Family Records Not Designed to Be Sold | Linea

The short answer

"Not designed to be sold" is a claim about a business model, not about where bytes sit — and most apps that say it are really only saying the easier half: our database is local. Linea makes both halves. Private records stay on device first, and the product is explicitly not designed around selling or sharing family data.

Concretely: your journey dates, recovery notes, baby-care logs and the photos you choose to add live in a local database inside the iOS app sandbox and are never uploaded to a server. There is no account to create. And if you delete your data or uninstall, it is gone — nobody, including the company that built it, can get it back for you.

That last sentence is the real shape of the promise. It is worth reading both halves together, because the second is where most of the actual consequences live.

Why "not designed to be sold" is an unusual thing to state

The query behind this page is usually not "where are my files" — it is "is anyone going to read this". Someone is holding a record of their pregnancy, or their baby's first year, or a loss, and they want to know whether that record is going to travel.

Each individual entry is ordinary. A due date. A feeding time. A note about how recovery felt. A photo of a child. It is the accumulation that is sensitive, not any single row — which is exactly the shape of record that a data broker, an ad exchange, or an analytics SDK with a habit of collecting more than it needs is built to find.

So the distinction that matters is not where the data rests tonight but what would have to change commercially for it to start moving. An app can keep everything local and still have a business model that quietly depends on it leaving later. That is why a privacy page that only describes storage is not the same as a product that says it is not built on selling or sharing your data.

What "on device first" actually covers

The privacy policy names the categories rather than gesturing at them, which is the useful part. Depending on which features you use, Linea handles: journey information (pregnancy stage, menstrual or due dates, birth dates, pregnancy outcome); parent and baby information (name, birth date, optional gender, feeding, sleep, diaper, growth, kick, contraction and recovery logs); wellness information (maternal recovery notes and scores from self-assessment tools); moment photos and captions you choose to add; and app preferences such as appearance and onboarding state.

A few consequences are worth spelling out because they are unusually clean:

• Reminders are computed on your phone. Your gestational week comes from the last menstrual period, or is back-calculated from a due date using a 280-day offset. Your baby's age comes from the birth date. The screening and vaccine windows that follow — the Tdap window, the glucose screen, the region-specific schedules for China and the United States — are all derived locally from those two anchors. Nothing about your cycle has to reach a server for a reminder to fire.
• Photos are selected, never scanned. If you add a photo to a bump diary or a first-year album, the app asks for access to the photo you pick, reduces it for display, and writes it to the app's local documents area. It does not walk your library. Decline the permission and the features that do not need photos keep working.
• The app is not a medical device. Its own terms say so in the first page of substance: it is an information and record-keeping tool that does not diagnose, monitor, treat, cure or prevent anything, and you should not use it to decide whether to seek care.

The three switches, and what deletion really removes

Linea's in-app privacy page exposes the whole data surface as three switches, all off by default: cloud backup (described as encrypted iCloud sync across your devices), anonymous analytics (described as crash reports only, no personal data ever), and caregiver sync (sharing logs with invited caregivers in real time). Nothing leaves your phone unless you turn something on. Honest caveat worth stating: those toggle states are held in memory for now rather than persisted, so treat them as a statement of intent rather than a durable setting you have configured.

Deletion is the part most apps get subtly wrong, and here it is unusually literal. Clearing your data runs a single transaction that hard-deletes every row from seven tables — journey, baby, log entries, maternal recovery, moment photos, plan appointments and symptom entries — and then removes the photo directory from disk. The photo bytes are not left behind as orphans after the database rows go, because the file cleanup is owned by the same code path as the row cleanup rather than being a separate job someone has to remember to run.

Deleting one item is softer: it leaves a local marker so related timelines stay consistent, and those markers live only inside the sandbox until all data is cleared or the app is uninstalled. There is a separate path for pregnancy loss, which can be cleared on its own, with a prompt to export first if you want to keep a record of it.

Where the promise stops

This is the section a competitor page will not write, so it is the one worth reading.

On-device means single-device. No account, no sync by default, no server-side copy — and therefore no recovery. The privacy policy is plain about it: because the records remain on your device, the developers cannot view or recover them for you. Lose the phone and the record is unless your iOS backup settings caught it. That is a real cost, not a footnote, and it is the direct price of the thing you asked about.

Backups are not entirely yours to control. Your device backups may include app data according to your Apple and iOS backup settings, controlled by Apple and your account. The app also cannot stop that. It is the one path where a copy of your records can exist somewhere you did not put it, which is worth knowing rather than discovering.

Nothing is completely sealed. The app relies on iOS sandboxing and device security, and it says outright that no system can guarantee absolute security. Meanwhile it does receive limited technical diagnostics and aggregate usage events for crash analysis — the policy states these are not intended to contain journey dates, health or recovery notes, baby-care logs or photos, and that Apple handles payment while the developer receives only transaction and entitlement status, never card details. Purchases, if you make any, are the one flow that necessarily touches a third party.

Security is partly your job. The terms put it on you: check dates, measurements and reminders before relying on them, maintain an appropriate backup yourself, and protect access to your device.

It is not finished yet. Linea is a work in progress, on iOS 17 and above, with no published App Store listing to install from — the push notification and Apple sign-in capabilities are declared but not yet switched on. Read the claims above as describing how the product is built, not as a download today.

What Linea does differently

Linea's data model is where this stops being a policy statement. Every log entry carries a subject — parent or baby — derived from what kind of record it is rather than typed in by hand. That one dimension is what lets the postpartum period carry two lines at once: your recovery and the baby's care in the same timeline, neither collapsed into the other.

The same derivation shows up in the stage model, where your stage is never stored as a label that can drift out of date. It is computed from the outcome and your dates every time: the first three trimesters by week, then postpartum for the baby's first 42 days, then infant to twelve months, then toddler to three. Record a birth and every screen re-derives from the one write.

And the design keeps a fourth timeline many competitors have no model for at all — a loss path that you can wipe in one action. Given that the sensitive part of this record is often the part you least want lying around, being able to make it disappear completely is a privacy feature, not a grief feature.

The decision

If your requirement is "nobody else touches this", verify it the way this page does: find the privacy policy and check whether it names the data categories, whether the storage claim is inseparable from a claim about monetisation, whether deletion removes files as well as rows, and what the app says it cannot do for you. A policy that only promises storage is answering half the question.

If you also need the record to survive a lost phone without thinking about it, be honest that you want two things at once — and that the second one is the one which requires the data to leave. That is the actual tradeoff, and it belongs to you to make rather than to a default.

Linea is one answer to it: the timeline from planning to age three, built so that the data staying on your phone is a property of the architecture rather than a setting.