How Dobbin treats your family's data

The short version

Dobbin handles private family‑care records without advertising, third-party analytics, tracking SDKs or paid AI services. The app does not sell data or use it for advertising.

What the app handles, and why

Apple‑derived account identifiers, device sessions, household membership, caregiver and child profiles, and the records you log: feeding, sleep, pumping, diapers, routines, milestones, growth, health observations, notes and photos you choose to attach. These are used for signing in, household access, history, trends, exports and native Watch and widget features.

Push‑notification tokens associate notifications with your signed‑in device. Background notifications carry a refresh hint. Live Activity updates contain the timer's display state so the lock screen can update while the app is suspended.

Where it is stored

Authoritative records are stored in per‑household databases on Cloudflare's infrastructure, and photo bytes in Cloudflare object storage. Requests use HTTPS and require household membership. This is server‑side storage, not an end‑to‑end encryption claim. Devices keep a protected, household‑scoped cache so history remains readable offline.

Sign in and sessions

Sign in with Apple establishes your identity; the server verifies Apple's credential and stores hashes of device session tokens, never the tokens themselves. Tokens live in the Keychain on each Apple device. The Watch receives its own session from the signed‑in phone and then talks to the server directly.

Who can see it

Only members of your household. Owners control invitations and membership; participants can leave. Removing access blocks future reads and writes. A disconnected device may keep a cache until it reconnects or is cleared. Signing out on your device does not erase another parent's household.

Exports and deletion

You can export CSV, PDF or a full backup at any time to a destination you choose; exported copies are outside the app's retention controls. Deleting an individual record keeps a small tombstone so retries can never resurrect it. Deleting a household is owner‑only and removes its operational records and photos. Provider backups may retain prior data for their configured retention period.

Medical use

The app records caregiver observations. It does not diagnose, prescribe or make clinical claims.

Contact

A support contact will be published here before public release.