The short version
- Dotdown stores your family's own data so that every phone in the family sees the same thing. That is the whole purpose of the app.
- There is no advertising, no profiling and no tracking across other apps or websites, and nothing is sold, rented or shared with anyone outside the companies that host the service. The one thing that leaves your family's own data is a crash report, so faults can be found and fixed; it carries no names, messages, photos or location. It is described below.
- To decide what to improve, Dotdown counts how often each part of the app is opened, per family and per day. The count names no person and holds nothing your family wrote. It is described below.
- Location sharing is off until you turn it on, and each phone has its own switch.
- You can delete your account from inside the app at any time.
What Dotdown collects
| What | When | Why |
|---|---|---|
| Your name and email address | When you sign in with Google, or when a parent creates a username login for a child | To know who you are and which family you belong to |
| Your family's calendar: events, and calendars you subscribe to such as a school feed | As you add them, or as the app fetches a feed you subscribed to | It is the calendar |
| Chores, points, lists, recipes, meal plans, special days, workout reminders and pets | As your family adds them | The rest of the app |
| Health records: allergies, medications, conditions, doctor and insurance details | Only if a parent fills them in | So the family has them when needed. A parent chooses who can see them. |
| Profile photos | Only if you add one | To show who is who |
| Your phone's location | Only while "Share my location" is on for that phone, and when you press the panic button | To show your family where you are on the shared map, and where to find you in an emergency. See below. |
| Your phone's battery level | Only during an emergency you started with the panic button | So the family knows how long your phone may last. See "Panic button" below. |
| A push notification token | When you open the app with notifications allowed | So another family phone can reach yours: a place alert, or a request for a fresh location |
| Places the family names, and arrivals and departures at them | Only if a parent sets places up, and only from phones that share their location | To tell the people a place names that someone arrived or left. See below. |
| How often each part of the app was opened (the calendar, chores, a widget, and so on), per family and per day, and whether by a parent's or a child's account | As the app is used; sent once a day or so | To learn which parts families use, so the right things get improved and the plans fit. See below. |
| A record of each purchase: the plan, when the current period ends, whether it renews, Google's order number and country, and which account bought it | When a parent buys a plan | To give the whole family its plan, and to show who bought it. See below. |
Health information
A family can record allergies, conditions, a blood type, a doctor and a dentist, insurance details, and the medicines somebody takes with the times they are taken. This can be recorded for anybody in the family, children included, and it is stored the way the rest of the family's data is: on the phone it was entered on, and in your family's own account on the database, so that the other phones in the family can show it.
Who can see and change it is decided by a parent, one family member at a time. Somebody a parent has given no permission sees nothing at all, including their own; a parent can allow a person their own records, or somebody else's. That rule is enforced by the database itself and not only by the app, so a phone is never sent a record it is not allowed to show.
Reminders to take a medicine are set by the phone itself at the times the family chose. Those times are part of the family's data and are not sent anywhere else.
None of it is a medical record, none of it is shared outside your family, and none of it is used for anything but showing it to the people a parent has allowed. It goes when the account or the family goes, as everything else does.
Location
Location sharing is off until the person holding the phone turns it on, under Location in the app, and can be turned off there at any time. A parent chooses, for the whole family, how phones report:
- When the app is open: a position is recorded when Dotdown is opened or brought to the front.
- Every so often: a position is recorded on a schedule, about every 15 to 60 minutes, even when Dotdown is closed or not in use.
The background option needs Android's "Allow all the time" permission, which the app explains and asks for on screen before Android does. Each phone's positions are kept for seven days and then removed, so the family can see where a phone has been that week; the phone's latest position is kept for as long as sharing is on. A parent can also name places, such as Home or School, with a circle around each; a sharing phone that enters or leaves a circle records that and notifies the family members the place names. Who can see whom, including places and history, is set by a parent, per family member. Location is never used for advertising and never leaves the services listed below.
Panic button
When somebody presses the panic button and its five-second countdown is not cancelled, their phone sends its position at that moment to the family members chosen for them, whether or not location sharing is on: a person asking for help needs to be found. On Premium with Location the phone keeps sending its position, with its battery level, until the person says they are safe or somebody alerted marks it resolved; a notification on the person's phone shows the whole time that it is sharing. Only the person and the family members alerted can see it.
It is kept only as long as it is needed: the positions are deleted an hour after the emergency ends, and the record that it happened (who, when and who ended it, with no location) a day after it ends.
On Android, Dotdown may also ask for activity recognition. That tells the app only whether the phone is still, walking or in a vehicle, so a departure can be reported sooner and a stop named. It is never stored and never shared; it only decides when to take a position.
Children
Dotdown is for families, and children use it. A child's login is created and controlled by a parent, who sets what the child can see and do, can change or remove the child's account, and can delete the family's data altogether. Dotdown does not show advertising, does not profile children, and collects nothing from a child beyond what the family itself enters into the app, and the count of which parts of the app were opened, in which a child's account is counted only as "a child" and never by name.
Google account data
If you connect a Google Calendar, Dotdown asks Google for two read-only permissions: to see the list of your calendars, so you can choose which to show, and to read the events in the calendars you choose. It uses them only to show those events inside the app. It never adds, changes or deletes anything in your Google account.
- Your Google events stay on your phone. They are read from Google by the phone that connected the calendar and kept in the app's private storage on that phone, which other apps cannot read. They are not sent to Dotdown's database, so they are not in its backups, and they are not put in crash reports or diagnostics. Nobody at Megalight Games can see them, because they never reach us.
- What is kept with your family's data: the name, colour and Google identifier of each calendar you chose to show, so the app knows which calendars to read and whose they are. For your main calendar, Google's identifier is your email address. If you recolour, rename or hide one of your Google events in Dotdown, that choice is kept with the family's data under the event's Google identifier, as it is for any calendar; the event itself is not. Other phones in your family can see that the calendar exists, by its name, but not its events.
- Access to Google is held by Google's own sign-in on the phone. Dotdown never sees your Google password. The short-lived access key Google issues is kept only in the phone's memory while the app is running and is never sent to Dotdown's servers or to anyone else. The address of the connected Google account is kept in the phone's encrypted secure storage (the Android Keystore).
- No other use. Data from Google is not sold, not used for advertising, not shared with anyone, and not used to train any artificial intelligence or machine learning model.
- Taking it back. In the app, More, Calendars, Add a calendar, Google, "Disconnect this Google account" withdraws Dotdown's access at Google itself. Removing a Google calendar from the Calendars list removes its events from the phone. You can also withdraw access from your Google account at myaccount.google.com/permissions.
Dotdown's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Where the data is, and who else touches it
Dotdown has no servers of its own. It uses these companies as service providers, each only for the purpose named:
- Supabase stores the family's data, photos and backups, and handles sign-in. Access is restricted per family by rules enforced in the database itself.
- Google provides sign-in, read-only calendar access when you connect one, the map on Android, Firebase Cloud Messaging for the silent "where are you now" request between family phones, and the names of nearby places (Places API) for meal polls and for naming where a phone has stopped. A place lookup sends a position and a radius, never who asked. And Google Play, which takes payment for plans and tells Dotdown when one renews, changes or ends.
- Expo delivers app updates and relays push notifications.
- Sentry receives crash reports, and the diagnostic lines a phone sends with a problem report, from every phone in the family including children's. These carry the model of phone, the app version and what the app was doing -- never names, messages, photos or location trails.
- TheMealDB answers recipe searches. Only the words you search for are sent.
- Cloudflare keeps a weekly copy of the whole service's data, so it survives even if something happened to Supabase. The copy is encrypted before it leaves, with a key only Megalight Games holds, so Cloudflare cannot read it. Cloudflare also receives email sent to a family's Dotdown address, and passes it straight on.
- Anthropic reads email forwarded to a family's Dotdown address, when a parent has turned that on, and photos taken with the scanner on a paid plan, to find the dates in them. It is sent the email's text and the PDFs and pictures attached to it, or the photo, and nothing else about the family. Nothing it is sent is kept by Dotdown, and Anthropic is not permitted to train its models on it.
Data travels between your phone and these services over encrypted connections. None of them is permitted to use your family's data for their own purposes, and none receives it for advertising.
How your data is protected
- In transit: everything the app sends or receives goes over encrypted (TLS) connections.
- At rest: Supabase encrypts the database, photos and backups on its disks. The weekly off-site copy with Cloudflare is encrypted before it leaves Supabase, with a key only Megalight Games holds.
- Per family: every row of data belongs to one family, and rules in the database itself -- not only in the app -- decide who may read or change it. A phone signed into one family cannot read another family's data, and within a family a parent's choices about who sees what (health records, locations, calendars) are enforced the same way.
- Who at Megalight Games can see it: direct access to the database is limited to Megalight Games, through Supabase's own access controls, and is used only to keep the service running, fix faults you report, or as the law requires. Google Calendar events are not in the database at all (see above).
- On the phone: the family's data is kept in the app's private storage, which other apps cannot read, and is cleared when the phone signs out. Sign-in keys are kept in the phone's encrypted secure storage.
- Nothing sensitive by default: location sharing and calendar connections are each off until somebody turns them on, and can be turned off again; health records exist only if a parent fills them in.
Purchases
Plans are bought through Google Play, which takes the payment. Dotdown never sees card details, a billing address, or anything else about how you paid.
When a parent buys a plan, Dotdown keeps a record of the purchase so that the whole family gets it: which plan it is, when the current period ends, whether it renews, Google's order number and the country it was bought in, and which Dotdown account bought it. Google Play tells Dotdown when a subscription renews, changes, is cancelled or is refunded, and the record is updated to match. The record is used only to give the family its plan and to show the family who bought it. It is kept for as long as the family exists, and deleted with it.
If you are in more than one family
Someone can belong to more than one family in Dotdown -- two households, say. An event assigned only to you, and a school, team or Google calendar subscribed just for you, then appears in each family you belong to, where the people allowed to see your calendar there can see it. Events shared with anyone else stay in their own family. You can switch this off in Calendars, "Show my own events in all my families", and your events are withdrawn from your other families.
How the app is used
Dotdown counts how many times each part of the app is opened: the calendar, lists, chores, workouts, a widget tapped, a settings page. The phone adds the counts up through the day and sends the totals. Each total is kept against the family, the day, the part of the app, and whether the account that opened it is a parent's or a child's. It holds no names, nothing anyone wrote, no times of day and no location, and it is not linked to any one person.
Alongside it, the service keeps a count of how much work each family's data takes to store and send -- how many times its phones sync, how many rows and bytes it writes in a day, how much space its photos and backups take -- so we can see what the service costs to run and keep it affordable.
Both counts are stored with Supabase, read only by Megalight Games, never shared, and deleted after thirteen months.
Email forwarded to Dotdown
A parent on a paid plan can turn on an email address for the family, and forward emails to it -- a school newsletter, say. Each email is read by an AI service (Anthropic, above) to find the dates in it, and the email is then deleted. What is kept is the email's subject, the name of who sent it, and the dates that were found, so that a parent can add them to the calendar or dismiss them. Nothing is added to the calendar until a parent does. Only parents, and adults a parent has allowed to add events for the whole family, can see these; children cannot. A parent can turn the address off, or replace it with a new one, at any time.
School emails often name other children and families. Those names may appear in the subject or in the sentence a date came from, and are kept only as long as the dates are (see below).
The scanner
The scanner turns a photo of an appointment card or a school letter into events for you to check. On the free plan the photo is read on your phone and goes nowhere. On a paid plan, while “Read with AI” is on (it is, until you turn it off in the scanner), it is shrunk on your phone and sent to an AI service (Anthropic, above) to find the dates, which can read handwriting and tables; the photo is not kept by Dotdown or by Anthropic's service beyond reading it. With “Read with AI” off, or without a connection, the phone reads it as on the free plan and it goes nowhere. Nothing is added to the calendar until you add it.
The iPhone waitlist
If you leave your email address in the iPhone box on dotdown.megalightgames.com, we keep that address and the time you left it, and nothing else. It is used for one email, when Dotdown is available on iPhone, and then deleted. It is stored with Supabase, is not shared with anyone, and is not connected to any Dotdown account. To have it removed sooner, write to contact@megalightgames.com.
How long it is kept
Your family's data is kept for as long as your family uses the app. The service takes a backup of each family every night, keeps a week of them and one a week for a month after that, so a deleted item can persist in a backup for up to five weeks after deletion. The weekly encrypted copy kept with Cloudflare follows the same limit: five copies, the oldest removed as each new one is made. A family's own phones also keep a local copy of the family's data, which is cleared when that phone signs out. The counts of how the app is used, and of what each family's data costs to run, are kept for thirteen months. Diagnostic lines a phone sends with a problem report are kept for fourteen days. A forwarded email is deleted as soon as it has been read; the dates found in it are kept for fourteen days after a parent adds or dismisses them, or thirty days if nobody does.
Deleting your account or your family
- Your account: in the app, More, Settings, Account and sync, "Delete my account". This removes your sign-in, your place in the family, your photo, your location and your health record immediately. Chores and events you took part in stay with the family, as its record. If you are the family's only parent, the whole family is deleted with your account.
- The whole family: a parent can delete the family and everything in it from the same screen.
- Without the app: see how to request deletion.
Your choices
- Location sharing, notifications and the connection to Google Calendar are each optional and can be switched off in the app or in your phone's settings.
- If you are in more than one family, whether your own events appear in each of them is yours to switch off, in Calendars.
- A parent can save a complete copy of the family's data as a file at any time, from Settings, Data.
Changes
If this policy changes, the date at the top changes with it, and the app will say so.
Contact
Questions about privacy go to contact@megalightgames.com.
Megalight Games, Colorado, United States.