BabyOpaPrivacy Policy
Last updated 21 October 2026 (version 1.1 adds optional sharing between phones)
BabyOpa is a baby log for iPhone. The short version: everything you enter stays on your iPhone unless you turn on Share with a partner. If you do, your log is encrypted on your phone before it is sent, with a key that only your phones have, and our server can only pass it along. BabyOpa has no account, no analytics, no ads and no tracking, and we never see what you log.
What you enter, and where it lives
| Data | Where it is stored | Who can see it |
|---|---|---|
| Your baby's name and birthday (both optional) | On your iPhone. If you share with a partner, also on their phone, and encrypted on our server | You, and the phones you shared with |
| Names of the people who help, such as "Alex", "Sam" or "Grandma" | Same as above | You, and the phones you shared with |
| Feeds, sleep and diaper entries, with times and which caregiver logged them | Same as above | You, and the phones you shared with |
| Settings: reminder interval, units, weekly report on or off | On your iPhone only. Never shared | Only you |
BabyOpa does not ask for your email, phone number, contacts, location, photos, camera or microphone. If you don't use Share with a partner, the app makes no network requests with your data.
Sharing with a partner's phone (optional)
Partner sharing lets up to five phones keep one log. It is off until you tap Invite a partner, Invite a helper or Join. There is no account: phones are linked with a one-time code.
Parents and helpers. Each phone joins as a parent or a helper (for example a grandparent or a nanny), chosen by the parent who invites it. Helpers can log, and change or delete what they logged; only parents can change other people's entries, remove phones or delete the shared log. Parents choose whether a helper can see the weekly report; by default helpers see the Today screen and the last-24-hours summary, not the weekly report. Our server enforces who may change what using the role and the random phone ID that created each entry, without reading the entries.
Removing a helper. A parent can remove any other phone. It loses access on our server immediately. The next time a removed helper's phone opens BabyOpa online, it deletes the shared log from itself; anything the helper had logged on that phone before joining (kept aside, never shared) comes back.
How it is protected. When you start sharing, your phone creates a random 256-bit secret. Your entries, your baby's name and birthday, and the caregiver names are encrypted on your phone with a key made from that secret (XSalsa20-Poly1305) before anything is sent. The secret itself is never sent to our server in readable form, so we cannot decrypt your log.
What our server stores (a Cloudflare Worker and database operated by us):
- A random household ID, and a one-way hash of a password-like token derived from the secret, used to check that a phone belongs to the household.
- For each phone: two random IDs made up by the app (not your Apple ID or any device identifier), its role (parent or helper), whether a helper may see the weekly report, which caregiver number it logs as (for example "person 2", not the name), and when it joined.
- For each entry: the encrypted contents, a random entry ID, which phone (random ID) created it, when it was last changed, whether it was deleted, and whether it is a timer still running (so a helper can end a nap someone else started). We can see how many entries there are and when they change, but not what they say.
- While an invite code is open (at most 15 minutes, and deleted as soon as it is used): the code, and the secret encrypted with a key made from the code. During those minutes, someone holding both the code and our database could read the secret, which is why codes expire quickly and work only once.
What our server sees in passing: like any website, the requests reach Cloudflare, which processes your IP address to deliver them. We don't log or keep IP addresses, and we have no analytics on the sync service.
Leaving or deleting. Leave shared log removes your phone from the household on our server; your phone keeps a copy of everything logged so far. Delete shared log deletes the household and all of its encrypted entries from our server for every phone; each phone keeps its own copy. When the last phone leaves, the household is deleted automatically.
Notifications
If you allow notifications, BabyOpa schedules feed reminders and the Sunday weekly report locally on your iPhone. They do not pass through any server of ours. You can turn them off in BabyOpa's Settings or in iOS Settings at any time.
Sharing
When you tap Share with partner, BabyOpa hands the report text to the standard iOS share sheet. Nothing is sent unless you pick an app, such as Messages, and send it yourself. That app's own privacy policy then applies.
Backups
Like other app data, BabyOpa's data can be included in your iPhone's iCloud or computer backup if you have backups turned on. Apple handles those backups under Apple's privacy policy.
Children's privacy
BabyOpa is meant for parents and caregivers, not for children to use. Information about your baby is entered by you. It leaves your device only if you turn on partner sharing, and then only in encrypted form that we cannot read.
Deleting your data
To delete a single entry, tap it and choose Delete entry; if you share with a partner, the deletion syncs to their phone too. To delete the shared copy on our server, open Settings › Share with a partner › Delete shared log. To delete everything on your phone, delete the BabyOpa app. If you can't reach the app (for example, a lost phone), email us and we'll delete your household; because we can't read the data, tell us roughly when sharing was set up.
Not medical advice
BabyOpa summarizes what you log. It does not diagnose anything or give medical advice. If you're worried about your baby's feeding, sleep, diapers or weight, contact your pediatrician.
Changes and contact
If a future version changes what is sent off your phone, we will update this page before that version is released and say exactly what is sent and why. Questions: babyopa@threadangellabs.com.