How Babyfino protects sound and picture from the nursery
A baby monitor listens where your child sleeps. That’s why Babyfino is built so that only the devices you admit receive sound and picture – not us, not our service providers, nobody in between.
Four promises
End-to-end encrypted
Sound and picture are encrypted before they leave the baby device and readable again only on your phones. WebRTC makes the encryption mandatory; it cannot be switched off.
Your devices sign for themselves
Each device has its own key that it creates itself, and signs every connection with it – which is why not even our server can put itself in between.
Nothing sits on a server
No sound, no picture, no recording is stored on a server. The sound clips for listening back stay on the baby device, and your evening’s history on your phones.
No account, no password
There is nothing to guess, phish or find in a data breach: the devices pair with a QR code.
How a connection is made
Pairing with a QR code
Your phone scans the baby device’s code, and the devices get to know each other; the parents confirm who belongs to the family with their signature. Being on the same Wi-Fi gives nobody access.
Setting up a connection
When a parent phone wants to listen, the two devices negotiate an encrypted connection. Each signs its key’s fingerprint; the other accepts the connection only if the signature comes from a device of the family.
Direct or through a relay
Where possible, sound and picture go straight from phone to phone. Where a network doesn’t allow that, a relay forwards the packets – encrypted, unable to read them.
Alarms
The baby device detects the noise itself. Our server then sends a notification through Apple or Google – a generic text and technical identifiers, never sound.
What our server sees – and what it doesn’t
To alert you, Babyfino needs a server. It knows as much as that takes, and no more:
- It sees: which devices belong to your family, when a monitor starts and stops listening, its sign of life every three seconds, when an alarm happens and where notifications are delivered.
- It doesn’t see: sound and picture and excerpts of them – they never pass through it. The loudness in the room, the baby device’s battery, the evening’s history and your children’s names it only forwards encrypted for your devices; it cannot read them.
Our servers run at Hetzner in the EU. Connections to the server go through Cloudflare, where the control data is readable; sound and picture never pass through it. Apple and Google deliver the notifications. The details are in the privacy policy.
What encryption can’t do
- It doesn’t protect a phone that is itself compromised or that someone else has unlocked.
- It doesn’t hide when a connection exists – our server sees that metadata.
- It is only as good as its implementation. Babyfino has not been independently audited yet; how other baby monitors have been attacked is in the guide Can baby monitors be hacked?.
Questions about Babyfino’s security
Can Babyfino listen to what happens in the nursery?
No. Sound and picture are end-to-end encrypted, and our server takes no part in the encryption: the keys are created on your devices, and every connection is signed by your devices.
Has Babyfino’s security been independently audited?
Not yet. What this page says describes how Babyfino is built. There is no independent audit yet, and Babyfino has not yet been shown on real devices.
What if someone gets hold of my unlocked phone with Babyfino on it?
Then they see what you see in the app – as with any app. Encryption protects the way between the devices, not a device someone else is using. A parent can remove a device from the family at any time; after that it receives nothing.
How do I report a security issue in Babyfino?
Write to [email protected], ideally with a description of how to reproduce the issue. The address is also in babyfino.eu/.well-known/security.txt.