Privacy and security

What this page covers

This page explains how this website and our contact mailbox handle information now, and the handling implemented in the BubCue development build and its connection service. The app is not yet available to download. Account creation and subscription billing are not implemented. Our current plan is an annual subscription for monitoring, with no separate subscription for invited viewers. Pricing and purchase terms are not final.

This is an overview. Our Privacy Policy gives the fuller description of the same practices, retention, recipients and privacy rights, and applies if the two differ. Neither page is consent to a new use of your information or a waiver of legal rights.

At a glance

If you or another person separately sends MFLOW information or files, for example with a support message, we receive and handle that copy. This is separate from the app’s ordinary monitoring path; see Emails to us.

How your video travels

At home. When both phones are on your home Wi-Fi, video and sound go directly between them over your network.

Away from home. A phone you paired connects to the nursery phone over the internet. BubCue’s connection service introduces the two phones; then video and sound go directly between them, encrypted. If a network does not allow a direct connection, BubCue can’t connect from there and shows that it isn’t live. It never sends your video through a relay instead.

In a browser. A laptop on the same Wi-Fi can watch through the monitor’s browser link. The video is encrypted, but the browser’s setup page is served by the nursery phone over plain HTTP, so someone else on the same network could tamper with it and watch. Use the browser link only on your own home network.

BubCue’s connection service

Watching from away, and invitation links, use BubCue’s connection service. It helps your phones find each other and never carries your video or sound.

• What it handles: network addresses, installation public keys and identifiers, session and invitation records, permissions, joins and cancellations. It passes connection-setup messages, which can contain addresses and cryptographic fingerprints, so the phones can establish their direct connection. It also helps each phone learn its public network address.
• What it never handles: video, sound, Activity records or any analysis results.
• When it is used: when you open pairing while you have internet, the nursery phone registers the session with the service and keeps a connection to it open until you stop monitoring, even if everyone watches at home. Watching at home over your Wi-Fi keeps working without it.
• Where it runs: its servers are in Australia. The hosting provider is based in the United States and may handle this information there.
• How long records are kept: access records are kept while the service regards the session as open. Ended session records and related cancelled or revoked access records become eligible for routine deletion after 24 hours; starting another session replaces the registration and retires the earlier access records. This depends on the service receiving the end or replacement and running maintenance. An abandoned session that never ends currently has no automatic time limit. Service logs can include network addresses and rotate by size, so their retention time varies. See Retention.

What each phone handles

• Analysis. Sound alerts, cry alerts (experimental) and face visibility (experimental) run on the nursery phone. Face visibility works in memory and saves no image. After detecting a face, the app can show a notice if camera analysis stops detecting it. It cannot determine why. Real-world detection performance has not been established. This feature does not assess breathing, health or safety.
• Face outlines. The nursery phone calculates face outline points from camera images and draws them on its own screen while you set up. When Show outlines is on, those points are sent through the encrypted connection to connected viewers, so BubCue apps can draw them; a web browser doesn’t draw them. The points are not saved or used to identify who the baby is.
• Diagnostic log. A text record of app events, including analysis results such as sound levels, cry and face visibility states and the cry-type guess’s scores and top label, including when no guess was shown, with times and the phone’s local network address. It contains no audio or video. The app keeps it on the phone and does not automatically upload it to MFLOW.
• App switcher. As with any app, your phone’s app switcher can keep a still image of the last screen you saw.

Turning Cry details off stops new cry-type guesses. Experimental guess. Development testing has not demonstrated reliable identification of hunger or tiredness. Independent confirmatory validation has not been completed. The guess can be wrong. Show outlines controls outline display and transmission; it does not turn face visibility off. Face visibility runs while monitoring video is active, unless it is unavailable, for example on Android 9 or when the phone is too hot. Cry alerts and face visibility have no separate off switch in the version described here. Stop on the nursery phone ends the monitoring session. None of these actions deletes records already saved.

Who can watch, and how you stay in control

A device joins by scanning the nursery phone’s current QR code, opening its browser link on the same Wi-Fi, or opening an invitation link the nursery phone shares. Each invitation can be used by one device. The nursery phone does not ask you to approve each join: having the QR code, the browser link or an unused invitation is the permission, so share them only with people you trust.

• Up to two viewers can watch at once. A laptop browser counts as one.
• Connected app viewers can watch, listen, talk and use live controls. Browser viewers cannot talk through BubCue. Viewers cannot stop the nursery phone’s monitoring or issue new invitations.
• Access ends when monitoring stops. After the nursery phone stops or restarts, everyone joins again with the new QR code, browser link or a new invitation.
• On the nursery phone’s Viewers page you can remove an app viewer, cancel an unused invitation, or change the pairing code. Changing the code stops new joins with the old code; it does not disconnect people already watching. A browser viewer is disconnected only by Stop.

Soothe voice clips

You can record up to three voice clips of up to 60 seconds each on the nursery phone, to play from Soothe. Recording is something you start yourself; BubCue never records automatically.

• A clip can pick up nearby sounds, including your baby.
• Clips are stored encrypted on the nursery phone, left out of backups, never sent as files, and kept until you delete them.
• While you record or play a clip, people watching can hear it through the live sound.
• Sound alerts pause while you record or review a clip.

Activity records

Activity lists alerts and the times parts of monitoring were unavailable. It never contains audio or video. Unless you choose to save it, it is cleared when you stop monitoring or restart the app.

• Saving is a separate choice on each phone. Saved records are encrypted on that phone, left out of automatic cloud backups, and kept until you delete them. Turning saving off does not delete records already saved.
• If you turn on sharing, your connected parent phones on the same home network can receive the records for the monitoring session they joined. Removing a phone stops future transfers but does not erase copies it already received.
• Exporting creates a file you control; where you send it follows that service’s own privacy rules.
• When Cry details shows a cry-type guess, the alert’s Activity entry includes it (for example “Possible crying · hungry?”), so saved or exported Activity keeps that guess. Experimental guess. Development testing has not demonstrated reliable identification of hunger or tiredness. Independent confirmatory validation has not been completed. The guess can be wrong.
• Activity is not a sleep log. A quiet period does not mean your baby was asleep.

Which networks to use

Use BubCue on your own home Wi-Fi. Shared networks such as hotel, guest, café or office Wi-Fi are not supported: they often stop the phones reaching each other, and other devices on them can see that a monitor is present.

Using BubCue respectfully

Monitor only rooms and people you are responsible for. Tell carers and visitors that the room is monitored, and never use BubCue to record or watch people without their knowledge. Anyone you invite could record what they see on their own screen, and removing them cannot erase that.

Children

BubCue is made to be set up and used by adults: parents and other caregivers. The nursery phone’s camera and microphone capture a baby and anything else in the room, and alerts and Activity describe what the nursery phone detected. Use BubCue only for children you are responsible for, and agree on its use with anyone who shares that responsibility.

This website

This website loads Google Analytics through Google Tag Manager when a page opens to count visits and see how pages are used. It sets cookies and sends visit information to Google, including pages, interactions, browser identifiers and device details. Google receives the request’s IP address and derives approximate location; its further handling varies by region and settings. Google may process information in the United States and other countries. The website host also processes IP addresses and request details through its worldwide network. MFLOW’s website access logging is disabled; that does not mean providers keep no security or operational records.

See Cookies and analytics for the cookies, retention distinctions, Google’s notices and browser options. Blocking cookies does not necessarily stop every analytics request. The BubCue app contains no analytics or advertising code.

Emails to us

If you write to contact (at) bubcue.com, we receive your address, message and attachments in Apple iCloud Mail. Apple says personal data it collects worldwide is generally stored in the United States, and can be handled by its entities in other countries. We use your message to answer you, investigate reports and meet applicable legal duties.

From 7 November 2026, our policy is to review support email monthly and delete routine correspondence once the case has been closed for 12 months. Reports of a missed alert, an injury or another product problem, and billing, complaint or legal records, may be kept longer while needed for the matter, a related claim or a legal obligation. This is a review process, not automatic deletion on a fixed day. Please keep routine messages free of children’s media, health details and access codes. You can ask us to review information held about you; see the Privacy Policy for detail.

Requests and complaints

BubCue is operated by MFLOW PTY LTD (ABN 39 633 568 635), Australia. Write to the Privacy Officer at contact (at) bubcue.com for a privacy question, access or correction request, deletion review or complaint. We will acknowledge it, ask only for verification reasonably needed and reply as soon as we can, subject to applicable legal deadlines. MFLOW cannot retrieve or erase a record kept only on your phone or another viewer’s device.

Postal address: UL40, Level 2, Suite 664, 1341 Dandenong Road, Chadstone VIC 3148, Australia.

If you are dissatisfied or have not received a response within 30 days, you can contact the Office of the Australian Information Commissioner, which decides whether it can deal with the complaint. The Privacy Policy explains additional regional rights and complaint routes.