Lantern Baby Tracker Privacy Policy

Last updated: October 15, 2026

Lantern Baby Tracker is published by Graehl Arts. This policy describes the Android app, package org.babytrack.app. The app is an early release. It provides record keeping for adult parents and caregivers, without medical advice, diagnosis, or treatment.

Records on your device

You can use local tracking without an account or internet connection. Child profiles, care entries, notes, and saved timer drafts are stored on your device. These records may include names, birthdays, feeding, sleep, diaper, growth, temperature, and medication information that you choose to enter. Local records are not uploaded merely because you use local tracking. The Android app disables Android application-data backup.

Optional sharing preview

Sharing is optional and currently uses a development preview relay. Use test data only in shared Families. Shared record contents are end-to-end encrypted in the shared Rust core before transmission. The relay does not receive the keys needed to read those contents. Devices you authorize can read the shared records and retain copies. Invitations are bearer capabilities: send them privately. A person who redeems a valid invitation can receive existing shared history.

The relay receives encrypted batches and authorization metadata such as opaque Family and device identifiers, public keys, membership changes, and operation timing and sizes. Your internet address and connection information are visible to the relay and its hosting infrastructure. End-to-end encryption does not hide this metadata. The preview service may be reset and is not a recovery backup.

Files and Android features

Backups and CSV exports are created only at your request and saved to a destination you choose through Android. A readable backup or CSV contains readable records. A password-protected backup is encrypted using your password. File providers and apps you select receive the files you give them under their own policies. A file contains only its saved point; later records require another backup. Restore creates a new local Family and does not restore membership in the original shared Family.

Optional local notifications show running timers. Notification permission can be declined while tracking remains usable. Device-local keys use Android’s key-storage facilities. The app includes no advertising or analytics SDK.

Retention, deletion, and other caregivers

Local records remain until you remove them, clear the app’s storage, or uninstall it. Manage exported files separately wherever you saved them. Copies held by another caregiver are under that caregiver’s control. Removing a device ends future shared access only after confirmation and does not retract data already received. The preview relay stores encrypted history and authorization metadata until the operator removes it or resets the service; there is currently no automatic expiry or fixed retention schedule. Deleting a timeline entry does not erase its earlier encrypted operations from the relay history. Clearing or uninstalling the app does not delete relay data. Connection and infrastructure logs may also remain under the hosting providers’ retention practices. The preview relay can be reset without notice, so do not rely on it to retain or recover records.

Privacy questions and deletion requests

Contact Graehl Arts at graehlarts@gmail.com for privacy questions or to request removal of identifiable preview-relay data. We may need an opaque Family or device identifier and verification that you are authorized to make the request. We cannot locate records by a child’s name because the relay cannot read encrypted contents. Do not send child records, decryption keys, backup passwords, or invitation secrets. There is no self-service relay deletion control in the current app.

Lantern does not create a hosted user account. Deleting local data, removing an authorized device, deleting a backup file, and requesting relay removal are separate actions. We cannot erase files or copies held on another person’s device or by a file provider you selected.

Service providers and this website

Network and hosting providers process the technical information needed to serve the relay and these public pages, such as IP addresses and request times. Emailing support gives us and our email provider the address and message you send. These Lantern pages contain no advertising, analytics scripts, or third-party fonts. GitHub Pages hosts this website; see GitHub’s privacy statement for its handling of website visitor data.

Changes to this policy

We will update this page when Lantern’s data practices change and revise the date above. Material changes to sharing or data handling will also be reflected in the app’s information.