Privacy Policy

1. What We Collect

We collect three categories of information, each with a distinct purpose. We collect only what is needed for the service you have requested.

Required — Core Birth Record

To produce a Birth Codex, we require: the child's full name, date of birth, time of birth (or a note that the time is unknown), and place of birth. These four data points are the foundation of the record. Without them, production cannot begin.

Required — Order Fulfillment

We collect the name, email address, shipping address, and relationship to the child from the person placing the order. This is used to confirm the order, deliver the proof, ship the record, and communicate about your order status. Payment is processed by a PCI-compliant third-party processor — we do not store full card numbers, CVV codes, or banking credentials. We retain only the last four digits and billing address for verification purposes.

Optional — Personalization

The Provenance intake offers optional fields: a name story, a dedication, narrative context, and color direction. These are entirely voluntary. Choosing to skip them does not diminish the record — it produces a facts-only Codex, which is a complete and valid choice.

Optional — Symbolic Modules

If you choose to include symbolic or interpretive content — such as celestial alignment, numerological profile, or archetype data — those modules are calculated from the birth date, time, and place you have already provided. They are optional additions, clearly labeled as interpretive content derived from established traditions. They are not presented as factual claims about a child's personality, capabilities, or future.

Website Usage Data

We collect standard technical data when you interact with our website: IP address, browser type, device type, pages visited, and session duration. This is used for site performance and security purposes only. The Provenance intake form stores your in-progress data locally in your browser using encrypted local storage — it does not leave your device until you confirm checkout.

2. How We Use It

We use the information you provide for these purposes only:

• To produce, proof, and deliver your Birth Codex record
• To process payment and manage your order
• To communicate with you about your order, proof, and delivery
• To maintain the Codex Archive as a verification record for the physical artifact
• To operate MYA for families who have activated it
• To comply with applicable legal obligations

We do not use your data for advertising, behavioral profiling, algorithmic scoring, or any purpose unrelated to producing and maintaining your record.

3. Who Sees Your Data

My Birth Codex™ does not sell, trade, rent, or license your personal information to any third party. We do not share data with advertisers, data brokers, or research organizations.

The following service providers receive limited access to specific data fields as required to fulfill your order. Each operates under a confidentiality agreement and is permitted to use your data only for the specific service they provide to us:

• Print production partner: Receives the finalized record layout for printing and fulfillment. Sees the composed document — not your raw intake form or contact details beyond the shipping address.
• Cloud hosting and infrastructure provider: Stores the encrypted intake and record data on servers in the United States. Does not have application-level access to your data.
• Payment processor: Receives payment details directly at checkout. My Birth Codex™ never sees or stores your full payment credentials.

Beyond these three categories, we share information only in two additional circumstances:

• Legal obligation: When required by a valid court order, subpoena, or applicable law. We will notify you to the extent legally permitted before complying.
• Record authentication: With your explicit, written authorization, to confirm the authenticity of a Codex record to a named third party of your choosing.

4. What We Keep and What You Can Delete

This section answers the question we are most often asked: what happens to your data after the Codex is delivered?

What we retain after delivery

After your record is delivered, we retain your order and contact records for standard business and legal purposes. We do not retain a permanent archive entry of your child's birth data on our servers.

Full deletion — including all birth data

Every Birth Codex order includes a deletion credential delivered with the physical record. Using this credential, you can request permanent deletion of everything we hold: the child's name, birth date, time, and place; your full Provenance intake; your contact information; and any optional personalization data you submitted. We will process confirmed deletion requests within 30 days.

Full deletion means we have no record of the data used to produce your Codex. The physical artifact you hold is yours permanently. We simply will not retain a copy of the information that created it.

What deletion means for reprints

After full deletion, we cannot reproduce the record — we no longer hold the data required to do so. If a reprint is ever needed, you would need to resubmit your information. This is the trade-off full deletion carries, and we disclose it clearly at the time of any deletion request.

5. Hospital Integrations (Codex Core)

Codex Core is an institutional service for hospitals and health systems. It is governed by a separate Master Services Agreement and Business Associate Agreement (BAA) executed between My Birth Codex™ and the institution before any data transfer occurs.

Clinical data ingested through Codex Core is handled as follows:

• Ingestion is read-only — no data is written back to the EHR system
• Data is encrypted in transit and at rest
• Access is limited to the personnel required to produce the record
• Retention is limited to what is required to produce and authenticate the Codex Origin record

HIPAA applies to Codex Core institutional integrations where a BAA is in place. Consumer-direct orders placed through our website are not governed by HIPAA. We do not represent consumer orders as HIPAA-covered transactions. For complete details on our institutional data practices, see our Notice of Privacy Practices.

6. MYA — The Living Record

MYA (Moment You Arrived) is a forthcoming digital vault for families who hold a Birth Codex. It is not yet available to the public. When launched, MYA will store the verified data from your Birth Codex and any family-contributed milestones or additions you choose to include.

What MYA stores

MYA stores your verified Codex record data and family-contributed content. This data is private to your family account and is not accessible to any third party without your explicit, written authorization.

AI processing

MYA will use AI to organize and surface your record data. AI processing will operate only on data already in your record — it will not ingest external sources or share your data with AI model training pipelines.

Data residency

MYA data will be stored in encrypted, access-controlled infrastructure in the United States. It will not be transferred to international servers for processing or storage.

7. SMS & Mobile Messaging

My Birth Codex™ may send SMS messages to individuals who have explicitly opted in to receive them. By opting in, you consent to receive text messages from us at the number you provided.

Mobile information and messaging consent are not shared with third parties or affiliates for marketing or promotional purposes. Your phone number and SMS consent are used solely for order updates, account communications, or services you have directly enrolled in.

Message frequency varies. Standard message and data rates may apply. To opt out, reply STOP to any message. To re-subscribe, reply START. For help, reply HELP or contact us at hello@mybirthcodex.com.

8. Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the data we hold. These include:

• Encrypted transmission for all data in transit (TLS 1.2 or higher)
• Encryption at rest for all stored personal and birth identity data
• Role-based access controls limiting data access to authorized personnel only
• AES-GCM encryption in the Provenance intake form — data is encrypted locally in your browser before it reaches our servers
• Periodic review of access controls and data handling practices

No system is impenetrable. In the event of a breach affecting your personal data, we will notify impacted individuals within 60 days of discovery via the email address on the order. The notification will describe: the incident, the data involved, steps you can take, and our remediation actions.

9. Children's Data

The Birth Codex records data about children — this is the purpose of the product. Data is collected from and consented to by the parent, guardian, or authorized representative submitting the order. We do not collect data directly from children, and we do not operate services directed at children.

All data about a child is held under the authority of the ordering parent or guardian. When the child reaches the age of majority, they may request transfer of record authority by contacting us at hello@mybirthcodex.com.

We do not use children's data for advertising, profiling, or any purpose beyond producing and maintaining their record. We do not include real child information in analytics events, session recordings, ad pixels, or URL parameters.

10. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of all personal information we hold, including birth data used to produce your record. See Section 4 for what this means for future reprints.
• Portability: Request a machine-readable export of your data
• Opt-out of communications: Unsubscribe from non-transactional communications at any time

California residents have additional rights under the California Consumer Privacy Act (CCPA). My Birth Codex™ does not sell personal information. To exercise any of these rights, contact us at hello@mybirthcodex.com. We will respond within 30 days.

11. Cookies & Tracking

Our website uses a minimal set of cookies necessary for site function: session management, security tokens, and form state. We do not use third-party advertising cookies or behavioral tracking technologies. We do not place real child data into cookies, analytics events, or URL parameters.

You may configure your browser to reject cookies. Doing so will not prevent you from accessing the site, but may affect certain form functions.

12. Changes to This Policy

We may revise this policy as our practices evolve or as required by law. Material changes will be posted with a revised effective date. Where appropriate, we will notify active account holders directly. Continued use of the site or services after a revision constitutes acceptance of the updated policy.

13. Contact

All privacy inquiries, deletion requests, and data concerns should be directed to: