Privacy Policy

Who is responsible

Domi Ops Cloud (domi-ops.com, app.domi-ops.com, demo.domi-ops.com): the sole proprietor doing business as Domi Ops is the data controller for accounts and household data stored on hosted infrastructure.

Self-hosted instances: the person or household who operates that server is the controller. Domi Ops (the project) does not operate a central database for self-hosted deployments and does not see that data.

Information stored

• Account identifiers (email, username, display name, profile photo)
• Household content you create (calendar events, shopping and chores, notes, expenses, school work, Drive files, optional health records)
• Session and authentication cookies (HTTP-only on the app domain)
• Optional Web Push subscription endpoints if you enable notifications

Data protection mechanisms for sensitive data

Security procedures are in place to protect the confidentiality of your data. We use encryption to protect your information when it is stored or sent over the network.

• In transit: Domi Ops Cloud serves the app and API over HTTPS (TLS). Browsers and our servers negotiate encrypted connections for sign-in, household data, and Google OAuth flows.
• At rest (OAuth): Optional Google Calendar and Docs connection tokens are encrypted using the instance encryption key. New sign-in access and refresh token writes are encrypted using the authentication secret; provider ID tokens are discarded after callback verification. older sign-in tokens require operator rotation or backfill. These server-held keys protect database storage, rather than providing end-to-end encryption.
• At rest (health): When the health module is enabled, sensitive health fields (for example titles, notes, medication names, dosage, instructions, and comparable vitals or log values) are encrypted at rest with the same ENCRYPTION_KEY. Dates, member assignment, and schedule times stay queryable without storing those values in plaintext.
• Access controls: Household members see only content their role and per-module permissions allow. Private notes, Drive objects, and health records are further limited by per-record visibility and segment ACLs. These application controls are separate from infrastructure access: authorized operators with access to the database, stored files and the instance encryption key can access hosted data for service operation and support. Encryption is not end-to-end encryption.
• We do not sell your data to advertisers, data brokers, or other third parties.
• Revoking Google access: Disconnect Google Calendar or Docs in household settings, or remove Domi Ops from your Google Account under Third-party access. That stops Domi Ops from accessing Google on your behalf.

Self-hosted: the person who operates the server is responsible for HTTPS, backups, and protecting ENCRYPTION_KEY. The same encryption behavior applies when the key is configured.

Google account data

If you choose Google sign-in or connect Google services, Domi Ops accesses only the Google user data needed for the features you enable:

• Sign-in: basic profile (name, email, profile photo) via OpenID Connect scopes used for authentication.
• Calendar: when you connect Calendar sync, calendars and events you select so Domi Ops can display and sync household events.
• Drive: when you enable Docs or Drive features, only files you create or open through Domi Ops (Google drive.file scope and the Google Picker), not your entire Drive.

We use this Google user data only to provide those features, for example signing you in, showing synced events, or exporting reports you request. We do not use it for advertising, and we do not use it to train general-purpose artificial intelligence or machine learning models.

We do not sell or transfer Google user data to third parties except service providers that help us run Domi Ops Cloud (for example hosting and email), and only as needed to operate the service. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Processors (when enabled)

• Google: optional sign-in, Calendar sync, and Drive drive.file (Docs/Picker). See Google's Privacy Policy. See the token storage and legacy-token limits described above.
• Withings: optional blood pressure cuff and watch import, only if you connect a Withings account. See Withings' Privacy Policy. Access tokens are encrypted at rest on the instance.
• Object storage: S3-compatible storage (MinIO or a cloud bucket) for uploads.
• Email: SMTP you or the hosted operator configure (verification and transactional mail).
• Weather: Open-Meteo using coordinates you provide; no weather account is required.
• Web Push: browser vendors deliver notifications; subscription keys stay on the instance.
• Stripe: billing, trials, and invoices when hosted checkout is live. Card details are handled by Stripe, not stored in Domi Ops.
• Sentry: error diagnostics when the operator configures it. This runs independently of optional usage metrics. The application sends error types and code locations, build/platform metadata and limited job categories; it removes error messages, console arguments, account identifiers, request URLs, bodies, headers and local variables. Performance traces and breadcrumbs are disabled. Diagnostic retention depends on the operator's Sentry project settings; contact us for the hosted configuration. As with other network services, the provider receives connection metadata such as an IP address.
• RevenueCat, Apple and Google Play: native store purchase and subscription status when store billing is enabled. Card details remain with the store.

Health module

Optional. Sensitive fields (titles, notes, medication names, dosage, instructions) are encrypted at rest with the instance ENCRYPTION_KEY. Dates, member assignment, and schedule times remain queryable. Access follows per-record visibility and segment ACL. There is no admin override of private health data. Domi Ops is not a healthcare provider and is not HIPAA-compliant.

MyAllyFile (optional). If you link a household member to a MyAllyFile profile, Domi Ops sends that profile the name, dose, instructions, schedule type, and paused status of that person's current medications, and sends an update whenever they change. Nothing is sent until you link, and nothing is read back. Anyone with that profile's emergency PIN can see the synced medications, as with any MyAllyFile profile data. The link is stored as an encrypted credential that you can revoke from either product; unlinking removes the synced medications from the MyAllyFile profile. MyAllyFile is a separate service with its own privacy policy.

Withings (optional). If you connect a household member to a Withings account, Domi Ops imports that person's blood pressure readings (systolic, diastolic, pulse), blood oxygen, body temperature and workouts (the activity, how long, and distance and calories when Withings has them), daily activity summaries (steps, distance, active minutes, active and total calories), and sleep summaries (start/end, time asleep/in bed, stages, awake time/count and sleep score), with when each was taken, as ordinary health entries, including past ones from the period you choose when you connect, and new ones as the cuff or watch syncs. They are protected like any other health entry. Withings' permission for this covers body measurements and activity generally. Domi Ops reads these supported categories and registers notifications for new data; it does not upload or edit your Withings health records. Readings Withings cannot attribute to one person, such as on a cuff shared by a household, are left out until they are assigned in the Withings app. The connection is stored as encrypted credentials that you can revoke from either product. Unlinking stops new readings and asks Withings to stop notifying Domi Ops; readings already imported stay in Domi Ops until you delete them, and Withings keeps its own copy under its own privacy policy. Domi Ops does not change or delete health records at Withings. Import behavior varies by category: activity and sleep summaries may update when Withings reports a newer version; previously imported individual readings and workouts are deduplicated. Disconnecting stops future imports and leaves existing Domi Ops records until you delete them.

School module

Homeschool and family coursework only. Domi Ops is not a school of record, not an accredited institution, and does not issue official transcripts to third parties.

Children and household accounts

Households may provision child or student accounts (including username-only members). A parent or guardian who owns or administers the household is responsible for those accounts and for deciding what data is stored.

Sharing inside a household

Members see household-visible content per module permissions. Private notes, Drive objects, and health records are limited to owners and people you explicitly share with (or grant ACL access).

Optional AI assistant connections

An adult member can connect a supported assistant after the instance operator and household administrator enable the integration. Each member approves their own connection and permissions. Approved reads send connection labels and timezone, shopping items, chores, and only explicitly selected planning notes to the chosen assistant provider. Current membership and record permissions still apply. The current integration does not directly access Calendar, School, Health, Drive or attachments, and cannot change household records. Do not select notes containing copied Google-derived, health, child or other excluded information for this workflow.

The assistant is a separate service you choose. Its account settings and terms govern its retention, human review and model training. Review those settings and the provider-specific notice before approving access; Domi Ops cannot verify those settings or promise that the provider will not retain or use shared conversation content. Connection setup does not share your Domi Ops password, login session or Google credentials with the assistant.

AI connections settings lets you review permissions, remove access or disconnect. Disconnect stops future reads; it cannot erase copies already held by the assistant. Security activity records tool names, outcomes, timing and response sizes rather than returned record content or raw tool arguments, with a 30-day activity retention window. Self-hosted operators administer their own deployment and retention.

Optional product metrics

Off by default on every household, self-hosted or Cloud. An owner or admin can turn it on in Settings → Privacy. When on, we collect:

• Technical health: page load measurements and fixed JavaScript error categories
• Feature usage: which modules and actions get used (e.g. "a chore was completed"), never the content of what you created

These events carry a randomly generated id stored in your browser (not your account, household, name, or email). The event store has no account or household identifier. Turning it off stops new collection and drops queued events; turning it on later starts a new random id, not a resumed history. We do not sell this data, or any data, to anyone, ever. It is used only to find bugs and decide what to build next.

Separately, anyone can send a bug report or feedback from their Profile page at any time, regardless of this setting. That message (and an optional reply email, if you choose to leave one) is sent because you chose to send it, not collected passively.

Configured Sentry error diagnostics are separate from this opt-in setting, as described under Processors. Turning optional metrics off does not disable connected services, transactional email, billing, or operator diagnostics.

Feedback uses a separate random id for each submission, so an optional reply email is not joined to your browser metrics id. Operators can also produce monthly activation counts from opted-in hosted households, using record existence and membership counts, without names or record contents. Cohorts smaller than five are suppressed. Random ids reduce direct identification; they are not a promise of formal anonymization.

Retention and deletion

Cloud: email privacy@domi-ops.com to update profile data, revoke Google connections, or request account and household deletion. You may request deletion of your Cloud account and associated household data by emailing that address; we will delete or anonymize hosted records within 30 days of verifying your request, unless we must retain specific records for legal, security, or billing disputes (for example open invoices).

Self-host: the instance operator manages retention and deletion. An encrypted household archive can be restored to an empty self-host instance with the same schema, including referenced stored files.

Cloud household archives are operator-assisted because they include other members' private records. Contact the privacy address above; we verify the recipient and affected adults' authorization. The archive uses a separate transfer key; hosted service keys, payment details, login sessions and external-service credentials are excluded. Report exports within your existing permissions remain available in the app.

Canceling renewal does not delete records. Backup copies expire through the service's backup rotation; we confirm the applicable backup and diagnostic retention windows when handling a deletion request. Deleted data must not be reintroduced during disaster recovery.

Your choices

You can disconnect Google Calendar or Docs in household settings, revoke Domi Ops in your Google Account, disconnect a Withings cuff or watch from Health (Checks), disable Web Push, turn off optional modules (within what the instance enables), and turn anonymized metrics on or off. See also the Terms of Service.

Contact

Cloud privacy questions: privacy@domi-ops.com. For a self-hosted instance, contact the person who administers that server.