Protecting your family's data
with the care it deserves.

1Introduction

Welcome to Baby's Day In (BDI). Early parenthood is a series of beautiful, exhausted moments. We are here to hold the technical weight of monitoring so you can hold your baby. Our mission is to provide you with "calm confidence" — that quiet, steady feeling that comes from having intelligent information at your fingertips.

When you use our two-smartphone setup — transforming one device into a nursery camera and the other into your command center — you are trusting us with your family's most private moments. We take the "invisible load" of tracking your infant's wellness seriously.

2Information we collect

To provide effortless insights and wellness benchmarking without the need for additional, vulnerable hardware, we collect the following:

• Account data Parental registration details: full name, email address, and secure encrypted credentials.
• Live camera feed Real-time video and audio streamed directly from the "Nursery" device to the "Parent" device.
• Cry and sound detection On-device audio processing that recognises crying, screaming, coughing, safety alarms and emergency sounds, and records the event with a confidence score. It does not determine why a baby is crying.
• Sleep logs Durations you start and stop in the app, summarised into weekly patterns.
• Activity logs Records of feedings, nappy changes, baths, and tummy time sessions.
• Health metrics Body temperature, medication administration, and vaccine records.
• Growth data Length/height and weight measurements.
• Wellness analysis Derived patterns across sleep, feeding, and crying data, shown against general World Health Organization (WHO) sleep-duration guidance.

3Consent & child privacy

As an app dedicated to infant care, we process sensitive information that falls under Special Category Data (Article 9 of the GDPR). Because this involves health-related data of a minor, we apply the highest tier of legal and technical protection.

• Affirmative express consent No data collection, audio monitoring, or video streaming begins until you have taken a clear, affirmative action within the app. Consent is never assumed — it is granted by you, the parent, for every specific monitoring feature.
• Child privacy protections Following FTC and GDPR guidelines, infant data is strictly partitioned. We never create "marketing profiles" for infants. The data exists solely to provide the care features you have requested.

4How we use data

Every piece of data we collect has a single purpose: giving you the information you need to care for your baby with calm confidence. Here is exactly how each feature uses it.

5Technical safeguards

Our security architecture treats your home like a high-security environment. By using two smartphones rather than cheap third-party IoT cameras, we inherit the hardware-backed security of modern mobile devices.

• Authenticated pairing The two-phone setup runs over a dedicated, authenticated and encrypted connection — preventing the "man-in-the-middle" attacks common in standard baby monitors.
• Data at rest Data on your phones is protected by the device's own encryption. Your activity and health logs never leave your devices. What we do hold — your baby's profile, alerts, detected-sound events and any soothe recordings — is stored with our processor, Google Firebase, protected in transit by TLS and gated by per-room access rules so only your devices can read it.
• Tuned against false alarms Detection has to hear a sound persist, not just occur once, before it raises an alert. We tune those thresholds against real recordings so an alert means something, and a passing noise does not wake you.

6Processors & analytics

We do not use advertising or social-media tracking, and we never sell your data. To run the service we rely on a small set of trusted infrastructure providers, disclosed here.

• Google Firebase Our backend: Authentication, Firestore database, Cloud Messaging (push notifications) and Cloud Functions. Your baby's profile, alerts, detected-sound events and soothe recordings are stored here on your behalf. Your activity and health logs are not — they stay on your devices.
• Cloudflare Provides the encrypted relay that forwards your video and audio when a direct phone-to-phone link isn't possible. It cannot decrypt the media.
• Resend E-mail delivery. Sends the one-time code you use to sign in. It receives your e-mail address and nothing else.
• Crash reports (Firebase Crashlytics) If the app crashes, a technical report (stack trace, device model, OS version, app version) is sent so we can fix it. Crash reporting is essential to keeping the monitor reliable and is always on. It never includes your video, audio, your baby's name, PINs or messages.
• Usage analytics & performance (Firebase Analytics, Performance) Anonymous, aggregated app-usage and performance data that helps us improve the app, with the same exclusions as above. You can turn this off at any time in Settings → Preferences → Privacy.
• Website analytics (Cloudflare Web Analytics) This website, not the app, counts page views and measures how fast pages load with Cloudflare Web Analytics. It sets no cookies, doesn't track you across sites and keeps no profile of you.
• No data brokers We do not sell, lease or trade your family's information, and we build no marketing profiles of infants.

7Your data, your control

For our aggregate wellness benchmarking (e.g. assessing average sleep patterns against WHO norms), all data is stripped of personal identifiers. This anonymous data helps us provide smarter insights for the entire BDI community without compromising your family's identity.

You have total control. To permanently erase all data associated with your account:

1. 1

   Settings

   Open the BDI App and go to Settings

2. 2

   My Account

   Select My Account

3. 3

   Delete account

   Tap Delete account and confirm

8Regulatory compliance

The UK Product Security and Telecommunications Infrastructure (PSTI) Act requires transparency for internet-connected products. BDI complies fully:

• No default passwords The system uses unique, hardware-backed pairing keys and user-generated credentials. There is no shared or factory-default password.
• Unique pairing Each two-phone setup is unique to the user, preventing unauthorised bulk access.

9Breach notification

In the unlikely event of a data breach, we follow the "Active Notification" rule. Consistent with GDPR:

• 72-hour commitment You will hear from us within 72 hours of a confirmed breach — not after legal review, not after PR consultation.
• In-app & email Notifications are delivered via direct in-app alerts and email so you receive them wherever you are.
• Full transparency We will provide a clear, honest account of what happened and what you should do next.

10International transfers

You have the sole right to export your "Doctor-Ready" wellness reports. While we store them securely, they are yours to share with healthcare professionals at your discretion.

• Doctor-ready exports Wellness reports are formatted for easy sharing with your GP, health visitor, or paediatrician. You own them entirely.
• Standard Contractual Clauses (SCCs) If data is processed outside your home jurisdiction, we utilise SCCs to ensure your data receives the same rigorous protection required by your local laws.

11Contact

Questions about your privacy shouldn't be met with sugarcoating or panic. Our Data Protection Officer (DPO) acts as a trusted friend — providing smart, honest, and calm answers.

Version 1.2.0 · Last updated September 2026 · Baby's Day In