Privacy policy

English · Deutsch

NapPhone turns two phones into a baby monitor. This policy explains what the app accesses, what leaves your phones, who receives it, how long it is kept and what you can do about it. Last updated: 2026-11-14.

In one sentence

Audio and video travel only between your own phones, end-to-end encrypted; nobody – including us – can watch or listen, and no recording is stored outside the baby phone.

Who is responsible

The controller is Dipl.-Ing. David Ammer, Waldstraße 6, 4642 Sattledt, Austria. E-mail: support@ammerbrothers.at – this address also reaches us for every data protection request.

Who the app is for

NapPhone is meant for adults who watch over their own child with their own phones. The child and anyone else near the baby phone can be seen and heard by the paired parent phones – only by them. Do not use the app to monitor adults without their knowledge.

Microphone and camera

• The baby unit uses its microphone continuously while monitoring and its camera only while a parent switches it on; its screen shows how many parents are connected and whether the camera is on, and the operating system adds its own indicators where it has them.
• The stream goes to your paired parent phones over WebRTC with DTLS-SRTP encryption: on your Wi-Fi directly; over the internet directly or, when no direct path exists, through a relay (TURN) server that forwards the encrypted packets and cannot decrypt them.
• Cry, noise and motion detection runs on the baby phone. No audio or image is sent anywhere for analysis.
• The parent unit uses its microphone only while you press and hold "Hold to talk" and its camera only to scan the pairing QR code.
• Optional recordings (5-second cry clips and snapshots of events, lullabies you record) stay in the app's private storage on the baby phone and never leave it. Clips and snapshots are deleted after 7 days, lullabies when you delete them. Snapshots a parent takes are saved to that parent phone's photo gallery.

On your Wi-Fi

The app finds the other phone on your Wi-Fi (mDNS / Bonjour) and connects directly. During pairing the phones exchange a device name, a random device id and their public keys. On the same Wi-Fi no server is involved at all.

Internet mode

Internet mode is optional. It uses the NapPhone server run by us. Each phone identifies itself with a key pair it creates itself, and the server knows it only by a random id and the public key. Push alerts (a cry, a low battery, a baby phone gone offline) need no account. Watching, listening and talking over the internet – and pairing by code from another network – need an account on both phones (see Account for internet mode); on the same Wi-Fi you never need one.

• The server stores: the phone's random ids and platform; for a baby phone its name (the platform label such as "Android phone"), a coarse region (Europe or America, derived from the phone's time zone only – never its location) and the time of its last alert; the parent phones registered to it with their push tokens; your energy balance and its history; your VIP status and the purchases bound to it.
• The messages that set up the encrypted connection (offers, answers and network candidates, which contain the phones' IP addresses) pass through the server to the other phone and are never stored.
• When the two phones find no direct path and no relay (TURN) is reachable, live sound and video are not possible. The baby phone's status and alerts and your commands (for example playing a lullaby) then pass through the server instead. They are encrypted between the two phones, so the server forwards them without being able to read them, and never stores them. Sound and video never take this route.
• To pair by typing the code the baby phone shows, a baby phone signed in to an account tells our server that code while its "Pair a parent" screen is open, so a signed-in parent phone anywhere can find it. The server keeps it in memory for at most five minutes and never in its database or logs; the baby phone still checks the code itself. To stop anyone guessing codes, the server counts wrong codes per phone and network for an hour.
• To find a direct path, the phones ask a STUN server for their public address; we run our own and use Google's public STUN server only when ours is unavailable. The relay (TURN) servers are ours; the server picks one in the baby phone's region.
• Like any internet service, our servers see your IP address. We keep it in short-lived security logs (see How long we keep data).

Account for internet mode

You sign in to use internet mode, and so that your phones find each other without scanning a QR code. On the same Wi-Fi, and for push alerts, you need no account.

• You sign in with Google, with Apple, or with an e-mail address and a password. We store your e-mail address, the name you give (or the one Google or Apple shares the first time), a salted hash of your password (never the password itself) and, for Google or Apple, the identifier they give us for your NapPhone sign-in. For Apple we also keep the token we need to cancel the sign-in with Apple when you delete the account.
• We send e-mails only to confirm your address, to reset your password, and to tell you about a change to how you sign in or about an attempt to sign up with your address. An e-mail service provider delivers them for us.
• Every phone you sign in is linked to your account, together with the phone's name. Accounts can form a family with a one-time invite code: the phones of a family see the names of its members and of its phones, and the family's baby phones let the family's parent phones watch and listen without pairing. Anyone who can sign in to an account of your family can therefore watch and listen to its baby phones – keep your password safe, and remove phones you no longer use (on the baby phone under "Paired parents", or by leaving the family).
• To protect accounts, the server counts failed sign-ins and wrong invite codes per network for a short time (in memory only).

Push notifications

When a parent phone is not connected, a cry or noise alert reaches it as a push notification through Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iPhone), and so does news about the baby phone itself: a low battery (with its level), or that the baby phone went offline – our server notices when a running baby phone disappears for more than three minutes (app closed by the system, phone switched off, network gone) and tells the parent phones that were not connected to it. The alert contains its title, the baby phone's name, its id, the kind of event and the time – never audio or video. To leave out the parents who are watching, the baby phone tells our server which parent phones are connected to it; the server keeps that list in memory only. For this, the parent phone registers with Google or Apple and the server stores the resulting push token. A phone used only as baby unit does not register for push.

Advertising and consent

On the Free tier, parent phones can watch rewarded ads from Google AdMob to earn energy. The baby phone never shows ads and never starts the ads software; VIP phones show no ads and make no ad requests.

• In the European Economic Area, the United Kingdom and Switzerland, Google's consent form (User Messaging Platform) asks for your choice before any ad is requested. You can change or withdraw it at any time: About, "Ad privacy choices".
• Ads are requested as non-personalised ads. The app does not ask for permission to track you (iOS) and does not use your advertising behaviour to build a profile.
• Google's ads software receives what it needs to deliver and measure ads and to prevent fraud: your IP address (and an approximate location Google derives from it), device and app information, the advertising ID or app set ID where your phone allows it, how you interact with the ad and your consent choice. To credit a watched ad, the app gives Google a random code that changes every day and that only our server can link to your phone – not your server id. Google processes this under its own privacy policy.
• Rejecting consent never affects monitoring, listening or alerts.

Purchases

Purchases are made through Google Play or the App Store. We receive a purchase token to check the purchase with Google or Apple, attach a pseudonymous account token (derived from your random server id) so the purchase can be restored on a new phone, and store your VIP status under your server id.

Crash reports (opt-in)

Crash reports are off by default. If you switch them on (About, "Diagnostics"), crash data (error, stack trace, app version, platform, operating system version and device model) is sent to our server and deleted after 30 days. No audio, video or names are included.

Scanning the pairing code

On Android, the QR scanner uses Google's on-device ML Kit. The camera image never leaves the phone; ML Kit sends Google usage and performance statistics with device and app information.

Forwarding calls and messages (optional, Android)

If you switch it on for the baby phone, the app reads the caller line of missed-call notifications and the sender of message notifications and forwards "missed call" or "message" with that line to your connected parent phone over the encrypted connection. Nothing of it is stored except the kind and the time in the baby phone's history, and nothing is sent to our server.

The website

napphone.at describes the app and publishes this policy and the terms of use. It sets no cookies, runs no scripts and loads nothing from other companies: fonts and images come from our own server. Like any web server, ours sees your IP address when you open a page and keeps it in the short-lived logs listed under How long we keep data. The store buttons are ordinary links; Google or Apple learn of your visit only when you follow one.

Why we may process your data

• Pairing, internet mode, relaying the connection, alerts, energy and purchases: to provide the service you asked for (Art. 6(1)(b) GDPR).
• Security logs and backups, choosing a nearby relay: our legitimate interest in a secure, reliable and efficient service (Art. 6(1)(f) GDPR).
• Crash reports and advertising cookies or identifiers on your phone: your consent (Art. 6(1)(a) GDPR and the rules on storing or reading information on devices), which you can withdraw at any time.
• Answering your requests and handling security incidents: our legal obligations (Art. 6(1)(c) GDPR).

Where your data is processed

Our servers are in the European Union. A relay server in the United States is used only for baby phones in America, or for a European baby phone when no European relay is available. Google and Apple may process push, advertising and purchase data in the United States; they rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

How long we keep data

• Live audio and video: never stored.
• Connection set-up messages, and the encrypted status, alerts and commands forwarded when there is no direct path: never stored.
• Server records of a phone: until you delete them (see below), or automatically after 13 months (395 days) in which the phone did not use internet mode.
• An account: until you delete it; a sign-up that was never confirmed after 7 days; an account no phone is signed in to, after 13 months without use. Confirmation and password-reset links last 10 minutes, family invite codes 15 minutes.
• Security logs with IP addresses: a few days; the web server's access log at most 14 days; relay logs a few days.
• Which parent phones are connected to a baby phone: in the server's memory only, replaced with every change.
• Crash reports: 30 days. Records of watched ads: 90 days.
• Encrypted backups of the server database: up to 35 days.
• On the baby phone: the history 60 days, cry clips and snapshots 7 days.

Deleting your data

• About, "Delete my server data" removes everything our server keeps for that phone at once – and your account too when no other phone is signed in to it. Your pairings on the phones stay; on the same Wi-Fi everything keeps working. Using internet mode again later creates a new, empty registration.
• Forget a baby phone or revoke a parent phone in the app to remove that pairing. Both also delete that parent's registration and push token on the server: revoking at once; forgetting deletes the push token at once and the registration the next time the baby phone is online.
• Account, "Sign out on this phone" unlinks that phone from your account; "Delete account" deletes the account, its sign-in methods and its family membership at once (your phones keep their own identity and their QR pairings).
• Uninstalling the app removes everything stored on that phone (the app is excluded from cloud backups).
• No access to the app any more? napphone.at/privacy/delete-account explains how to have an account deleted without it.
• Deleted data can remain in our encrypted backups until they expire (up to 35 days); it is never restored into service.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw a consent at any time. About, "Export my server data" gives you a copy of everything our server keeps for that phone, and "Delete my server data" removes it. For anything else, write to us – because we do not know who you are, we will ask you to show that you control the phone concerned. You can also complain to a data protection supervisory authority, in particular in the country where you live or work.

What we never do

• Store or analyse audio or video anywhere except the optional clips on the baby phone.
• Include analytics or tracking software.
• Sell your data or share it beyond the services named in this policy.

Changes

We update this policy when the app changes what it processes; the date at the top shows the current version, which is bundled with the app and published at napphone.at/privacy.

Contact

Write to support@ammerbrothers.at. The address is also on the About screen.