Beacon BabyPrivacy first
“Off. Nothing leaves this device.”
That sentence is from the app's own Account and sync screen, and it describes the state Beacon Baby ships in. Sharing exists for families who want one log across everyone's phones — it is off until you switch it on, and this page is the whole accounting either way.
This page used to say there was no server.
There is one now, and it would be worse than useless to leave that quiet. Beacon Baby added sharing so a family can keep one log across everyone's phones, and a household that turns it on has its entries copied to a database. Everything below is what that does and does not mean — including for any install that never turns it on, for which nothing has changed at all.
“Earlier versions of this policy said the log never leaves your device and that Beacon Baby has no server. That is still true of every install that does not use sharing. It stops being true for a household that does, so the policy now describes both.” — from the app’s own privacy policy
Two states, and you choose
What leaves your phone, in both cases.
Sharing off — the default
Nothing about you leaves your phone.
No account, no email address, nothing about you on any server of ours. Entries live in a database on your iPhone; photos are written with file protection on and are excluded from device backups.
- You are never asked for an email address
- There is no account, so there is nothing to breach
- The app contacts nothing at launch
- Voice is transcribed on-device; audio is never recorded or sent
Sharing on — only if you switch it on
Your entries are copied to our database.
Every kind of entry — feeds, nursing, diapers, sleep, pumping, baths, medicines and other medical notes, vaccinations, milestones, growth and solids — with its time, any note, and who in the family logged it. Each child's name and date of birth, so every phone files an entry under the right child. The name each person chooses to be shown by, and what they can do in the family. Your sign-in email sits with your account and is never shown to anyone else in the family. Hosted on Supabase, in the United States.
- You sign in — Sign in with Apple, where you can hide your real address behind Apple's private relay, or a link and an 8-digit code sent to your email. That email is delivered by Resend, which receives your address and the message and nothing else
- Your household is isolated in the database itself, not by the app asking nicely
- You choose what each person can do — manage the family, log care, or only view — and which children they can see. The database enforces it, not the app
- Removing someone ends their access straight away. What they logged stays in your history, under the name they used
- Photos are never synced, and neither is the sex recorded for growth charts. Both stay on the device
- Joining someone else's household moves your log into it, and that cannot be undone — the app asks first
- Turning it off stops syncing and signs you out
- Delete my account removes your account and the name you chose. If you are the only one in the family, the server copy of the log goes with it; if someone else is still in it, the log stays with them, no longer under your name
Network activity, complete
Every request the app can make.
Not a summary. The list, including the one that used to be the only one.
- On launch
- Nothing.
- Deliberate. This app is opened at 3am, and a launch-time request would leave a timestamped record of when your household is awake.
- When you log a feed
- Nothing, unless sharing is on.
- With sharing off the entry is written to your phone and stays there. With sharing on it syncs to your household.
- When you speak to it
- Nothing.
- Speech is transcribed by Apple's on-device recognizer. Audio is not recorded, not stored, and not sent to any server, including ours — whether or not sharing is on.
- When you view trends
- Nothing.
- Every chart is computed on your phone from your own log.
- When you open Settings or the subscription screen
- One signed configuration file.
- Fetched from our configuration server, describing which features are paid. It sends nothing about you or your child.
- When you view plans, subscribe, or restore
- Apple's App Store.
- Prices, the purchase and any restore go through Apple. We never see your payment details.
- If you download the speech model
- A download from Apple.
- Voice needs it, and you start it yourself — from Settings, or from the voice sheet if the model is missing. Tapping the mic never starts it. It comes from Apple, and Beacon Baby sends nothing with it. Leave voice off and you never need it.
- When you turn sharing on
- Sign-in, then syncing.
- Only once you have switched it on. Until you sign in, nothing about you or your baby leaves your phone.
Still absent
Six things that are not in this app at all.
Not disabled, not opt-out, not behind a toggle. Not present in the binary.
Analytics — no Firebase, no Amplitude, no Mixpanel
Any advertising SDK, and any tracking pixel
Crash reporting that ships your log with the stack trace
An IDFA request, or a consent dialog for one
Any launch-time network call whatsoever
Photo syncing, even with sharing switched on
The privacy details the app declares to Apple match this: no tracking, and nothing collected until someone turns sharing on. Then it is the entries, each child's name and birth date, each person's display name and role in the family, an email address and an account ID. All of it is used only to make sharing work. Read the full policy — it is the same document the app links to, word for word, and it is the one that governs.
Off by default. On only if you ask.
And with sharing off, it contacts nothing at all when you open it at 3am.
Free to log, forever. No account needed to log. iPhone, iOS 26 or later.
Not ready to install anything?
Get the free Day-One Kit →