A private baby monitor that records nothing

Every baby monitor on sale claims to be private. The word has stopped doing any work, because it gets used for at least four different things: an encrypted connection, a password on an account, a GDPR posture, and footage held on a server that the vendor promises to look after properly.

Only one of those tells you what happens to video of your child's bedroom. The question worth asking is narrower than "is it private". It is: where does the video end up, and how long does it stay there.

The short answer

MonitorUltra records nothing. Video and audio from the baby unit are encrypted in transit and relayed live to the parent unit through LiveKit, then discarded as they pass. There is no clip history, no playback and no footage written to a server. The stream exists only while the two devices are connected, and no copy of it survives afterwards.

What "private" usually means on the box

Five claims you will see, and what each one actually covers.

• "Encrypted connection." Describes the pipe. Says nothing about what sits at the end of it. A camera can be encrypted in transit and still write every frame to a bucket.
• "Password protected." Describes access control. Says nothing about retention, and it is the claim most often undone by a customer reusing a password.
• "Local storage on an SD card." Genuinely useful. In most products the camera stays cloud-connected so you can view it remotely, so the card adds a second copy and the server copy still exists.
• "Cloud storage with a 30-day retention policy." Honest, and it means the footage exists. A retention policy is a promise about deletion, and it presumes there is something to delete.
• "GDPR compliant." A statement about lawful handling of personal data. It assumes data is being held.

None of these are dishonest. They answer a different question from the one most parents are actually asking.

The architecture, precisely

Nothing is recorded

There is no record button, no clip list and no way to review last night. This is a product decision that removes a feature people ask for, and it is the load-bearing part of everything else on this page. Storage that does not exist cannot be searched, subpoenaed, resold, misconfigured or dumped.

Encrypted in transit

Audio and video are encrypted while they travel between the devices and the relay. That is the accurate description of what happens, and I am not going to stretch it into anything stronger. If you want to compare monitors on this specific point, the phrase to look for on a competitor's site is what happens at rest, because nearly everyone encrypts in transit now.

Relayed through LiveKit

A media server sits between the baby unit and the parent unit and forwards the stream. MonitorUltra uses LiveKit for this.

The relay is what makes the rest of the product work. Because a server in the middle handles the connection, the two devices do not have to be on the same Wi-Fi network, you do not have to open ports on your router, and the parent unit works over cellular from anywhere with signal. A monitor that insists both phones share a LAN avoids the relay and pays for it in usefulness.

What the relay does is forward packets between two connected participants. It does not write them to disk, and there is no bucket accumulating last week's nights.

Cry detection runs on the baby unit

Audio is classified on the phone in the nursery, using Apple's SoundAnalysis framework. Nothing is uploaded for a model on a server to listen to and label. This matters independently of the streaming question, because a monitor can avoid storing video and still send every second of your child's room to a cloud classifier. Why cry detection should stay on the phone goes through how that works and why it is a harder engineering choice than the cloud version.

What I am not claiming

This section exists because privacy claims are checkable, and the ones that get checked and fail are worse than never having made them.

• It is not peer-to-peer. A relay handles the media. The two devices do not open a direct connection to each other.
• It is not local-network-only. Traffic leaves your home network. That is the mechanism by which the parent unit works from the office.
• It does not "never touch a server". A relay is a server. It forwards live media and keeps none of it.
• It is not end-to-end encrypted in the sense a messaging app means. Encrypted in transit is the honest phrase, and it is the one I use.

Anyone claiming all four of those at once about a monitor that also works over cellular is describing something that cannot exist.

Why recording is the part that leaks

Publicised baby monitor incidents fall into two shapes.

The first is somebody getting into an account and viewing a live camera, usually through a reused password or a weak default credential. That is an access-control failure, and it can be mitigated by the user with unique passwords and second factors. If you want to work out whether it has happened to you, how to tell if your baby monitor has been compromised is a practical walkthrough.

The second is a vendor-side exposure of stored footage. A misconfigured bucket, a breached database, an over-broad internal access tool. You cannot mitigate this one. You are relying entirely on a company you have no visibility into to keep a video archive of your child's bedroom safe, indefinitely, including after they get acquired, pivot or shut down.

Not recording removes the second category completely. It is the only privacy property in this whole category that a user does not have to take on trust, because you can reason about it from the feature list: there is no playback screen, so there is nothing to play back.

Access is the other half of the question

Storage is what leaks at scale. Access is what goes wrong one household at a time, and it deserves its own answer.

MonitorUltra pairs by showing a QR code on the baby unit and scanning it with the parent unit. That has a useful physical property: adding a viewer requires being in the room with the nursery device, holding it, at the moment you set it up. There is no username to guess, no default password shipped on the hardware, and no camera sitting on the public internet waiting for a port scan to find it.

Several parent devices can watch the same baby unit, and each one gets its own alerts, so a second parent or a grandparent staying over does not mean handing your phone across. The list of devices that can connect is one you built by hand, one scan at a time, which is a smaller and more legible thing to keep track of than an account with sharing links.

What you give up

This is a real trade, and pretending otherwise would undermine the rest of the page.

• No playback. You cannot show a partner what happened at 3am, or send a clip to a grandparent.
• No sleep history. No timelapse, no nightly report, no chart of wakings to bring to a clinician or a sleep consultant.
• No evidence. Parents occasionally want footage of a nursery or a carer. This will not give you that.

If any of those matter to you, buy a monitor that records. There are good ones, and the right choice depends on which risk you would rather carry.

Five questions to ask any monitor

Ask these of whatever you are considering, including this one. The answers are usually in the privacy policy rather than the marketing page.

1. Is video or audio written to disk anywhere outside my own devices, and for how long?
2. Can anyone at the company view a live stream or stored footage, and under what process?
3. If I delete my account, what happens to footage already stored, and when?
4. Where is audio analysed for cry detection, on the device or on a server?
5. If I stop paying, does anything already stored persist?

A monitor that answers question one with "nothing is stored" makes questions two, three and five much less interesting. What actually makes a baby monitor secure covers the rest of the checklist, including the parts that are your responsibility rather than the vendor's.

Where this fits

Everything above is one property of a monitor built from two iPhones. The setup, the features and the honest comparison against dedicated hardware are in the complete guide to iPhone baby monitor apps, and you can try the audio tier of MonitorUltra without paying for anything.

Frequently asked questions

Is the stream end-to-end encrypted? It is encrypted in transit. A relay handles the media between the two devices, so end-to-end in the sense a messaging app uses the term is not the right description.

Is anything stored on a server? No. There is no recording, no clip history and no footage held anywhere after a session ends.

Does the baby unit need an account? No. Pairing is a QR code shown on the baby unit and scanned by the parent unit. There is nothing to register on the nursery device.

Do both phones have to be on my home Wi-Fi for this to be private? No, and the network makes no difference to the storage question. The parent unit works over cellular, and nothing is recorded either way.

Where does cry detection happen? On the baby unit, using Apple's SoundAnalysis framework. Audio is not uploaded for analysis.