BebeCam Privacy Policy
BebeCam is made and run by BebeCam Dev. It's an app that looks into your baby's room, so I want to be completely open about what information goes where and how long it stays. In this policy, "I" means BebeCam Dev. It's written to meet Korea's Personal Information Protection Act, so it runs a little long, but the part that matters most comes first. If this English version and the Korean version ever differ, the Korean version applies.
The short version
Video and audio from your baby's room are never recorded or stored anywhere. They travel live between your two devices, and they're encrypted on the device before they leave, so neither I nor any server in between can see them.
There's no account, so I never ask for your name, phone number or email. The server keeps only the small amount it needs to connect your devices. No ads, no analytics, no tracking and no cookies.
1. What I process and why
To pair your camera and parent devices, and to reconnect them each time you start monitoring, the server has to remember a few things. Only the information below is kept on the pairing server (Cloudflare). It's needed to provide the service you asked for, so it's processed without separate consent.
| What's stored | Why | How long |
|---|---|---|
| Device public keys, pair ID, pairing status, the parent device's join proof | To connect your devices securely and check that each request really comes from one of them | Until the period in section 3 |
| Session ID; session start, end and expiry times; random participant IDs and room name; the parent device's access token (valid for 4 hours at most) | To connect your devices when monitoring starts | Only the 20 most recent per pairing |
| Monthly usage minutes and session count | To show your monthly allowance and keep server costs in check | Until the period in section 3 |
| Anti-replay values and request times | To stop anyone from replaying intercepted requests or flooding the server | Deleted automatically after 1–2 minutes |
Because data travels over the internet, your IP address passes through Cloudflare and LiveKit (section 5). I don't store it. The pairing server is set up not to log request contents, keys or tokens.
How video and audio travel
Video and audio go live from the camera device to the parent device, and nowhere else. They're end-to-end encrypted (AES-GCM) on the device before they're sent. The key is created on your devices from a value they exchange by QR code when you first pair them, and it's never sent to a server. That's why neither I nor any server in between can see the content. If encryption can't be confirmed, the session simply ends.
Right now, video and audio pass through LiveKit's relay servers. The relay just passes the encrypted data along; it can't unlock it.
Downloads and purchases are handled by Apple, so I never receive your name or payment details. I don't handle sensitive information, national ID numbers or location, and I don't create pseudonymized data.
What's going to change
A heads-up about a few changes I'm planning:
- Your devices will connect to each other directly (peer-to-peer), with Cloudflare TURN relay servers used only when a direct connection isn't possible. After that, LiveKit won't be used.
- When the free video trial and the lifetime video pass arrive, the pairing server will store when your trial started and whether the pass applies.
- To keep an eye on connection quality, each session will record whether it was direct or relayed, and for how long. Video, audio, keys and IP addresses won't be recorded.
I'll update this policy before any of this ships and let you know ahead of time, as described in section 12.
2. What stays on your device
The following never leaves your device, and it's deleted when you delete the app.
- Each device's private key and pairing details live only in that device's Keychain. They don't sync to other devices or move with backups.
- The camera and microphone are used only to see and hear the baby's room when the device is the camera. Nothing is recorded.
- Cry alerts work by having the parent device listen to the audio it receives with Apple's on-device sound classifier. The analysis stays on the device, and the audio is never stored or sent anywhere.
- App settings such as language, baby character, monitoring length and camera direction are stored only on the device too.
3. How long it's kept
When you unpair in the app, I delete the device public keys, join proof and session records within 30 days. I keep only the pair ID and its "unpaired" status, so the same ID can never be reused. Pairings that go unused for 12 months, and pairing attempts that were started but never finished, are cleaned up the same way.
Only the 20 most recent sessions are kept per pairing; older ones survive only as monthly totals. Monthly usage is kept for 12 months and then deleted. Anti-replay values and request times disappear on their own within 2 minutes, and anything stored on your device goes when you delete the app.
Server records are deleted from the database so they can't be brought back. There are no paper records, and I don't hold anything a law requires me to retain.
4. Sharing with third parties
I don't hand your information to anyone else. The only exceptions are when a law specifically requires it, or when an investigative authority asks through the procedure the law sets out.
5. Service providers and transfers abroad
I can't run servers entirely on my own, so I use the two services below. Both companies are outside Korea, which means personal information is transferred abroad.
Cloudflare, Inc.
- Country
- United States and other countries with Cloudflare data centres
- Information
- What the pairing server stores (section 1), IP address
- Purpose
- Running the pairing server
- When and how
- Each time the app contacts the server, over encrypted connections (HTTPS)
- Retention
- As in section 3
- Contact
- PrivacyQuestions@cloudflare.com
LiveKit Incorporated
- Country
- United States and other countries with LiveKit Cloud data centres
- Information
- IP address, network connection details, random participant IDs and room name, end-to-end encrypted video and audio
- Purpose
- Relaying live video and audio
- When and how
- While you're monitoring, over encrypted connections
- Retention
- Video and audio are passed along, never stored. Connection logs may be kept under LiveKit's own policy.
- Contact
- privacy@livekit.io
If you'd rather your information not go abroad, you can stop using the app or unpair. Without the transfer your devices can't connect, though, so the app won't work. If I switch providers, I'll update this policy and let you know.
6. Your rights
You can ask me at any time to show you your information, correct it, delete it or stop processing it, and you can withdraw your consent.
The quickest way is to unpair in the app. The server stops using that pairing straight away and deletes its records within the period in section 3. Deleting the app removes what's stored on the device.
You can also email me at the address in section 10. I'll explain how to confirm the devices are yours and get back to you within 10 days. A legal guardian or someone you authorise can ask on your behalf, with proof of the authorisation. If a law stops me from doing what you ask, I'll tell you why.
7. Children
BebeCam is for parents and caregivers. Your baby's video and audio are delivered live and never stored, and I don't collect children's personal information.
8. Cookies and automatic collection
Neither the app nor this website uses cookies, advertising identifiers or analytics. I don't let other companies collect information about how you use them, either.
9. Security measures
I handle only the information that's needed, and I'm the only one who can administer the server. Video and audio are end-to-end encrypted, and every request to the server is checked against a device-key signature. Replayed or excessive requests are blocked, and all connections are encrypted (HTTPS). The server doesn't log request contents, keys or tokens, and device private keys never leave the device's Keychain.
The server runs in Cloudflare data centres, so physical security follows Cloudflare's own safeguards.
10. Privacy officer
If you have a question, a concern or a complaint, please just email me. I read and answer every message myself.
- Privacy officer: Young Jin Jung (developer)
- Email: bebecam.dev@gmail.com
11. Getting help
If you're not happy with my answer or need other help, you can report or get advice from these Korean authorities:
- Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, 118 in Korea
- Personal Information Dispute Mediation Committee: www.kopico.go.kr, +82 1833-6972
- Supreme Prosecutors' Office: www.spo.go.kr, 1301 in Korea
- Korean National Police Agency: ecrm.police.go.kr, 182 in Korea
12. Changes and history
If this policy changes, I'll announce it in the app and on this page at least 7 days before the change takes effect. For bigger changes, such as handling new kinds of information or changing transfers abroad, I'll give at least 30 days' notice.
| Version | Effective | Change |
|---|---|---|
| 1.0 | 2026-10-26 | Initial release |
BebeCam Dev is run by independent developer Young Jin Jung (정영진).