What Joey knows, what it can't, and who else is involved.

Joey is built so that the people running it cannot read what you log. This page says exactly what that means in practice, in plain language, and what happens to the little the server does hold.

Effective 21 September 2026. Applies to the Joey app for iPhone and Android and the service at joey.medipearl.com.au.

The short version

Everything you log lives on your phone. It only leaves if you turn on family sharing, and then it leaves encrypted with a key the server never has.
There are no accounts. We don't know your name, your email, your baby's name, or who is in your family.
The server holds ciphertext it cannot open, plus the minimum needed to deliver it: random ids, timestamps, and push-notification tokens.
No advertising, no trackers, no third-party analytics, no selling or sharing of data. The only usage counts are our own, on our own server (explained below). The only third parties are the infrastructure that carries it: Cloudflare, Apple and Google.
You can delete it all yourself, from inside the app: this phone, or the whole family's records on the server. You can export a copy first, and you can still email us instead.

Who we are

Joey is made by MedApps Pty Ltd, an Australian company. For anything about privacy, including deletion requests, email joey@medapps.com.au. We handle personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles.

What Joey keeps on your phone

Joey is a diary of a baby's routine. On your phone it stores what you enter:

feeds (breast, with left and right timing; bottles and volumes), pumping, sleep, nappies;
growth measurements, medications and doses, temperatures;
notes, milestones, and comments on entries;
your baby's profile: name, date of birth and, if you enter it, sex;
the names you give to the phones in your family (for example "Mum's iPhone"), and which phone logged each comment.

Information about a baby's feeding, sleep, medication and growth is health information, which the Privacy Act treats as sensitive. That is why Joey is built the way it is: this information stays on your phone, and if it travels at all it travels encrypted.

Joey does not read your contacts, location, photos or anything else on the phone. It asks for notification permission so that the family's phones can wake each other to sync and show live timers on the lock screen. Backups you export from the More tab are ordinary files under your control.

What the sync server receives, if you use family sharing

Family sharing is optional. If you never set it up, nothing about your baby leaves your phone and the rest of this section does not apply.

When you do set it up, every entry is encrypted on your phone with AES-256-GCM before it is sent. The encryption key is generated on the first parent's phone and is never sent to the server. It travels only sealed to a specific phone that a parent approved in person, or inside the printed recovery document Joey makes for you. The server stores what it is given: ciphertext it cannot open.

The server holds

encrypted entries, keyed by a random family id and a random entry id, with a last-changed timestamp;
a hash of the family's access token (not the token itself);
for each phone in the family: a random device id, whether it is iPhone or Android, and its push-notification token from Apple or Google;
short-lived lock-screen timer tokens, so a timer stopped on one phone ends on the others; these are removed within 48 hours of the timer ending;
when the family was created, and for each phone how often it syncs — one row per phone per day with a sync count, a session count and a last-seen time, kept 180 days.

The server can never see

your baby's name, date of birth or sex;
any feed, sleep, nappy, pump, medication, temperature, note, milestone or comment;
times, sides, volumes, doses;
who anyone in the family is: no names, no email addresses, no phone numbers, no accounts;
the names you gave your phones, or which phone wrote what. Those are inside the encrypted entries too.

Like any web service, the server briefly sees the internet address (IP address) of a phone that connects to it, and request details such as the time and size of a sync. Cloudflare keeps operational logs of requests for a short period (up to seven days) for troubleshooting. We do not build profiles from them.

Push notifications are content-free. A notification tells a phone "something changed, sync now" or "that timer ended" — or, occasionally, carries a short notice from us (see below). It never carries an entry.

What we do with it

Run the service. Store encrypted entries and hand them to the family's other phones; send content-free push notifications so they stay in step.
Keep it working. We keep our own usage counts, on our own server: how many families and phones exist, how many entries were synced this week, how many phones are iPhone versus Android, and which days each phone synced (one row per phone per day, tied to its random device id, kept 180 days). That is the whole of Joey's analytics. It tells us whether Joey is being used; it contains no content and no identities, and it never leaves our server.
Tell you things. Occasionally we send a short notice inside the app, for example to ask for feedback or warn about a change. It is written by us, shown once, and we record only which phones have shown it. Nothing about you or your baby is involved.
Nothing else. We do not use your information for advertising, do not sell or rent it, do not share it with data brokers, and do not train models on it. Nothing is sent to Google Analytics, Firebase Analytics or any other analytics service, and there are no advertising or crash-reporting SDKs in the app.

Who else is involved

Provider	Role	What it handles
Cloudflare	Hosts the sync server and its database, and serves this website	The encrypted entries and the server records listed above. Cloudflare operates a global network, so this data may be stored or processed outside Australia.
Apple	Delivers push notifications to iPhones; distributes the app through the App Store and TestFlight	Your device's push token and content-free notifications. Apple's own terms cover the App Store.
Google	Delivers push notifications to Android phones	Your device's push token and content-free notifications.

None of these providers holds the encryption key, so none of them can read your entries. We may disclose the server's records if the law requires it, but there is no way for us to disclose the contents of your entries, because we cannot decrypt them.

Children

Joey is used by parents and carers to record information about their baby. It is not designed for children to use, and there is nothing to sign up for. The information you record about your baby is health information about a child; it stays under your control on your phone and is unreadable to us in transit and at rest.

How long we keep it, and how to delete it

On your phone: until you delete an entry, or delete the app. Deleting the app removes its data from that phone.
On the server: the family's encrypted entries stay until the family is deleted. Push tokens are removed when Apple or Google reports them invalid. Lock-screen timer records are swept within 48 hours. Request logs expire within days.
After a family is deleted: the server keeps only a marker — the family's random id and the deletion time — for 180 days, so the family's other phones can be told the family was deleted rather than simply failing to sync. It holds no entries.
To delete: open More → Delete my data in the app. You can export a copy first. Delete everything on this phone wipes that phone and leaves the family; Delete the family everywhere (admin phones) purges every record from the server immediately and wipes the phone. Other phones in the family are told the family was deleted and can export, wipe, or keep their own copy. You can also email joey@medapps.com.au and we will purge the family for you and confirm when it is done. Removing a single phone from the family in the app also rotates the encryption key and the access token, so that phone can never read new entries or write again.

How it's protected

Entries are encrypted on the phone with AES-256-GCM. Every entry is also signed by the phone that wrote it, inside the encrypted blob, so a forged entry is dropped.
Keys live in the phone's secure storage: the Keychain on iPhone, the Keystore on Android.
All traffic uses TLS. The server never holds a plaintext access token, only a hash.
There is no "forgot password", because there is nothing the server could reset. Keep the recovery document Joey gives you somewhere safe; it is the one thing that can restore a family if every parent's phone is lost.

MedApps Pty Ltd is certified to ISO/IEC 27001:2022 for the design, development, operation and support of its Med App hospital platform. Joey is a much smaller product built under the same roof and discipline; that certificate covers MedApps' information security management system, not Joey specifically.

Your rights

Because your entries are on your phone and unreadable to us, access and correction are in your hands: open the Journal to see or edit anything, and export a backup from the More tab to take a copy. For the small set of server records, or if you believe we have handled information in a way that breaches the Australian Privacy Principles, email us at the address above. We will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

If this policy changes, the new version will be published here with a new effective date. We will not weaken the encryption model described above: the server not having the key is the point of Joey, not a setting.