Privacy Policy

Local records, optional encrypted sharing

The short version

By default, your records stay in your browser, on your device, and no server of ours receives them. If you create a caregiver link, an encrypted copy passes through our relay — encrypted on your phone before it leaves, with a key that never reaches us. We can't read it, we can't decrypt it, and we couldn't hand over its contents if someone asked, because we never receive the key.

What we collect

Through the app: nothing. No account, no login, no email, no analytics, no advertising trackers, no third-party pixels, no fingerprinting, no behavioural profiling. We do not sell or share personal information, and we have no data to sell.

Everything you type — your child's nickname and birthday, feedings, diapers, sleep, medicines, supplies, routine, handoff notes, and check-ins — is written to your browser's local storage and stays there.

What our host can see

The app is served as static files by a web host. Like every web host, it processes standard technical request data (IP address, browser type, timestamp) to deliver the page and defend against abuse. That is transport, not tracking, and it contains nothing you entered.

Caregiver links

Creating a caregiver link is optional and off by default. When you create one:

• Everything is encrypted on your device first. The relay stores ciphertext under a random id. The unlock key lives in the part of the link after the #, which browsers never send to servers — so the relay never has it and cannot read what it stores.
• Only the children you pick, only the level you pick. A link carries the specific child or children you selected — a caregiver cannot see or switch to any other child on your account. You also choose how much: Basic (routine, feeds, sleep, diapers, notes), + Safety (adds medicines as you typed them, your contact line, and house notes), or Full day (adds the day's medicine log and running-low supplies). Whatever the level, the copy contains the nickname you chose and an age like "4 mo" — never the birthday — and covers the last 72 hours. Never inside it, at any level: your check-ins, your answer to any check-in question, other children, or anything you haven't logged.
• It ends. Links expire on the schedule you picked, and you can revoke one at any time; either way the relay copy is deleted. This deletes the relay copy after expiry or confirmed revocation; it does not delete browser copies, unsent encrypted outboxes, or files someone downloaded.
• The link is the access. Anyone who has the full link can open the board while it's live, so share it the way you'd share a house key, and revoke it when the sitter goes home.
• Caregivers who log something send it back the same way: encrypted on their phone, relayed as ciphertext, readable only on a device holding the link.

The relay processes standard technical request data (IP address, timestamps) to move the ciphertext and prevent abuse — transport, not tracking.

If you buy something

Checkout happens on our payment provider's own site, not here. No card number, CVV, or billing address is ever entered into this app or seen by it. The payment provider handles that under its own privacy policy and is responsible for it. We receive only what we need to give you access and answer a support email.

When you unlock with a license key, the key is checked against the payment provider's records to confirm it's active and belongs to this product. The key is kept on your device to renew that check quietly; it identifies your purchase, not your child, and travels with none of your records.

Your check-ins

Check-ins are stored separately from your child's records, under a different key, on purpose.

• Your answer about thoughts of harm is never saved. It is not written to your device, is not in any backup, and cannot appear anywhere. It decides what screen you see next, and then it is gone.
• Check-ins are never included in a caregiver handoff, a caregiver link, or a visit report — the code that builds those cannot read them. They can appear in your own "My last 24 hours" report and in backups only when you explicitly select that option each time.
• Backups leave check-ins out unless you tick the box asking for them.
• Nothing you enter is scored, rated, screened, interpreted, or used to reach any conclusion about you.
• You can delete every check-in from the You screen at any time.

Crisis and support links

Tapping a support line opens your phone or browser and connects you to that organization directly. We are not part of that conversation. We do not know whether you tapped it, whether you called, or what was said. Those organizations have their own privacy policies.

Legacy Care™ — caring for an adult

A profile in this app can be a baby, an adult you help care for, or yourself. Everything in this policy applies the same way to all three: the records live in your browser on your device, we don't receive them, and a share link only carries the profiles and the level of detail you pick.

• An adult's records are theirs. If you keep a profile for a parent, grandparent, or other adult, you are responsible for having their agreement to do so and for who you share it with. We have no way to verify that, and we don't see the contents either way.
• Self-managed profiles work identically. If you're keeping this for yourself, nothing extra is collected and nothing is treated differently. It's your device, your record.
• What a Legacy Care share link can contain: the preferred name you entered, meals, fluids, movement, notes, and any fall you logged — plus, at the + Safety level, medicines, dose records and your contact line, and at Full day, personal-care entries, wellness notes, appointments, and running-low supplies. Never included, at any level: dates of birth, other profiles you didn't select, or your own check-ins.
• We never label a condition. The app records what you type and nothing more. It does not detect, diagnose, score, or flag dementia, cognitive change, depression, dehydration, malnutrition, or any other condition, and no entry is interpreted by us or by anyone else.

More than one child

You can keep up to five children on one device. Each profile's records are grouped separately within the same on-device account, and a caregiver link only ever contains the child or children you selected for that link.

Children

This app is operated by adults. It is not directed to children, has no child accounts, no child login and no ads. A parent may type information about their own child into their device. Optional caregiver sharing sends selected records through our relay as ciphertext; the relay does not receive the fragment key needed to read them.

Your rights

Use the Log to view available entries and delete incorrect ones; re-enter corrected details when needed. Settings provides backup/restore with paid access and during storage recovery, plus a device-erasure control. For a caregiver link, deletion is the Revoke button: the relay's encrypted copy is removed when the server confirms revocation; expiry removes it automatically.

For anything about a purchase (an email address tied to an order), write to watsonlegacygroup@gmail.com and we'll handle it.

Keeping it

Your records last exactly as long as your browser keeps them. Clearing browsing data, private-session ends, browser reinstalls, storage-pressure cleanups, and lost devices all erase them permanently. The encrypted relay is a temporary, limited copy and cannot restore your complete account. Export backups.

Changes

If this policy changes, the date below changes. If we ever started collecting anything, we'd say so here first and plainly.