Privacy Policy

Introduction

This Privacy Policy describes how Novi Homines Software Oy ("we", "us", or "our") handles information when you use the Vaava mobile application.

By using Vaava, you agree to this Privacy Policy. We do not sell your data. Our business model is built on providing value through our app, not through data monetization.

Local Data

Vaava can be used without creating a user account. We do not require an email address or password for normal app use. Vaava runs locally on your devices, and your baby tracking data stays on-device by default instead of being uploaded to our servers in basic use.

What stays on your device in basic use:

• Your local baby event data (feedings, diaper changes, sleep, etc.)
• Device pairing information
• App preferences and settings

Local Wi-Fi data sharing:

When you use local Wi-Fi data sharing, data is shared directly between your devices over your local network via peer-to-peer connections. No baby data passes through our servers. This is separate from Vaava Plus Family Data Sharing described below.

Vaava Plus Family Data Sharing (optional, requires Vaava Plus)

Vaava Plus Family Data Sharing is optional. When enabled, it uploads syncable Vaava family data from your device to Vaava servers after the app encrypts it. Only authorized household devices holding the household encryption keys can decrypt the protected content.

Vaava Plus Family Data Sharing does not require an email address or password. The app creates a pseudonymous Vaava identity, household, and device records so the service can authorize household members and deliver encrypted data to the right devices. Your 24-word recovery phrase and device private keys never leave your devices. The encrypted recovery package can be used to restore your encrypted history on a new device.

Data transferred and stored encrypted:

• Baby and caregiver data: names, birthdates, profiles, colors, genders, and display names
• Event data: event type details and labels, event attributes, calendar events, descriptions, notes, event start and end times, and creator or editor details
• Growth data: measurement dates, weights, heights, head circumferences, notes, and related measurement settings
• Routines and reminders: baby day rhythms, wake and bedtime settings, reminder rules, quiet hours, and notification preferences stored as part of the shared rule
• Milestones and family settings: developmental milestones, photo milestones, parent heights, household member profiles, and household device profiles
• Photo-book data: custom photo-book entries, dates, captions, notes, overlays, and other entry settings
• Photo content: baby profile images, photo milestone images, and custom photo-book images
• Media descriptors: filenames, MIME types, dimensions, capture dates, and other descriptive media metadata
• Encryption material: encrypted recovery-package contents, household keys, record keys, media keys, and wrapped key shares

Data transferred and stored as service metadata, not end-to-end encrypted:

• Identity and device data: random Vaava user, device, and public-key identifiers; device platform; public keys; key status; and creation or revocation timestamps
• Household and membership data: household and member identifiers, owner and member roles, membership state, invitation state, and joined, removed, created, or expired timestamps
• Record routing data: broad entity type, record and mutation identifiers, author device identifier, schema, envelope and key versions, deletion state, the technical edit timestamp used for synchronization, sync cursor, request identifier, server-received timestamp, and ciphertext size
• Media and storage data: opaque upload and media identifiers, household and actor identifiers, ciphertext byte counts, storage quota usage, ciphertext hashes, upload status, object status, and upload, deletion, expiry, or purge timestamps
• Recovery and entitlement data: recovery identifier, recovery public key, package version, encryption algorithm, entitlement provider or app identifiers, entitlement status, and validity or billing timestamps
• Security and service operations data: security event type, outcome, reason code, actor identifiers, item or byte counts, key version, and event timestamps

This service metadata can show that a record or media object exists, its broad category, approximate edit activity, and size. It does not reveal the event type details, descriptions, notes, measurements, captions, photo contents, or actual baby event start and end times.

Vaava does not receive the plaintext payload, record keys, household keys, device private keys, or your 24-word recovery phrase for Vaava Plus Family Data Sharing. Encrypted records and media may remain available to the household for synchronization until they are deleted according to the app's sync controls. Deleted encrypted media is placed in a seven-day recovery grace period before its stored bytes are purged.

Household access

Authorized household devices may decrypt the shared data. Removing a household member and rotating household keys prevents that member from decrypting new changes after the rotation, but cannot erase copies or keys that were already delivered to a device.

Vaava Plus remote baby monitor (optional, requires Vaava Plus)

The baby monitor lets one device act as the baby unit and another household device act as the parent unit. In free local Wi-Fi mode, live audio and optional live video travel directly between the devices and do not pass through Vaava's backend or an external relay service. When the devices are on different networks, such as one on cellular data, Vaava Plus extends the monitor over the internet with encrypted live audio and optional live video.

A remote session is started from a household device, and only devices in the same household can join one. Live audio and optional live video are encrypted end-to-end between the two devices and transmitted through a third-party WebRTC relay service. The relay provider carries only encrypted media and cannot decrypt, listen to, watch, or record the audio or video content. Vaava does not hold keys that could decrypt it. Neither audio nor video is recorded or stored for later playback.

Connection relay

Remote baby-monitor sessions use a WebRTC relay (TURN) rather than establishing a direct connection between the devices. The relay sees the IP addresses of both devices, the timing and volume of traffic, and the duration of the session, but it only handles encrypted media it cannot decrypt.

Data transferred as service metadata, not end-to-end encrypted:

• Session data: household and device identifiers, session identifiers and state, connection events, heartbeats, and session timestamps
• Connection setup data: session descriptions and relay addresses exchanged through Vaava servers (encrypted in transit) so the two devices can establish the connection
• Relay data: IP addresses, traffic volumes, timing, and session duration as described above, processed by a third-party WebRTC relay provider on our behalf

This metadata can show that a monitor session took place, when, and between which devices. It does not reveal any audio or video content.

Vaava AI chat and summaries (optional)

Vaava AI is optional. It powers the chat and the automatic daily, weekly, and monthly digest summaries. Before the first cloud AI request, the app explains this processing and asks for your permission. If you do not agree, no content is sent to a cloud AI provider and the summaries stay in their standard, non-AI form. You can also turn AI digest summaries off at any time in Settings, independently of whether the chat entry point is shown.

Data sent when you use cloud AI:

• For chat: your current message and the recent conversation needed to answer it
• For automatic summaries: the digest figures for the day, week, or month being summarized, such as feeding, sleep, and diaper counts, durations, and totals
• Relevant baby context, such as an app identifier, name, birthdate, calculated age, locale, date, and timezone
• Relevant baby records returned by on-device tools, such as feeding, sleep, diaper, growth, routine, or milestone data, when needed to answer your request
• Images or files only when you choose to attach them

This data is encrypted in transit and sent through Vaava's backend to a third-party AI provider, currently OpenAI or Google Gemini, to generate the response or the summary. Vaava does not use chat or summary content to train AI models.

Storage and retention:

Your chat history, generated summaries, and local attachment copies remain on your device until you delete them in the app or remove the app's data. Vaava does not retain your raw chat messages, baby context, tool results, or attachments as server-side conversation history after processing. For credit metering, abuse prevention, and reliable retries, Vaava may retain pseudonymous user and household identifiers, a request fingerprint, technical usage and status records, timestamps, and the final assistant response. You may request deletion of cloud AI records associated with your Vaava identity by contacting us.

OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring, unless a longer period is required by law. Vaava sends OpenAI Responses API requests with application-state storage disabled; OpenAI's abuse-monitoring retention still applies. Google Gemini may retain prompts, contextual information, and outputs for 55 days for abuse monitoring. Google states that paid Gemini API prompts and responses are not used to improve its products. Images and files may also be scanned for child-safety purposes.

Apple Foundation Models and Private Cloud Compute

The Vaava backend and third-party AI processing described above applies when you choose Vaava Cloud AI. On eligible devices running iOS 27 or later, you can instead choose Apple Foundation Models for Vaava AI. When Private Cloud Compute handles a request, your message, relevant conversation context, attached photos, and baby profile or records needed to answer go directly from your device to Apple, without passing through Vaava's servers.

Apple uses request content only to fulfill the request. Private Cloud Compute does not retain it or make it available to Apple staff. If Private Cloud Compute is unavailable, Vaava uses Apple's on-device model instead; information processed on device does not leave your device. Private Cloud Compute requires internet access and has a per-user daily request limit. You can change your AI provider in Vaava's settings.

Voice dictation and OCR

When you use voice dictation, a short audio snippet is sent to the Vaava service server, which forwards it to an AI service provider, currently Google or OpenAI, for transcription and structuring. The audio is not stored after processing.

When you scan growth measurements, the photo is sent to the Vaava service server, which forwards it to an AI service provider (including Google Gemini) for OCR. The image is not stored after processing.

These payloads are used only to return structured results to your device. Vaava does not use them to train any model or to create encrypted Vaava Plus Family Data Sharing records on the server. Upstream provider terms (AI service provider APIs) apply to transit handling.

Backend infrastructure is hosted in the EU.

Vaava Plus purchase handling

Vaava Plus is purchased through the Apple App Store or Google Play. Vaava uses RevenueCat on the device for entitlement checks and to support restoring a purchase on the same platform.

For that purpose, RevenueCat may receive purchase-related information from the store platform together with an app-specific identifier provided by Vaava so the app can determine whether Vaava Plus is unlocked on that device or restored on another device on the same platform.

In the current setup, Vaava does not send your email address, password, or baby event content to RevenueCat.

Optional Crash Reporting

Vaava includes an optional crash reporting feature powered by Firebase Crashlytics to help us diagnose technical failures and improve reliability.

• Disabled by default - Crash reporting starts only if you enable it
• User-controlled - You can enable or disable it at any time in Vaava Settings
• No baby tracking data - Crash reports do not include your baby event content

What may be collected when enabled:

• Crash stack traces and technical error details
• App version, bundle or package identifier, and crash timestamp
• Device and operating system details such as model, OS version, memory, and storage state
• Crashlytics installation identifiers and Firebase session identifiers used to group crash reports
• Technical app state around the crash, such as whether the app was in the foreground or background

What Vaava does not attach:

• No custom user ID is attached to Crashlytics reports
• No custom logs or custom keys are added by Vaava
• No analytics breadcrumb events are sent with crash reports in the current setup

Crash diagnostics are used only for app stability and debugging, not for advertising or marketing.

Third-Party Services

Vaava uses the following third-party services:

• OpenAI (via the Vaava service server): may process optional Vaava AI chat messages and automatic digest-summary requests, relevant baby context and records, selected attachments, and generated responses as described above. OpenAI may also process dictation audio and the resulting transcript for the voice dictation feature.
• Google (via the Vaava service server): may process optional Vaava AI chat and digest-summary data, and its speech-to-text service may transcribe dictation audio for the voice dictation feature. Google also uses Gemini to convert a scanned photo into structured data. Vaava does not retain dictation audio or scan images after processing.
• Apple Foundation Models (when selected on an eligible device): processes AI requests on device or through Apple Private Cloud Compute as described above.
• Apple App Store / Google Play: used for processing the one-time Vaava Plus in-app purchase.
• RevenueCat: used for client-side entitlement verification and same-platform restore support for Vaava Plus. RevenueCat may receive purchase-related information and an app-specific identifier, but Vaava does not send email, password, or baby event content to RevenueCat in the current setup.
• Firebase Crashlytics: optional crash diagnostics, disabled by default and user-controlled in Settings. Crash reports do not include baby event content.
• WebRTC relay infrastructure provider: transmits encrypted media during remote baby-monitor sessions. The provider processes encrypted media in transit and related network metadata, including IP addresses, traffic timing and volume, and session duration, but cannot decrypt or listen to the audio.

These services have their own privacy policies. We only share the minimum necessary data with each service to provide the stated functionality.

Data Security

We implement industry-standard security measures:

• TLS encryption
• Local network data sharing is encrypted with industry-standard encryption methods (such as AES-256)
• Vaava Plus Family Data Sharing (when enabled): content is encrypted on-device (AES-256-GCM) before upload; servers store only ciphertext and never receive decryption keys
• Vaava Plus remote baby monitor (when used): live audio and optional live video are encrypted end-to-end between the two devices and are never recorded or stored for playback
• Local Mode keeps baby tracking data on your devices
• Industry-standard security practices for app infrastructure

Your Rights

You can:

• Export your data from supported app features
• Delete local app data from your device
• Delete encrypted Vaava Plus Family Data Sharing data by deleting your Vaava Plus family from the app's Vaava Plus Family Data Sharing settings
• Request deletion of your Vaava Family Sync data
• Manage your in-app purchase via the App Store or Google Play account that purchased it
• Request deletion of cloud AI records associated with your pseudonymous Vaava identity

Account and Family Sync data deletion

You can request deletion of your Vaava Plus Family Sync data without reinstalling the app. Email hello@novihomines.com with the subject Delete my Vaava data.

Include your Vaava user ID if you have it. It helps us locate the correct records, but it is not a password. Do not send your 24-word recovery phrase, private keys, or family content by email.

• Leave family: for a member, we remove the membership, revoke access to that family, and delete the member's Family Sync identity data when it is not used elsewhere.
• Delete family: for the owner, we delete the family's encrypted records, media, memberships, keys, and related service data from Vaava servers.

Local data on your device and copies already downloaded to other family devices are not deleted from those devices by these actions. We may retain a limited amount of security or audit metadata where necessary to protect the service or comply with legal obligations. Any such retention is limited to the stated purpose and period.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes through the app. Continued use of Vaava after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: hello@novihomines.com
Company: Novi Homines Software Oy