Timmy does not need to know when your child sleeps

Most baby cameras sell you a night you can leave. They want an account, a clip in the cloud, and a dashboard of sleep scores. Babyphone Timmy sells a smaller promise. Two phones you already own. Audio first. Video only when you ask. And a two-digit number you have to look at.

Timmy does not need to know when your child sleeps.

— babyphone-timmy.ch

That line is not decoration. It is the product. The app creates no account, serves no ads, and ships no tracking SDKs. Temporary signalling data is encrypted, then deleted after the two devices have found each other. There are no persistent cloud recordings of the nursery. The marketing page says so. The public security core is more interesting than the marketing page.

One developer, two phones, a city that likes quiet tools

Timmy is built independently in Zürich by Tim Kaltenbrunner. Not a baby-tech roll-up. Not a hardware brand with a companion app. A Flutter app that turns an old Android or iPhone into the nursery unit and keeps yours as the parent unit. EuroMakers listed it this week under Security, which is the right neighbourhood: encrypted messaging is the job, even if the payload is a night instead of a chat.

The site is blunt about scale. "Timmy is not an anonymous data platform. It is a small tool for families." Being reviewable is treated as part of the product. The security-relevant backend, pairing, and signalling primitives live in a public GitHub repository, baby-monitor-timmy-core, under Apache 2.0. The screens, the navigation, and the rest of the app stay private. That split is honest. You can inspect how trust is built. You cannot pretend this is a full self-hosting kit.

The short code is not the secret

Here is the claim a directory card cannot give you. The four-character pairing code — typed or scanned — is only a meeting point. It is not the encryption key.

The short code is only a rendezvous hint. The actual long-term pairing key is derived from the ECDH shared secret and never sent to Firebase.

— baby-monitor-timmy-core architecture notes

Each device publishes an ECDH P-256 public key. Both derive the same pairing key locally. That key never goes to the backend. What you compare on screen is a Short Authentication String: SHA-256 of the shared secret, reduced to two digits. If someone sits in the middle of the meeting point and swaps keys, the digits should not match.

Two digits are a parent-in-the-dark compromise, not Signal's long safety numbers. Timmy's own security notes put the collision chance at about one in a hundred per attempt. Compare them anyway. If the number feels too convenient, pair again. The point of the ritual is that you are in it.

After pairing, WebRTC offer, answer, and ICE candidates are encrypted with AES-256-GCM before they are written to Firestore. Media then travels end-to-end with DTLS and SRTP. Push-to-talk and camera-control messages ride the same encrypted data channel. The nursery audio does not sit on a server waiting for you to replay it.

What a night with it actually looks like

You hear first. Live video is optional, at a modest 320×240 when it is on. Noise detection pokes the parent phone when the baby makes sounds. If the network hops, the session tries to come back. If no signal arrives for more than fifteen seconds, the parent side is warned. White noise, added as a bedtime aid, plays locally on the baby device. You can still change volume and timer from the parent phone. There is no sleep promise attached. The site says keep it quiet, leave space to the crib, and use a timer.

iphone-ticker.de noticed the mixed-platform bet. Apps such as LIL1 keep the link on the local network and stay inside Apple's garden. Timmy will pair Android with iPhone, and a browser can join as parent or baby through the premium app. The cost of that reach is the internet path. You should want that trade, not discover it at 2 a.m.

The web companion has no subscription of its own. The phone remains the gatekeeper. Keep the browser tab in the foreground. Battery saving still belongs to the mobile app. After a 30-day trial, Premium is CHF 1 or EUR 1 a month, or a one-time purchase the store shows before you buy — iphone-ticker.de recorded €4.95. One purchase covers both paired phones.

Who should not buy it

Buy a dedicated camera if you need infrared night vision, a battery that is not a phone, or a monitor that keeps working when the fibre is down. Timmy is a technical aid, not a medical device. It will not score sleep, count breaths, or replace being in earshot.

• You only have one spare phone. The product is a pair.
• You want local-only audio with no cloud meeting point at all.
• You want to self-host the whole stack. The public repo is the security core, not a distribution.
• You will skip the two-digit check. Then you bought a ritual you refuse to perform.
• You need several adults watching one crib at once. Timmy is built as two devices that belong together.

Parents who do have two compatible phones, will look at the digits, and are tired of nursery footage living on someone else's disk — that is the buyer. The listing will not make that decision for you. The two digits will.

New to the EuroMakers Journal? Start with how the Journal works.