Nobody listens to your nursery but you

Moonside was built so that there would be very little to write a privacy policy about. This page says plainly what we can and cannot see; the privacy policy has the full text.

What we never have

• Your audio

  Live audio is encrypted end to end between your paired phones with DTLS-SRTP, the encryption of encrypted video calls, and the messages that set the connection up are signed with Ed25519 keys your phones make themselves. Our servers never store the audio, and when it passes through our relay it is still encrypted and cannot be listened to.

• An account

  There is nothing to sign up for, no email address, no password. The phones identify each other with keys they create themselves.

• A camera

  Moonside is audio only. There is no camera in your child's room and no video feed to leak.

• Ads or trackers

  No advertising, no analytics SDK, no tracking. The app talks to a purchase service, an update service and, if you allow it, a crash-reporting service, and to nothing else.

• Your phone's address in a log

  Our signalling server and relay write no IP address, device identifier or key to any log or file. Connections are tagged with a random label that exists only in memory.

• A record of who spoke to whom

  The server's own records are outcomes, not identities: that a connection failed and why, never who was connecting or from where.

What stays on your own phones

• Messages you record in your own voice are kept on the Baby phone so they play instantly.
• Sound clips, a few seconds of what an iPhone or iPad in the nursery heard, are kept so you can play back what woke it. They move only between your paired devices over the same encrypted connection, are deleted automatically after 36 hours, and can be switched off in Settings, which also deletes the ones already saved.
• The history of the night leaves the phone only when you send it yourself with Send Log.
• Your device's private key lives in the phone's secure storage and is never included in a QR code.

What we do receive, and why

• An anonymous purchase record at RevenueCat, so the one-time purchase can be checked and restored. No name, no email, no audio.
• A short technical report after each session: how long it lasted, how it ended, whether the connection was direct or relayed, the phone model and system version. Never audio, sound levels, the times your baby made a sound, or anything you typed. Reports are kept for 90 days and can be switched off in Settings.
• A crash report, if the app crashes and you have left crash reports on, to a crash-reporting service in Frankfurt, Germany, with the IP address not stored. Also switchable in Settings.

Monitoring works exactly the same with the reports off.

Safety: a monitor that never pretends

The most dangerous baby monitor is the one that fails quietly: a calm screen and silence from a room you cannot see look exactly like a sleeping baby. Every part of Moonside is built to say so when it does not know.

• If the Parent phone hears nothing from the Baby phone for about 30 seconds, it sounds an alarm and shows a notification, then reconnects by itself as soon as it can.
• The Baby phone warns about a low battery instead of going quiet.
• Moonside transmits the real silence rather than generating an artificial one, so a quiet room is a quiet room and a dead microphone is an alarm.
• Phones trust each other only after you pair them in person. A phone that is not paired cannot listen, and the pairing can be removed in Settings at any time; the other phone is told.

Moonside is not a medical device and does not replace adult supervision. It is a baby monitor: use it within reach, with an adult responsible.

Deleting your data

There is no account to close. History, sound clips and pairings can be removed on the phone itself; deleting the app removes the rest. The one record held outside your phones, the anonymous purchase record, is deleted within 30 days when you write to [email protected] with your store order number. Details in the privacy policy