How ParAI Keeps Your Baby's Data Private & Secure

Why Baby Data Privacy Matters

Think about what a baby tracking app knows about your family: feeding schedules that reveal your daily routine, health data including medications and temperatures, sleep patterns that show when everyone in the house is asleep, and growth measurements that are medical data by any definition.

This isn't just "app data." It's a detailed profile of your infant's health, your family's schedule, and your parenting patterns. It deserves the same protection as medical records — because in many ways, that's exactly what it is.

Most baby tracking apps treat this data casually. They send your raw text to cloud servers for processing, share analytics with third parties, or fund themselves with targeted advertising based on your baby's data. ParAI takes a fundamentally different approach.

On-Device Processing

When you type "baby fed 150ml at 3pm" into ParAI, that text never leaves your phone for parsing. Here's what happens:

1. Your text is tokenized locally using a MiniLM-L6-v2 encoder (22MB TFLite model stored on your device)
2. The on-device model classifies the intent (feeding, sleep, diaper) in under 100 milliseconds
3. Slot extraction pulls out structured data (amount: 150ml, time: 3pm, type: bottle)
4. Only the structured result — not your raw text — is stored and optionally synced

This is a critical privacy distinction. Other apps send your raw text like "baby had diarrhea again, worried about the rash" to a cloud server where it's parsed, logged, and potentially used for model training. In ParAI, that sensitive text is processed entirely on your phone's processor and never transmitted.

The TFLite model supports all 11 languages locally — English, Bulgarian, Spanish, French, German, Portuguese, Hindi, Turkish, Italian, Japanese, and Korean. No language requires a server connection for intent recognition.

Learn more about how this works: Natural Language Baby Tracking.

What Data Goes to the Cloud

Transparency matters. Here's exactly what leaves your device and why:

• Structured activity logs — event type, amount, time, duration. Synced for backup and family sharing. Encrypted in transit and at rest.
• AI chat messages — when you use the AI chat feature, your question goes to Google Vertex AI for a response. These queries are not stored by Google for training and are not used to improve their models.
• Account data — your email (from OAuth), child profiles, and preferences. Required for the service to function.

What does NOT go to the cloud:

• Your raw natural language input text (processed on-device only)
• Biometric data or device identifiers for tracking
• Data shared with advertisers or data brokers (we have none)

See also: Offline Baby Tracking — how ParAI works without any internet connection.

Encryption & Security

Multiple layers protect your data:

• TLS 1.3 in transit — all communication between your phone and our servers is encrypted. No one can intercept your data.
• Encrypted at rest — your data is stored on Google Cloud infrastructure with AES-256 encryption. Even if someone accessed the storage directly, the data is unreadable.
• OAuth authentication — ParAI uses Google and Apple sign-in exclusively. We never store passwords. There is no password database to hack, no credentials to leak in a breach.
• JWT tokens — short-lived access tokens with refresh rotation. Even if a token is compromised, it expires quickly.
• No third-party analytics SDKs — we don't embed Facebook Pixel, Google Analytics, or other tracking SDKs that send your usage data to advertising companies.

The practical result: there is no "password reset" attack vector, no credential stuffing risk, and no database of passwords that could be exposed in a breach. Your authentication is delegated to Google or Apple — companies that invest billions in security infrastructure.

Your Rights

ParAI is fully GDPR compliant. Here's what that means in practice:

• Export everything — download all your data anytime as CSV files. Feeding logs, sleep records, growth measurements — it's your data and you can take it anywhere.
• Delete permanently — delete your account and ALL associated data is permanently removed from our servers. Not archived, not "anonymized and kept" — deleted.
• See what's stored — full transparency about what data we hold. No hidden profiles or shadow data.
• Never sold — your family's data is never sold, shared with data brokers, or used for advertising targeting. Our business model is subscriptions, not your data.
• Data portability — switch to another app anytime. Your data export is in standard CSV format that other apps can import.

These aren't just policies — they're built into the app. The export and delete functions are accessible directly from Settings, not buried behind support tickets.

Family Sharing Privacy

When you share a child's profile with a caregiver (partner, grandparent, nanny), privacy controls are granular:

• Explicit sharing only — caregivers see ONLY the children you explicitly share with them. They cannot discover or access other children in your account.
• Permission levels — choose between view-only and edit access per caregiver, per child.
• Instant revocation — remove a caregiver's access and it takes effect immediately. No grace period, no cached access.
• No residual data — when access is revoked, the caregiver loses all access to that child's data. Nothing remains in their app.
• Invitation-based — sharing requires an explicit invitation token. No one can request access to your children's data.

This matters for real-life situations: when a nanny's employment ends, when co-parenting arrangements change, or when you simply want to limit who sees your baby's health data.

Learn more: How AI is Changing Parenting Apps — including privacy implications.

How We Compare

Frequently Asked Questions

Is my data used to train AI models?

No. Your activity data is never used to train any AI model. When you use the AI chat feature, your queries go to Google Vertex AI under an enterprise agreement that explicitly prohibits using customer data for model training. Your baby's feeding patterns are not improving Google's AI.

What happens if I delete my account?

All your data is permanently deleted from our servers within 30 days. This includes all activity logs, child profiles, chat history, preferences, and any associated data. This is irreversible — we cannot recover deleted accounts. You can export your data as CSV before deleting.

Is ParAI HIPAA compliant?

ParAI is not marketed as a HIPAA-covered medical device. However, we apply security standards that meet or exceed HIPAA technical safeguards: encryption at rest and in transit, access controls, audit logging, and secure authentication. We treat your baby's health data with medical-grade seriousness even though we're a consumer app.

Can I use ParAI without creating an account?

Yes. ParAI supports guest mode where you can track activities locally on your device without creating an account. Guest data stays entirely on your phone. However, features like cloud backup, family sharing, and AI chat require authentication. You can upgrade from guest to a full account anytime without losing data.

Experience AI-Powered Parenting with ParAI

SmartSpot predictions, natural language logging, AI Sleep Coach, and personalized insights — all in one app. See what AI can do for your family.