Babee Privacy Policy · Pilot version · 12 October 2026, revision 2
Part A: For parents
1. The short version
- Babee is a messaging app for children under 13; calls are planned for later. Only a parent or guardian can open a child's account, in the Parent Babee app, and the parent is the account holder.
- What a child sends is checked before it's delivered, mostly by automated tools. When a check isn't sure, the parent decides. Content that may be dangerous goes to a person at Babee, never to other parents.
- Messages are not end-to-end encrypted, because Babee has to check them. They're encrypted in transit and in storage. Connections between the apps and our servers pass through Cloudflare, a network security provider, which decrypts and re-encrypts them in transit and so can technically process them, including outside Israel (§7, §8).
- Your child's messages, photos and voice messages are stored and checked on Babee's own servers in Israel. They aren't sent to AI companies abroad, and we don't send them to any other company to check or store. Notifications are the exception: they show the sender and the start of a message and pass through Apple and Google (§7).
- We collect as little as we can. No location, no ads, no selling of data, no marketing profiles, no public profiles, no like counts.
- Who can join the pilot: only parents whose phone number is on the pilot list, which Babee prepares with the families it invites. An identity check through a partner (ID and a selfie) will be added before Babee opens to more families. This policy already explains it; it applies once it is added. Babee will never keep your ID images.
- You can see, export and delete your child's information at any time in Parent Babee.
Babee is in a pilot. The pilot apps run on Android phones (Google Play testing) and iPhones (Apple's TestFlight). They include text messages, built-in stickers, quick replies and reactions; voice messages in family chats and between children (with a classmate, a sibling, or a friend from outside the class whom both parents approved; in a class group chat only once it is switched on, up to 30 seconds); friends from outside the class, connected only when a parent of each child approves; and "is typing" and "here now" signs. They don't include photos or videos between children, calls of any kind, or custom stickers; photos in family chats come once they are added. Where this policy describes those, it applies once they're added, and we'll update it before adding anything it doesn't cover.
2. Who we are
Babee is run by Capitan Ltd. (קפיטן בע"מ), company no. 515184711, Israel. Capitan Ltd. is the controller of Babee's databases.
Privacy contact: during the pilot, questions and requests about privacy are handled by Yakir Sabag, Babee's founder, at [email protected].
3. Whose information this covers
| Who | Examples |
|---|---|
| You (parent or guardian) | Account, identity check, parenthood checks, settings |
| Your child | Profile, messages and voice messages (photos in family chats once added), connections with friends outside the class, call details once calls are added, safety information |
| Other children and family members your child talks to | Their messages in your child's chats |
| Community admins (for example a class-committee parent) | Name, contact, what they approved |
| A second guardian you invite | The same as for you |
4. What we collect, and why
| Information | Why we need it |
|---|---|
| Your name (a first name is enough), phone number, email and language | To open and run your account and send you notices. Your first name is shown to people you invite, to your child (the name or label you choose for them to see) and in notifications to you |
| Once the identity check is added (not in the pilot yet): your ID document and a selfie, processed only by our identity-verification partner (named in the app before you start the check) | To confirm that you're a real adult and that the ID is yours, so that only real parents can reach children. The partner compares your face with the ID photo once; this is biometric information. The images and the face check are done by the partner, on our behalf, inside the check you start from Parent Babee. They don't pass through or get stored on Babee's own servers, and Babee doesn't keep them. We receive only the result: verified adult, the name on the ID and a check reference |
| Your ID number, stored as a scrambled code | To match you with the signs of parenthood you choose, and to prevent duplicate accounts |
| Signs of parenthood: confirmation in person by your child's community admin, and, where needed, the signed registry extract you download from gov.il | To confirm you're your child's parent before your child joins a class. From the extract we check the government signature and whether your child is listed under you, and delete the file at once. We never keep information about other people listed on it |
| Consent records (what you agreed to, when, from which device) | To show that you gave consent |
| Your child's profile: first name, month and year of birth, how the Hebrew app should address them, an avatar | To run your child's account. No real photo is needed. If you use the registry extract, we also ask for your child's full date of birth, use it only for that check and don't keep it |
| What your child sends and receives: messages, photos, voice messages, stickers, reactions | To deliver them, and to check them before delivery |
| Call details, once calls are added (not in the first pilot version): who, when, how long. Never the content: calls are not recorded | To run calls, show you who your child called, and apply your call limits |
| Safety information: check results (not the content), reports, blocks, a safety score per account | To keep children safe and find accounts that bully or try to reach children |
| Device information: device model, app version, a notification token, a device key | To link devices, send notifications and keep accounts secure |
| "Is typing", "is recording" and "here now" signs | Shown only to people who are in that chat; "here now" only to your child's guardians and siblings, never to other adults. Never stored, logged or counted |
| Connections with friends outside the class: who invited whom, both parents' approvals, the date | To connect two children only when a parent of each approves. The other family sees your child's first name and a label; either parent can end the connection at any time |
| Unlocking Parent Babee: a yes/no signal from your phone's secure chip. We never receive your face or fingerprint | To make sure only you can approve things |
| Support messages | To help you |
| Usage statistics (our own, not shared): which features are used and how often, under a scrambled code instead of a name. No message content, no device IDs, no IP addresses. It's still information about your child (we can link the code back), so it's deleted with the account | To understand whether Babee works for children and to improve it |
| Pilot test versions: you install on an Android phone from a Google Play testing link, or on an iPhone through Apple's TestFlight (we don't send installation files); no email is needed. The Android test listing can be found in Google Play during the pilot, but only invited families can use the app. Google's and Apple's test programs show us device model, app version and crash reports, plus anything you send through their feedback button | To run the pilot and fix problems |
What we don't collect: your child's location (location data is removed from photos on the phone and again on our servers), contacts from the phone's address book, browsing, advertising IDs, or a real photo of your child for the profile.
Do you have to give this information? No law requires you to. But Babee can't work without the information it needs for the account, the checks and message checking. In the pilot you can't open an account unless your phone number is on the pilot list (and, once it is added, without the identity check). Until parenthood is confirmed, your child can chat with family only.
5. How checking works
- Before anything is delivered, Babee's systems check it: hidden data is removed from photos; images may be compared against digital fingerprints of known child-abuse images, on our own servers; photos are scanned for unsafe content and text in them is read; voice messages are turned into text (the check reads the words, not the tone or other sounds); then an automated model decides.
- Word lists stop swearing and insults instantly. Words about who someone is (for example "gay" or "my two moms") are never blocked; only insulting use is stopped.
- If the check is sure it's fine, it's delivered. If it's sure it isn't, your child gets a friendly explanation. If it isn't sure and it's a judgment call, you decide in Parent Babee. If it may be dangerous (sexual content, abuse, grooming, self-harm), it's blocked and held for review by a person at Babee, who looks at the most serious cases first. To understand a serious case, that person may also read the recent messages around it in the same chat, from everyone in that chat. This is logged, limited to that chat and that case, and never used for anything else. If an item isn't reviewed within 7 days, it is deleted and never delivered. The most serious items (possible abuse, self-harm, a child who may be at risk) never go to parents. In chats between children, some borderline messages and voice messages may go to the sending child's own parent as well as to a person at Babee, and whoever looks first decides; the parent hears or reads only their own child's message. If a person at Babee, after looking at a case, believes your child may be at risk of hurting themself, they may send you a short message in Parent Babee, without showing your child's message, unless telling you could put your child at risk. We may also report to 105. In family chats, where a parent is part of the conversation, photos the check isn't sure about go to a person at Babee instead, shown to that person blurred and in grayscale. Messages between a parent or another family adult and your child get a lighter check: only for the most serious content (the same danger check). Swearing and insults aren't stopped there, and nothing goes to another parent for review. If a message there may be dangerous, it is held for a person at Babee and not delivered, and the sender is told only that it needs a look first.
- When you review, other children's faces are blurred, and screenshots and downloads are blocked or blurred.
- Checking the checker: to measure how often the system wrongly stops ordinary messages, a person at Babee may look at a small random sample of stopped, non-dangerous messages, shown without names or the rest of the chat, within the 7 days before they're deleted. We keep only the label ("correctly stopped" or "shouldn't have been stopped").
- If you think a decision was wrong: for items sent to you for review, you decide. For some other stopped messages (ones the system judged low or medium risk), your child can ask you to take a look and you may release them. Messages stopped by the word lists, high-risk items and dangerous items can't be released by parents. You can also write to [email protected]. A named member of the Babee team reads it, confirms receipt within 2 business days and aims to answer within 7 days. By default we look only at the decision record (category, time, model version). We look at the message itself only if you ask us to, only that message, only if it isn't a dangerous item, and the access is logged. While your complaint is open, that message is kept for up to 30 days instead of being deleted on day 7.
- Reports to the authorities: if we suspect a child is in danger, or a crime involving a child, we may keep the content in restricted storage and report it to the Israel Police or the national child online protection unit (105), as the law allows or requires. We may not be able to tell you first.
6. Who can see what
| Your child | You | Other children | Other parents | Babee staff | |
|---|---|---|---|---|---|
| Your child's delivered messages | ✔ | ✔ in chats with you and family; ✔ items sent to you for review | ✔ only messages sent to them | ✘ | Only when needed: a report, a safety case, support you ask for, or the accuracy sample (§5.5) |
| Items waiting for review | ✔ (their own) | ✔ | ✘ | ✘ | A person at Babee, for dangerous items, and for photos in family chats the check isn't sure about (blurred, grayscale) |
| Who your child talks to, call history | ✔ | ✔ | ✘ | ✘ | Safety cases |
| Reactions | Only the person who wrote the message sees who reacted |
Babee staff access is limited by role and logged.
7. Who we share information with
- Our identity-verification partner, once the identity check is added, which will process your ID images and selfie for us only to do the check, and will be named in the app before the check starts.
- Our SMS provider, MultiSend (Israel), which receives your phone number to send you sign-in codes. The texts contain only the code, never anything about your child.
- Cloudflare, our network and security provider. Connections between the apps and our servers (including messages, photos and voice messages) pass through its network, where they are decrypted and re-encrypted so that attacks can be filtered out. Cloudflare doesn't store this content for its own use, but it can technically process it in transit, in data centres that may be outside Israel. It also runs our website's address (DNS), delivers the public web pages and forwards emails sent to [email protected], and processes technical data such as IP addresses.
- Google (Google Workspace), which hosts the mailbox where emails to [email protected] arrive. If you write to us, your email is stored there, including outside Israel. Please don't send your child's messages or photos by email.
- Apple and Google, which deliver notifications. A notification about a delivered message shows the sender's first name and the start of the message (up to 60 characters; for a voice message or sticker only a label), so that text passes through Apple's and Google's notification services, which may keep an undelivered notification for a while. Notifications about items waiting for review, blocks or safety never contain content. You can turn previews off for your phone and for each child's phone in Parent Babee, and the phone's own lock-screen setting is respected. Apple and Google also run the pilot test programs (§4).
- Other users, as part of the service: your child's delivered messages go to the people they're sent to; community admins see who asked to join.
- Authorities, when the law requires or allows it, especially to protect a child (§5.7).
- If Babee is sold or merged, the buyer must keep these promises, and you'll be told first.
- We never sell information, share it for advertising, or let anyone build marketing profiles of children.
Hosting, message checking, image checking, reading text in images, voice-to-text and call servers all run on Babee's own servers in Israel. If we match images against lists of known child-abuse images, the lists come to us and the matching happens on our servers: images don't leave Israel.
8. Information outside Israel
Your child's messages, photos and voice messages are stored and checked in Israel, and we don't send them to any company abroad to check or store. Connections to Babee, however, pass through Cloudflare (§7), which can process them in transit, including in data centres outside Israel, only to deliver and protect them. Outside Israel we also use: Apple and Google for notifications (which show the sender and the start of a message, §7) and for the pilot test programs; and Google Workspace for the support mailbox (§7). If this changes how your child's content is handled, we'll tell you first and ask for your consent again. Any transfer abroad follows the Privacy Protection (Transfer of Data to Databases Abroad) Regulations 2001, with a written undertaking from each provider.
9. How long we keep information
| Information | How long |
|---|---|
| ID images and selfie (once the identity check is added) | Never kept by Babee |
| Result of the ID check, consent records | While the account is open, and 7 years after, to show consent was given |
| Signed registry extract | Deleted immediately after the check |
| Messages and media waiting for a check | Until the decision; items waiting for a parent expire after 24 hours; family photos waiting for a person at Babee expire after 7 days and are deleted |
| Delivered messages and media | While your child's account is open. You can delete them at any time |
| Stopped messages (not dangerous) | 7 days, then deleted; we keep only the decision record (no content) |
| Voice transcripts and text read from images | Not kept after the check |
| Call content | Never recorded |
| Call details (who, when, how long), once calls are added | 12 months |
| Check decisions, reports | 24 months (no content) |
| Evidence of a suspected crime against a child | Only as long as the police need it, and no more than 12 months unless the law requires longer |
| A copy of a message you or your child reported, if we decide not to pass it on | Deleted 30 days after we close the report (a report nobody looks at closes after 30 days, so at most 60 days from the report). Kept longer only if the police or a court require it. We keep a record of the decision, without the message, for 24 months |
| Usage statistics | Raw events 90 days; per-child daily counts (still linked to a code) up to 13 months; anonymous group totals (at least 5 children) 24 months |
| Application logs | 30 days, with no children's content |
| Backups | 35 days, encrypted |
| Copy of recent messages on the phone | Up to 200 per chat and 30 days; deleted at sign-out, when the phone is removed, at account closure, or 14 days without a connection |
| After you delete an account | Removed within 30 days, and from backups when they expire. Messages, photos and voice messages your child sent are also removed from other people's chats (they show as "message removed"); other people's own messages stay. Exceptions: items under a legal hold, in our safety evidence storage, or that were reported are kept there under the rules above, and are removed from other people's view |
10. Security
Encryption in transit (TLS 1.3, between your phone and Cloudflare, and between Cloudflare and our servers) and at rest; information kept in Israel; separate, restricted storage for content waiting for a check and for evidence; staff access by role; every access to evidence logged; security testing. We follow the Privacy Protection (Data Security) Regulations 2017. Messages aren't end-to-end encrypted, because Babee must check them. If a serious security incident happens, we'll report it to the Privacy Protection Authority and, where required, tell you.
To make the apps open quickly, recent delivered messages (up to the last 200 per chat, no older than 30 days) are also kept on the phone, in an encrypted database whose key is held by the phone's secure hardware. Messages waiting for a check or for review, voice recordings and photos are not kept there. The copy is deleted when you sign out, when a child's phone is removed, when the account is closed, and when the phone has not connected to Babee for 14 days. If a phone is lost, remove the child's phone in Parent Babee (Kids → Set up your child's phone → Remove) or write to [email protected] (for your own); the copy is deleted the next time the phone connects. A phone that is never switched on again keeps an encrypted copy until the app is opened or removed. Anyone who has the phone unlocked can see what the app shows, as with any messaging app.
11. Your rights
- See the information about you and your child, and export it from Parent Babee, or ask us (Privacy Protection Law, section 13).
- Correct it if it's wrong (section 14).
- Delete your child's messages, your child's account or your whole account, at any time.
- Withdraw consent in Parent Babee → Settings → Privacy & consent. We'll explain what changes.
- Complain about a decision on your child's content (§5.6).
- Opt out of marketing emails at any time (we send them only if you opted in).
- Complain to us ([email protected]) or to the Privacy Protection Authority (הרשות להגנת הפרטיות) at gov.il.
A second guardian has the same rights for the children you share with them. Your child can ask you, or us, to explain what we hold about them.
12. Our promises about children's privacy
No location. No ads. No selling. No public profile. No follower or like counts. No streaks, no endless feeds, no night-time notifications (other than calls within the hours you set). No strangers: only people in communities you approved, and friends from outside the class whom both parents approved. No real photo needed. The children's app tells your child, in simple words, that messages are checked and that you can see some things.
13. Changes
We'll tell you in Parent Babee and by email at least 30 days before a material change. If a change brings new kinds of features for children, or new partners or countries processing children's information, we'll ask for your consent again.
14. Contact
Capitan Ltd. (קפיטן בע"מ), company no. 515184711 · [email protected]
---
Part B: Babee and your information (for kids)
🐝 Babee keeps you safe, and keeps your things private. 1. Your grown-up set up Babee for you. Mom, Dad or your guardian made your account and chose who you can talk to. 2. Babee checks messages before they go. A computer looks at your messages to make sure they're kind and safe. It's super fast. 3. Sometimes your grown-up takes a quick look. If the computer isn't sure, it asks your parent or guardian. They see only that message, not everything. Sometimes a message waits for a person at Babee to look at it before it can go out. 4. What your parent or guardian can see: who you talk to, who you called and for how long, and messages they're asked to check. 5. What nobody else can see: messages that weren't sent. Nobody is told "a message was stopped". 6. Babee never shows where you are, never shows ads, and never sells anything about you. 7. Calls aren't recorded. Nobody listens to your calls. 8. If something feels wrong, open Talk to someone in Me, or use Block or Tell Babee. If someone might be in danger, a person from Babee helps, and sometimes tells your grown-up or the police, to protect kids. To understand what happened, that person may read the messages around it in that chat. 9. You can ask your grown-up to show you or delete your information. 10. Babee keeps your newest messages on your phone, locked, so the app opens fast. If you lose your phone, tell your grown-up.