What Subby keeps, where, and who can read it.
The short version is on every other page. This is the long one, including the parts that aren’t perfect. If anything here is unclear or looks wrong, please write to us.
Draft, not dated yet · privacy@subby.baby
On your phone
Without sync, Subby never talks to a server. There’s no account, no analytics and no ads in the app.
The log is an encrypted database
Everything you log is stored with SQLCipher. Its key sits in the phone’s own secure storage (the iOS Keychain or the Android Keystore), and can be read once you’ve unlocked the phone after a restart.
Predictions are worked out on the phone
Nap windows, trends and growth percentiles are calculated from your own log, on the phone. Nothing is sent anywhere to do it.
Backups can have a passphrase
A backup is one file with every entry and photo. With a passphrase, it’s encrypted before it’s saved, and nobody can open it without that passphrase, including us.
CSV exports are plain files
That’s on purpose, so you can open them in a spreadsheet. The app tells you so before you export. Treat the file like any other private document.
What the sync server sees
Each entry is encrypted on the phone before it’s sent. The server needs a little information around each locked box to get it to the right phones. Here’s all of it.
It can see
- Random ids for your family, each phone and each entry
- Whether a box holds a child’s profile, a log entry or a phone’s name, but not what’s in it
- Which phone wrote each box, and when
- Version numbers, and whether something was deleted
- How big each box and photo is
- Each phone’s public keys and signatures, and the signed list of family phones
- On Android with push turned on, the phone’s push token
- The internet address a phone connects from, while it’s connected. The server doesn’t write these to its logs
- On our server, if you buy an unlock: which store it came from, which phone or family it’s for, and a reference to the purchase that we check with the store. No name, email or card details; the store handles the payment
It can’t see
- What kind of entry it is: a feed, a nap, a diaper, a dose of medicine
- Amounts, sides, durations, notes or milestones
- Your baby’s name, birthday or photos
- The names you give your phones
- The family key, or your recovery words
What that means in practice: the server could tell that one of your phones saved something at 3:12 a.m. It can’t tell whether that was a feed, a diaper change or a note.
How long our server keeps it: as long as your family uses it. If no phone in a family syncs for 12 months, we delete the family from our server, with a warning in the app from month 11. Your phones keep everything. On your own server, that’s up to you.
Adding a phone
The QR code holds a one-time secret that never goes to the server. It expires after 10 minutes.
Both phones then show a 6-digit code made from both phones’ keys and that secret. If anyone in between, the server included, swapped in a key of their own, the codes wouldn’t match. That’s why the app asks you to compare them.
Every change to the family (a phone added or removed, a new key) is signed by a family phone and chained to the one before. Each phone checks the whole chain itself, so the server can’t add a phone or hand out a key of its own.
Removing a phone
When you remove a phone, the remaining phones make a new family key and share it only with each other and the recovery key. The server then refuses anything written with the old key.
The removed phone can’t read anything logged after that.
The honest limit: it keeps whatever it had already synced before it was removed. No app can reach into someone else’s phone and wipe that.
The recovery key
The recovery key is 24 words, shown once. If every family phone is lost, the words let a new phone join the family and read the log again.
The server only ever sees a public key worked out from the words, never the words themselves.
- Anyone with the words can join. Keep them like you’d keep a passport: on paper, somewhere safe.
- You can replace them. The old words stop working and the family key changes.
- No words and no phones means no way back. We can’t recover the log for you, because we never had the key.
What we can’t protect against
Encryption keeps the server from reading or faking your log. It doesn’t fix everything, and we’d rather you hear it from us.
An unlocked phone
Anyone holding an unlocked family phone can open the app and see the log. A screen lock is your first line of defence.
A server that stops helping
A server can’t read or forge boxes, but it could hold them back or delete them. Your log is still on every family phone if that happens.
Activity patterns
As above, the server sees when boxes arrive and how big they are. Self-hosting means that stays with you.
Android push goes through Google
The message only says “sync”, nothing else. Google can still see that one was sent to your phone, and when.
The cryptography
Standard, well-studied building blocks, from the open-source @noble and @scure libraries. Our code goes public on GitHub before launch, so anyone can check how they’re used.
- Locking entries and photos
- XChaCha20-Poly1305
- Signing, and logging in
- Ed25519
- Handing the family key to a phone
- X25519 sealed box, HKDF-SHA256
- The family list
- Signed entries, SHA-256 hash chain
- Recovery words
- BIP39, 24 words (256 bits)
- Backup passphrase
- scrypt, then XChaCha20-Poly1305
- The database on the phone
- SQLCipher
Subby hasn’t had an independent security audit yet. If you find a security problem, please tell us at security@subby.baby.
This website
subby.baby is a plain static site. It sets no cookies, runs no analytics and has no scripts. The fonts and images come from this domain, so your browser doesn’t talk to anyone else while you read it. It’s served over HTTPS only.
It runs on a server we rent from Hetzner, the same one that runs Subby Sync. The server keeps no access logs, so we don’t record who visits or from where. Like any hosting company, Hetzner’s network carries the connection, but it can’t see inside it.