Privacy notice
Last updated
This notice explains what Dom keeps about you and your household, why, who helps us run it, and the choices you have. It is written to be read in a few minutes.
Contents
The short version
- Dom keeps your household’s information so it can show it back to the people in your household. That is the only reason we hold it.
- We do not show adverts, sell data, share it for marketing or track you around the web.
- Your household’s data is stored in the EU, in Ireland, with our database provider.
- Fitness stays off for each person until it is switched on for them, because workouts can say something about health.
- Children under 13 never get a login. Teenagers only get one when an adult in their household invites them.
- The owner can delete the whole household at any time. Anyone can ask us for a copy of their data, or ask us to correct or delete it.
Who we are
Dom is a BozApps product. BozApps is the trading name of Semir Kahrimanovic, a sole trader based in Grays, Essex, England. Semir is the controller of the personal information in Dom. That means he decides how it is used and is responsible for looking after it. In this notice, “we” and “us” mean Semir trading as BozApps.
How to reach us
- Privacy
- privacy@bozapps.co.uk
- Everything else
- hello@bozapps.co.uk
- Post
- Postal address available on request.
What Dom keeps
Dom only holds what you and the people in your household put into it, plus what is needed to run your account and your plan.
Your login
Your first name, email address and password, and when you signed up and last signed in. Your password is stored scrambled (hashed) by our sign-in provider. Nobody at Dom can read it.
Your household
The household’s name and, if you add one, its postcode. We turn the postcode into approximate map coordinates for the postcode area so Dom can show your local weather.
The people in your household
Names, roles (owner, adult, child or viewer), the colour each person is shown in, and birthdays if you add them. This includes children and anyone else who does not have their own login.
Calendars
If you link a calendar, its secret iCal address and the events in it, such as titles, times, places and notes, as your calendar provides them. Also any events you add in Dom. Treat a secret calendar address like a password: anyone who has it can read that calendar.
Everyday lists
Tasks, notes, chores and who did them and when, meal plans, recipes you save with your ratings and favourites, and the shopping list.
Bills and renewals
Names, providers, amounts, due dates, reminders and notes, and reference numbers if you type them in. Please do not store bank card numbers, PINs or passwords in Dom. It is not built to hold them.
Family and friends
People outside your household that you choose to add: names, how they are related to you, birthdays, gift ideas, notes and when you last got in touch.
Fitness, only if it is switched on
Workout plans and logs: sessions, exercises, sets, weights, times, distances, how hard a session felt and any notes. See the fitness section below.
Your plan
Whether the household is on its free trial or the paid plan, the price, renewal and cancellation dates, and the reference numbers Stripe gives us for your customer record and subscription. You type your card details into Stripe’s own payment page. Stripe holds them. Dom never sees or stores them.
The early access list
If you join it: your email address, and if you give them, your first name, postcode and the features you are interested in. We also note which page you joined from, and that you agreed to be emailed.
Technical information
When your device talks to Dom, our hosting and database providers record technical details such as your IP address, browser type and the time of the request. We use these to keep Dom secure, stop abuse and fix faults.
A note on sensitive details
Things you type into notes, events, tasks or bills can reveal sensitive details, such as a hospital appointment. Dom stores them only to show them back to your household. We do not read them, analyse them or use them for anything else.
Why we use it, and the law we rely on
UK data protection law says we need a lawful reason, called a lawful basis, for each thing we do with personal information. These are ours.
Running Dom for your household
- What
- Your login, your household, calendars, lists, meals, bills, family and friends, and your plan.
- Lawful basis
- Contract. We need this information to give you the service you signed up for.
Information about other people
- What
- Children and other household members without a login, teenagers with a login, and the family and friends you add.
- Lawful basis
- Legitimate interests: helping your household organise its life. We keep it to what you choose to add, show it only to your household and never use it for anything else.
Fitness
- What
- Workout plans and logs.
- Lawful basis
- Explicit consent, given by switching Fitness on. You can take it back at any time.
Taking payment and keeping accounts
- What
- Plan status, amounts, dates and Stripe references.
- Lawful basis
- Contract, and the legal duty to keep tax records.
Emails about your account
- What
- Confirming your email, password resets, invites, and messages about your trial and plan.
- Lawful basis
- Contract. These are part of the service. We do not send marketing emails unless you have asked for them.
The early access list
- What
- One email to tell you when Dom opens to new households.
- Lawful basis
- Consent. Ask us to remove you at any time.
Security and fixing faults
- What
- Technical logs, and limits on how often a form can be sent from one address.
- Lawful basis
- Legitimate interests: keeping Dom and every household in it safe and working.
Requests, complaints and legal claims
- What
- Your messages to us and our replies.
- Lawful basis
- Legal obligation, and legitimate interests in answering you and protecting our legal position.
Fitness and health information
Workout plans and logs can say something about a person’s health. The law treats health information as special category data and asks for extra care. So Fitness is off for each person until it is switched on for them, on their own profile.
- Switching Fitness on is your explicit consent for Dom to store your fitness information and show it to you and your household.
- A person with a login decides for themselves. For a child without a login, a parent or carer in the household decides.
- Like everything else in Dom, fitness information can be seen by the people in your household.
- You can take your consent back at any time by switching Fitness off. To remove what is already logged, delete it in Fitness, or email privacy@bozapps.co.uk and we will delete it for you.
Dom’s workout plans are general exercise ideas, not medical advice.
Children and teenagers
- Under 13s never get a login. An adult can add a child to the household as a profile, so the family can share their chores, events, meals and birthday. The adult who adds them is responsible for what they add.
- 13 to 17 year olds can have a login only when an adult in their household invites them. They see and add to the household’s shared lists like everyone else. They cannot manage people, settings or the plan.
We have designed Dom with the ICO’s Children’s code in mind. A household’s information is private to that household by default. There are no adverts, no profiling, no tracking and no selling of data. Dom does not track anyone’s location: the only location it holds is the household’s postcode area, for the weather. We do not use design tricks to get children to share more.
If you are worried about a child’s information in Dom, email privacy@bozapps.co.uk.
Who can see your household’s data
- The people in your household. Everything in Dom is shared with everyone in your household who has a login, including viewers. Think about what you add, especially about people outside your household.
- Us, only when needed. We can technically reach the database. We only look at a household’s data when you ask us to, for example to help with a problem, when we need to keep Dom secure or fix a fault, or when the law requires it.
- The services that help us run Dom, listed in the next section, only to do their job for us.
- Others, only where the law requires it, for example a court order, or to protect someone from serious harm.
- A new owner. If Dom or BozApps is ever sold, the information could pass to the new owner, who would have to keep to this notice. We would tell you before that happens.
Services that help us run Dom
Supabase: database and sign-in
- Handles
- Everything stored in Dom, including logins.
- Where
- Stored in the EU, in Ireland.
- Safeguards
- Supabase teams and providers in the United States and Singapore may access data to run and support the service. Those transfers are covered by standard contractual clauses approved for transfers from the UK.
Vercel: hosting
- Handles
- Every request to Dom’s website and server, including your IP address, and short-term technical logs.
- Where
- Vercel is based in the United States and serves pages from locations around the world.
- Safeguards
- Vercel is certified under the EU-US Data Privacy Framework, which it says covers transfers from the UK, and its data processing terms include the UK’s international data transfer addendum.
Stripe: payments
Stripe also uses some of this information for its own purposes, such as preventing fraud and meeting financial rules. For that it follows its own privacy policy.
- Handles
- Only when an adult chooses to subscribe: card details, name, email, billing address if asked, and payment history.
- Where
- Stripe’s UK and Irish companies, with some processing by Stripe in the United States.
- Safeguards
- Stripe is certified under the UK Extension to the EU-US Data Privacy Framework, and its data transfer terms include the UK addendum.
Open-Meteo: weather
- Handles
- Your device asks it for the forecast using the approximate coordinates of your postcode area. It also sees your IP address.
- Where
- Run by OpenMeteo GmbH in Switzerland, which UK law recognises as protecting personal data adequately.
- Keeps
- Open-Meteo says its server logs are deleted after 90 days.
postcodes.io: postcode lookup
- Handles
- Your device sends it the postcode you type, to get approximate coordinates. It also sees your IP address. Nothing else is sent.
- Who
- An open-source UK postcode service maintained by Ideal Postcodes.
Email sending
We have not yet chosen the service that will send Dom’s emails. We will add it to this page before it handles anyone’s information.
Sending information outside the UK
Some of these services work outside the UK. When information leaves the UK, it is protected in one of these ways:
- The EU (Ireland) and Switzerland: UK law recognises both as protecting personal data adequately, so no extra paperwork is needed.
- The United States: the UK Extension to the EU-US Data Privacy Framework for companies certified under it, backed by the UK’s international data transfer addendum.
- Other countries, such as Singapore: standard contractual clauses approved for transfers from the UK.
Ask us at privacy@bozapps.co.uk if you would like more detail about these safeguards.
How long we keep things
Your household’s data
For as long as the household exists. When the owner deletes the household, everything in it is deleted from the live database straight away. It then drops out of our database provider’s rolling backups within 7 days.
Things you delete
A task, an event or a person you delete goes from the live database straight away, and from backups within 7 days.
When a trial or plan ends
The household becomes read-only and we keep its data, so you can download it or come back. If we ever decide to remove households that have been read-only for a long time, we will update this page first and email the owner at least 30 days before anything is deleted.
Your login
If you leave a household, your login is unlinked from it. What you added stays with the household as part of its shared records, and your name stays on your profile until an adult removes it. Deleting a household does not close the logins of the people in it. To close your login completely, email privacy@bozapps.co.uk and we will delete it within one month.
Linked calendars
Until you remove the calendar from Dom. The events copied from it are removed with it.
Payment records
Stripe keeps payment records under its own legal duties. We keep records of what was paid and when for as long as tax law requires. For a sole trader that is at least 5 years after the 31 January filing deadline for the tax year concerned.
The early access list
Until we have emailed you to say Dom is open and you have had a chance to join, and no longer than 12 months after Dom opens to new households. We delete your entry sooner if you ask.
Emails you send us
As long as we need to deal with what you asked, then up to 24 months after our last message.
Technical logs
For a short time, set by our hosting and database providers, and then deleted automatically.
On your device
Until you sign out or clear your browser’s storage. See cookies and device storage.
Your rights
You have the right to:
- get a copy of the personal information we hold about you
- have it corrected if it is wrong or incomplete
- have it deleted
- ask us to limit how we use it, or object to how we use it
- take it with you: you can download your household’s data from Settings as a file (JSON)
- take back your consent at any time, where we rely on consent
Most things you can do yourself in Dom. For anything else, email privacy@bozapps.co.uk. We reply within one month. If a request is complicated we can take up to two more months, and we will tell you if so. We may ask you to confirm who you are first, usually by writing from the email address on your login.
If a household added you
If someone added you to their Dom, for example as a grandparent with a birthday on their list, you have the same rights. Tell us your name and who added you. We may need to ask the household to help us find the right details.
Keeping it safe
- Each household’s data is walled off from every other household by rules inside the database itself, not just in the app.
- Everything travels over encrypted connections (HTTPS), and our database provider encrypts the data it stores.
- Passwords are stored scrambled. Nobody at Dom can read them.
- Administrative access is kept to the people who run Dom.
If something goes wrong, we will report it to the Information Commissioner’s Office within 72 hours where the law requires, and tell you without delay if it puts you at high risk.
You can help too. Use a password you do not use anywhere else, keep secret calendar addresses private, and sign out on shared devices. Dom keeps a copy of recent data on your device so it opens quickly, and signing out removes it.
What we never do
- Show adverts, or use advertising or tracking cookies.
- Sell or rent personal information, or share it for anyone’s marketing.
- Run analytics on Dom. We do not use any at the moment. If we add privacy-friendly analytics, this notice and the cookies page will say so first.
- Use your household’s data to train AI models. We will update this page before adding any feature that sends your data to an AI service.
- Make automated decisions about you that have legal or similarly serious effects. Dom suggests things, such as a meal plan or whose turn a chore is, and you can always change them.
Complaints
If you are unhappy with how we have handled your information, please tell us first at privacy@bozapps.co.uk. We will acknowledge your complaint within 30 days and reply as quickly as we can.
You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
When we change this notice we update the date at the top. If a change matters, for example a new service that will handle your data, we will tell you in Dom or by email before it takes effect.