Privacy Policy

Effective date: 22/09/2026

Last updated: 22/09/2026

1. About this Privacy Policy

First Nibbles Pty Ltd ABN 75 696 864 276 trading as Nibbles ("Nibbles", "First Nibbles", "we", "us" or "our") respects your privacy and understands the importance of carefully protecting information about you and your child.

This Privacy Policy explains how we collect, hold, use, disclose, store and protect personal information when you:

Use the Nibbles mobile application.
Visit the Nibbles website.
Create or manage a Nibbles account.
Create or manage a child profile.
Subscribe to a Nibbles service or communication.
Contact our customer support team.
Participate in a survey, promotion or research activity.
Otherwise interact with First Nibbles Pty Ltd.

We handle personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW) where applicable, and other applicable privacy, health-record and data-protection requirements.

This Privacy Policy should be read together with our Terms of Use and Medical & Safety Disclaimer.

2. Who Nibbles is designed for

Nibbles is designed for parents, legal guardians and authorised adult caregivers.

Users must be at least 18 years old or otherwise have legal capacity to create an account and accept our Terms of Use.

Nibbles is not designed for children to create or independently manage their own accounts. Information about a child should only be entered by the child's parent, legal guardian or another person who is legally authorised to provide the information.

By creating a child profile or providing information about a child, you confirm that:

You are the child's parent, legal guardian or authorised caregiver.
You have authority to provide the child's information to us.
You have authority to provide any required consent on the child's behalf.
The information you provide is accurate to the best of your knowledge.

3. Meaning of personal and sensitive information

Personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable.

Sensitive information is a category of personal information that receives additional legal protection. It includes health information and certain information about a person's racial or ethnic origin, religious beliefs and other protected matters.

Information about a child's allergies, medical conditions, development, growth, feeding difficulties, swallowing ability, dietary requirements or reactions to food may be health information or sensitive information.

4. Information we may collect

The information we collect depends on how you use Nibbles and which information you choose to provide.

4.1 Account and contact information

We may collect:

Your name.
Email address.
Telephone number, where provided.
Username or account identifier.
Password or authentication information in secured form.
Country, region, language and time zone.
Communication preferences.
Subscription status.
Records of your acceptance of our Terms of Use, disclaimers and privacy consents.

4.2 Information about your child

You may choose to provide information such as:

The child's first name, nickname or profile name.
Date of birth or age.
Developmental stage.
Feeding stage and feeding abilities.
Readiness-check responses.
Head, neck, sitting, grasping and oral-motor readiness information.
Foods and textures introduced.
Allergens introduced.
Known or suspected allergies and intolerances.
Previous or suspected reactions to foods.
Dietary requirements or preferences.
Foods accepted, refused or being explored.
Feeding progress and feeding history.
Saved recipes, meal plans, checklists and favourites.
Information about gagging, chewing, swallowing or feeding difficulties.
Information about prematurity, development, growth or medical concerns that you voluntarily provide.
Notes or other information you choose to enter into the child's profile.

We will seek to collect only information that is reasonably necessary to provide the relevant Nibbles feature.

You should not provide detailed medical records, medical reports, government identification numbers or information that Nibbles has not requested.

4.3 Subscription and transaction information

Where you purchase a subscription or service, we may receive:

The product or subscription purchased.
Subscription start, renewal, expiry or cancellation information.
Transaction identifier.
Purchase status.
Currency and approximate location of purchase.
Refund or billing-support information.

Payments may be processed by Apple, Google or another authorised payment provider. We generally do not receive or store your full debit-card or credit-card details when payment is processed by those providers.

Your payment provider handles payment information under its own privacy policy and terms.

4.4 Device and technical information

When you use Nibbles, we may automatically collect information such as:

Device type and model.
Operating system and app version.
Device or app identifiers.
Internet Protocol address.
Language and regional settings.
Time zone.
Mobile network or internet service information.
Login dates and times.
App session information.
Error logs, diagnostic data and crash reports.
Security and authentication events.
Push-notification token.
General location inferred from an IP address, where applicable.

We will not access precise device location, contacts, photographs, camera, microphone or other restricted device information unless the relevant feature requires it and you grant permission.

4.5 Usage information

We may collect information about how Nibbles is used, including:

Screens and features accessed.
Recipes viewed, saved or completed.
Search terms entered.
Filters and preferences selected.
Links or buttons selected.
Checklist and meal-planning activity.
Notification engagement.
Approximate session duration.
Feature performance.
Referral or acquisition source.

We use this information to operate, secure, understand and improve Nibbles.

4.6 Communications and support information

When you communicate with us, we may collect:

Your contact details.
The date and content of your communication.
Support requests.
Feedback and complaints.
Screenshots or attachments you provide.
Records of our response.
Information required to verify your identity or account ownership.

Please avoid including unnecessary health information or other sensitive information in general support messages.

4.7 Surveys, promotions and research

Where you voluntarily participate, we may collect:

Survey responses.
Product feedback.
Competition or promotion entries.
Testimonials.
Interview or research responses.
Demographic information you choose to provide.

We will provide additional information or seek additional consent where a survey, promotion, testimonial or research activity involves a new use of sensitive information.

4.8 Marketing information

Where you choose to receive marketing communications, we may collect:

Your email address.
Marketing consent.
Communication preferences.
Email delivery, opening and link-selection information.
Unsubscribe records.

We do not use a child's health information to send targeted marketing without separate, express consent.

5. How we collect information

We may collect information:

Directly from you during onboarding or account creation.
When you create or update a child profile.
When you use Nibbles features.
When you contact us.
When you complete a survey or promotion.
Automatically through the app, website and associated technology.
From app stores, payment providers and authentication providers.
From analytics, hosting, security and customer-support providers acting on our behalf.
From another authorised account holder or caregiver where shared-profile functionality is offered.
From another source where you have consented or where collection is permitted by law.

Where reasonable and practical, we collect personal information directly from the person to whom it relates or from that person's authorised representative.

6. Why we collect and use information

We may collect, hold, use and disclose personal information to:

Create and manage user accounts.
Create and manage child profiles.
Provide the Nibbles app and its features.
Personalise content to a child's age, feeding stage, preferences and information provided.
Filter or flag content based on allergens and dietary information.
Provide readiness checklists and general educational results.
Generate meal ideas, recipe suggestions, feeding checklists and reminders.
Save progress, preferences, recipes and meal plans.
Process and manage subscriptions.
Authenticate users and maintain account security.
Respond to support requests and complaints.
Communicate important service, safety, security or account information.
Send marketing communications where permitted and requested.
Understand how Nibbles is used.
Diagnose errors and improve app reliability.
Develop, test and improve our content, services and features.
Prevent fraud, misuse and unauthorised access.
Protect users, children, First Nibbles and third parties.
Meet legal, accounting, taxation, insurance and regulatory requirements.
Establish, exercise or defend legal claims.
Manage a proposed or completed business transaction.
Perform another purpose that is disclosed to you and to which you consent.
Perform another activity permitted or required by law.

We will not use sensitive information for a purpose unrelated to the purpose for which it was collected unless we obtain additional consent or the use is otherwise permitted or required by law.

7. Health and sensitive information

We may collect health or sensitive information about a child where:

The information is reasonably necessary to provide a requested Nibbles feature.
The child's parent, legal guardian or authorised caregiver has provided express consent.
Collection is otherwise permitted or required by law.

We do not require users to provide every category of child information listed in this policy. However, certain personalised features may not work properly without the relevant information.

You may withdraw consent for future handling of optional sensitive information by:

Updating or removing information within your account.
Deleting the relevant child profile.
Deleting your account.
Contacting us using the details at the end of this policy.

Withdrawal of consent will not necessarily require us to delete information that we are legally required or permitted to retain. Withdrawing consent may also prevent us from continuing to provide personalised features that rely on that information.

8. Automated personalisation and recommendations

Nibbles may use rules-based or automated processes to organise, filter or recommend content.

For example, Nibbles may use information about a child's:

Age.
Developmental or feeding stage.
Readiness-check responses.
Allergies or dietary requirements.
Foods previously introduced.
Saved recipes and preferences.
Use of Nibbles features.

These processes may be used to:

Display age- or stage-relevant content.
Exclude or flag recipes containing identified allergens.
Recommend recipes, textures or feeding resources.
Create checklists, meal plans or reminders.
Display general readiness results.
Personalise the order or presentation of content.

Automated recommendations are general educational tools. They do not diagnose a medical condition, confirm developmental or medical readiness, replace professional advice or make legally binding decisions.

Users remain responsible for deciding whether any recommendation is appropriate for their child.

You may contact us to ask about the information used to generate a recommendation, correct inaccurate information or request that a particular child profile be deleted.

Unless we obtain separate, express consent, we will not use identifiable child health information to train a publicly available or general-purpose artificial intelligence model.

9. De-identified and aggregated information

We may create statistical, aggregated or de-identified information from personal information.

We may use properly de-identified information to:

Understand general feeding trends.
Measure product performance.
Improve recipes and educational content.
Test and develop features.
Conduct internal research.
Prepare non-identifying reports.

We will take reasonable steps to reduce the risk that de-identified information can be re-identified.

Information that has been effectively de-identified so that no individual is reasonably identifiable may no longer be personal information. We will not attempt to re-identify it except where permitted by law or required to test the effectiveness of our de-identification processes.

10. When we may disclose information

We may disclose personal information to the following categories of recipients where reasonably necessary.

10.1 Service providers

These may include providers of:

Cloud hosting and database services.
Account authentication.
Data storage and backup.
App development and maintenance.
Analytics and performance monitoring.
Crash reporting and diagnostics.
Cybersecurity and fraud prevention.
Customer support.
Email and communication services.
Push notifications.
Subscription and payment processing.
Survey and feedback tools.
Professional document storage.
Business administration.

Service providers may only receive the information reasonably required to perform their services. We seek to require providers to protect the information and to use it only for authorised purposes.

10.2 App stores and payment providers

We may exchange transaction, subscription and account information with Apple, Google or another payment provider to:

Process purchases.
Verify subscription status.
Manage renewals and cancellations.
Process refunds.
Prevent fraud.
Resolve billing issues.

10.3 Professional advisers

We may disclose information to professional advisers such as:

Lawyers.
Accountants.
Auditors.
Insurers.
Cybersecurity specialists.
Business consultants.

We will limit the disclosure to information reasonably necessary for the relevant professional service.

10.4 Legal and regulatory disclosures

We may disclose information where we reasonably believe disclosure is necessary to:

Comply with a law, court order, warrant or enforceable regulatory request.
Respond to an authorised government agency.
Protect the safety of a child or another person.
Prevent or investigate fraud, abuse or unlawful conduct.
Protect our legal rights.
Establish, exercise or defend a legal claim.
Respond to an emergency or serious threat where disclosure is permitted by law.

10.5 Business transactions

If First Nibbles is involved in a proposed or completed merger, acquisition, investment, financing, restructuring, insolvency or sale of all or part of its business or assets, relevant information may be disclosed to advisers and potential transaction parties.

We will take reasonable steps to protect information during any transaction and require the recipient to handle personal information consistently with applicable privacy obligations.

10.6 With consent

We may disclose information to another person or organisation where you have provided consent or asked us to make the disclosure.

11. Selling information and advertising

We do not sell or rent personal information.

We do not sell or rent a child's health, allergy, development or feeding information.

We do not use a child's sensitive information for third-party targeted advertising without separate, express consent.

We do not permit advertisers to access an identifiable child profile through Nibbles.

Any future introduction of advertising or materially different tracking practices will require an update to this policy and, where required, additional notice or consent.

12. Analytics, cookies and similar technologies

Our website or app may use cookies, software development kits, local storage, analytics tools, pixels or similar technologies to:

Keep users signed in.
Remember preferences.
Maintain security.
Measure app performance.
Diagnose errors.
Understand general usage.
Improve Nibbles.
Measure the effectiveness of communications or campaigns.

We will not intentionally place child health information inside advertising tags, tracking pixels or analytics event names.

The analytics and technology providers currently used by Nibbles are:

Supabase (hosting, database and authentication).
Google Firebase Analytics (analytics).
Google Firebase Crashlytics (crash reporting).
Apple and Google (sign-in).
RevenueCat (subscription management).
OpenAI (AI meal plan generation).

You may be able to control certain technologies through device settings, browser settings or Nibbles privacy settings. Disabling essential technology may prevent some features from operating correctly.

13. Direct marketing

We may send information about Nibbles products, recipes, updates, offers or services where:

You have requested those communications.
You have provided consent.
The communication is otherwise permitted by law.

You may opt out at any time by:

Selecting the unsubscribe option in an email.
Changing your communication settings.
Disabling optional promotional notifications.
Contacting us.

Service-related communications, such as security alerts, material terms updates, subscription messages and important account notices, are not marketing communications and may continue while your account remains active.

We will not use sensitive information for direct marketing without the consent required by law.

14. Overseas storage and disclosure

Some service providers may store or process personal information outside Australia.

Our current providers may process information in:

Australia.
Singapore.
The United States.

The countries involved may depend on the provider, the service used and the location of its data centres and support personnel.

Before disclosing personal information to an overseas recipient, we take reasonable steps required by applicable law to ensure that the information is handled appropriately. However, overseas recipients may be subject to the laws of their own country.

15. How we store and protect information

We may store information:

In secured cloud infrastructure.
In databases operated by us or our contracted providers.
On secured business systems.
In encrypted backups.
In limited circumstances, in secured administrative or legal records.

We use administrative, technical and organisational safeguards designed to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

Depending on the system and information involved, safeguards may include:

Access controls and authentication.
Role-based access restrictions.
Encryption during transmission.
Encryption of stored information where appropriate.
Secure password handling.
Logging and system monitoring.
Software updates and vulnerability management.
Backup and recovery procedures.
Staff and contractor confidentiality obligations.
Vendor security reviews.
Incident-response procedures.
Limiting access to people who require it for their work.

No electronic system or method of transmission is completely secure. We cannot guarantee that a security incident will never occur, but we take reasonable steps appropriate to the nature and sensitivity of the information we hold.

You are responsible for protecting your password, device and account credentials and for notifying us promptly if you suspect unauthorised access.

16. Retention of information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy or as required or permitted by law.

Retention periods may depend on:

Whether your account remains active.
The type and sensitivity of the information.
The reason the information was collected.
Legal, accounting and taxation requirements.
Insurance and dispute requirements.
Fraud-prevention and security needs.
Backup and disaster-recovery cycles.
Any applicable health-record retention obligations.

Subject to applicable legal requirements, our intended retention periods are:

Active account and child-profile information: retained while the account or relevant profile remains active.
Deleted child profiles: removed from active user-facing systems within 30 days.
Deleted accounts: removed from active systems within 30 days.
Backup copies: progressively overwritten or deleted within 90 days.
Subscription and financial records: retained for the period required by taxation, accounting and corporate laws.
Consent and Terms-acceptance records: retained for as long as reasonably necessary to demonstrate the consent or agreement obtained and manage legal obligations.
Security and fraud-prevention records: retained for as long as reasonably necessary to protect users and our service.
Complaints and legal records: retained for as long as necessary to manage the matter and applicable limitation periods.

Where a law requires health information to be retained for a longer period, the legally required period will apply.

We may retain properly de-identified or aggregated information where it no longer identifies an individual.

When personal information is no longer required, we will take reasonable steps to delete it or de-identify it, subject to legal retention obligations and technical backup cycles.

17. Accessing your information

You may request access to personal information we hold about you or a child for whom you are legally authorised to act.

You may be able to access much of this information directly through your Nibbles account.

For other information, contact our Privacy Officer using the details below.

We may need to verify:

Your identity.
Your account ownership.
Your relationship to the child.
Your authority to access the requested information.

We will respond within a reasonable period, generally within 30 days.

Access may be limited or refused where permitted by law, including where access would:

Unreasonably affect another person's privacy.
Create a serious threat to a person's life, health or safety.
Reveal commercially sensitive evaluative information.
Prejudice an investigation.
Be unlawful.
Relate to anticipated or existing legal proceedings where the information would not otherwise be accessible.

Where we refuse access, we will generally provide written reasons and available complaint options unless the law permits or requires otherwise.

We will not charge a fee for making an access request. A reasonable administrative fee may apply for providing access where legally permitted. We will notify you before charging a fee.

18. Correcting information

We take reasonable steps to ensure that personal information is accurate, current, complete, relevant and not misleading.

You can update certain information directly through your Nibbles account.

You may also contact us to request correction of information.

We may ask for information reasonably required to confirm the correction. We will respond within a reasonable period, generally within 30 days.

Where we do not make a requested correction, we will generally explain why and tell you how to make a complaint. Where required, you may ask us to associate a statement with the information explaining that you consider it inaccurate, out of date, incomplete, irrelevant or misleading.

19. Deleting information and accounts

You may request deletion of:

Your account.
A child profile.
Optional profile information.
Saved preferences.
Other personal information, where deletion is legally available.

Deletion may be available through the app or by contacting us.

After a valid deletion request:

We will remove or de-identify information from active systems within our stated processing period.
Some information may remain temporarily in secured backups until the relevant backup cycle expires.
We may retain information where required or permitted for legal, safety, fraud-prevention, accounting, dispute or regulatory purposes.
We may retain a minimal record of the request and its completion.
Properly de-identified information may be retained.

Deleting a child profile or withdrawing consent may prevent personalised Nibbles features from operating.

Deleting the Nibbles app from a device does not necessarily delete the account or information held in our systems. You must use the account-deletion process or contact us.

20. Shared profiles and multiple caregivers

Where Nibbles allows a child profile to be shared with another caregiver:

The account holder is responsible for inviting only authorised caregivers.
Invited caregivers may be able to view or update child-profile information.
The account holder should ensure that each caregiver understands their responsibilities.
Access should be removed when a caregiver is no longer authorised.
Nibbles may keep records of invitations, access and profile changes for security purposes.

Do not share login credentials. Use official profile-sharing features where available.

21. Data breaches

We maintain processes for responding to suspected loss, unauthorised access, disclosure or other misuse of personal information.

Where an incident occurs, we may:

Investigate and contain the incident.
Take steps to reduce possible harm.
Reset credentials or restrict access.
Contact affected users.
Notify service providers, insurers, law-enforcement bodies or regulators.
Notify the Office of the Australian Information Commissioner and affected individuals where required by the Notifiable Data Breaches scheme.
Take steps designed to prevent recurrence.

We encourage you to contact us immediately if you believe your account or information has been compromised.

22. Anonymity and pseudonyms

Where practical, you may interact with us anonymously or using a pseudonym.

For example, certain general website or educational content may be available without creating an account.

We may need identifying information where it is impractical to provide a feature anonymously, including where we need to:

Create an account.
Manage a paid subscription.
Secure a child profile.
Respond to an account-specific request.
Verify authority over child information.
Meet a legal obligation.

You may use a child's nickname rather than their full legal name unless a specific feature requires otherwise.

23. Unsolicited information

If we receive personal or sensitive information that we did not request, we will consider whether we could lawfully have collected it.

Where we could not have lawfully collected it and it is not contained in a legally protected record, we will take reasonable steps to delete or de-identify it.

Do not send us detailed medical records, identity documents or other unnecessary sensitive information unless we have specifically requested them through a secure process.

24. Government-related identifiers

We do not generally request Medicare numbers, passport numbers, driver-licence numbers, tax file numbers or other government-related identifiers.

Please do not provide these identifiers unless we specifically request them for a lawful and necessary purpose.

We will not adopt a government-related identifier as our own account identifier except where permitted by law.

25. Third-party websites and services

Nibbles may contain links to third-party websites, products, resources or services.

Third parties are responsible for their own privacy practices. This Privacy Policy does not apply to information handled independently by those third parties.

We encourage you to review a third party's privacy policy before providing information or using its service.

The inclusion of a link does not necessarily mean that First Nibbles endorses the third party's privacy or security practices.

26. International users

First Nibbles Pty Ltd is based in Australia, and information may be handled in Australia and the overseas locations identified in this policy.

Users outside Australia may have additional rights under the laws of their country or region.

Nothing in this policy limits a privacy or data-protection right that cannot lawfully be limited.

Before actively offering Nibbles in another jurisdiction, we may provide additional notices or regional terms where required.

27. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

Changes to Nibbles.
New features or data practices.
Changes to service providers.
Changes to applicable law.
Regulatory guidance.
Security or operational improvements.

The current version will display its effective date and last-updated date.

Where a change is material, we will take reasonable steps to provide notice through the app, website, email or another appropriate method.

Where legally required, we will obtain new consent before applying a materially different practice to previously collected sensitive information.

We may retain previous versions of this policy for record-keeping and transparency.

28. Privacy complaints

You may contact our Privacy Officer if you believe we have mishandled personal information or breached an applicable privacy requirement.

Please include:

Your name and contact details.
A description of the issue.
Relevant dates.
The account or child profile involved.
The outcome you are seeking.
Any relevant supporting information.

We will:

Acknowledge the complaint within 7 days.
Investigate the complaint fairly.
Request further information where necessary.
Aim to provide a substantive response within 30 days.
Explain any delay.
Explain the outcome and available escalation options.

If you are not satisfied with our response, you may be entitled to complain to:

The Office of the Australian Information Commissioner.
The Information and Privacy Commission NSW, where the matter falls within its jurisdiction.
Another applicable privacy or consumer regulator.

We encourage you to contact us first so that we have an opportunity to resolve the matter.

29. Contact us

Questions, privacy requests and complaints may be directed to:

Privacy Officer
First Nibbles Pty Ltd

Email: hello@thenibblesapp.com
Postal address: Unit 4, 22-24 Donnelly Road, Crows Nest NSW 2065

Website: https://www.thenibblesapp.com

Please write "Privacy Request" or "Privacy Complaint" in the subject line where appropriate.