Privacy Policy

1. Account Information

• Email address and name (provided when you create your account on jaenworld.com)
• If you sign in or create your account with Google: the Google account identifier and, for an account created with Google, the email address and name Google gives us — see “Signing in with Google” below.
• Password, if you set one (stored only as a salted hash — we never see the plain password; an account created with Google has none until you set one)
• Subscription tier and license status (used to enable your plan's features; the app checks these periodically and caches the result for a few days of offline use)

Signing in with Google (only if you choose it)

• Where the data comes from: Google, and only when you press “Continue with Google” (“Sign up with Google” on the sign-up page). You sign in on Google's own page; we never see your Google password.
• What Google sends us: the basic profile that comes with the two permissions we ask Google for, “profile” and “email” — including your Google account identifier, your name, a link to your profile photo, your email address and whether Google has verified it, and, for a Google Workspace account, the domain it belongs to. We refuse the sign-in if Google has not verified the address.
• What we keep: the Google account identifier and your email address; for an account created with Google, also the name, and that Google had verified the address — so the account starts out confirmed. We do not store the profile-photo link, or any token Google issues for the sign-in: the access token is used once, to ask Google for the profile above. The Workspace domain is only compared with your email address, never stored.
• Which accounts it can sign in to: Google can be linked to an existing account, or create a new one, only at an address whose mailbox Google itself runs — a Gmail address (gmail.com or googlemail.com), or a Google Workspace account at its own domain — because only there does Google's word that the address is verified say who holds the mailbox today. At any other address, sign in with your password or a passkey, or sign up with your email address and a password, instead. An existing account is linked only once its address has been confirmed with us. We recognise you by your Google account identifier first, and by your email address only when no account holds that identifier, and one Google account can be linked to one Jaen account only.
• Why, and the legal basis: to create the account you asked for, to sign you in, and to recognise you the next time you use Google — which is also how we refuse a Google sign-in to an account that belongs to someone else. An account created with Google uses that email address and name as its own. The legal basis is Article 6(1)(b) GDPR: it is needed to provide the account you requested. We do not use this data for advertising or profiling, and no decision with legal or similarly significant effects on you is made with it by automated means alone.
• It is optional: you can create your account and sign in with an email address and password instead — sign-up by email is open whenever sign-up with Google is. The Jaen app signs in with an email address and password only, so an account created with Google needs a password before it can use the app: set one with “Set a password” on your account page, or “Forgot Password?” on the sign-in page.
• How long we keep it: as long as your account exists. If your account's email address changes, we remove the link to Google at the same moment, and deleting your account erases the identifier with the rest of your account data (see “Data Retention & Account Deletion”). To have the link removed without either, contact us.
• Google's own role: for the sign-in on its pages Google is a separate, independent controller — Google Ireland Limited for users in the EEA and Switzerland — and Google's Privacy Policy applies to what Google does. You can also end the link from Google's side: on the linked apps page of your Google Account, choose “Stop using Sign in with Google”. Google then stops signing you in to us automatically; that does not delete what we already hold, which is covered above.

2. App Usage Data

• A random per-install app identifier — generated on the device, not a hardware ID, and replaced by a new one if you reinstall. It holds no name or email address, but it is an online identifier, so we treat it as personal data. It goes with the reports below whenever they are sent, which the end of this section describes. Some features you use while signed in send it whatever you choose about usage data, so that they can tell your devices apart: push alerts, showing which of your devices are online, watching from away, and Cloud Sync.
• A short status report when the app starts, when it comes back to the screen and every 15 minutes while it is open: the identifier, your device's name, its operating-system version and the app version, and how long the app has been open. It is sent whether or not you are signed in.
• Crash reports — if the app crashes, the error and the code path that led to it, with the identifier, your device's name and its operating-system version, uploaded the next time you open the app.
• Usage events and device diagnostics, only while you are signed in — which screens are opened and which features are used, how long a session lasts, events such as an alarm going off, a lost connection or a crib device's low battery, error messages the app recorded, and how the app is running (battery level and charging, memory in use, frame rate and smoothness, processor load and thermal state), with the app version, the platform and your device's name. They carry the identifier and are stored with your account, so they are pseudonymous, not anonymous.
• Your device's name, in these reports, is what the app can read of it: its maker and model on Android, and on Windows the name the computer was given when Windows was set up. On other devices, such as an iPhone or iPad, the app reads no name and sends only “Parent device”.
• Update checks — your platform, app version and build number, the update channel, and whether the app was installed from a store or downloaded directly, so we can offer the right update by the right route. No per-install identifier is attached. If you are signed in, the request also carries your account token, so an account-specific update channel can be answered.
• We use no third-party analytics, crash-reporting, or advertising SDKs. On Android, the QR-code scanner built into the app — Google's ML Kit — does report its own use to Google; see “Data Sharing and Third Parties” below.

In versions of the app after 0.9.2 (build 1230), the status reports, usage events, device diagnostics and crash reports are sent only if you say yes. The app's first-run walkthrough ends by asking whether you want to share usage data, with nothing chosen for you. If you started using the app before that question existed, it asks you once after you update, unless you had switched Share usage analytics off, which counts as your no. Until you say yes, none of it is sent. If you close the question without answering, nothing is sent and you are not asked again; you can still turn it on in Settings. The update check is the one exception: the app needs it to offer you the right update, and before you sign in it carries no identifier at all.

Your yes is your consent (GDPR Article 6(1)(a)), which is also what EU law requires before an app reads information like this on your device and sends it (Article 5(3) of the ePrivacy Directive). In those versions we do not rely on a legitimate interest for it. You can withdraw your consent at any time by switching off Share usage analytics in the app's Settings. That takes effect at once: nothing more is sent, not even what was already waiting on your phone. Withdrawing does not make what was sent before unlawful. The app keeps a record of your answer on your phone — yes or no, the version of the question you answered, and when — and what it sends after a yes carries that version's number. If the question changes in a way that matters, you are asked again, and nothing is sent until you answer.

Versions up to 0.9.2 (build 1230) — the app shows its version in Settings, under About — were published before that question existed and send this data without asking. In them, switching Share usage analytics off in Settings stops the status reports, usage events and device diagnostics at once, though the oldest versions have no such switch; crash reports are still sent, so we can fix what broke, and the switch says so. For those versions we rely on our legitimate interests instead — see “How We Use Your Information” below — and you can object to them (see “Your Right to Object”).

3. Feedback Reports (only when you send one)

• Your message, the app version and platform, the name your device uses on the network, and its OS version. A report is stored with your account, and a copy of the message — with your email address, so we can reply — goes to our feedback mailbox.
• A screenshot of the app screen, captured when the report sheet opens. Because a screenshot taken on the monitor screen would contain the live camera view of your child, the video areas are blurred out by default — you see the exact image that will be sent, and can draw on it, turn the blur off, or leave the screenshot out altogether. If the blur cannot be produced, no screenshot is attached at all.
• Technical diagnostics attached to the report
• If the screen shows your care log, the screenshot shows those entries too — the blur covers only the live video. Leave the screenshot out if you would rather not send them.

4. Remote-Sharing Metadata (paid tiers, only if you use remote access)

• Your device's public encryption key and crib-room membership (who may connect to which crib) — public routing material only, never private keys
• The names of your cribs and devices: a crib is named after the device it runs on until you rename it — to “Nursery”, for example — and a parent device is labelled with its own name automatically (see section 2)
• A record of each remote viewing — which account watched which crib, from which device, and when it started and ended — and a log of what happened during it, such as a device connecting (the log is deleted after 90 days)
• When the stream has to be relayed, our relay server sees the IP addresses of both devices and your account's id, which is part of the short-lived password the relay checks
• Invited caregiver contacts (email, name) that you explicitly add

5. Cloud Sync (optional — off unless you turn it on)

Cloud Sync is part of a paid plan and is off by default, for every account. It starts only when you turn it on yourself while signed in. In versions of the app after 0.9.2 (build 1230), every way of turning it on — the question the app asks before anything is backed up, the switch in Settings under Back up & sync, and creating or accepting a co-parent share (sharing cannot work without Cloud Sync) — first shows the same question. It says what is uploaded, that some of it is health information, who keeps it and where, and that we can read it. Nothing is chosen for you, and only your “I agree — back them up” starts it. Your answer is recorded, on your phone and on our servers, with when you gave it, the version of the question and where in the app you answered it, so that it can be shown later. If we change the question in a way that matters, you are asked again, and backing up pauses until you answer. The question has changed since earlier versions of the app, so if you answered it or turned Cloud Sync on in one of them, you are asked again after you update.

Versions up to 0.9.2 (build 1230) were published before that question existed, and keep your answer only on your phone. From 0.9.1 to 0.9.2 (build 1230), an earlier form of the question is asked before anything is backed up, but the switch in Settings, under Back up & sync, starts Cloud Sync at once without it, and creating or accepting a co-parent share turns Cloud Sync on even if you had chosen to keep your records on the phone — both sharing screens say so before you press the button. Some test versions older than 0.9.1 work differently again; if you still have one, please update it.

Once it is on, every baby on that phone is backed up, not only a shared one. Paying for a subscription does not switch it on by itself. It exists so your records reach your own other devices and any co-parent you invite. When it is on, these are uploaded to our servers:

• Your care log — sleeps, feeds, nappies, pumping sessions, medication, growth entries and the other events you record, with their times, anything you typed into a note, and medicine names and doses
• Your baby's profile — name, birth date, due date, gender if you set one, and the avatar photo if you choose one
• With each entry, who logged it — the caregiver name you typed, if you named one — and an id for the phone that wrote it, so two phones merge the same day instead of duplicating it

Camera and microphone streams are never uploaded — this is the recorded log and profile only. Turning Cloud Sync off only pauses it: nothing more is uploaded, and nothing already in your account is erased. If you share a baby, it also stops the shared log reaching the other parent, who keeps what they already have. To erase a baby's records, remove the baby in the app (tap their name at the top of the screen, then Edit, and choose “Remove”), then choose “Delete permanently” in the baby switcher: that erases them from that phone and from your account. A baby you only remove can still be restored, so its backup is kept until you delete it permanently. While Cloud Sync is on, deleting a single entry erases what it said from your account too. What is erased leaves only an empty marker on our servers — which entry or baby it was, and when it was deleted — so that the deletion reaches your other devices; the markers go when your account is deleted. To erase everything from our servers, delete the whole account at jaenworld.com/delete-account, or write to us and we will erase them without deleting your account. See “Data Retention & Account Deletion” below.

Some of the care log is health information: about your baby, medicines and doses, growth measurements and anything you write in the notes; and about you, your pumping sessions. We use it only to back up your records and keep them in step on your devices and with a co-parent you invite — never for advertising or profiling. The legal basis is explained under “How We Use Your Information” below.

A shared baby's log belongs to the parent who started sharing: it stays on our servers, including the entries the other parent logged, until that parent deletes the baby permanently or deletes their account. The other parent cannot delete it permanently. If sharing ends, whatever already reached the other parent's phone stays on that phone.

6. Records We Keep While You Use an Account

• Sign-in records — for each sign-in, however you sign in: the IP address, your browser's or app's user-agent string, the approximate place worked out from the IP address (see “Sign-In Location Check” below), when it was last used and, for some sign-ins, more details of your device where your browser shares them, such as its model and version details. They make up the list of devices signed in to your account. Each time you sign in, we delete the records of your sessions that have expired, and of those signed out more than 30 days before. Records of sessions that ended more than 12 months ago are deleted even if you do not sign in again. Our security checks also keep, for 7 days, a record of the latest sign-in from each kind of device you use, with your email address, your account's role and that sign-in's details: browser and operating system, IP address, place, time and how you signed in.
• Addresses you have signed in from — each IP address with its approximate city and country, when it was first and last used, and how often, so we can email you when you sign in from a new one. We stop adding to it if you switch Login Notifications off.
• The countries and devices your account has signed in from, to notice a sign-in from somewhere new.
• A security log of sign-ins and failed sign-in attempts, password, two-factor and passkey changes, deletion requests, and what administrators do to an account — with the email address, IP address and browser involved, and whether it succeeded. A failed attempt is logged with the email address that was typed, even if no account uses it.
• Risky sign-in attempts — when a sign-in attempt looks risky to our automatic checks, for example many attempts from one address within a few minutes, we record the IP address, the browser, what was requested and why it looked risky.
• Password resets — the IP address and browser a reset was requested from, and the IP address your password was last changed from.
• How often an address is sent reset and confirmation emails — when a password-reset email or a new confirmation email is asked for, we keep a keyed hash of the email address it is for — not the address itself — for about 15 minutes, and send no more than three of each kind to that address in that time, whoever asks.
• Confirmations by email — if your account has no password or authenticator app, some changes are confirmed through a link we email you (see “Security Measures” below). For each request we keep which change was asked for, the browser and IP address that asked, and when; the email and the page the link opens show them to you, so that a request that was not yours stands out. A request goes with your account, or once it has expired and you ask for another.
• Passkeys and two-factor sign-in, if you set them up — each passkey's public key, the name you gave it and when it was last used; your two-factor secret and your backup codes (the codes stored only as hashes).
• Push alerts — your device's push token, and a log of the alerts we pushed: the kind of alert, which crib sent it, when, and how many of your devices it reached.
• Which of your devices are online — while a crib is running a session, or a parent screen is open, the app tells our server every 20 seconds or so, with the device's name and role (crib or parent) and, for a crib, when it started monitoring. That is how your other devices show a crib as online, and how we can tell you when a monitoring crib goes silent.
• Anything optional you add to your profile on this website — for example a username, phone number, postal address, website, short bio or picture.
• Contacts — the people you add, any nickname or private note you give them, people you block, and the invitations you send and receive.
• Downloads from this website — for each installer you download: a pseudonym of your IP address, your browser, the time and, if you are signed in, your account. The pseudonym is worked out from the address with a secret key that only our server holds, so the same address always gives the same pseudonym, which lets us count how many different addresses download from us, but the address itself is not stored. Because we hold that key, we still treat the pseudonym as personal data. Download records made before 23 September 2026 held the address itself; we have deleted those addresses.
• Server logs — our web server logs each request (the IP address, the time, the address requested and your browser), and our application logs record some events with the email address or IP address involved.

7. Forms on This Website

• Beta sign-up — your email address and which form you used. We send one confirmation email.
• Contact form — your name, email address and message, and the company, phone number and subject if you give them. It is emailed to a Gmail mailbox we use for the contact form, so Google receives and stores it (see “Data Sharing and Third Parties”); it is not stored in our database.
• Newsletter and status updates — the email address you sign up with on our blog or on our status page; what we keep with it, how you confirm and how you leave are under “Newsletter and Status Updates” below. No address left on the status page before it used that list is kept.
• “Was this article helpful?” — in the knowledge base: your answer and, if you answer “Not really”, what you write in the box that follows, with a pseudonym of your IP address worked out the same way as for downloads, so that each address counts once for each article. The vote is not linked to your account.

Information We Get From Others

Some personal data reaches us from someone other than the person it is about:

• Google Play, if you buy a subscription in the app: the subscription's status and product, its renewal and expiry dates, and any grace period, refund or cancellation — from Google's answers when we check it, and from the notices Google Play sends us.
• Google, if you sign in with Google: your Google account identifier and, for an account created with Google, your email address and name (see “Signing in with Google” above).
• A location database: the approximate city, country and map coordinates of an IP address come from DB-IP's IP to City Lite, a database we keep on our own server — your address is not sent to DB-IP (see “Sign-In Location Check” below).
• Other users: your email address, if someone invites you — together with their name, and their message if they wrote one; the entries the other parent logs in a baby you share; and the name of another caregiver, such as a grandparent, that a parent types into a care-log entry.

If someone invited you and you are not a user, what we keep depends on the kind of invitation:

• An invitation to join Jaen, from a friend or from our team, is emailed to you with a link to accept it. We keep it — your email address, who invited you, the message in it and whether it was accepted — so that you can accept it. It stays after it has expired, even after the person who sent it deletes their account.
• A contact invitation to an address with no Jaen account is never sent: we do not email you or tell you about it, and it does not reach you even if you join later. We keep it — your email address, who sent it and their message — so that the sender's list of invitations looks the same whether or not an address belongs to a Jaen user, which stops anyone using invitations to find out who uses Jaen. It is deleted when the sender deletes their account.

We have not yet set a time after which unanswered invitations are deleted; write to us and we will delete yours.

What we do NOT collect

• No audio or video recordings — ever. We never receive a recording of your camera or microphone, and we hold no key to the stream between your devices. The only picture of the app that can reach us is a screenshot you send with a feedback report, where the live video is blurred out by default — see section 3 above.
• No device location — the app never requests GPS or a location permission and never reads your device's own position. The only location we hold is the approximate city, country and coordinates worked out from the IP address you sign in from, described under “Sign-In Location Check” below. (Visits to this website separately resolve an approximate city from a shortened IP address; that is described under “Cookies and Tracking” below, and it is not tied to your account.)
• No address book access
• No advertising identifiers, no ads, no cross-app tracking
• Your care log (sleep, feeding, history) stays on your device unless you turn on Cloud Sync — see section 5 above and “Data That Stays On Your Device” below

Sign-In Location Check

Every time you sign in, however you sign in, we look up the IP address you connected from in a location database kept on our own server, which gives an approximate city, country and map coordinates. We use it to notice a sign-in from somewhere unfamiliar and warn you, and to show you where your signed-in devices are. A sign-in on record with neither its place nor its device details is looked up when the list of your signed-in devices shows it, and your account's security pages, and an administrator looking into a security problem, can look an address up again. Visits to this website are looked up the same way, from a shortened address (see “Cookies and Tracking” below).

No IP address leaves our server for this. The database is DB-IP's IP to City Lite, a file we keep on our own server, so neither DB-IP nor anyone else is sent your address. If it has no answer for an address, we record the location as unknown and carry on. The location data is DB-IP's, used under the Creative Commons Attribution 4.0 licence: IP Geolocation by DB-IP.

Emails about sign-ins. When you sign in from an IP address that your list of addresses (section 6) has not seen in the last 30 days, we email you the approximate place, the device, the IP address and the time — unless you have switched Login Notifications off. When a sign-in comes from a country and a device your account has not used before, we email you a security alert with the same details instead, whatever Login Notifications says. The sign-in that creates your account sends neither. If we have no earlier sign-in of yours on record and Login Notifications is on, a sign-in gets the first email rather than the alert. Both emails are sent through the mail service that sends all our email, Zone's (see “Data Sharing and Third Parties”), and through no other.