Updated: 28 October 2026
BabyMonitor: Audio Calls is operated by Dogo App GmbH, Kottbusser Damm 103A, 10967 Berlin, Germany. Contact [email protected] and identify your request as concerning BabyMonitor.
This policy covers the BabyMonitor app for iPhone, iPad and native Mac and its pairing, call-routing and media services. BabyMonitor provides manually initiated audio calls between paired devices. Calls are initiated manually. Incoming calls on iPhone and iPad are accepted manually. Mac versions with Automatically answer paired devices can receive and play calls from paired devices automatically while that option is explicitly enabled; older Mac versions use manual answer while waiting. Builds with the optional Apple Watch companion can analyze received audio on the paired iPhone for potential crying and deliver alerts to the watch; this does not automatically start calls.
Live audio
When a call is accepted, the selected sending device captures microphone audio for live playback on the paired listener. Receiving a call on Mac uses output-only audio and does not activate the Mac microphone. Audio is end-to-end encrypted with keys held on the paired devices. Calls use our self-hosted LiveKit media server, including when both devices share Wi-Fi. It forwards end-to-end encrypted audio between the devices. Direct device-to-device or offline calling is not available. The app has no persistent audio recording feature, and our deployed calling service has no recording service configured. Our signaling backend does not receive microphone samples. We do not retain audio recordings.
Optional Apple Watch companion
In builds that include the companion, potential-cry analysis runs on the listening iPhone using Apple Sound Analysis. The companion holds up to three seconds of received audio in memory for a requested listening preview. Preview chunks, call status and alert information travel between the paired iPhone and Apple Watch using Apple WatchConnectivity, rather than the LiveKit end-to-end encryption layer. Previews are not saved to disk or sent to our backend. A prepared phone preview is cleared when it becomes stale; this is temporary playback, not a saved recording. Companion settings and alert state remain on the paired devices. The Mac app does not provide this watch integration.
Information on your devices
Pairing credentials and private encryption keys are stored locally in Keychain. Saved destination names and preferences stay on your devices. Microphone access is used to send audio. On iPhone and iPad, camera access scans pairing QR codes; Mac displays a QR code for another device to scan. Local network access, where requested, supports network connectivity; it does not enable offline calling. We do not upload camera images for pairing or collect your contacts, advertising identifier or device location.
Information our service retains
Our servers receive and retain device-level routing identifiers, pairing identifiers, exchanged public keys, device roles and push tokens. Call records contain call identifiers, the participating device identifiers, call status, timestamps and ending reasons. Mac listener presence is used to route incoming calls while waiting is enabled.
Operational logs contain pairing, room and participant identifiers, connection events, errors and technical information such as device model, operating system and SDK version, IP/network addresses, connection timing and packet/transport statistics. These records are used to operate, secure and troubleshoot pairing and calls. Device identifiers can link these records to the same device even though the app has no account or sign-in.
Service providers and disclosures
The backend and self-hosted LiveKit media relay run on Hetzner infrastructure in Germany. LiveKit server software handles connection metadata and encrypted live media; we do not use LiveKit Cloud for these calls. Apple Push Notification service delivers incoming-call routing messages to iPhone and iPad. These push messages do not contain microphone audio. Network providers process the network information needed to carry connections. Provider processing may involve countries outside your country; this policy does not promise that every provider processes data only in Germany.
The app includes no advertising or third-party analytics SDK. We do not use the service metadata for advertising or cross-app tracking, and we do not sell it. We may disclose information where required by applicable law.
Retention and removing pairings
Removing a saved destination removes its local pairing credentials and attempts server revocation. A failed network request can prevent server revocation. Revocation changes the pairing status; it does not erase call history, logs or database copies.
Completed and revoked pairing records, ended call records and registered device routing tokens currently have no automatic age-based deletion. They may remain stored after a call ends or a destination is removed. Historical database copies also remain stored without a fixed automatic expiry. Backend and media-server logs rotate by size rather than a fixed number of days. These settings do not guarantee deletion after a particular period, and restoring a database copy can restore older records. We do not promise automatic erasure from all copies when you unpair or uninstall.
Pending pairing requests normally expire after 60 seconds. Mac listener presence expires after 10 seconds without renewal. Expired pending requests and presence are removed by a sweep approximately every 30 seconds while the service runs. These expiry rules do not apply to completed pairings or call history.
Support and privacy requests
Email [email protected] with BabyMonitor in the subject for support or to request access, correction, deletion, restriction or other applicable data-protection rights. You may also contact us at the postal address above. We may need information to verify that the relevant device or pairing belongs to you before acting. Do not email private keys, pairing QR codes, push tokens or audio of your child. Removing a destination is not a substitute for a server-data request. We do not currently offer an in-app server-data deletion tool.
When you contact support, we receive the email address and information you choose to send and use them to handle your request. Please share only what is necessary. You may complain to a competent data-protection supervisory authority. The app is intended to be operated by adults; it does not create child profiles or ask children to submit information.
Website and updates
These app practices are separate from the cookies and services used by the Dogo website. For website practices, see Dogo's website privacy policy at https://dogo.app/privacy-policy/. We will update this BabyMonitor policy when our practices change. BabyMonitor support is available at https://dogo.app/babymonitor/support/.