Privacy, explained without hand-waving.

Everything you log — sleep, feeds, diapers, notes, pregnancy and recovery entries, glucose and blood-pressure readings, mood screens — is stored in the app's local storage on your device. It never leaves your phone unless you turn on family sharing. Deleting the app deletes this data, unless your phone's own backup kept a copy.

When you create a family, your phone generates a random secret and puts it after the # in an invite link like duckaby.com/join#…. Browsers never send the part after # to any website, and our join page never sends it anywhere either. From that secret, each phone derives its own encryption key (AES-GCM, 256-bit) — the key is made on the device, not issued by us.

Every change is encrypted on your phone before it leaves. Our relay — a small Cloudflare Worker — only stores and forwards those encrypted blobs, along with a sequence number and the time received, so a phone that was offline can catch up. It never has the key, so it cannot read what it's storing. Like any web server, it does see network information such as your IP address while your phone is connected.

Anyone who has the invite can read and edit the shared baby log — a member's role (parent, caregiver, sibling) only changes what the app shows them, it isn't a separate lock, because every member holds the same key. Your pregnancy and recovery health is not included in that sharing unless you turn it on separately; if you do, every family phone with the invite receives it.

If you type your email into the pre-order waitlist on this site, we store your email and the option you picked, only to email you about that. No cookies, no analytics, no trackers, no third-party fonts or scripts on this website. Pre-orders are paid on a Stripe-hosted page; Stripe handles your payment details under its own policy, and we receive your email and the purchase record, not your card number.

• There is not yet a button to delete the encrypted family copy from the relay — email support@duckaby.com and we will delete it. It's unreadable to us either way, before or after.
• Anyone with your invite link is family. If a phone with the invite is lost or a person needs to be removed, use "Remove & re-invite everyone" in Settings to move the family to a brand-new secret — the safer of the two removal options, because the new secret only reaches people you invite directly.
• Removing a member does not undo syncing that already happened — they keep the copy of the log they already had.
• The relay sees ordinary web-server metadata (like your IP address) while your phone is connected, even though it cannot read the content.
• “Ask Duckaby” runs on your phone from your own log. Connecting it to a model you run yourself (like Ollama) or to your own Home Assistant is optional, off by default, and goes from your phone straight to a server you control — not to us.