Who we are
Sova Nanny is published by ForgeLabs Systems (Poland). Questions about this policy: contact@forgelabs.systems.
What leaves your phones
At home, nothing. Sound, video, your voice and every command travel straight between the two phones over the Wi-Fi they share. They do not pass through us and they are not recorded. So that your phone can find the nursery on the Wi-Fi, the nursery phone announces itself there with a short code that changes every hour; its name is shown on the network only while the pairing card is open on it.
Away from home, only these four things leave, and nothing else:
- Alerts. The nursery phone tells your phone, through our server, that crying started or stopped or that the phone is overheating, and lets our server know that it is still alive. What happened, together with the battery level, temperature, signal strength and the crying of the last few hours, is encrypted with a key only your phones have: our server and Google, who deliver the notification, see only that the nursery checked in or sent something, and when. No sound and no video are ever part of this. Crying is recognised on the nursery phone itself; only the answer travels. If one of the parent phones still runs an older version of the app that cannot read encrypted alerts, the nursery also sends that phone a readable copy, until it is updated.
- Sound and video, with Sova Pro. While you listen or watch from outside your home, the nursery phone sends them to your phone through our server, and your voice goes back the same way. We pass the bytes on and keep none of them. They are encrypted with a key only your two phones can work out, so we cannot hear or see anything, and neither can anyone who gets hold of our server. The same connection is opened for a few seconds in two other moments: when you ask for the free twenty minutes, because that request has to reach the nursery phone, and just after you finish speaking, so that a second message starts at once instead of waiting. In both cases it carries nothing but that request, and closes by itself.
- Keys that prove it is you. Your phones share a secret when you pair them, and each parent phone also gets a key of its own from the nursery. Neither ever leaves your phones. What our server receives are different keys made from them, enough to check that messages really come from your phones and useless for anything else. That is also how the nursery can disconnect a single parent phone: our server simply stops accepting that phone's key.
- An address for notifications. A token from Google that lets us wake your phone. It is the only way to reach an Android phone with a notification while the app is not running.
All of this is switched on by default and can be switched off on the nursery phone. With it off, the app never contacts a server of ours at all; listening and watching from outside stop working too.
What we keep, and for how long
For each nursery our server keeps the keys that check your signatures, the notification addresses of your parent phones, and the last thing the nursery reported, so that your phone can show it while you are out: battery, temperature, Wi-Fi signal strength and the crying of the last four hours. That report is encrypted with a key we do not have, so we keep it without being able to read it. Only while a parent phone still runs an older version of the app does the server also hold a readable copy of it, and of the times crying started and stopped over the last four hours; older entries are dropped automatically. Nothing else about alerts is kept: they are passed on to your phones. Sound and video are never stored, anywhere. When the nursery phone goes quiet for several minutes, we tell your phone that it is offline. When it has been quiet for about a month, everything we hold for those phones is deleted by itself. When you give the nursery a new code, everything we held for the old pair is deleted at once, before the new code even starts working.
Our server's own diagnostic logs are kept deliberately blind: they record the room's random name, the server's own decisions and timings, and nothing from your home. Not the battery level, not the temperature, and not whether the baby was crying.
We have no user accounts and no list of our users. The server runs on Cloudflare and notifications are delivered by Google; both handle only what is described here. There is no advertising, no analytics and no tracking in the app, and we do not sell anything to anyone.
What stays on your phone
So that it can work, the app keeps on the phone itself: whether this phone is the nursery or the parent, the four-digit pairing code, the shared secret and the parent phones' own keys, the address and name of the paired phone, your sound and alert settings, and a short diagnostic log that lives in memory and disappears when the app closes. None of this reaches us. Uninstalling the app, or clearing its data, removes all of it.
Microphone and camera
- Nursery phone. It listens the whole time monitoring is on, so that it can tell crying from other sounds. Audio is not recorded and not saved. When you stop monitoring, the microphone is released.
- Parent phone. The microphone is used only while you hold the Talk button, to send your voice to the nursery. Nothing is stored.
- Camera. Switched on only while a parent is actually watching, and only if you allowed camera access. The picture is never recorded.
Permissions
Android shows you the full list before you grant anything. The ones worth explaining:
- Microphone, camera
- Listening in the nursery, talking back, and live video while you watch.
- Notifications
- The alarm, and the quiet notice that tells you monitoring is running.
- Full-screen notifications
- Showing the alarm on the lock screen, so you can silence it without unlocking the phone.
- Alarms, start at boot, battery
- Bringing the monitor back if the system stops it in the night or the phone restarts.
- Local network, internet
- Finding the other phone on your Wi-Fi, and sending alerts when you are away.
- Do Not Disturb (optional)
- Letting the nursery phone silence itself so it does not wake the baby. Only if you turn it on.
Children
The app is for parents and carers. The sound it listens to will include a child's voice, but that sound is examined on your own phone and never recorded. When you are away from home, what reaches us is the verdict, "crying", and never the sound itself; with Sova Pro the sound passes through us encrypted with a key we do not have. We collect no personal information about anyone, children included.
Purchases
Live video, and listening and watching while away from home, are a one-time purchase called Sova Pro, made through Google Play. Google handles the payment; we never see your payment details. The phone remembers that the purchase was made, and the nursery remembers that a parent with Sova Pro has connected to it, so one purchase covers the whole family. Without Sova Pro, one parent phone can be paired with the nursery; Sova Pro lets in more, up to four. You can try these features for twenty minutes before buying. The nursery phone counts those minutes and only while something is actually playing; if you ask for them while away from home, the request travels to it through our server like everything else described above.
Security
A parent phone joins the nursery by scanning the code on its screen or typing its four-digit PIN, and only while both phones are on your home Wi-Fi and the nursery phone is showing its code. The code on the screen carries nothing but that PIN: a photo of it does not open anything from outside your home. The PIN itself is never sent over the network, the nursery blocks a device that keeps guessing, and before any new phone is let in, the nursery phone asks whoever is holding it to allow it. Everything the two phones say to each other afterwards is encrypted, so neither your neighbours nor we can read it. Giving the room a new code on the nursery phone disconnects every paired phone, makes the old one unreachable, and erases what we held for it.
If you want to know exactly how that is done, down to the names of the algorithms, it is all written out in How Sova is secured.
Your choices
- Stop monitoring at any time, from the app or from its notification. The microphone and camera are released at once.
- Switch alerts over the internet off on the nursery phone, and nothing ever leaves your home again.
- Close the listening or video screen, and the stream through our server stops at once; the connection itself closes a few seconds later. Nothing of it remains anywhere.
- Use "Forget nursery" on a parent phone to take that phone out of the pair and off our server.
- Give the nursery a new code, and every paired phone is out and everything we held for the old pair is erased at once.
- Uninstall the app, and everything it kept on the phone goes with it.
Changes to this policy
If the app ever starts handling data differently, this page is updated and the date at the top changes with it. The current version is always at this address.
Contact
This page loads no fonts, scripts, trackers or images from anywhere else. Opening it tells us nothing about you, which is the least a privacy policy can do.