The first screen most pumping apps show you is the sign-up screen. Email, password, terms-of-service checkbox. Maybe a "sign in with Apple" button if you're lucky. You're standing in the kitchen at 9 PM with a pump in one hand and a phone in the other, and the app wants you to create an account before you can log a single ounce.
This is so common we've stopped noticing it. But the account is doing a specific thing, and that thing is worth understanding before you hand over an email address and the timing of every overnight pump for the next twelve months.
What "Create an account to continue" actually means
When an app asks you to register, it's making one or more of the following choices:
- Sync your data to a server so it can appear on your other devices, or your partner's.
- Tie your usage to a billable customer because the business model involves payments.
- Build a longitudinal profile of your behaviour for analytics, marketing segmentation, or aggregate research.
- Comply with a feature that genuinely requires shared state — a community forum, a live chat with a lactation consultant, something that has to exist outside your phone.
Most accounts in pumping apps are a mix of (1), (2), and (3). Sometimes (4). The thing to understand is that the account isn't optional infrastructure. Once it exists, every feature gets built assuming it's there. The "sign in with Apple" button is a UX upgrade, not a privacy upgrade — you've still created an account, the email is just hidden behind Apple's relay address. Your pumping schedule is still on someone's servers.
What an account-required app can do that a local-first app can't
This is the honest list. I'm not going to pretend the account-required model has no upside, because it does:
- Sync to a partner's phone. This is the legitimate use case. If you and your partner are co-managing a stash, an account is the easiest way to keep both your phones in sync.
- Restore on a new phone. If you drop your iPhone in the pool, an account-backed app can put your last twelve months of sessions back when you buy a replacement. (Note: iCloud device backups give you something similar for local-first apps, with different trade-offs.)
- Show you data on the web. Some moms want to look at pump trends on a laptop. That requires the data to live somewhere your laptop can reach.
If those three things are core to how you want to use a pumping app, an account is the right choice and you should pick an app with one. There's nothing dishonest about a paid, account-required tracker.
What the account doesn't magically buy you:
- HIPAA protection. This is the most common misconception. HIPAA applies to "covered entities" — hospitals, insurance plans, health-care providers and their business associates. Consumer health-tracking apps are not covered entities. Pumping apps are not bound by HIPAA. The privacy policy of the app is what governs your data, and privacy policies can change.
- Encryption. Saying "your data is encrypted" usually means "encrypted in transit and at rest on our servers." This is table stakes. It doesn't mean the company can't see your data — they can, because they hold the keys. End-to-end encryption is rare in health-tracking apps.
- Privacy from the developer. The developer has the data. Whether they look at it depends entirely on policy, not technology.
This isn't a scary list. It's just the actual list. The privacy promise an account-based app can make is limited by the architecture: as long as the data lives on a server, the company holds it.
What "local-first" actually means
A local-first app stores everything on your device only. The implication is fairly extreme if you think it through:
- The app's developer doesn't have your data because they never received it.
- The app cannot be subpoenaed for your data, because there's nothing in the app's servers to subpoena.
- A data breach at the developer's end cannot expose your records, because the developer doesn't have your records.
- The app continues working with no network connection, including in airplane mode, basement-level NICU rooms, and Wi-Fi-dead night-shift hospitals.
- Switching off the app's notifications or analytics is not a choice you make — it's a property of the system. There's nothing to switch off because there's nothing collecting.
That last point is the one I think gets undersold. The strongest privacy guarantee an app can offer is structural — "we can't see your data because we never get it" — not policy — "we promise not to look at your data."
What MommyRon does and doesn't do
I'll be specific so this doesn't read as marketing.
MommyRon does:
- Store your pump sessions, stash inventory, and settings in the app's sandboxed container on your iPhone, using Apple's SwiftData.
- Schedule local notifications and alarms for pump reminders and stash expiry. iOS handles those locally on your device.
- Run companion messages through Apple's Foundation Models framework — Apple Intelligence on the device, with no network round-trip.
MommyRon does not:
- Make any network requests. (You can verify this in iOS Settings › Privacy & Security › App Privacy Report.)
- Create accounts, ask for an email, or include a sign-up screen.
- Use any analytics SDK, crash-reporting service, advertising SDK, or behavioural tracking.
- Set cookies, use device identifiers, or collect location data.
The full statement is in the privacy policy. It's short, because it has to describe a small amount of behaviour.
The honest trade-off
A local-first app cannot sync to your partner's phone or restore on a new device automatically. Those are real trade-offs and I won't pretend they don't matter.
The way local-first apps handle this is by getting out of your way: export your data when you want a copy. MommyRon lets you export to CSV (for spreadsheets) or PDF (for sharing with an IBCLC or paediatrician), and iOS's encrypted device backup will restore your data on a new phone the same way it restores your photos.
It's a different shape of solution. It puts you in charge of the copy. The upside is that the company you downloaded the app from has no role in your data continuing to exist.
How to tell if a pumping app is actually local-first
If you're picking between trackers and you care about this:
- Look for "no account required" in the App Store description. Not "sign in with Apple supported" — those are different things.
- Check the App Privacy "Data Linked to You" section on the App Store listing. Local-first apps should report nothing collected.
- Read the privacy policy. It should be short and specific about what doesn't happen.
- Look at the network indicator on launch. Tools like Little Snitch (Mac) or the iOS App Privacy Report show network calls. A local-first app should be silent.
These are the same heuristics I'd use as a developer evaluating any health-tracking app. They're not unique to pumping.
The wider point
The reason this matters isn't that pumping schedules are uniquely sensitive (although they're not nothing — they're a fairly precise map of a postpartum body's recovery). It's that the defaults of the consumer app world have drifted, over the last decade, toward "create an account first, ask questions later." Pumping apps inherited those defaults from the rest of the industry.
For an exclusively pumping mom, the schedule, the volume, and the supply curve are deeply personal artifacts of a hard year. They shouldn't have to live on a stranger's server because that's what an app store norm dictates.
That's the entire pitch for local-first. The privacy isn't a feature on a marketing page — it's the absence of every other thing.
MommyRon is the free, private exclusive pumping app for iPhone. No accounts, no tracking, no network calls. Get it on the App Store, or read the full privacy policy.