Privacy Policy

This policy explains what personal information DadWell collects, why we collect it, who we share it with, how long we keep it and the rights you have over it. It applies to the DadWell app for iPhone and Android, our website at dadwell.app, and the emails and notifications we send you.

Some of what you tell us is sensitive. Your check-ins can say how you are feeling, and a due date tells us that someone is pregnant. We have written this policy with that in mind, and we have tried to keep it in plain English. Where the law uses a particular term, we use it too and say what it means.

1. Who we are

We are the controller of your personal information. That means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

If you have a question about this policy or about your information, email support@dadwell.app and put “Privacy” in the subject line, or write to us at our registered office.

2. The short version

  • We collect what we need to run DadWell: your account details, the answers you give when you set up the app, and the things you choose to write, post or save.

  • Your daily check-ins are only stored on our servers if you say yes when the app asks. If you say no, they stay on your phone.

  • Other members never see your check-ins. Our team does not read them either. We only ever look at totals across everyone.

  • Posting anonymously in the community hides your name from other members. It does not hide it from our moderators.

  • We do not sell your information. There are no adverts in DadWell, and the app contains no advertising or analytics tracking tools.

  • You can download a copy of your information or delete your account from the Settings screen in the app.

3. The information we collect

3.1 Information you give us

  • Account details: Your email address and password. Your password goes straight to Firebase Authentication, a Google service, which stores it in a scrambled (hashed) form. We never keep a readable copy of it.

  • Sign in with Google or Apple: If you choose one of these, the provider sends us your name, your email address and, for Google, a link to your profile picture. If you use Apple’s Hide My Email option, we receive a relay address instead of your real one.

  • Setup answers: Whether you are expecting or already a dad, your first name, your partner’s due date or your baby’s date of birth, and, if you choose to give it, your partner’s first name.

  • Check-ins: Only if you agree to save them to your account: the date, how you are feeling (good, okay or tough), any note you add, and whether you skipped that day.

  • Community: Your posts and replies, any edits you make, whether you posted anonymously, reports you make about other posts and the reason you give, and the fact that you accepted the community guidelines.

  • Saved items: Guides and community posts you save. When you save a post, we keep a short preview of it and the display name it was posted under, so it appears correctly in your saved list.

  • Your choices: Your notification settings, whether you want marketing emails, and whether you want your check-ins saved to your account.

  • Messages to us: Emails you send to our support address, and any appeal you send us from inside the app if your account has been suspended.

3.2 Information collected when you use DadWell

  • Time zone: Your phone’s time zone, so that check-ins are dated correctly and reminders reach you at a sensible hour.

  • Notification token: If you allow notifications, a token issued by Apple or Google that lets us send notifications to your device.

  • Account activity: When you created your account and last signed in, how you sign in, whether your email address is verified, and running totals of your community posts, replies and any reports made about them.

  • Server logs: When the app talks to our servers, our systems record your IP address, the address of the request, the time and whether it worked. A few requests, such as checking how an email address signs in, include that email address.

3.3 Information we receive from others

  • Apple and Google, when you buy or renew a subscription. We receive the product you bought, the relevant dates, whether it is active, in a trial or in a billing grace period, and a transaction reference. We never receive your card or bank details.

  • RevenueCat, the service that keeps track of subscription status for us, passes on the same purchase information.

  • Other members, if they report one of your posts.

3.4 What we do not collect

DadWell does not ask for or collect your location, contacts, photos, camera, microphone, phone number, date of birth or advertising identifier. The app contains no advertising, analytics or crash reporting tools.

4. Health information and information about your partner

The law gives extra protection to information about health, which it calls special category data. Two kinds of DadWell information fall into it.

4.1 Your check-ins

How you are feeling, and any note you write, is information about your health. The first time you open check-ins, the app asks whether you want to save them to your account. If you say yes, you are giving us your explicit consent to store and use them for the purposes in this policy. If you say no, they are kept only on your phone and are removed when you sign out or change phones.

You can change your mind at any time in Settings, then Privacy and data. If you turn saving off, new check-ins stay on your phone, and we delete the check-ins already stored on our servers within 30 days. You can also delete any single check-in yourself.

Nobody else in the community can see your check-ins. Our staff tools do not show individual check-ins. We look only at totals across all members, such as how many check-ins were made in a week, to understand how the service is being used.

4.2 Tough weeks

If you record a tough mood on every day from Monday to Saturday, the app shows you a list of organisations that can help. This is worked out automatically on our servers from your saved check-ins, or on your phone if you keep them there. Nobody at DadWell is alerted about you, and we do not contact you or anyone else as a result. Our team sees only the total number of times this has happened across all members, with no names attached.

DadWell is not an emergency or crisis service and nobody monitors check-ins in real time. If you or someone else is in danger, call 999. For urgent medical help call NHS 111. You can talk to Samaritans for free, day or night, on 116 123.

4.3 Your partner’s due date and your baby’s date of birth

A due date shows that someone is pregnant, so we treat it as health information about your partner as well as you. We use it only to work out which week of pregnancy or of your baby’s life you are in, so that we can show you the right guides and place you in the right community group. We ask for your explicit consent before we store it, and you can withdraw that consent by deleting your account or by asking us to remove it. Without a due date or birth date, the weekly guides cannot work.

4.4 Your partner’s name

Giving your partner’s first name is optional. We use it only to personalise some of the text you see in the app. We never contact your partner and we do not show their name to anyone else. Please make sure your partner is happy for you to share their name and due date with us.

5. How we use your information, and our lawful basis

The law says we must have a lawful basis for each thing we do with your information. The table below sets out what we do, what we use, and the basis we rely on. Where the information is health information, we also rely on your explicit consent, except where we need it to establish, exercise or defend a legal claim.

  • Create and run your account, verify your email address, sign you in and reset your password. Information used: Account details, sign-in method, account activity. Lawful basis: Contract: we need it to provide DadWell to you.

  • Work out your week and show you the right weekly guides. Information used: Stage, due date or birth date. Lawful basis: Contract, and explicit consent for the due date.

  • Personalise the text you see. Information used: Your first name, your partner’s first name. Lawful basis: Contract for your name. Legitimate interests for your partner’s name, which you choose to give.

  • Save your check-ins, show your history, weekly summaries and streaks, and show support information after a tough week. Information used: Check-ins, time zone. Lawful basis: Explicit consent.

  • Place you in a community group, show posts, and let you post, reply, save and report. Information used: Due month, posts, replies, reports, display name or anonymous handle. Lawful basis: Contract.

  • Keep the community safe: review reports, remove content, pause or ban accounts, and deal with illegal content. Information used: Posts, replies, reports, moderation history, account details. Lawful basis: Legitimate interests in running a safe community, and legal obligation under the Online Safety Act 2023.

  • Send notifications you have switched on, such as the daily check-in reminder at around 10am your time, new guides and replies to your posts. Information used: Notification token, time zone, notification settings. Lawful basis: Consent, which you give through your phone’s permission and the switches in Settings.

  • Send service emails such as verification codes, password resets, deletion notices and your data export. Information used: Email address. Lawful basis: Contract, and legal obligation where the email relates to your data protection rights.

  • Send news about DadWell by email or notification. Information used: Email address, notification token. Lawful basis: Consent. We only send these if you opt in.

  • Confirm your subscription and unlock Plus. Information used: Purchase information from Apple, Google and RevenueCat. Lawful basis: Contract.

  • Keep financial and tax records. Information used: Purchase information. Lawful basis: Legal obligation.

  • Protect DadWell from misuse, limit repeated sign-in attempts, fix faults and keep our systems secure. Information used: Server logs, IP address, account activity. Lawful basis: Legitimate interests in keeping the service secure and working.

  • Handle suspension appeals, support requests and complaints. Information used: Your messages, account details. Lawful basis: Legitimate interests, and legal obligation where the request is about your rights.

  • Respond to legal claims and lawful requests from authorities. Information used: Whatever is relevant to the claim or request. Lawful basis: Legal obligation, or legitimate interests in defending our legal rights.

Where we rely on legitimate interests, we have weighed our interests against yours and concluded that the use is expected, limited and fair. You can ask us for details of that assessment, and you have the right to object (see section 10).

We do not make any decision about you that has legal or similarly significant effects based only on automated processing. The tough week message in section 4.2 is automatic, but it only shows you information and does not change anything about your account.

6. Who can see your information

6.1 Other members

Members of your community group can see your posts and replies. If you post under your name, they see your display name. If you have not set one, the part of your email address before the @ sign is used instead, so we suggest setting a first name. If you post anonymously, they see a handle such as “anon · #1234”. Our moderators can always see who wrote a post, including anonymous ones, so that they can deal with reports.

6.2 Our team

Access to our staff tools depends on each person’s role. Depending on their role, a team member may see your email address, name, stage, due month, partner’s first name, time zone, plan, consent choices, and when you joined and last signed in. Moderators can read community posts and reports, and see who made them. Staff tools do not show individual check-ins.

6.3 Companies that provide services to us

We use a small number of companies to run DadWell. They act on our instructions and may only use your information to provide their service to us.

  • Google (Firebase and Google Cloud): Sign-in and password storage, our main database, notification delivery, storage for images in our guides, and small pieces of app text such as the What’s new message.

  • Apple and Google (app stores): Distributing the app, taking subscription payments and delivering notifications to your device.

  • RevenueCat, Inc.: Keeping track of which subscription you have and whether it is active.

  • Our server hosting provider: Running the servers that the app talks to.

  • Our community messaging server: Storing community posts and replies. It runs on Matrix, an open messaging system, on a server operated for DadWell.

  • Our email delivery provider: Sending account emails, deletion notices and data exports.

If you would like the names of our hosting and email providers, ask us and we will tell you.

6.4 Other disclosures

We may share information with our professional advisers, with a buyer or investor if our business or its assets are sold or restructured (they would have to protect your information in line with this policy), and with the police, courts, regulators such as the ICO and Ofcom, or other authorities where the law requires it or where we believe someone is at serious risk of harm.

6.5 Connections your phone makes

To check whether your phone is online, the app may briefly contact public services run by Cloudflare, Google and Apple. The app may also download fonts from Google, and our emails load a font from Google when you open them. These requests reveal your device’s IP address to those companies, but they carry no account information.

7. Transfers outside the UK

Some of the companies in section 6.3, including Google, Apple and RevenueCat, may process information in the United States or elsewhere outside the UK. When that happens, we make sure one of the protections recognised by UK law is in place. That will be either UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the company is certified under it, or the International Data Transfer Agreement or Addendum approved by the ICO. You can ask us for a copy of the relevant safeguard.

8. How long we keep information

  • Your account and profile: While your account is open. If you delete your account, it is permanently deleted when the 7-day recovery period ends (see section 11)

  • Check-ins saved to your account: Until you delete them, turn saving off (we then delete them within 30 days) or delete your account.

  • Check-ins kept on your phone: Until you delete them, sign out or remove the app. We never receive them.

  • Community posts and replies: Until you delete them or your account. When you delete a post, it disappears from the community straight away and we remove it from our systems within 30 days.

  • Saved guides and saved posts: Until you remove them or delete your account.

  • Reports and moderation records: 6 months after the report or action, unless we need them for longer to deal with a legal claim or a request from the police or a regulator.

  • Suspension appeals and support emails: Appeals for 6 months after our decision. Support emails for 24 months after your last message.

  • Record kept after you delete your account: For 6 months: your account ID, a scrambled (hashed) version of your email address, the relevant dates and any reason you gave for leaving. We keep this to deal with disputes and to stop people deleting an account to avoid a ban.

  • Subscription and transaction records: 6 years from the end of the financial year they relate to, because tax law requires it.

  • Server logs: 30 days.

  • Your data export: We do not keep a copy once the email has been sent.

  • Backups: Information deleted from our live systems may remain in encrypted backups for up to 35 days before being overwritten.

9. How we protect your information

  • All traffic between the app and our servers is encrypted in transit using HTTPS.

  • Your sign-in details are kept in your phone’s secure storage (the Keychain on iPhone, the Keystore on Android), not in ordinary app storage.

  • Our database is hosted by Google, which encrypts stored data by default.

  • The credentials your account uses to reach the community messaging server are encrypted with AES-256 before we store them.

  • One-time codes and password reset codes are stored only in scrambled (hashed) form.

  • Staff access is limited by role, and our systems limit repeated attempts to sign in or reset a password.

No system is completely secure. If a breach puts your information at risk, we will report it to the ICO within 72 hours where the law requires, and we will tell you without undue delay if it is likely to put your rights and freedoms at high risk.

10. Your rights

You have the following rights over your personal information. They are free to use.

  • Access: Ask for a copy of the information we hold about you.

  • Rectification: Ask us to correct information that is wrong or incomplete. You can change your name and partner’s name in the app. You can move your due date to another day in the same month yourself. For a different month, email us, because it also changes your community group.

  • Erasure: Ask us to delete your information. The quickest way is to delete your account in the app (see section 11)

  • Restriction: Ask us to pause using your information while a concern is looked into.

  • Portability: Receive the information you gave us in a format a computer can read. In the app, go to Settings, then Export your data. We email you your information as CSV files within 24 hours. You can request an export once every 7 days.

  • Objection: Object to anything we do on the basis of legitimate interests. We will stop unless we have compelling grounds that override your interests, or we need it for a legal claim.

  • Withdraw consent: Withdraw consent at any time, for example by turning off check-in saving, marketing or notifications. This does not affect what we did before you withdrew it.

  • Automated decisions: Not be subject to decisions with legal or similarly significant effects made solely by automated means. We do not make any such decisions.

To use any of these rights, email support@dadwell.app. We may need to confirm it is you, usually by replying from the email address on your account. We will respond within one month. If a request is complex, we may extend that by up to two further months, and we will tell you why within the first month.

If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

11. Deleting your account

You can delete your account in the app by going to Settings, then Delete account. If you no longer have the app, you can ask us by email. The steps are set out at dadwell.app/delete-account.

Once you confirm, your account is closed straight away. You then have 7 days to change your mind by signing in and choosing to recover your account. We email you the day before the deletion becomes final. After that, your account and the information linked to it are permanently deleted, apart from the limited records described in section 8.

Deleting your account does not cancel a subscription bought through Apple or Google. Please cancel it in your App Store or Google Play settings as well.

12. Marketing

We only send you news about DadWell, such as new features or guides, if you have opted in. You can opt in or out at any time in Settings, and every marketing email will include a way to unsubscribe. Service messages, such as a password reset or a deletion notice, are not marketing and will still be sent.

13. Children

DadWell is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has created an account, please tell us and we will delete it.

14. Cookies and information stored on your device

The app does not use cookies, but it stores some information on your phone so that it can work, such as your sign-in details and a copy of recent content for when you are offline. Our Cookie Policy at dadwell.app/cookies explains this, and the cookies used on our website, in full.

15. Links to other services

The support resources in DadWell link to other organisations, such as charities and helplines, and some open in apps like WhatsApp or Telegram. Those organisations have their own privacy policies, and we are not responsible for how they handle your information.

16. Using DadWell outside the UK

DadWell is currently available in the United Kingdom only. Before we offer it in any other country, we will review this policy and update it to meet that country’s requirements.

17. Changes to this policy

We will update this policy when the way we handle information changes. The date at the top shows when it last changed. If a change is significant, we will tell you in the app or by email before it takes effect.

18. Contact us

Email: support@dadwell.app, with “Privacy” in the subject line.