Privacy policy

Account identity

Firebase Authentication stores your account identifier and information Apple or Google shares under your privacy settings, such as a name or private relay email. Lullabies also supports signing in with email and password, mainly for App Store and Play reviewers and demo accounts rather than everyday sign-in. Hubs and Remotes authenticate separately. Access to each Nursery is bound by its permissions.

Nursery state and Remote/Hub playback

Firebase Realtime Database stores each Nursery name, members, paired Hub, Go-To Sound, Desired State (what a Remote asked for) and Actual State (what the Hub reports back), Sleep Timer, notification tokens, and short-lived Pairing Codes or invite codes. This is the operating data that lets a Remote control a Hub playing in another room, and that lets you share a Nursery with other household members.

Uploads

If you choose the upload Provider, Firebase Storage keeps your private audio and its title, size, and duration. Uploads stay under your account and are used only for playback on your Hub.

Generated Lullabies

When you request a Generated Lullaby, your prompt and bounded descriptors are processed by our backend. The active music-generation Provider, currently Google, receives generation instructions. The private result is stored as an Upload. Job and review records are associated with your account; only the founder may access rejection audit records.

Purchases

Apple or Google processes purchases. RevenueCat validates transactions and maintains the LBY credit ledger. For paid access and subscription/revenue analytics, RevenueCat receives transaction data and an account or device identifier. It also records a coarse last-seen country inferred from the connection IP address for analytics; the app does not request precise location. Lullabies does not receive your card details. Upcoming Monthly and Lifetime plans will use these same purchase services.

Push notifications

If you enable alerts, Lullabies stores a delivery token and uses Apple, Google, and Expo services to send operational notices such as low Hub battery or offline playback. These alerts are not marketing.

Lock-screen controls, widgets, and watch

Sleep Timer and playback controls are also available from your lock screen, a home-screen widget, and (if paired) an Apple Watch or Wear OS watch. These surfaces read and write the same Nursery state described above — they do not collect any additional data of their own.

Live monitoring and Listening mode

When you enable Baby Monitor on a Hub, a Hub and a Remote on the same account connect directly over WebRTC to share the Hub's live camera view and, in Listening mode, live audio with the Hub's own lullaby cancelled out so you hear the Nursery, not the speaker. When two devices can't connect directly, Cloudflare's TURN relay service relays the encrypted connection between them without storing the media. Talkback lets a caregiver speak through the Hub's speaker; the Hub always announces it with a chime and an on-screen indicator. Overnight listening keeps that same audio connection running through the night and self-heals after drops; we record only the aggregate bytes relayed per account per month (never the content) to warn about, but never enforce, fair use of the relay. Low-light enhancement processes the camera image on the Hub itself, on-device, to brighten a dark room — the improved frame is never sent anywhere the original frame wasn't already going. None of this is end-to-end encrypted in the sense that our infrastructure providers hold no key of their own — see Retention and deletion below for how it is protected instead.

On-device possible-cry detection and Night Insights

If you turn it on, the Hub listens for a possible cry using a classifier that runs entirely on the device — Apple's built-in Sound Analysis on iOS, or a Google-published on-device model on Android. No audio, and no model file, ever leaves the device for this feature. Only the resulting fact — that a possible cry was detected, and when, never the audio itself — reaches our backend, and only if you have separately opted into Night Insights: an owner-only history of reported playback, requests, possible-cry alerts, and Hub availability for a Nursery, retained for 30 days and never a sleep measurement.

Moments

A Moment is a snapshot, photo, or an explicitly requested 30-second silent clip captured by a Hub for its Nursery, stored in your Moments inbox. Moments are retained for seven days and can be deleted sooner from the app. If you save a copy to your device's own Photos library, that copy is outside our control and stays until you delete it there.

Connected AI assistants

If you explicitly connect an AI assistant, Lullabies issues a scoped access token and records tool, Nursery, time, and success or failure so you can review and revoke access. Nothing connects automatically.

Feedback reports and crash diagnostics

Problem reports contain your description, optional category and reply email, optional screenshot, device/app details and up to 100 allowlisted operational breadcrumbs. They are sent to Firebase and forwarded to Linear for support. You can preview the exact payload and remove a screenshot before sending. Screenshots are automatic only on known camera-free screens with no monitoring; Hub, Remote camera views and unknown screens require explicit opt-in and a camera warning. Reports contain no recorded audio or video. Offline reports stay on the device until sent and are cleared on sign-out or account switch. Reports and attached screenshots are erased through account deletion, including the Linear copy; minimal closure records and empty upload guards remain to prevent late writes. Retiring a Hub deletes its own anonymous identity and reports, while the parent account and Nursery remain. Production builds use Google Firebase Crashlytics for native crash diagnostics and redacted JavaScript failures. We set a hashed user ID and bounded app/role attributes, not an email or Nursery name. Crashlytics also collects its SDK crash/device identifiers; historical diagnostics may remain under Google's retention rules. Processor retention and erasure still require review.

Service providers

Firebase provides Authentication, Realtime Database, Cloud Storage, Cloud Functions, App Check and Cloud Messaging. RevenueCat validates purchases and maintains the LBY ledger. Apple and Google process sign-in and payments. Expo delivers push notifications. The active music-generation Provider, currently Google (Lyria), receives generation instructions. Cloudflare relays monitoring connections that cannot connect directly (TURN). Regions and transfers are discussed under storage and deletion below.

Website and waitlist

The waitlist stores your normalized email, language, and signup time in Firebase. On supported Vercel deployments, cookieless Vercel Web Analytics measures page visits and completed waitlist or feature-request events without submitted content or cross-site tracking. It is disabled elsewhere. Contact support to erase waitlist entries or feature requests separately.

Retention and deletion

Account deletion cleans up your Nurseries and private audio, then removes your sign-in identity after cleanup succeeds. If cleanup fails, deletion must be retried, and a partial attempt is never reported as complete. Minimal account-linked deletion markers and empty Storage guard objects retain account or object identifiers without automatic expiry, to stop delayed work recreating deleted data. Moments are kept for seven days unless you delete them sooner; feedback reports are deleted with your account. Nursery state and Cloud Functions run in the EU (europe-west1); private media in Cloud Storage is held in the US — both are Firebase-managed and encrypted in transit and at rest. Backups, soft-deleted data, Provider records, financial records, aggregate monthly relay-usage byte counts, and referral or attribution records need their own retention or erasure handling. The account-deletion flow requests RevenueCat customer deletion and verifies the result before completing. This does not erase every store or processor financial record. Contact support about other Provider records and retention requests.

Deleting your account

Open the app → Settings → Delete account for a permanent, self-service deletion — see Retention and deletion above for exactly what that does and does not remove.

If you can't use the app, or need to ask us to delete data by email instead, see our account deletion page.

Children's privacy

Lullabies accounts are for adults. Enabled features can still process a child’s voice, image, or description, as well as data about other household members who never created an account of their own.

Your choices and rights

You can review Nursery access, revoke connected assistants, disable notifications, delete Nurseries, and delete your account in the app. You may request access, correction, erasure, restriction, portability, or objection, and withdraw consent where it applies. You may complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

Contact

Email support@lullabies.baby with privacy or data questions.

Changes to this policy

We will update this page and its date when data practices change.