Privacy policy

Beacon Baby keeps your log on your device. There is no analytics and no tracking, and nothing you log is sent anywhere — unless you set up sharing in the Family tab, which is off until you turn it on.

What changed. Earlier versions of this policy said the log never leaves your device and that Beacon Baby has no server. That is still true of every install that does not use sharing. It stops being true for a household that does, so the policy now describes both.

All entries are written to a database on your iPhone. Photos are written to your device's application storage with file protection enabled and are excluded from device backups. None of it is transmitted to us. You are not asked for an email address, you have no account, and there is nothing about you on any server of ours.

Sharing lets everyone caring for your baby — a partner, a grandparent, a nanny — keep one log across their phones. Switching it on means:

• You create an account. Either Sign in with Apple — in which case you may use Apple's private relay and we never see your real address — or an email address you type, which is used only to send you a sign-in link and code. That email is delivered by Resend, a transactional email service, which receives your address and the message and nothing else.
• Your entries are copied to our database. Feeds, nursing sessions, diaper changes, sleep, pumping, bath times, medicines, temperatures, vaccinations, milestones, growth measurements and solids, their times, any notes you attached, and which child each one is for. Each child's name and date of birth are copied too, so every phone files an entry under the right child. This is hosted on Supabase, in the United States.
• Each entry says who logged it. The database records which member logged each entry and who last changed it, along with the name that person chose to be shown by. Nobody's email address is shown to anyone else in the family.
• Photos are not synced, and neither is the sex recorded for growth charts. Both stay on the device.
• Your family is isolated at the database level. Every row is keyed to a family, and the database refuses any request for a family you are not a member of. This is enforced by the database itself, not by the app asking nicely.
• Each person's access is set by the family. Someone can manage the family, log care, or only view, and can be limited to particular children. The database enforces this too: a person limited to one child cannot read another child's log.

Turning sharing off stops any further syncing, and signs you out, so nothing further leaves the phone. It does not delete what has already been uploaded — see Deleting your data.

When you delete an entry, the server keeps a marker saying that entry is gone, so the other phone finds out even if it was offline at the time. The marker keeps only the entry's identifier and the time it was removed — the note, the amount, the photo name and everything else you wrote are erased from the server.

Someone who can manage the family invites a person with a six-character code, choosing what that person will be able to do and which children they will see. Codes work once, expire within a day, and only one is live at a time; only the people who can manage the family can see them. Anyone holding a live code can join your family with the access it grants, so treat it like a password.

Entering a code moves your own log across, and that cannot be undone. If you have been logging on your own, those entries become part of the family you are joining, and everyone in it can read them. The app tells you this before you join, and asks you to confirm.

Only a log that has never been shared moves this way. If you have previously shared a log with somebody else, it stays where it is even after they leave — their entries are theirs, and joining a new household never carries somebody else's history into it.

Beacon Baby never contacts anything when it launches. That is deliberate: this app is opened in the middle of the night, and a launch-time request would leave a timestamped record of when your household is awake.

Every request the app can make, in full:

• A signed configuration file from beaconbaby-config.vercel.app, fetched only when you open the subscription screen or Settings. It sends nothing about you or your child.
• Sign-in and syncing, only once you have turned sharing on.
• If you choose to download the offline speech model, that download comes from Apple. It starts only when you ask for it, from Settings or the voice screen, never on its own, and Beacon Baby sends nothing with it.

As with any web request, our hosts receive your IP address and the timestamp. We do not analyse, profile, or sell them.

If you purchase a subscription, Apple's App Store handles the transaction. Apple, not Beacon Baby, processes your payment; we never see your payment details.

Speech is transcribed by Apple's on-device speech recogniser. Audio is not recorded, not stored, and not sent to any server, including ours. This is true whether or not sharing is on.

Beacon Baby is used by adults to record information about an infant. We do not knowingly collect personal information from anyone under 13. The account holder is the parent or carer, not the child.

You can leave a shared family at any time from Family → Account and sync. Your copy of the log stays on your phone, the others' copies stay on theirs, and new entries stop being shared.

Anyone who can manage the family can also remove someone from it — necessary when access is shared with a carer or a nursery. Their access ends straight away; what they logged stays in the family's history, under the name they used. Nobody can remove the person who started the family, and a family always keeps at least one person who can manage it.

Deleting the app removes every entry and photo from that device.

If you used sharing, Family → Account and sync → Delete my account removes your account immediately. You do not need to ask us, and there is nothing to wait for.

Where other people are still in your family, deleting your account removes you, your access and the name you chose — the entries you logged stay, no longer under your name — and leaves their copy of the log intact, because it is their history too. If you were the only person who could manage the family, the longest-standing remaining member takes that on. If you were the last member, the family and everything in it on the server go with you.

Your own copy stays on your phone either way. Deleting the app removes that.

You can export your log as a file at any time from the Trends tab. Once you share that file, it is outside our control and this policy no longer covers it.

If this policy changes materially, the updated date above will change and the new version will appear at this address.