This is a translation provided for convenience. Kroha is operated from Russia and this policy is drawn up under Russian law. The Russian version is the legally binding one; if the two texts differ, the Russian text prevails.
This Privacy Policy (the “Policy”) sets out how personal data of users of the Kroha service (kroha.baby, the “Service”) is processed and how it is kept secure. The Policy is drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other applicable personal-data legislation of the Russian Federation.
By using the Service, creating an account or taking the questionnaire, the user confirms that they have read this Policy and consent to their personal data being processed on the terms set out in it.
Personal data — any information relating to a directly or indirectly identified individual. Processing — any operation performed on personal data: collection, recording, storage, use, transfer, deletion. Operator — the party that organises and carries out the processing and determines its purposes.
The operator of personal data is sole proprietor [full name — to be filled in], TIN [to be filled in] (the “Operator”, “we”).
Contact for questions about data processing: support@kroha.baby.
The Service collects only the data it needs in order to work:
Some of this data is health information within the meaning of Article 10 of 152-FZ — a special category of personal data whose processing, as a general rule, requires separate explicit consent. This category covers:
Consent to process this data is given by entering it into the Service voluntarily and by accepting this Policy at registration. Entering it is not required: the questionnaire can be completed without answering questions about how you feel, and any tool may be left unused — this does not limit access to the rest of the Service.
The Service does not assess what you record: it does not compare your figures with any norms, does not flag deviations and draws no conclusions or warnings from them. The entries exist so that you can show them to your doctor.
The Service is not a medical information system, does not diagnose and does not replace a consultation with a doctor — see the Terms of Service.
Processing is carried out on the basis of the data subject’s consent (Article 9 of 152-FZ) and, as far as paid services are concerned, also in order to perform a contract (a public offer) to which the data subject is a party (Article 6(1)(5) of 152-FZ).
The Operator receives all personal data directly from the user: at registration, while taking the questionnaire, and when filling in the profile and the vitamin tracker. The Service does not collect data from other sources or from third parties.
Before an account is created, a draft of the questionnaire answers is stored temporarily in the browser’s local storage (not on the server) and is moved into the account only after registration — see section 9.
This is an open issue, and we think it is better stated than passed over. The Service’s database and authentication service run on infrastructure provided by Supabase Inc. (USA), hosted on AWS servers. As at the date of this Policy, Supabase does not offer a database region inside the Russian Federation, which means users’ personal data is physically processed and stored outside Russia.
Article 18(5) of 152-FZ (as amended by Federal Law No. 242-FZ) requires that, when collecting the personal data of Russian citizens, the recording, systematisation, accumulation, storage, amendment and retrieval of that data be carried out using databases physically located in Russia. The Service’s current infrastructure does not meet that requirement. The Operator is aware of this limitation and is considering ways to resolve it, including moving the database to infrastructure physically located in Russia.
Processing by Yandex.Metrica (section 9) is carried out by Yandex LLC on servers located in Russia.
To run the Service, personal data is passed to the processors below. Each handles data only to the extent needed to provide its own service, and under its own privacy policy:
The Service does not sell personal data and does not pass it to third parties for purposes unrelated to running the Service, except where Russian law expressly requires it (for example, in response to a lawful request from a state authority).
The Service uses:
Cookies can be managed through your browser settings. Declining in the banner switches off session recording; anonymised traffic statistics continue to be collected. To switch those off as well, use your browser or the official Yandex.Metrica opt-out.
Personal data is kept for as long as the account exists. “Settings” → “Delete my data” immediately deletes your due date, name, questionnaire answers, supplement list and every entry in the “Tools” section (weight, bump, blood pressure, kicks, contractions, to-do list, wishlist, names and journal). That action cannot be undone. Records of a paid subscription are kept, as they relate to payment for services. The account itself (email address and the ability to sign in) remains; to have the account deleted in full, write to support@kroha.baby — as at the date of this Policy this is done on request, and there is no separate button for it in the interface.
The technical log of the payment provider’s webhooks is stored separately from the profile and is used solely to confirm that a payment took place and to prevent the same payment being processed twice.
Under Articles 14–15 of 152-FZ you have the right to:
To exercise these rights, send a request to support@kroha.baby. We will normally reply within 30 days of receiving it.
Access at the database level is restricted by row-level security policies: technically, each user can read and change only their own data. The connection between the application and the user is protected by TLS (HTTPS). Passwords are stored hashed and are not available to the Operator in plain text. The Service does not request data it does not need and does not gather anything automatically: everything stored about a user was entered by that user and can be deleted by them.
The Service is intended for people over 18. By creating an account you confirm that you have reached that age.
The Operator may amend this Policy. The current version is always available on this page, and the date of the last update is shown at the top of the document. Material changes affecting the scope or purposes of processing will additionally be announced inside the Service.
For anything to do with the processing of personal data: support@kroha.baby.