections clearly and, where required, comply with U.S. Federal Trade Commission guidance. We will describe at that time exactly what (if anything) is collected, why, and your choices.

Third-party links

If GYST links to third-party products, retailers, registries, or websites, those parties have their own privacy practices that we do not control. Review their policies before providing information to them.

Your choices and rights

• Delete everything: Settings → "Erase all data" permanently removes your plan, events, tasks, questions, GYST Log, birth plan, milestones, baby info card, meds, your babies' pictures, saved baby names, and your profile from the app on your device; if iCloud sync is active, the deletion syncs to your private iCloud database and your other devices as well. It takes down a published wish list first and stops without erasing anything if that fails. It removes any symptom entries you shared with a partner, and this device's record of them, and stops without erasing anything if it cannot. If you share with your GYST Family, it stops your sharing first, and stops without erasing anything if it cannot; if you run the family, that ends sharing for everyone. If you are a member who shares, "Erase all data" first asks the same three things leaving does: keep everything as it is, take your symptoms and moods off the other phones, or also remove everything you added. GYST then does that before it erases, removing it from the shared plan and from the other phones as each one next syncs, but it cannot reach anything someone already exported, copied or sent. If you keep everything, or if you run the family, erasing does not reach what you already shared: copies stay on the other people's phones and in their iCloud, and if you are a member who keeps everything, what you added stays in the shared plan. Your GYST Family itself — its requests and activity — stays for the other members: if you are a member you are removed from it, and if you run it your profile is withdrawn and invite codes are turned off. If you run the family, its requests and activity stay in your iCloud for the others; end the family in GYST Family first if you want those gone too. Erasing also resets the free-preview counts, and doesn't undo a purchase: GYST checks with Apple again, and Restore Purchases gets GYST Baby Unlock back if it doesn't show.
• Notifications: manage or revoke permission in your device settings at any time.
• Access, correction, deletion: apart from a baby shower wish list you have published, the GYST Family invite code records described above, and any email you send us, we hold nothing of yours to access, correct, or delete. You can remove the list and your invite code yourself at any time in the app — unpublish the list, or turn invites off — and that deletes those records immediately. If you would rather we did it, or you no longer have the device, email info@GYSTBaby.com. We don't hold what you shared through GYST Family, so we can't delete it for you; use the choices in GYST Family, or ask the people you shared with. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA/CPRA.

Security

No method of storage is perfectly secure, but keeping your information on your own device — rather than on our servers — reduces exposure. Protect your device with a passcode and keep your operating system up to date. You are responsible for the security of your device and backups.

Sharing with your GYST Family is like handing someone your notebook: the people you share with can see, change and delete what you share, and keep a copy. Share only with people you trust. iCloud keeps the shared entries to the people the family's owner turned on, and a live invite code lets nobody in until whoever runs the family says so (a family set up with an earlier version of GYST is switched to this the next time whoever runs it opens GYST 2.0 or later). Invite only people you would trust with what you share, and turn invites off once everyone has joined. If you run the family, what everyone shares is kept in your iCloud, so keep your Apple Account secure.

A published baby shower wish list is meant to be opened by guests, so treat its link like the invitation itself — anyone you send it to can pass it on. You can put a password on it, and you can take it down at any time.

Data retention

Your information remains on your device until you delete it (by erasing data in Settings or removing the app). We keep no copy of it. Removing the app removes what is on that device only: your private iCloud copy, a GYST Family you run, a live invite code and a published wish list all stay. So erase, end the family, or turn invites off in the app before you delete GYST.

What you share with your GYST Family stays with the people you shared it with after you stop sharing, leave, or erase, until they delete it. When a shared entry is deleted, a small marker that it was deleted — with its contents cleared, apart from what identifies it (for example, which milestone it was) — stays in the shared plan so every phone learns of the deletion. Stopping sharing deletes the shared plan, markers included. A symptom entry you shared with a partner stays in your iCloud, readable by that partner, until you remove it or make it private, the connection ends, you leave the family, or you erase.

A published baby shower wish list is the exception: it stays online, in the public area of our iCloud container, until you take it down in the app or use "Erase all data." Deleting the app does not take it down, so unpublish first. A GYST Family invite code's record stays until you rotate the code, turn invites off, or end the family; a request to join stays until the device that sent it hears back, takes it back or asks again.

International users

GYST is operated from the United States and reflects U.S. guidance and law. If you use GYST from elsewhere, you are responsible for compliance with your local laws, and local data-protection rights may apply.

Changes to this policy

We may update this policy. Material changes will be reflected in a new version and effective date, and you will be asked to review the current version. Settings always shows the current policy, along with the version and date you accepted.

Contact

Questions about privacy: info@GYSTBaby.com.