Privacy Policy
Last updated 19 October 2026
Most privacy policies are written to permit as much as possible. This one is written to describe what the app actually does, because the app was built so there would be little to describe.
What we collect, and what we do not
- There are no accounts. You never create one, and there is no password to lose.
- There is no advertising and no tracking. The app sends us a short technical report after each monitoring session, described under Session reports; it holds no audio, no name and no address. If the app crashes, it sends a crash report to Sentry, described under Crash reports. The other outside services the app talks to are the purchase service described under Purchases and the update service described under App updates.
- We cannot listen to your audio. Live audio is encrypted end to end between your paired devices and is not recorded. When the two cannot connect directly it passes through our relay, still encrypted, and is not saved there.
- Two kinds of audio are saved on your own phones. Messages you record are your own voice, captured only while you hold the record button, and kept on the Baby phone so they can be played to your child instantly. Sound clips are a few seconds of what the Baby phone heard, saved automatically each time it detects a sustained sound, so you can play back what woke it. Both stay in the phones' own private storage and move only between your paired devices, over the same encrypted connection as the live audio.
- Sound clips are on by default, and short-lived. You can switch them off in Settings at any time, which also deletes the ones already saved. Left on, they are deleted automatically after 36 hours, and immediately if you delete them yourself or unpair. Sound clips are made only when the Baby device is an iPhone or iPad; an Android phone in the nursery does not record them.
- We do not sell or rent information to anyone. The only records we hold are the anonymous purchase record described under Purchases, the session reports described under Session reports and the crash reports described under Crash reports.
Purchases
The one-time Parent unlock is sold through the App Store or Google Play. To check and restore it, the app uses RevenueCat, a purchase service. When the app starts it sends RevenueCat an anonymous ID created for this installation and the store's record of the purchase. As with any internet request, RevenueCat also sees the IP address, device model, system version, app version and country. It receives no name, no email address and no audio. We use this to unlock the Parent role and to count sales. It is not linked to your identity and is not used to track you.
App updates
Between store releases the app can receive small updates to its own code through Expo, the service that delivers them. Each time the app starts it asks Expo whether an update is waiting; that request carries a random ID created for this installation, which Expo keeps only to count how many installations fetch updates, together with the app's version and platform and, as with any internet request, the IP address. If the app crashed right after taking an update and went back to the previous version, the next request also carries that error message so the broken update is withdrawn. No name, email address, audio or pairing data is involved, and the ID is not linked to you.
Session reports
A baby monitor that drops out at night has failed at its one job, and we can only fix what we can see. So after a monitoring session has ended, the app sends our own server one short technical report about it. We wrote the list of what it may contain, and it is this:
- How the session went: whether the phone was the Baby or the Parent device, how long the session lasted, how it ended (stopped by you, or the app was no longer running, for example), how long the first connection took, how often and how long the sound was away, and whether the alarm sounded and how soon it was silenced.
- Why the app stopped, if it did: the reason the phone's system gives for ending the app (for example low memory, a crash, or that it was closed by hand), how long the app spent in the background, and whether it was paused by the system.
- The connection: whether the phone was on Wi-Fi or mobile data and when that changed, and whether the two phones were connected directly or through our relay.
- The phone: its model and roughly how old that model is, its memory size, its system version, the app version, its battery level, whether it was charging, and whether battery saving was on.
- Settings that explain a failure: whether notifications and the microphone are allowed, which of the app's own alerts and options are switched on, whether an Apple Watch is used, how many devices are paired, and on Android whether battery optimisation or a background restriction applies to the app.
- How often features were used: for example how many times talk-back or a soothing sound was used during the session. Counts only, never what was said or played.
- After a session that went wrong only: the connection quality of the last half hour, measured once a minute (delay, lost packets, data rate), the connection steps the app took, and the text of an app error if there was one.
- Set-up and purchase steps: that a role was chosen, that two devices were paired or unpaired, that the trial began, that the purchase screen was shown, and whether a purchase or a restore was started, completed or cancelled. Not the price and not the order.
Each report carries a random ID that the app creates for this installation. It lets us see that ten failures came from one phone rather than from ten. It is not your phone's advertising ID, it is not derived from the phone or from you, and we do not combine it with the purchase record or with anything else that could tell us who you are. Deleting the app ends it.
A report never contains audio, sound levels, the times your baby made a sound, the names of your devices, recordings or Wi-Fi network, your location or time zone, or anything you typed. Our server does not store the IP address a report arrives from. Reports are kept for 90 days and then deleted, and are seen only by us.
You can switch the reports off in Settings, under Privacy. Monitoring works the same without them.
Crash reports
If the app crashes or hits an error it did not expect, it sends a report to Sentry, a crash-reporting service, stored in Frankfurt, Germany: where in the app's code it happened, the app and system version, the phone model, free memory and storage, the country and region worked out from your IP address, and a random identifier for this installation, so one phone crashing often can be told apart from many phones crashing once. Sentry is set not to store your IP address. A report never contains audio, sound levels, the names of your devices, pairing details, recordings or anything you typed. Reports are deleted after 90 days at most and are seen only by us.
You can switch crash reports off in Settings, under Privacy. Monitoring works the same without them.
How the two phones find each other
To connect, the two phones need to be introduced. A small signalling service we run passes the initial handshake between them, and can also relay audio when a direct connection is impossible — for example on mobile networks that block one.
Being honest about what that service can see:
- It sees the IP addresses of the two phones while they are connected, because a message cannot be passed between them otherwise — but it does not keep them. No address is written to any log or file.
- It sees the device identifiers and public keys your phones generate for themselves, and uses them only to route a message to the right phone. They are created on your device, are not linked to you, your email, or any account, and are never written down, sold, or shared.
- Its own records of connections are outcomes, not identities: that a connection failed and why, never who was connecting or from where. Connections are tagged with a random label that exists only in memory and is discarded the moment the phone disconnects.
- It sees the technical details of the connection handshake — network addresses and audio format — because those messages are signed but not encrypted. It cannot alter them without detection.
- When audio is relayed, it passes through encrypted and cannot be listened to, by us or by anyone operating the relay. The relay does not record who connected to it or from where — its logging of addresses is switched off, not merely rotated.
- No address, device identifier or key is written to a database, a log, or a file. They exist in memory only while your phones are connected. A pairing message is held, also in memory, for a few minutes at most so it can be delivered if a phone reconnects. What the server does keep is the session reports described under Session reports, which hold none of these.
- On an iPhone used as the Parent device, the app also gives this service the push token of its Live Activity, the listening status on the Lock Screen and in the Dynamic Island. iOS gives an app that is swiped away no chance to remove that status itself, so it would stay on screen for hours. When the phone disconnects without saying goodbye and does not come back within about 30 seconds, the service asks Apple's push service to remove the Live Activity, and forgets the token. The token is created by iOS for that one Live Activity and is useless once it has ended. It is held in memory only, never written to a log or a file, and sent to no one but Apple. Nothing else goes with it: no sound, no status, no name.
- One honest caveat: the connection to our pairing service ends at our own server, which sees your phone's network address as any server does and does not log it; our website, and the pairing service as a fallback route, pass through Cloudflare, which can see network addresses in the process, as any internet provider between your phones can.
When both phones are on the same Wi-Fi, they can also pair over your local network.
What stays on your phone
- Your device's private key, held in the device's secure storage (Keychain on iOS, Keystore on Android). It never leaves the phone and is never included in a QR code.
- The history of events — connections, loud sounds, battery warnings — is stored on your phone. It leaves the phone only when you send it yourself with "Send Log" on the History screen. The session reports described under Session reports are made from the connection entries only, never from the loud sounds.
- Any short message you record for the baby device is transferred directly to that phone and stored there.
- Deleting the app removes the history, the sound clips and the recorded messages from that phone. On Android, if Google's device backup is switched on, app data may be included in your own Google backup.
- On iPhone and iPad, the device's key, its role and its pairing are kept in the system keychain and remain after the app is deleted. Remove the pairing in Settings before deleting the app to clear the role and the pairing; the key stays in the keychain and is never sent to us.
Deleting your data
There is no account to close, and almost everything Moonside stores is on your own phones, where you can remove it yourself:
- History — clear it on the History screen.
- Sound clips — switch them off in Settings, which deletes the ones already saved.
- Pairings — remove them in Settings; the other device is told.
- Everything else on the phone — delete the app, after removing the pairing as described above.
The one record held outside your phones is the anonymous purchase record at RevenueCat. To have it deleted, write to [email protected] with your App Store or Google Play order number, which is on the receipt the store emailed you. We delete it within 30 days and confirm by email. The App Store and Google Play keep their own record of the purchase under their own policies, which we cannot change.
The random update ID held by Expo is tied to nothing but the installation: deleting the app ends it, and a reinstall gets a new one.
Session reports are deleted by themselves after 90 days. To stop them, switch them off in Settings; deleting the app ends the random ID they carry. To have the reports of the last 90 days deleted sooner, tap "Send Log" on the History screen and send it to [email protected]: the log's first lines include the ID ("Report ID"), which is the only way we can find your reports. We delete them within 30 days and confirm.
Crash reports are deleted by themselves after 90 days. To stop them, switch them off in Settings; deleting the app ends the random identifier they carry.
Permissions
- Microphone — to send audio from the baby's phone, and on the parent's phone only to talk back or record a message. Talk-back never transmits unless you are holding the button.
- Camera — only to scan the pairing QR code. No photos or video are taken.
- Local network — so the two phones can find each other when they are on the same Wi-Fi. Declining it means the app uses the internet instead.
- Notifications — shown by your phone only. There is no push service and no push token.
Children
The app is used by parents and carers. It collects no information about children: nothing about the baby is transmitted beyond the sound the paired phone plays, and any sound clips stay on your own devices as described above. We receive none of it.
Changes
If this policy changes, the date above changes with it. Material changes will be noted in the app's release notes rather than made quietly.