Privacy Policy

Effective date: October 7, 2026 · Applies to the Baboo app for Android, iPhone, iPad and Apple Watch, the Baboo web viewer and this website.

The short version

You do not need an account. We never ask for your name, email or phone number to use the app.
Live video and sound travel encrypted between your own devices. We do not record, store, watch or listen to them.
Recorded clips and your activity history stay on your devices and, on iPhone and iPad with iCloud, in your private iCloud storage, which we cannot access.
Our server only helps your devices find each other: it sees device identifiers, device names, pairing codes and IP addresses.
We use Google Firebase for usage statistics and crash reports, and Google AdMob to show ads in the free version. Subscribers see no ads.

The full policy below is what legally applies. This summary does not replace it.

1. Who we are

The Baboo app, the Baboo web viewer and the website babymonitormobile.xyz (together, the "Service") are provided by FlashSoft OÜ, a private limited company registered in Estonia under registry code 16941816, with its registered address at Ruunaoja tn 3, Lasnamäe linnaosa, Tallinn, Harju maakond 11415, Estonia ("we", "us", "our").

For personal data processed as described in this policy, we are the controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR, except where a third party acts as an independent controller as described in section 4. You can reach us at support@babymonitormobile.xyz.

This policy forms part of, and should be read together with, our End User License Agreement. By installing or using the Service you acknowledge that you have read this policy. If you do not agree with it, please do not use the Service.

2. What we process and why

2.1 Device and connection data (our signalling server)

To let two of your devices find and connect to each other, the app talks to a signalling server that we operate. For this purpose the server processes:

a random identifier the app generates for each installation, and the device name and type (for example "Mom's phone", Android phone, iPhone or iPad);
temporary four-digit pairing codes and the list of devices each installation is paired with;
whether a device is online, whether it is acting as the camera or the parent device, and connection events (connect, disconnect, pairing, start and end of a session);
the IP address of each connection, which we may use to derive an approximate country for aggregate statistics and to protect the Service against abuse;
technical information needed to set up the connection, such as network candidates exchanged between your devices.

We use this data only to provide the pairing and connection features, to keep the Service secure, to troubleshoot problems and to produce aggregate statistics (for example, how many sessions took place on a given day).

2.2 Live video and sound

Video and sound from the camera device are sent to your parent device using WebRTC, which encrypts media in transit between the two devices. Where your devices can reach each other directly, for example on the same Wi-Fi network, the media goes straight from one to the other. Where they cannot, it is forwarded through a relay (TURN) server. The relay passes along encrypted packets and cannot view or listen to them.

We do not record, store, view, listen to or analyse your live video or sound on our servers.

2.3 Clips, activity history and settings

When motion or crying is detected during a session, the app can save a short video clip. Clips, your session and activity history, your paired devices and your settings are stored on your device. If iCloud is enabled for the app on your device, this information is also synchronised through your private iCloud account using Apple's CloudKit, so that it is available on your other Apple devices.

On Android, this information stays on the device and is not synchronised anywhere; it is removed when you delete the app or clear its storage.

Data in your private iCloud account is held by Apple under Apple's own privacy policy. We cannot access it. You can delete clips in the app, turn off iCloud for the app in iOS Settings, or manage your iCloud storage at any time. We do not keep a copy, so data you delete, or data lost with a device or iCloud account, cannot be restored by us.

2.4 Sound analysis

Crying and noise detection runs entirely on the camera device: on iPhone and iPad using Apple's on-device sound analysis, on Android by measuring the sound level on the device. The audio used for detection is not sent to us. Only the result (for example, a noise level or "crying detected") is sent to your own parent device, encrypted, to show readings and alerts.

2.5 Device permissions

The app asks for the following permissions and uses them only for the purposes stated:

Camera and microphone – to capture video and sound on the camera device, detect crying and let you talk to your baby. Nothing is captured unless you start a session.
Local network, Bluetooth, Wi-Fi and nearby devices – to connect your devices directly to each other without going through the internet where possible. On Android 11 and earlier, the system requires the location permission before an app can scan for nearby Bluetooth devices; the app asks for it only for that reason and does not use it to determine your location.
Notifications – to alert you about crying, motion, low battery or a lost connection.
Running in the background (Android) – a foreground service with a visible notification keeps the camera, microphone and sound playback running while the screen is off. You can also exempt the app from battery optimisation so that the system does not stop it overnight.

The app does not access your location, contacts, photo library or health data. You can change permissions at any time in your device settings. Some features stop working without them.

2.6 Purchases

Subscriptions and one-time purchases are processed by Apple through the App Store or by Google through Google Play. We never receive your name, payment card or billing address. The store tells the app which purchases are active on your Apple ID or Google account so that it can unlock premium features, and we may record anonymous purchase events (for example, "subscription started") in our analytics.

2.7 Support requests

If you email us or use the feedback form in the app, we process your email address, your name if you give it, the content of your message and anything you choose to include, such as device models or screenshots, in order to answer you. The in-app form sends this to our support server at flashsoftapps.com.

2.8 This website

The website does not use cookies, analytics or advertising trackers. Like any web server, ours records standard access logs (IP address, date and time, page requested, browser type) for security and troubleshooting.

3. What we do not collect

We do not require or offer an account, and we do not ask for your name, email address or phone number to use the app.
We do not collect your location.
We do not sell your personal data for money.
We do not use your video, sound or clips to train any model, to build profiles or for advertising.

4. Third-party services

The app includes software from the following providers. They process data under their own privacy policies and, in some cases, as independent controllers. We are not responsible for their privacy practices.

Google Firebase Analytics (Google LLC / Google Ireland Ltd) – usage statistics such as screens opened, features used, pairing success and session length, together with device model, OS version, app version, country derived from IP address and an app-instance identifier. Used to understand how the app is used and to improve it. Firebase privacy.
Google Firebase Crashlytics – crash reports and diagnostic information (stack traces, device model, OS version, app state at the time of the crash). Used to find and fix bugs.
Google AdMob and the Google User Messaging Platform – shows ads in the free version and asks for your advertising consent where the law requires it. Depending on your choices, AdMob may process your device's advertising identifier (IDFA on iOS, the Android advertising ID on Android), IP address and information about your interaction with ads, to serve, measure and, if you allow it, personalise ads. On iOS the advertising identifier is only available if you allow tracking when the system asks. On Android you can reset or delete it in the system settings. How Google uses data from apps.
Apple – the App Store (downloads and purchases), iCloud and CloudKit (synchronisation in your private iCloud account), notification services and on-device frameworks. Apple privacy policy.
Google Play and Google Play services (Android) – downloads and purchases, the in-app rating prompt, and Nearby Connections, which lets two Android devices connect directly over Bluetooth or Wi-Fi. Google privacy policy.
Google STUN servers – used by WebRTC to help your devices discover how they can reach each other. They see the IP address of the connection, not your media.
Hosting providers – our signalling, relay and web servers run on infrastructure rented from third-party cloud providers, who process data on our behalf and under our instructions.

Subscribers do not see ads, and the app does not request ads for them.

5. Legal bases (EEA and UK)

Performance of a contract (GDPR Art. 6(1)(b)) – device and connection data, live media relay, clips and settings, purchases and support, because these are needed to provide the Service you asked for.
Legitimate interests (Art. 6(1)(f)) – security, abuse prevention, troubleshooting, crash reporting, aggregate statistics and non-personalised advertising that keeps the free version free. You can object at any time (see section 12).
Consent (Art. 6(1)(a)) – personalised advertising and access to the advertising identifier, where you give it through the consent form and the iOS tracking prompt. You can withdraw consent at any time without affecting the lawfulness of earlier processing.
Legal obligation (Art. 6(1)(c)) – where we must keep or disclose data by law.

We share personal data only:

with the service providers and third parties listed in section 4, for the purposes described there;
between your own paired devices, for example the camera device's name shown on the parent device;
if required by law, court order or a lawful request from a public authority, or where we believe in good faith that disclosure is necessary to protect the rights, property or safety of us, our users or others;
in connection with a merger, acquisition, reorganisation or sale of all or part of our business, in which case the recipient will be bound by this policy or one offering at least the same protection.

7. International transfers

Our service providers, including Google and Apple, may process data outside the European Economic Area, including in the United States. Where they do, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework, where the recipient is certified) or on the European Commission's Standard Contractual Clauses.

8. How long data is kept

Device and pairing data on our server – for as long as the device uses the Service. Pairing codes expire as soon as they are used or abandoned.
Server logs – only as long as needed for security and troubleshooting, after which they are deleted or anonymised.
Live video and sound – not stored by us at all.
Clips, history and settings – on your devices (and in your iCloud on Apple devices) until you delete them or the app.
Analytics and crash data – according to the retention settings of Google Firebase.
Support emails – as long as needed to handle your request, and afterwards only where the law requires it.

9. Children

The Service is intended for use by parents, guardians and other adults. It is not directed at children, and children should not install, configure or operate it. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA) as users.

The purpose of the app is for an adult to watch and listen to a child. Video and sound of the child are transmitted, encrypted, only between the adult's own devices and are not stored or accessed by us, as described in section 2. If you believe a child has provided personal information to us, contact us and we will delete it.

10. Your responsibilities

You decide where the camera device is placed, who can see the parent device and whether clips are kept. If the camera can capture anyone other than your child – for example a babysitter, relative or guest – it is your responsibility to inform them and to obtain any consent the law requires for recording or monitoring. Keep your devices, passcodes, Apple ID and Google account secure, and do not pair devices you do not own or control. See our End User License Agreement for the full terms.

11. Security

We use technical and organisational measures appropriate to the nature of the data, including encryption of live media in transit, encrypted connections to our servers and access restrictions on our infrastructure. However, no method of transmission over the internet or of electronic storage is completely secure. We cannot guarantee absolute security, and to the extent permitted by law we are not responsible for unauthorised access that results from causes outside our reasonable control, including compromised devices, Apple IDs, Google accounts, Wi-Fi networks or third-party services.

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent at any time. To exercise these rights, email support@babymonitormobile.xyz. Because we do not use accounts, please include the device name shown in the app so that we can find the relevant records. We may ask for information to confirm the request is yours.

You can also act directly:

Delete your data – unpair devices and delete clips in the app, then delete the app. Turn off iCloud for the app in iOS Settings to stop synchronisation and remove its data from iCloud. On Android, deleting the app or clearing its storage removes everything it stored on the device.
Advertising – change your answer in the app's privacy settings, turn off "Allow Apps to Request to Track" in iOS Settings › Privacy & Security › Tracking, delete the advertising ID in Android Settings › Privacy › Ads, or subscribe to remove ads.
Permissions – change them at any time in iOS Settings › Baboo or in Android Settings › Apps › Baboo.

If you are in the EEA or the UK, you have the right to lodge a complaint with a data protection authority, including the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the authority where you live. We would appreciate the chance to address your concern first.

13. Additional notice for US residents

In the past 12 months we have collected the categories of personal information described in section 2: identifiers (installation identifier, IP address, and the advertising identifier where you allow it), internet or other electronic network activity (app usage and diagnostics) and approximate location derived from IP address. We do not sell personal information for money. Allowing personalised advertising may count as "sharing" for cross-context behavioural advertising under California law; you can opt out at any time as described in section 12. We do not use or disclose sensitive personal information for purposes that require a right to limit, and we will not discriminate against you for exercising your rights.

14. Changes to this policy

We may update this policy from time to time, for example when we add features or when the law changes. The new version takes effect when it is published on this page with a new effective date. If a change materially affects how we use personal data, we will give notice in the app or on this website. Continuing to use the Service after a change takes effect means you accept the updated policy.

15. Contact

FlashSoft OÜ
Registry code 16941816
Ruunaoja tn 3, Lasnamäe linnaosa, Tallinn, Harju maakond 11415, Estonia
Email: support@babymonitormobile.xyz