Privacy Policy

Introduction

This Privacy Policy describes how Novi Homines Software Oy ("we", "us", or "our") handles information when you use the Vaava mobile application.

By using Vaava, you agree to this Privacy Policy. We do not sell your data. Our business model is built on providing value through our app, not through data monetization.

Local Data

Vaava can be used without creating a user account. We do not require an email address or password for normal app use. Vaava runs locally on your devices, and your baby tracking data stays on-device by default instead of being uploaded to our servers in basic use.

What stays on your device in basic use:

• Your local baby event data (feedings, diaper changes, sleep, etc.)
• Device pairing information
• App preferences and settings

Local Wi-Fi data sharing:

When you use local Wi-Fi data sharing, data is shared directly between your devices over your local network via peer-to-peer connections. No baby data passes through our servers. This is separate from Vaava Plus Family Data Sharing described below.

Vaava Plus Family Data Sharing (optional, requires Vaava Plus)

Vaava Plus Family Data Sharing is optional. When enabled, it uploads syncable Vaava family data from your device to Vaava servers after the app encrypts it. Only authorized household devices holding the household encryption keys can decrypt the protected content.

Vaava Plus Family Data Sharing does not require an email address or password. The app creates a pseudonymous Vaava identity, household, and device records so the service can authorize household members and deliver encrypted data to the right devices. Your 24-word recovery phrase and device private keys never leave your devices. The encrypted recovery package can be used to restore your encrypted history on a new device.

Data transferred and stored encrypted:

• Baby and caregiver data: names, birthdates, profiles, colors, genders, and display names
• Event data: event type details and labels, event attributes, calendar events, descriptions, notes, event start and end times, and creator or editor details
• Growth data: measurement dates, weights, heights, head circumferences, notes, and related measurement settings
• Routines and reminders: baby day rhythms, wake and bedtime settings, reminder rules, quiet hours, and notification preferences stored as part of the shared rule
• Milestones and family settings: developmental milestones, photo milestones, parent heights, household member profiles, and household device profiles
• Photo-book data: custom photo-book entries, dates, captions, notes, overlays, and other entry settings
• Photo content: baby profile images, photo milestone images, and custom photo-book images
• Media descriptors: filenames, MIME types, dimensions, capture dates, and other descriptive media metadata
• Encryption material: encrypted recovery-package contents, household keys, record keys, media keys, and wrapped key shares

Data transferred and stored as service metadata, not end-to-end encrypted:

• Identity and device data: random Vaava user, device, and public-key identifiers; device platform; public keys; key status; and creation or revocation timestamps
• Household and membership data: household and member identifiers, owner and member roles, membership state, invitation state, and joined, removed, created, or expired timestamps
• Record routing data: broad entity type, record and mutation identifiers, author device identifier, schema, envelope and key versions, deletion state, the technical edit timestamp used for synchronization, sync cursor, request identifier, server-received timestamp, and ciphertext size
• Media and storage data: opaque upload and media identifiers, household and actor identifiers, ciphertext byte counts, storage quota usage, ciphertext hashes, upload status, object status, and upload, deletion, expiry, or purge timestamps
• Recovery and entitlement data: recovery identifier, recovery public key, package version, encryption algorithm, entitlement provider or app identifiers, entitlement status, and validity or billing timestamps
• Security and service operations data: security event type, outcome, reason code, actor identifiers, item or byte counts, key version, and event timestamps

This service metadata can show that a record or media object exists, its broad category, approximate edit activity, and size. It does not reveal the event type details, descriptions, notes, measurements, captions, photo contents, or actual baby event start and end times.

Vaava does not receive the plaintext payload, record keys, household keys, device private keys, or your 24-word recovery phrase for Vaava Plus Family Data Sharing. Encrypted records and media may remain available to the household for synchronization until they are deleted according to the app's sync controls. Deleted encrypted media is placed in a seven-day recovery grace period before its stored bytes are purged.

Household access

Authorized household devices may decrypt the shared data. Removing a household member and rotating household keys prevents that member from decrypting new changes after the rotation, but cannot erase copies or keys that were already delivered to a device.

Vaava Plus remote baby monitor (optional, requires Vaava Plus)

The baby monitor lets one device act as the baby unit and another household device act as the parent unit. On your local Wi-Fi network the live audio travels directly between the devices and does not pass through Vaava's backend or an external relay service. When the devices are on different networks, such as one on cellular data, Vaava Plus extends the monitor over the internet.

A remote session is started from a household device, and only devices in the same household can join one. The live audio is encrypted end-to-end between the two devices and transmitted through a third-party WebRTC relay service. The relay provider carries only encrypted media and cannot decrypt, listen to, or record the audio content. Vaava does not hold keys that could decrypt it.

Connection relay

Remote baby-monitor sessions use a WebRTC relay (TURN) rather than establishing a direct connection between the devices. The relay sees the IP addresses of both devices, the timing and volume of traffic, and the duration of the session, but it only handles encrypted media it cannot decrypt.

Data transferred as service metadata, not end-to-end encrypted:

• Session data: household and device identifiers, session identifiers and state, connection events, heartbeats, and session timestamps
• Connection setup data: session descriptions and relay addresses exchanged through Vaava servers (encrypted in transit) so the two devices can establish the connection
• Relay data: IP addresses, traffic volumes, timing, and session duration as described above, processed by a third-party WebRTC relay provider on our behalf

This metadata can show that a monitor session took place, when, and between which devices. It does not reveal any audio content.

Voice dictation and OCR

When you use voice dictation, a short audio snippet is sent to the Vaava service server, which forwards it to an AI service provider (including Google Gemini) for transcription and structuring. The audio is not stored after processing.

When you scan growth measurements, the photo is sent to the Vaava service server, which forwards it to an AI service provider (including Google Gemini) for OCR. The image is not stored after processing.

These payloads are used only to return structured results to your device. Vaava does not use them to train any model or to create encrypted Vaava Plus Family Data Sharing records on the server. Upstream provider terms (AI service provider APIs) apply to transit handling.

Backend infrastructure is hosted in the EU.

Vaava Plus purchase handling

Vaava Plus is purchased through the Apple App Store or Google Play. Vaava uses RevenueCat on the device for entitlement checks and to support restoring a purchase on the same platform.

For that purpose, RevenueCat may receive purchase-related information from the store platform together with an app-specific identifier provided by Vaava so the app can determine whether Vaava Plus is unlocked on that device or restored on another device on the same platform.

In the current setup, Vaava does not send your email address, password, or baby event content to RevenueCat.

Optional Crash Reporting

Vaava includes an optional crash reporting feature powered by Firebase Crashlytics to help us diagnose technical failures and improve reliability.

• Disabled by default - Crash reporting starts only if you enable it
• User-controlled - You can enable or disable it at any time in Vaava Settings
• No baby tracking data - Crash reports do not include your baby event content

What may be collected when enabled:

• Crash stack traces and technical error details
• App version, bundle or package identifier, and crash timestamp
• Device and operating system details such as model, OS version, memory, and storage state
• Crashlytics installation identifiers and Firebase session identifiers used to group crash reports
• Technical app state around the crash, such as whether the app was in the foreground or background

What Vaava does not attach:

• No custom user ID is attached to Crashlytics reports
• No custom logs or custom keys are added by Vaava
• No analytics breadcrumb events are sent with crash reports in the current setup

Crash diagnostics are used only for app stability and debugging, not for advertising or marketing.

Third-Party Services

Vaava uses the following third-party services:

• AI service provider (including Google Gemini) (via the Vaava service server): used only for transient voice dictation parsing and OCR scanning. Audio and images are not stored after processing.
• Apple App Store / Google Play: used for processing the one-time Vaava Plus in-app purchase.
• RevenueCat: used for client-side entitlement verification and same-platform restore support for Vaava Plus. RevenueCat may receive purchase-related information and an app-specific identifier, but Vaava does not send email, password, or baby event content to RevenueCat in the current setup.
• Firebase Crashlytics: optional crash diagnostics, disabled by default and user-controlled in Settings. Crash reports do not include baby event content.
• WebRTC relay infrastructure provider: transmits encrypted media during remote baby-monitor sessions. The provider processes encrypted media in transit and related network metadata, including IP addresses, traffic timing and volume, and session duration, but cannot decrypt or listen to the audio.

These services have their own privacy policies. We only share the minimum necessary data with each service to provide the stated functionality.

Data Security

We implement industry-standard security measures:

• TLS encryption
• Local network data sharing is encrypted with industry-standard encryption methods (such as AES-256)
• Vaava Plus Family Data Sharing (when enabled): content is encrypted on-device (AES-256-GCM) before upload; servers store only ciphertext and never receive decryption keys
• Vaava Plus remote baby monitor (when used): live audio is encrypted end-to-end between the two devices and is never recorded or stored
• Local Mode keeps baby tracking data on your devices
• Industry-standard security practices for app infrastructure

Your Rights

You can:

• Export your data from supported app features
• Delete local app data from your device
• Delete encrypted Vaava Plus Family Data Sharing data by deleting your Vaava Plus family from the app's Vaava Plus Family Data Sharing settings
• Request deletion of your Vaava Family Sync data
• Manage your in-app purchase via the App Store or Google Play account that purchased it

Account and Family Sync data deletion

You can request deletion of your Vaava Plus Family Sync data without reinstalling the app. Email hello@novihomines.com with the subject Delete my Vaava data.

Include your Vaava user ID if you have it. It helps us locate the correct records, but it is not a password. Do not send your 24-word recovery phrase, private keys, or family content by email.

• Leave family: for a member, we remove the membership, revoke access to that family, and delete the member's Family Sync identity data when it is not used elsewhere.
• Delete family: for the owner, we delete the family's encrypted records, media, memberships, keys, and related service data from Vaava servers.

Local data on your device and copies already downloaded to other family devices are not deleted from those devices by these actions. We may retain a limited amount of security or audit metadata where necessary to protect the service or comply with legal obligations. Any such retention is limited to the stated purpose and period.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes through the app. Continued use of Vaava after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: hello@novihomines.com
Company: Novi Homines Software Oy