Who Wants Your Breastfeeding Data (and Why You Shouldn't Hand It Over)

It is 3:12am and you tap "left side, start." Your baby is eating, you are half asleep, and logging it takes about one second. It feels like the least consequential thing you will do all day.

Now zoom out. Do that six to twelve times a day, for months, in an app that asks for your baby's birthday and your email. You have quietly built a minute-by-minute record of when your household is awake, how your baby is growing, whether you added a bottle, and how the whole thing is going. A lot of people would like a copy of that. So here is my argument, and it is a simple one: the best thing you can do with that record is not share it with anyone.

What a feeding log says about you

It looks like nothing. Start time, side, duration. But stack a few weeks of it together and it says quite a lot:

• Your baby's exact age, which is the single most useful fact in all of baby marketing.
• Your schedule. When you are up, when you are home, when you are alone with a newborn at 4am.
• Supply signals. Short feeds, frequent feeds, a bottle added here and there. Anyone who has ever panic-Googled "is my baby getting enough milk" knows exactly what that pattern feels like from the inside.
• How you are doing. Plenty of apps also ask about mood, pain, sleep and postpartum symptoms.
• Everything attached to it. Your email, your name, your device ID, your location, the photos you uploaded.

None of that is scandalous. It is just personal, it is partly about a person who cannot consent, and it covers the most vulnerable stretch of your life.

Every app that keeps your data is making you a promise

Here is the thing about privacy policies. When an app stores your data on its servers, it is not giving you privacy. It is making you a promise. We will only use this to run the app. We will not share it with anyone we should not. We will take good care of it.

That promise has to survive a lot at once: a hack, a curious employee, an advertising partner, a policy rewrite in 2028, a new owner, an investor who wants growth, a bankruptcy. Most of the time nothing goes wrong. But "most of the time" is a strange standard for the record of your baby's first year.

Now compare that with data that never leaves your phone. There is no promise to keep, because there is nobody holding it. It cannot be sold, because there is nothing to sell. It cannot leak from a server, because there is no server. I will take a design that does not need to be trusted over a company that asks nicely, every time.

Then there is the second business

A lot of free baby apps are free because of something. Ads, data, venture money, or a product the app exists to sell. Nara is the clearest example I can think of, and I want to be fair about it, because it is not a scandal. It is a strategy, and honestly a smart one.

Founder Esther Hallam built the tracker first, it grew to about 1.5 million parents, and the formula came later. Inc. covered it under the headline "How This Founder Accidentally Created a Marketing Funnel of 1.5 Million Users." That is a business magazine describing the app as a way to build trust with the parents who would later buy the formula, out in the open. (I dug into the rest of the story in the formula recall post.)

Which raises the question a lot of parents are asking right now: did Nara use the app's data to work out who to show formula ads to?

Honestly, I do not know. Nobody outside the company does, and I am not going to tell you they did. Here is what is actually public:

• Nara says the app is ad-free and that your data is "only shared with users authorized by you."
• Its privacy policy, last updated August 25, 2025, is one policy for the whole company. It lists "marketing the services" and personalizing communications as purposes, and names ad networks, data brokers and marketing providers among the kinds of companies data can go to.
• It says targeted advertising cookies apply to website visitors, and that Nara does not "sell" personal data for money. It also says some advertising-related disclosures "may be deemed a 'sale' or a 'share'" under certain state laws, and it lists health data as a sensitive category.
• It does not say whether what you log in the app is combined with what the formula side of the business knows. It does not say it isn't, either.

That last line is the whole problem, and it is not really about Nara. Whatever app you use, you cannot audit from the outside what a company does with your data. You get a policy written by lawyers that lists what the company is allowed to do, and you take it from there.

And a formula company knowing which parents are breastfeeding, how often, and how worried they seem to be about supply is a particularly sensitive thing to leave to a policy. Marketing formula to breastfeeding parents is one of the oldest fights in infant feeding (the WHO adopted an international code restricting it back in 1981), and a feeding log is the most precise map of who that would work on. I am not saying Nara did it. I am saying an app that lives inside a formula company makes it a fair question, and you should not have to take anyone's word for the answer.

Two more lines from that fine print are worth knowing, mostly because you will find some version of them in nearly every app. The App Store privacy label says "Usage Data" may be used to track you across apps and websites owned by other companies. And "all of your Personal Data" may be transferred to a third party if the company goes through a merger, acquisition, bankruptcy or other transaction. The people who wrote that clause were not being sinister. They were being lawyers. But it means the company you trusted at 3am is not necessarily the one that ends up holding the data.

"But HIPAA protects health data, right?"

This is the assumption almost everyone makes, and it is mostly wrong. HIPAA covers health plans, health care providers that bill electronically, and clearinghouses, plus the vendors that work for them. An app you downloaded yourself and typed your baby's feeding schedule into is generally not one of those. Your pediatrician's chart is protected. The same information in a consumer app mostly is not.

What does apply is the FTC. In 2024 it expanded its Health Breach Notification Rule to cover most health and wellness apps, including unauthorized disclosures to advertisers. That is a good rule. It is also the government cleaning up afterward, not preventing anything.

The track record is not hypothetical

If you are thinking "that sounds paranoid, surely nobody actually does this," here is the short version of the last few years:

• Flo Health (2021). The FTC said the period and fertility app shared sensitive health data, including the fact that a user was pregnant, with Facebook, Google and other companies while telling users their data was private. Flo settled without admitting wrongdoing.
• Flo and Meta (2025). In August, a federal jury found Meta liable under California's wiretapping law for collecting data from the Flo app. Flo had settled the day before.
• GoodRx and BetterHelp (2023). Two more FTC actions over sharing health data with advertising platforms.
• Glow (2020). California's attorney general settled with the fertility app for basic security failures that put users' medical information at risk, including a $250,000 penalty.
• Mozilla (2022). When it reviewed 25 pregnancy and period apps and connected devices, it put its privacy warning label on 18 of them.

Those are the ones that got caught. The pattern is the boring, consistent one: the app promises privacy, the code quietly sends events to an analytics or advertising service, and it comes out later. None of these companies set out to write a scandal. They set out to grow, and your data was lying around.

"It is just feeding times. Who cares?"

Fair question, and I do not want to be dramatic about it. A left/right log is not your medical history. Most of you will never see a single consequence.

Here is why I still care. First, it is not really your data, it is your baby's, and your baby is going to spend a lifetime being a person with a data trail that started in the delivery room. Nobody asked them. Second, data does not expire. A breach in 2031 does not un-leak, and a company that "does not sell your data" in 2026 can be a different company in 2029. Third, "just feeding times" is rarely just feeding times. It comes with an email address, a device ID and a birthdate attached, and that is what makes it useful to someone else.

The reason to keep it private is not that something terrible is likely. It is that there is no upside to you in having it sit on someone else's server, and you can skip the whole question for free.

The simplest fix is not sharing it

Everything above has the same root: your data ended up somewhere it did not need to be. You do not have to become a privacy expert to fix that. You can pick the boring option. An app that keeps everything on your phone cannot be caught sharing it, cannot be acquired along with it, and cannot quietly change its mind about it. That is a better position than a company that promises it won't.

If you would rather pick an app yourself, here are five checks that take about two minutes:

1. Read the App Privacy section on the App Store listing. Scroll down to it. "Data Not Collected" is the best answer you will get. "Data Linked to You" with a long list is the opposite.
2. Notice whether it wants an account. An account is what puts your data on a server. If the app works without one, that is a very good sign.
3. Search the privacy policy for "merger," "acquisition" and "bankruptcy." If your data can travel with the company, you want to know that up front.
4. Ask how you delete it. And whether "delete" means the data is actually gone or just hidden from you.
5. Ask what the app is for. Free with no obvious business model means the business model may be you, or something the app is there to sell. I got into this in why most breastfeeding apps do too much.

And a bonus: log less. If you are never going to look at the mood tracker, do not fill it in. Data you do not enter cannot be shared.

What I did about it

I am not a neutral party here, so take this as a pitch and check it: MilkMode is a breastfeeding timer that keeps everything on your phone. There is no account to make. There is no server, so there is nothing for your data to be sent to. There is no analytics and no ad SDK. There is no second business either, no formula and no data to resell, just a $4.99 timer. Its App Store listing says "Data Not Collected," and you can read the privacy policy in about a minute because there is not much to it. I built it this way because I was a new parent tapping "start" at 3am and did not want a stranger's business model attached to it.

The honest tradeoffs, since this whole post is about reading the fine print: it is iPhone only, it does not track diapers, sleep or pumping, and it will not sync to your partner's phone. That last one is the direct cost of having no server. If you need shared logging between caregivers, an app with cloud sync is the right tool, and you can still pick a good one using the checklist above. Also, because I never have your data, I cannot restore it for you if you lose it. That is what privacy costs, and I think it is worth it, but it is a real tradeoff. Our roundup of timer apps covers the alternatives, including where mine loses.

The bottom line

You are allowed to want your baby's feeding log to be boring. Not a data asset, not an audience, not a line item in somebody's acquisition, not a way to figure out who might buy a can of formula. Just a note that says left side, 14 minutes, so you can remember which one is next.

Every app you download has a business behind it, and you will not always be able to see it. Whatever you pick, the safest version of your baby's data is the one nobody else has. If you have found something in a privacy policy that made you squint, I would honestly love to hear about it. You can reach me through the support page.

Common questions

Why should I keep my breastfeeding data private? Because a feeding log shows your baby's age, your schedule and sometimes your worries about supply, which is valuable to advertisers, data brokers, companies selling things like infant formula, and anyone who later acquires the app company. Data that never leaves your phone cannot be sold, leaked from a server or transferred in an acquisition.

Did Nara use app data to target formula ads? There is no public evidence either way, and I am not claiming it did. Nara says the app is ad-free and that data is shared only with users you authorize. Its company-wide privacy policy allows marketing and personalized communications, lists ad networks and data brokers among possible recipients, and does not say whether app data is combined with the formula business. That gap is the reason to prefer an app that never collects the data.

Does HIPAA protect my baby tracking app? Usually not. HIPAA covers health plans, health care providers and clearinghouses. A consumer app you download yourself generally falls under FTC rules instead.

Have health apps really shared user data? Yes. Flo Health settled with the FTC in 2021, a jury found Meta liable over Flo app data in 2025, and the FTC has acted against GoodRx and BetterHelp. Mozilla flagged 18 of 25 reproductive health apps and devices in 2022.

How do I find a private breastfeeding tracker? Look for "Data Not Collected" on the App Store listing, avoid apps that require an account, and read the privacy policy for merger and bankruptcy language. MilkMode has no account and no server, so there is nowhere for your data to go.