Privacy policy
Last updated: October 6, 2026
In plain words: what MeiMei keeps, where it lives, how long, and how to make it go away.
Who is responsible
The controller of your data is TECHNO FUSION SRL, CUI 21343176, J22/741/2007, Str. Petre Andrei nr. 4c, parter, ap. 2, Iași, Romania. You can reach us at support@meimeimonitor.com.
What MeiMei is
MeiMei turns a spare phone into a baby unit and your own phone into the parent unit. The baby unit listens and watches, and the parent unit shows you what is happening and alerts you. MeiMei reports what it observes, such as sounds and movement. It does not tell you what they mean.
MeiMei is not a medical device and is not made for watching over a child who is unwell or needs medical care: such a child needs an adult with them at all times. If your child is struggling to breathe, turns blue or goes limp, call your emergency number.
What is kept, and where
| Data | Where it lives | How long | Does it leave your home? |
|---|---|---|---|
| Live video and sound | Streamed from the baby unit to the parent unit, only while a parent asks | Not stored | On your home network: no. When you are away: through a relay, still encrypted from phone to phone |
| Recorded clips | Only on the baby unit, in the app's private storage (in a browser, the browser's own storage), and never uploaded | Without MeiMei Home or MeiMei Away nothing is saved. With Home or Away, up to 30 nights or 2 GB, whichever comes first | Only a clip you choose to save to your photos |
| Events, nights and sleep reports | On the phones. Without MeiMei Home or MeiMei Away they are only shown while a session runs, then dropped | With Home or Away, up to 30 nights | Only as event codes, times and counts, for AI notes (see below), and only if AI notes are on |
| Pairing secret | The secure storage of both phones (Keychain on iPhone, Keystore on Android) | Until you pair again | Never |
| Browser sign-in (only if you sign in in a browser): one refresh token, and for alerts a key derived from the household key | This browser's own storage (local storage and IndexedDB), on that device only, never a cookie | Until you sign out (signing out revokes the token) or turn alerts off | Never. The key cannot be extracted and neither is sent to us |
| Account email | Amazon Cognito | Until you delete your account | Yes, it is the account. Needed for alerts to a locked phone and for remote viewing |
| Device registry: device id, hashed household id, role, phone type, device name, language and push address (for a browser with alerts on, its Web Push address) | Amazon DynamoDB | While the device is registered. A Web Push address goes sooner, as listed under "Alerts to a browser (Web Push)" | Yes, for alerts and remote viewing |
| Purchases: your plan (Home or Away, both subscriptions with a 7-day free trial, plus any extra parent devices), the store order id, purchase and renewal dates, and the proof the store gave your phone | Amazon DynamoDB, with the household's id | Until you delete your account | Yes, only if you buy a plan and are signed in. Apple or Google, and our servers, can see it. Payment itself is handled by the store, and we never see card details |
| Connection records: connection id, room, device id and the network address the connection came from | Amazon DynamoDB, with an automatic expiry | Expire after 2 hours (signed-in connections) or 10 minutes after the last message (no-account browser connections), and are deleted automatically soon after | Yes, only while you use remote viewing, alerts or the no-account mode in the browser |
| Rate-limit counters (how often a household or network address connected) | Amazon DynamoDB, with an automatic expiry | Minutes to three days, then deleted automatically | Yes, only when the cloud is used |
| Messages between your phones and alert pushes | Pass through Amazon API Gateway and AWS Lambda | Not stored. Encrypted with your pairing secret, so the cloud sees only ciphertext | Yes, only when the cloud is used |
| Server logs | Amazon CloudWatch | 14 days | Yes. Request ids and timings only, never message content, tokens or video |
| Your child's age (optional) | On both phones, as birth month and year | Until you change or delete it | Only as an age band, such as "6 to 11 months", with AI notes |
Alerts to a locked phone
When your phone is locked, alerts arrive as push notifications through Apple or Google. The notification text is encrypted with your pairing secret before it leaves the baby unit. Apple, Google and Amazon carry only ciphertext and a generic "MeiMei alert" title. Your phone decrypts it and shows the real message.
AI notes
With MeiMei Away, MeiMei can explain events in plain words. To do that, the baby unit sends event codes, times and counts, and your child's age band if you set one, to Amazon Bedrock through our servers. It never sends audio, video, clips or names. Nothing is stored there, and the answer comes back in your language. Turn AI notes off in Settings and MeiMei writes its notes on the phone instead, with nothing leaving it.
No account, in the browser
You can use MeiMei on two devices in a browser, with no install and no account. Browsers cannot find each other on a network, so the two devices meet through a small relay: either our cloud relay, or a program you run on a computer at home so that nothing leaves the house. The cloud relay sees a room code (a scrambled household id), device ids, timing, the network address of each connection and encrypted messages. It does not see video or sound: those travel directly between the two devices. The browser session lasts as long as the devices stay connected, and the room is removed shortly after the last device leaves. In this mode nothing is saved. It needs the browser tab open and the screen on, and it cannot alert a locked phone. The app can.
Signing in, in a browser
A browser can sign in to the same account as your phones: with an e-mail one-time code, with a password where you set one, or with a passkey where passkeys are switched on. Once signed in, the browser can be a baby unit or a parent device in your household, mixed with phones, through MeiMei's cloud relay. It is the same end-to-end encrypted relay the phones use: video and sound still go directly between the devices, never through MeiMei's servers, and clips never leave the baby unit.
To keep you signed in, the browser keeps one refresh token in its own storage, not in a cookie, until you sign out. Signing out revokes it. The no-account mode above is unchanged: nothing is sent to an account and nothing is saved.
Alerts to a browser (Web Push)
A parent can switch on alerts for a browser that is signed in, only by tapping a button and accepting the browser's permission question. The browser then creates a push subscription with its own push service: Google (Chrome, Edge, Brave and other Chromium browsers use Google's service), Mozilla (Firefox), Apple (Safari, and the Home Screen app on iPhone and iPad) or Microsoft (Edge on Windows may use Microsoft's service). Your browser chooses the service, and no data goes to anyone else.
A push subscription is an address (a web address at that service plus two public keys) that lets our server send that one browser a message. We store it with the device record, in the same table as phone push tokens, as the push address of that device, in AWS (us-east-1, Lambda and DynamoDB, as for the phones).
The push services only ever carry ciphertext. The alert is encrypted on the baby unit with the household key, which neither MeiMei's servers nor the push services have, and the push is encrypted again for that browser, as the Web Push standard requires. A service worker in the browser decrypts it with a key derived from the household key, kept in that browser's own storage (IndexedDB), on that device only, as a non-extractable key. If anything fails to decrypt, the notification carries only the generic "MeiMei alert" title. As with Apple and Google for phones, a push service sees the subscription address, the time, the size and our server's address, not the content. The service worker only handles push messages and notification clicks: it caches nothing and intercepts no requests.
On iPhone and iPad this works only with iOS 16.4 or newer, and only for MeiMei added to the Home Screen. Alerts are always free; a free account is enough.
A push subscription is deleted when:
- you turn alerts off in the app,
- you sign out,
- you remove the device,
- you delete everything, or your account,
- or the push service reports it expired or invalid, and we then remove it.
Wi-Fi network names (optional)
If you turn on “Show Wi-Fi names” in Settings (phone apps only), the system asks for location access, because it requires it to read the name of the Wi-Fi network. MeiMei uses that access only for the network name: it does not read, store or send your location. The baby unit sends its network name to your paired devices over the encrypted link, never to our servers, and nothing is stored. The switch is off until you turn it on, it is never asked for at launch, and everything works without it. Browsers cannot read the network name.
Cookies and analytics
The website and the app use no cookies and no analytics. The app keeps its settings, and in a browser the pairing secret of that browser, in the browser's local storage. If you sign in in a browser, it also keeps the sign-in token there, and for browser alerts a key in IndexedDB. That storage is strictly necessary for MeiMei to work, it is never sent to us, and it is not used to track you.
Your child's data
Video and sound of a child are sensitive personal data, even when they never leave the phones. MeiMei keeps them on your devices, protects the pairing secret in the phone's secure storage, and streams live pictures only while you ask for them.
Who else is involved
- Amazon Web Services hosts the account, the device registry, the relay and this website.
- Apple and Google deliver push notifications to phones, as ciphertext. For a browser with alerts switched on, the push service of that browser does: Google, Mozilla, Apple or Microsoft, as ciphertext.
- Apple and Google process purchases and payment, and we ask them to confirm a purchase you made so that your plan works on every phone in your household. Our servers keep the plan, the order ids, the dates and the store's proof.
- Nobody else. MeiMei has no analytics, advertising or crash-reporting services, and it does not sell data.
Where the servers are
MeiMei's cloud runs on Amazon Web Services in the United States (us-east-1, N. Virginia). Personal data sent there (account email, device registry, purchases, connection records) is transferred outside the EU under the EU-US Data Privacy Framework, in which Amazon Web Services participates, and the Standard Contractual Clauses in AWS's data processing terms. Video, sound and clips never go there.
Why we may use your data
To provide the service you asked for (your account, alerts to a locked phone, remote viewing and your plan), because we need it to keep our contract with you. To keep the service safe and working (rate limits and short server logs), because we have a legitimate interest in doing so. AI notes only when you have them on, and you can turn them off at any time.
Your rights
You can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to how it is used. Write to support@meimeimonitor.com; we answer within one month. You may also complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, www.dataprotection.ro), or to the authority where you live.
Your choices
- Delete everything. In Settings, "Delete everything" wipes both phones and deletes your account, your registered devices, your connection records, your plan and order records and your household's video channel from our servers.
- Use it without an account. Watching and alerts on your home Wi-Fi, or between two browsers, need no account. The account is for alerts to a locked phone or a browser, and for remote viewing.
- Turn AI notes off in Settings.
- Turn browser alerts off, or sign out. Either one deletes that browser's push address from our servers; signing out also revokes its sign-in.
- Ask us. To see or remove anything we hold about you, write to the address on the support page.
Children using the app
MeiMei is for parents and caregivers. It is not meant to be used by children.
Changes
If this policy changes, this page changes, and the date below with it. Translations (machine drafts that still need legal review) are linked below; if they differ from this page, the English text applies.