BabyDaze Privacy Policy
Last updated 2026-10-11.
BabyDaze exists to keep videos of a child private to the people who love them. This policy explains what Carmy Labs Inc. ("we", "us") collects, why, how long we keep it, and what we never do with it. It applies to the BabyDaze app, website, and support service.
What we collect
| Data | Why | Where it lives |
|---|---|---|
| Apple account identifier and, if you choose to share it, email address | To sign you in | Supabase Auth (encrypted at rest) |
| Legacy phone number, for accounts created before Apple-only sign-in | To preserve the existing account during migration | Supabase Auth and our database |
| Name, optional profile photo, avatar colour, relationship label | So people in a circle recognise you; your display name also identifies you as the recorder on parent-created sharing links | Profile details in our database; optional photo in private Cloudflare R2 storage |
| Journal details: child's name, birthday, timezone, colour | To build the calendar | Our database |
| Clips and photos, their recorded audio, captions, when they were recorded | The product | Cloudflare R2 in a private bucket; journal playback uses short-lived signed links, and optional external sharing uses expiring parent-created links |
| Optional external sharing selections, creating parent, link expiry and revocation | To share only the moments a parent explicitly selects outside the app and let that parent turn a link off | Our database stores the selection and a hash of the random link token |
| Who is in each circle and their roles | To enforce who can see what | Our database |
| Comments, reports, who watched, screenshot events | Shown to the circle or to parents as described in the app | Our database |
| Private story hearts: sender identity, individual taps, tap timing and position in the story | To show the story's poster who sent hearts and reproduce the rhythm of their taps | Our database; unsent taps are temporarily saved on the sender's device for retry |
| Precise location, accuracy, and an expiring nearby-camera token | Only if an adult turns on nearby Group Cam while the app is in the foreground | Our database for a matching lease of at most 30 seconds |
| Notification settings and device notification identifiers | To send the notifications you turn on | Our database, Apple, and Google Firebase |
| Support messages and contact details you send us | To answer requests, investigate safety reports, and provide support | Our support inbox and related service records |
| Website request data, such as IP address, browser type, requested page, and timestamp | To securely deliver and protect the public website | Short-lived hosting and security logs |
Nearby Group Cam is optional and off until an adult turns it on from its foreground screen. When it is on, BabyDaze sends a fresh latitude, longitude, and accuracy sample to the private matching service so it can find an eligible family camera nearby. The service keeps that sample for no more than 30 seconds, removes it immediately when the person turns nearby location off, leaves the screen, backgrounds the app, changes account or access, or loses authorization, and returns only opaque candidates rather than another person’s coordinates or distance. We do not use location for advertising or tracking.
We do not upload your phone’s address book or the contacts selected in its contact picker. We do store the private-circle memberships, invitation relationships, and roles you create in BabyDaze so we can manage access and sharing. We do not collect advertising identifiers or information about your browsing outside BabyDaze. The public website does not use advertising or analytics cookies. Its host may create limited request logs needed to deliver and protect the site. Google Firebase processes crash reports, technical errors, app-use events (screens visited, sign-in steps, recording or importing, posting outcomes, playback starts and watch time, comments, invitations, and notification choices), and performance measurements such as startup, playback, and posting time, connection type, measured video-transfer speed, buffering, video dimensions, and preloading results. Temporary random playback-visit identifiers connect related technical events without identifying the video. These reports include app version, device and operating-system information, timestamps, and a Firebase installation identifier. Google Analytics derives approximate geography from masked IP addresses, and Firebase Performance uses IP addresses for geographic segmentation of performance reports. This is separate from the optional nearby Group Cam location feature and is not used for advertising or cross-app tracking. We do not attach your BabyDaze account, family names, captions, private media, or signed media links to these reports. Automatic network tracing and advertising measurement are disabled. We do not upload delayed Apple MetricKit payloads.
How access works
A journal parent can deliberately create an external link for selected ready clips or a day's story. Anyone who receives that link can watch those selected moments in a browser without an account, including when a clip's journal audience is restricted. Creating a link does not change the journal audience or add later uploads to that link. These links expire after seven days. The creating parent can turn them off from the sharing screen. Playback requests also stop when the parent's access is removed, their account is reset or deleted, or a selected clip is removed or becomes unavailable. A recipient may save or forward media while access is available; turning off a link cannot remove copies they already obtained. Public playback shows each selected clip’s capture time and the recorder’s profile display name. A neutral label is used when no display name is available; phone numbers and email addresses are not used as name fallbacks. It does not expose comments, reactions, viewer lists, child names, or captions.
Every request is checked against the journal's rules in our database. A clip or profile photo is only delivered through a short-lived link that we create for people the rules allow. Parents can see journal content, including who watched, clips waiting for review, and reports from that journal. Private story hearts are visible only to the person who posted that story, while they still have access to it. Other viewers and parents cannot see the heart totals or who sent them. A sender sees feedback for their own taps. Heart sender names, profile photos, story identifiers, and individual tap timing are not attached to analytics.
Children
Children are the subjects of journals, not users. We do not knowingly collect information from children, require account holders to affirm that they are adults during setup, and let parents control and delete every journal about their child.
Sharing
We do not sell data, share it for cross-context behavioural advertising, or share it with advertisers. The third parties that process data to run BabyDaze are Supabase (database, authentication, functions), Cloudflare (private media storage and delivery), Apple (sign-in and push notifications), Google Firebase (crash reporting, app analytics, performance monitoring, and push notification delivery), and Railway (public website hosting and security logs). Optional sharing with Google advertising, benchmarking, and account-specialist services is disabled. A destination you deliberately select through the iOS share sheet processes the exported file under its own privacy practices.
We disclose data when the law requires it, and we report apparent child sexual abuse material to the National Center for Missing and Exploited Children or another appropriate authority when required by law.
How long we keep data
Journal, account, and membership data is kept while the relevant account or journal remains active. Deleted live data is removed through the deletion flows described below. Nearby Group Cam location leases expire within 30 seconds. Firebase diagnostic and analytics retention is controlled in the Firebase project and is kept only as long as needed to operate, secure, and improve BabyDaze. Support and safety records are kept only as long as needed to resolve the request, protect users, meet legal obligations, and document the response. Limited website security logs are kept only for operational and security needs. Residual deleted data may remain in encrypted service backups for up to 30 days before being overwritten, unless a longer period is legally required.
Your choices
- Turn notifications on or off, per kind and per journal, in Settings.
- Leave any circle, or remove your own clips, at any time.
- Choose whether to create external sharing links, and turn off your active links from the selected clip or day's sharing screen. Anyone with an active link can watch the selected moments.
- Choose Share video file to create a separate video with a BabyDaze ending for the destination you select. That copy leaves the app and cannot be recalled by turning off a link.
- When you choose Save to Photos or Share video for an optional covered-video export, that file leaves BabyDaze and is handled by Photos or the destination you select under its own terms and privacy practices.
- Delete your account in Settings. Your videos, comments, sent hearts, and profile are deleted from every journal, including shared journals. Deleting a story also deletes the hearts it received. Journals where you are the only parent are deleted with all their clips. Deletion is confirmed after live media is removed and Apple sign-in access is revoked. Residual copies may remain in encrypted service backups for up to 30 days before being overwritten through the providers' normal backup cycle, unless a longer period is legally required.
- Ask to access or correct your personal information, withdraw consent where applicable, or make a privacy complaint by emailing chris@carmylabs.com. We may need to verify your identity before acting on a request. If we cannot fulfil a request, we will explain why and describe available recourse.
Security
Data is encrypted in transit and at rest. Journal video links are signed and expire. External links use random, expiring tokens and require an explicit parent action. Sign-in uses Apple authentication. You can add a Face ID lock to the app in Settings.
International
We select the hosting regions used by our providers. Your information may be processed in the United States, Canada, or other countries where those providers operate. When information is processed outside your province, state, or country, it may be subject to the laws of that place and accessible to courts, law enforcement, or national-security authorities there. We remain responsible for personal information transferred to service providers for processing and use contractual and technical safeguards appropriate to the service.
Changes
We will tell you in the app before material changes take effect.
Contact
Privacy Officer, Carmy Labs Inc.
2108 N Street, Ste N
Sacramento, CA 95816, United States
310-895-8146