A private baby tracker: how Plumi handles your data
Feeds, sleep, growth, health notes and photos are sensitive. Here is what stays on your phone, what changes when you turn on sync, and what Plumi cannot read.
Plumi is a privacy-focused baby tracker for iPhone. Everyday logging works offline, without an account or ads. Care records stay on your device by default; optional Plumi Pro sync and family sharing encrypt them before upload so our servers cannot read their contents.
Baby logs can include photos, health notes and care routines. Here is what stays local, what uses the internet and what changes when you enable sync. This is our explanation of our own product, not an independent security audit.
What stays on your phone, and what uses the internet?
| What you use | What happens to the data | Plan |
|---|---|---|
| Local feeds, sleep, diapers, growth and health logs | Stored on your device; no Plumi account required | Free |
| Photos and scanned documents | Stay on the device that added them and in your optional backups; not shared through Plumi sync | Photo attachments are Free; document scanning needs Pro |
| CSV export | You choose where to save or send the exported file | Free |
| Optional encrypted iCloud Drive backup | Stored in your own Apple account, separately from Plumi sync | Free |
| Optional sync and caregiver sharing | Care records are encrypted before upload; account, membership and delivery metadata are handled separately | Pro |
| Website visits | The website uses Google Analytics; the native app has no analytics or advertising SDKs | Website only |
You can use Plumi without an account
The core app does not need sign-up. You can add your baby, log feeds, start timers, track diapers, record sleep, save growth measurements, keep checklists, add milestones and use Plumi offline without creating a Plumi account.
That matters because an account usually means a server record. For everyday tracking, Plumi does not need one.
If you never turn on Pro sync or partner sharing, your baby logs are local to your device. They are not uploaded to Plumi’s servers in the background, and we do not have a copy we can browse, analyze, sell or hand to an ad network.
No third-party analytics, no ads
We do not build the app around advertising. We do not include third-party analytics SDKs. We do not sell or rent personal data.
Free local logging has no ads or third-party analytics. Pro adds sync, sharing and other features.
What changes when you turn on sync
Some families want Plumi on more than one phone. Some want a partner, grandparent or nanny to log care too. That is what Plumi Pro sync and sharing are for.
When you choose to use those features, you sign in with Apple or Google so Plumi can connect your devices and your subscription. From that point, the app uses Plumi’s relay servers to move updates between the people and devices you invited.
The server receives encrypted care records.
Your entries are encrypted on your device before upload. The server stores ciphertext and sync metadata, not readable baby logs. The keys needed to read a child’s history stay on devices that are allowed to see that child. We cannot open the database and read a feed note, a medication entry, or your baby’s name from the encrypted sync payload. Your baby’s profile photo, entry photos and scanned documents never reach our servers: they stay on the device that added them and in your own optional backups. They do not sync to your other devices or caregivers.
Sync is also optional. If you do not turn it on, there is no Plumi sync record for your baby.
Sharing is per child
You choose which children to share.
Each child has their own encrypted record. When you invite someone, you choose the children they can see and one role for the invitation. A caregiver can see and log care for the child you shared with them. A parent has broader controls, such as managing lists, reminders, exports and profile details.
If you do not share a child with someone, their phone does not get that child’s data or key. That child is not merely hidden in the interface; there is nothing for that person to decrypt.
This is why Plumi asks you to choose carefully before sending an invite link. Sharing is private by design, but it is still sharing. Invite people you trust with that child’s information.
Backups are separate from sync
Sync is for keeping devices and caregivers up to date. Backup is for recovering your own data later.
Plumi can keep an optional iCloud Drive backup through your Apple account. That backup is not a Plumi server feature, and it is separate from Pro sharing. If you use it, the backup belongs to your iCloud account and is governed by Apple’s privacy and security model.
If you do not want backup, leave it off. If you do not want sync, leave sync off. The app is designed so local tracking still works.
What Plumi does store
Account features need some server records, separately from the encrypted care record.
For local-only use, your baby data stays on your device.
If you choose account features, Plumi stores a minimal account record, such as the sign-in provider identifier and email if provided, plus subscription status. If you enable sync or reminders, the service may also keep device push tokens needed to notify your devices. Payments are handled by Apple through the App Store; Plumi does not receive your card details.
For encrypted sync, the server stores the encrypted updates it needs to relay between authorized devices. Those updates are not readable by us.
Export and deletion stay in your hands
You can export your baby history to CSV. You can delete entries and babies in the app. If you created an account for Pro features, you can also delete the account from Plumi.
Because most baby data lives on your device, deleting the app removes the local copy from that device. If you use sync, deletions sync to the shared record. If you use iCloud Drive backup, any backups you created live in your own iCloud storage.
Deleting the app removes its local copy, but does not delete your account or optional iCloud Drive backups. Manage those separately.
Is Plumi free without selling baby data?
Everyday tracking for one baby is free, with no ads and no sale or rental of personal data. The latest month of journal history is visible on Free; older records stay stored, and growth and saved milestones retain their full history. Pro adds full journal history, sync, sharing and other extras. See current pricing and plan limits.
Can my partner use it without sharing a password?
Yes. With Pro, each invited person uses their own account. A shared child can have up to five people, including the sharing owner, covered by one subscription. You choose the children and the role for each invitation. Read the family sharing guide for permissions and the limits of removing access to records someone has already saved.
Does offline mean nothing ever connects to a server?
No. Local tracking works without internet access, but optional services such as sign-in, subscriptions, sync and book lookup use a connection. If you use Plumi in ChatGPT or photo logging through Apple Private Cloud Compute, those providers process the information you submit under their own terms. The Privacy Policy describes those flows and the service providers involved.
Privacy should be boring
Free local logging keeps care records on your phone. If you enable Pro sync, our servers store encrypted copies that we cannot read. You choose whether to use sync or backup.
For the formal version, read the Plumi Privacy Policy. Questions go to privacy@plumi.app. You can try Plumi on the App Store and read about feeding or sleep tracking before deciding.
Updated October 23, 2026
