Privacy
Last updated 3 September 2026. Plain language on purpose. If anything here is unclear, write to support@ranked.ng.
Who runs Parents
Parents, the service at parents.ng, is run by Ranked Technologies Limited (RC 9522220), Lekki, Lagos, Nigeria. Ranked Technologies Limited is registered with the Nigeria Data Protection Commission under registration NDPC/DCP/14538. We have not appointed a data protection officer, so privacy questions go to support@ranked.ng and a person reads them.
Who is responsible for a child's data
The creche that opens the account decides which children are added, what is recorded about them, and who gets a login. Under the Nigeria Data Protection Act 2023 the creche is the data controller for its children. Ranked Technologies operates the software and processes the data on the creche's instructions. We do not use it for anything else.
A creche must have the parent's or guardian's consent before it enters a child in Parents, and that consent has to cover the record being held on a server in Türkiye. This is set out for creches in the terms of use.
What is stored
- For each child: first name, last name, birth date, an optional birth time, and an optional photo.
- Daily care entries logged by staff, each with a time: feeds, sleep and naps, nappy changes, tummy time, temperature, medication, and carer notes. A note can carry a photo.
- Growth records if the creche uses them: weight, height, head circumference and BMI.
- For staff and parents: a login name, a first and last name if given, a password stored as a hash and never in clear, an optional email address, and the time zone and language that login chose. A login can also hold an API key, which the person can create and delete from the user menu.
- Failed sign in attempts, which record the address the attempt came from, the browser it used, the login name that was tried and the time. This is how the five wrong passwords lockout works.
- Web server logs: the page requested, the time, the status and the browser type. Public traffic reaches us through Cloudflare and our own proxy, so the address in that log is our proxy's, not yours. These logs rotate every week and fourteen are kept, so roughly three months, then they are overwritten.
Parents does not store parents' phone numbers. The daily report is put together on the staff device and handed to WhatsApp on that device; the carer picks the chat and sends. From that point the content is on WhatsApp, off our server, and WhatsApp's own terms apply to it.
The birth date and the immunisation dates
The immunisation table is worked out in your browser from the child's birth date and a copy of the Nigerian routine schedule held on this site. It is a reminder, not medical advice, and Parents does not know what a child was actually given. Nothing about it is sent anywhere.
Where the data is kept
The Parents server is operated by Ranked Technologies in Istanbul, Türkiye, not in Nigeria, and it is reached through Cloudflare, which carries the traffic and handles the encryption on the way in. This means a child's data leaves Nigeria. Under the Nigeria Data Protection Act that is a cross border transfer, the controller is a Nigerian company, and the processing happens in Türkiye. A creche must tell parents this and have their consent before adding a child. If you are a parent and did not agree to this, ask your creche to remove the child's record, or write to us.
The data sits on that one server and we are the only ones with access to it. There is no off site backup today, so a creche that needs its own copy should export it or ask us for one.
Who can see a child's record
Only the logins the creche created. Two things are worth saying plainly. Every login on a creche's instance can see every child on that instance, so a parent login is read only but is not limited to that parent's own child. And each creche gets its own separate instance of Parents, so one creche cannot see another creche's children.
What we do not do
We do not sell personal data, we do not share it with advertisers, and there is no advertising or analytics tracking on Parents. The pages load nothing from anyone else: no fonts, no scripts and no images from other sites. The only outside links are the WhatsApp hand off, which you press yourself, and the link to the Baby Buddy source code. This site also does not send email, so no confirmation or password reset message will reach you; the creche administrator sets passwords.
Cookies
Two, and neither is for tracking. A csrftoken cookie is set on every page and protects forms against forgery. A sessionid cookie is set once you sign in and is what keeps you signed in. Signing out clears it.
How long data is kept
A child's record stays for as long as the creche's account is open. When a creche asks for a child's record to be removed, it is deleted within 30 days. When an account is closed, all of its data is deleted within 30 days. Web server logs are kept for about three months as described above.
Your rights
You can ask to see the data held about you or your child, to correct it, to delete it, to have it exported to you in a usable form, to object to it being processed, and to have processing restricted while a question is being sorted out.
Ask your creche first, since it manages the account and decides what is recorded. You can also write to support@ranked.ng and we will work with the creche to act on the request. We answer within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission.
Security
The site is served over HTTPS. Passwords are stored as hashes. Five wrong passwords lock a login for an hour. Access to a child's data is limited to the logins the creche created, and the records are on our own server, which nobody outside Ranked Technologies can reach. We do not claim any certification or audit, because we hold none.
Open source
Parents is built on Baby Buddy, an open source project released under the BSD-2-Clause licence. The daily report, the WhatsApp hand off and the Nigerian immunisation schedule are additions built by Ranked Technologies Limited.