Privacy Policy

This Privacy Policy explains how Masofi d.o.o. ("we", "us", "our") handles information in connection with the Ninna mobile application (the "App") and our website at ninnaapp.com (the "Website"). We are based in Slovenia, and you can contact us at privacy@ninnaapp.com.

This Policy covers Ninna on iPhone and Android. Available sign-in and sharing features depend on the version installed on your phone; using another platform does not create a separate privacy policy for your Ninna account.

We built the App to be private by design: it turns two of your own phones into a baby monitor. Your camera and microphone streams are sent between your devices in real time and are never recorded or stored by us.

1. Summary

Scroll sideways to see the full table.

2. Information we process

Account data. Local monitoring does not require an account. If you sign in, we store a Ninna account identifier, your sign-in provider identifiers, account creation and last-use times, and your access level. We request a verified email address from Apple or Google when available, or verify an address using an email code. Apple may provide a private relay address instead of your personal address. You can also add a verified email address to an existing account. We use verified addresses to sign you in, recognise an existing account and deliver service messages. We do not use your provider profile name or photo to create your Ninna account.

One account across platforms. Apple, Google and email-code sign-in are available on iPhone and Android. A new sign-in method can be associated with an existing Ninna account when it proves an email address that account has already verified. We normalise addresses for this matching; equivalent Gmail addresses with dots or a plus tag are treated as the same mailbox. Existing separate accounts are not automatically merged. An Apple private relay address and your personal email are different addresses unless you verify the additional address for that account. We do not receive your Apple or Google password.

Devices and sharing. We store identifiers, names, platform and activity times for signed-in phones, and records of sign-outs and revoked access. Household sharing stores membership and invitation information, including the recipient's email address. The household owner and members can see the account information shown in the household, such as member email addresses. Camera pairing and access permissions are managed separately from household membership. Our services also process camera connection state and access records to connect authorised phones; these records do not contain live video or audio.

Service emails. We send sign-in codes, account welcome messages and household invitations through Google Workspace. Delivery records include the recipient, message type, language, delivery status and times. Sign-in codes and invitation secrets are not stored in this delivery log. We do not use these messages as a marketing mailing list.

Account support and service operation. Our protected support system receives your Ninna account identifier, verified email, sign-in provider and verification time so we can identify your account and help with access or billing. This account directory is separate from product analytics. Service logs record connection and authorisation outcomes, camera state and pseudonymous account or room references for reliability and abuse prevention. Switching off optional usage analytics does not switch off the account, billing and security processing needed to provide the service.

Subscription data. Purchases are processed by Apple or Google Play. We use RevenueCat to verify and manage your subscription entitlement. RevenueCat receives the pseudonymous account identifier and purchase information from the relevant store. We never see your payment card or store credentials.

On-device data. Session tokens and pairing secrets are stored using the platform's protected storage. Preferences, saved camera names and recent monitoring history are stored locally. Recent session history contains times, durations and event summaries, not video or audio, and is retained for up to seven days, with limits of 60 sessions and 200 events per session. It is not a cloud recording archive.

Live streams. Audio and video are transmitted in real time between your devices. Local mode connects the phones on your network. Remote Pro mode uses an end-to-end encrypted relay; the relay passes encrypted media through to deliver it and does not record or persist it.

Alerts. Noise and motion detection runs on your camera device. Only small event messages (e.g. "noise detected" with a timestamp) are sent to your viewer device(s). These are not stored on our servers.

Diagnostics & analytics. To keep the App reliable and understand how it's used, we process:

• Crash and error diagnostics (via Sentry): device model, OS and app version, and technical error data.
• Product analytics (via PostHog and our own analytics service): in-app events such as app opened, signed in, pairing, connection attempts, paywall viewed and use of Explore guides, including step completion and time spent. These can include device and app version, language, region and camera/viewer role. When an event reaches PostHog, its network address is used to derive an approximate location (country and city) and stored with the event; we use the country for usage statistics by country, and we never use this to position your phone or to decide prices or experiments. Before sign-in, events use an installation identifier. After sign-in, installation, analytics and purchase identifiers can be linked to your Ninna account to recognise use across phones and platforms. Verified email is handled in the separate account directory, rather than added to these product events. Events do not include live video or audio.
• Install attribution (via Apple's AdServices framework, iOS only): when the App is first opened, Apple can tell us whether the download came from an Apple Search Ads campaign, and if so which campaign, ad group and keyword (as numeric identifiers). This is Apple's own privacy-preserving attribution — it does not involve the advertising identifier (IDFA), cross-app tracking, or any data broker, and we use it solely to measure which of our own ads work. It is processed together with the analytics data above and is covered by the same "Share usage analytics" switch.
• Install attribution (via Google Play Install Referrer, Android only): Google Play can pass us the non-identifying campaign labels attached to the store link, plus click and install timestamps. We use them only to understand which Ninna content led to an installation.
• Campaign measurement on our website: when you open our download page (ninnaapp.com/get), we record the non-identifying campaign labels in the link, your device type (iPhone/Android), and a salted one-way hash of your IP address. The campaign-matching record stores this hash instead of the raw IP address. On iOS, if the App is first opened within a short window (about an hour) from the same network, we use the matching hash to connect that installation to the campaign the click came from — this tells us only which of our own posts and ads work. No advertising identifier, no cross-site or cross-app tracking, no data brokers, and the hash is used only for this measurement.

Website cookies & analytics. On the Website we use Google Analytics to understand how visitors find and use our pages — but only if you agree. When you first visit, a banner asks for your choice; until you click Allow analytics, Google Analytics does not run and its cookies are not set. If you agree, Google Analytics sets first-party cookies (_ga and _ga_*) and we receive aggregated usage statistics; advertising features and ad personalization are permanently disabled. If you decline, the Website works exactly the same without Google Analytics. Your choice is stored in your browser and you can change it at any time, which also removes the analytics cookies.

Separately, download and invitation pages send a request-count event to our service using platform and campaign labels, without including invitation or pairing tokens. This event is independent of your Google Analytics choice.

Network data and permissions. Our servers and providers process network addresses to deliver the service and prevent abuse, including rate limiting; network addresses can appear in web access and security logs, and our product analytics provider stores the network address together with each analytics event for the retention period described below. We do not use network addresses to build advertising profiles. Camera and microphone permissions enable live monitoring, QR scanning and talk-back. Local network or nearby Wi-Fi permissions help phones discover and connect to each other; notification permission enables alerts on your phone.

3. Why we process it (legal bases under GDPR)

• To provide the service (performance of a contract): accounts, streaming, subscriptions.
• Legitimate interests: security, abuse prevention, and improving the App (diagnostics and analytics), balanced against your rights.
• Consent, where required by your jurisdiction (e.g. certain analytics). This includes Google Analytics on the Website, which runs only after you accept the cookie banner. You can withdraw consent at any time — in the App’s settings, or on the Website by changing your cookie choice.

Usage analytics and crash reports are controlled separately in the App's Settings → Privacy & legal, so you can keep crash reporting on while switching product analytics off. Turning either off takes effect immediately.

4. Sharing and sub-processors

We do not sell your personal data. In addition to the household sharing described above, we use the following providers for sign-in, payments, hosting, email and analytics:

Scroll sideways to see the full table.

Where data is transferred outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses. Our core account data is hosted in the EU.

5. Retention

We keep active account data while your account is in use. Account deletion removes sign-in identities, contact email, signed-in device records and the sharing records described in Section 7. Limited account and security records, including a marked-deleted internal account record and revoked-access records, can remain to prevent old credentials from regaining access.

Completed email delivery records are subject to a 90-day cleanup; on account deletion we remove the recipient address from delivery records associated with your account. Our routine cleanup removes service connection and authorisation events older than 180 days. Local session and alert history is limited to up to seven days and the entry limits described above.

Product analytics, installation attribution and purchase records are held separately for reliability analysis, campaign measurement and billing history. Account deletion does not automatically erase every pseudonymous operational or purchase record from those systems. Retention depends on the purpose of the record and the relevant provider's settings, including any billing, security or legal requirements; we do not apply one universal 90-day limit to all systems. You can request deletion of associated data at privacy@ninnaapp.com. Provider backups can take additional time to expire.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to the processing of your personal data, and to withdraw consent. EEA/UK users may lodge a complaint with their data protection authority. California residents have rights under the CCPA/CPRA, including the right to know and to delete; we do not sell or "share" personal information for cross-context behavioral advertising.

To exercise any right, use the in-app Delete Account option or contact us at privacy@ninnaapp.com.

7. Deleting your account

You can delete your account in Settings → Account & subscription → Delete Account. Deletion signs your devices out, removes your sign-in identities and contact email, and revokes access linked to the account. Deleting a household owner also ends that household and its shared Pro access. Limited technical records described in Section 5 can remain; deleting an account does not clear local history or saved preferences on every phone. If you cannot access the App, request account deletion through support. App Store and Google Play subscriptions must be cancelled separately in the relevant store's subscription settings.

8. Children

The App is intended for use by parents and caregivers (adults). It is not directed to children, and we do not knowingly create accounts for children. A live stream may show your child. Local streams connect your phones on your network; remote streams pass through an encrypted relay. We cannot view or listen to the end-to-end encrypted remote media and do not record or store your live video or audio.

9. Security

We use encryption in transit, protect session tokens and pairing secrets on your phones, and keep server credentials on our servers. Remote media is end-to-end encrypted using pairing keys held by the phones. We apply server hardening and rate limiting. No method of transmission or storage is 100% secure, but we work to protect your information.

10. Changes

We may update this Policy. We will revise the "Last updated" date and, for material changes, provide notice in the App or by other appropriate means.

11. Contact

Masofi d.o.o.
Slovenia
privacy@ninnaapp.com
masofi.si