Privacy Policy

Effective date: 22 August 2026

Overview

DobbyLight is a family organiser that helps families manage calendars, chores, tasks, meal plans, growth milestones and medication or feeding records. Your data belongs to you and stays in your own Google account.

Information we collect

• Basic Google profile information (name and email address) when you sign in.
• Family member names and optional photos that you add to the app.
• Calendar and task data you choose to display from your Google account.
• Chores, rewards, meal plans, growth entries and medication or feeding logs you create within the app.

How we use information

We use the information to show and manage your family's schedule and tasks. We do not sell, rent or share personal information with third parties for marketing purposes.

Where your data is stored

Your family data is stored in your own Google account:

• Calendar events and task lists are read from and written to your Google Calendar and Google Tasks.
• Family members, chores, rewards, meal plans, growth entries and medication or feeding logs are stored as an event log inside your Google Drive appDataFolder, which only this app can access.
• Member photos are stored as files created by the app in your Google Drive.

DobbyLight also keeps a minimal Cloudflare D1 database record for each user account. This record contains your Google subject identifier, an access tier and a security-revocation timestamp. It does not contain your name, email address, photo, family data, calendar events, tasks, chores or photos.

Health-related records. Growth, medication and feeding records you choose to log are treated exactly like the rest of your family data: they live in your Google Drive appDataFolder, are never stored on our server, and are used only to display them back to you — never for advertising, profiling or any secondary purpose.

Data protection and security

We protect your sensitive data using the following measures:

• End-to-end access control: All sensitive family data is stored within your own Google account (Google Calendar, Google Tasks, Google Drive appDataFolder and Google Photos) and is accessible only to users who have signed in and authorised the app. The only data DobbyLight stores on its server is a minimal account record used for sign-in, access control and security events.
• Encryption in transit: All communication between the app, Google APIs and our server is encrypted with TLS/HTTPS.
• Encryption at rest: Data stored by Google in your account is protected by Google's own encryption and access controls. Our server does not persist Google data on disk.
• Minimal data collection: We collect only the information required to provide the service and do not process sensitive data for any secondary purpose such as advertising, profiling or sale to third parties.
• Revocation: You can revoke DobbyLight's access to your Google account at any time from your Google Account settings, which immediately stops the app from accessing your data.

Google OAuth

We use Google's OAuth service to authenticate you and access the Google APIs you authorise. Your Google refresh token is encrypted and stored in an HttpOnly session cookie in your browser; our server (a Cloudflare Worker) uses it only to issue short-lived access tokens on your behalf and does not permanently store it in any database.

Cross-Account Protection (RISC)

DobbyLight participates in Google's Cross-Account Protection (RISC) programme. Google may send us signed security-event notifications about your Google account, such as when your account is disabled, deleted or compromised. We use these notifications only to protect your account and revoke access if necessary. They are not used for advertising, profiling or any other purpose.

AskDobby (AI assistant)

If you use AskDobby, the text (and any photo) you submit is sent, via our server, to Google's Gemini API to generate a response. We do not store these requests ourselves; they are processed according to Google's applicable terms for the Gemini API.

Limited Use compliance: The use of raw or derived user data received from Google Workspace APIs (including Google Calendar, Google Tasks and Google Drive) and Google Photos will adhere to the Google User Data Policy, including the Limited Use requirements. DobbyLight does not use, transfer or sell any Google user data to create, train or improve any generalized or foundational artificial intelligence or machine learning models.

Children's privacy

DobbyLight is intended for family use, including use by children under parental supervision. We do not knowingly collect personal data from children under 13 without parental consent. If you believe a child has provided personal information without consent, please contact us.

Data retention and deletion

Because data is stored in your Google account, you can delete it at any time by removing the app's data from Google Drive, revoking access from your Google account, or deleting the files created by the app. See DobbyLight account and data deletion for steps to delete individual data or request deletion of your DobbyLight access record.

Changes to this policy

We may update this Privacy Policy. Any changes will be posted on this page with an updated effective date.

Contact us

If you have any questions, email developerdobbylight@gmail.com.