Pairing
ECDH pairing, key derivation, and the short verification number make tampering visible.
Security Core
The open code behind Timmy
Pairing, signaling, and backend boundaries live in a separate public core. That makes the part responsible for security and privacy open to inspection.
Quick answers
Baby Monitor Timmy at a glance
Five plain answers about the product behind the open security core.
What is Baby Monitor Timmy?
- Timmy is an app that turns two Android or iOS smartphones into a baby monitor with audio and optional live video.
How does Timmy work?
- One phone stays near your baby and the other stays with you. The devices pair with a short code and send media encrypted over WebRTC.
What data does Timmy create?
- Timmy needs no account and uses no tracking or ads. It creates no cloud recordings; temporary encrypted connection data is deleted after the connection is established.
What does Timmy cost?
- You can try Timmy free for 30 days. Afterwards, choose monthly Premium or a one-time purchase; your app store shows the local price before you buy.
Who is Timmy for?
- Timmy suits parents and caregivers who have two compatible phones and want a simple baby monitor without an account, tracking, or separate hardware.
What is public?
Three areas you can inspect
The app interface stays separate. The logic that has to earn your trust is open.
Signaling
Clear contracts show which encrypted data moves between the app, Firestore, and a session.
Backend boundaries
Rules, data models, and automatic cleanup show what the server is allowed to do – and what it is not.
A secure connection
From a short code to an encrypted conversation
The four-character code is only a meeting point. The real security is created afterwards on both devices.
- The devices meetThe short code brings both devices to the same encrypted exchange.
- Keys are createdBoth devices create a shared secret without ever sending it to the server.
- You compare a numberThe same two-digit number on both devices protects against unnoticed tampering.
- Media stays protectedAudio and video travel encrypted over WebRTC; signaling data is cleaned up afterwards.
For developers
Review the repository and architecture
The core keeps the security-critical packages, backend contracts, and architecture documentation in one place.
Open the repository →For parents
What does this mean day to day?
The guides turn the same decisions into clear questions about pairing, privacy, and permissions.