Caradomi Privacy Policy — DRAFT
DRAFT — not reviewed by a lawyer, not published. Placeholders in «…». Factual claims are grounded in data-map.md (caradomi-docs); if the code changes, this changes.
*Last updated: «date» · Effective: «date»*
In plain words
We wrote this section first because the rest is the long version, and you should be able to stop after this one if you want.
- Caradomi listens only when you start it yourself, and there are exactly two ways to do that: Start Conversation, and Alarm Watch. Both stop when you tap stop. The microphone never turns itself on — not when you unlock the phone, not after it restarts, not while you sleep.
- The app itself *does* wake up in the background, and you should know why. On Android, after your phone restarts or Caradomi updates itself, the app wakes for a moment to rebuild your reminders. Restarting a phone wipes everything that was scheduled on it, so without this your pill box and medication reminders would quietly stop after a reboot and nobody would notice until a dose was missed. It does not start the microphone, audio monitoring, or Alarm Watch by itself. Those only ever begin when you start them.
- Alarm Watch keeps listening with the screen off, until you stop it. That is the point of it: it is listening for your smoke or carbon monoxide alarm while you cook or sleep, and a phone that stopped listening the moment the screen went dark could not do that. It only ever runs because you turned it on, your phone shows a notification the whole time it is running, and it listens for alarm sounds — it is not transcribing you and nothing from it is written down or sent anywhere unless it hears an alarm.
- What people say stays on your phone. We don't keep conversation transcripts on our servers.
- Your stories stay on your phone. The recordings you make in Story Keeper never leave it unless you choose to share one.
- Your family sees only what you've turned on — things like whether you checked in today, alerts, and your location if you enabled it. They cannot read your conversations.
- We do use other companies to turn speech into text and to answer questions. That means some of what you say is sent to them to be processed. The list is below.
- You can delete everything, at any time, from Settings.
Who we are
Caradomi is operated by «legal entity», «address». Questions: «privacy@domain».
What we collect
We do not have accounts. No email, no password, no name. Your phone registers itself and gets an anonymous ID. We cannot look you up by name, because we don't have it.
Stays on your phone
Conversation transcripts and summaries · Story Keeper audio recordings · Memory Book people, photos, and facts · your medication list · symptom journal entries · your trusted contact.
All of it is encrypted on your device.
Sent to us and stored
Alerts you or the app raise · daily check-ins · location and safe zones, if you turn location on · health readings from Apple Health or Health Connect, if you connect them · medication schedules and the times you marked a dose · symptom entries you choose to send · discharge paperwork you submit for family review · stories you explicitly share · how many minutes of transcription and how many requests you've used, so we can run the service.
Sent for processing, not stored by us
Conversation audio and text is sent to be turned into words and to work out whether something sounds like a scam. We do not save the transcript on our servers. Summaries are saved; the conversation they came from is not.
Who else sees your information
To make the app work we use these companies. They only receive what's needed for the job they do.
| Company | What they get | When | Can you avoid it? |
| Deepgram | Audio of your conversation | While you're using Start Conversation — never during Alarm Watch | Yes — don't use Start Conversation. The app falls back to your phone's own speech recognition if Deepgram is unavailable |
| OpenAI | Conversation text; photos of letters, bills or paperwork you ask us to check; medication and discharge information | When the app is answering, checking or summarising | Yes — every one of these is something you ask for. None of it runs on its own |
| Google (Gemini) | The specific claim you asked us to check | When you use Check This For Me on something said to you | Yes — same |
| Anthropic | The same as OpenAI above: conversation text; photos of letters, bills or paperwork you ask us to check; medication and discharge information | When the app is answering, checking or summarising, if we have it running on Anthropic's models rather than OpenAI's | Yes — every one of these is something you ask for. None of it runs on its own |
| ElevenLabs | The short sentences the app speaks to you | When you use a premium voice | Yes — turn the premium voice off and your phone speaks instead |
| LiveKit | Your video and audio | During a family video check-in | Yes — don't answer a video check-in |
| Apple, Google | The alert itself, and your phone's notification address | When your family is alerted | No — this is how a phone receives any notification |
| OpenStreetMap | Your location coordinates | Only when a family member taps "view on map" from the portal | No, other than the family member not tapping it |
| jsDelivr (Fastly) | Your family member's internet address | When they open a video check-in page in a browser | No |
| Twilio | A family member's phone number and the alert text we send them | When Caradomi sends a text to family | No, if you want your family texted |
| Resend | A family member's email address, and the invitation we send to it | When you invite a family member to help look after you, and when they sign in | No, if you want that person to be able to help |
| Render | Everything the app stores on our servers, because they host them | Always | No |
Alarm Watch is not in that table on purpose. It listens on your phone, for the sound of an alarm, and sends nobody the audio — not us, not Deepgram, not anyone. If it hears an alarm, what leaves your phone is the fact that an alarm was heard and when, so your family can be told. Never a recording.
We also look things up from public government sources (food recalls, weather). Those requests contain no information about you.
We do not sell your information. We do not use it for advertising. We do not use Apple Health data for anything except showing it to you and the family you chose.
[LAWYER] Two things to settle here: (a) whether each vendor's terms permit this content, especially photographed documents that may contain account or Social Security numbers; (b) whether "we do not sell" can be stated flatly under the CCPA/CPRA definition of "sell" and "share", which is broader than the ordinary meaning.
What your family can see
Only through a link you approve: alerts, whether you checked in, your location and safe zones, health trends, medication reminders, the weekly summary, and discharge paperwork waiting for their review.
They cannot see your conversations or your stories.
You can switch off any family link from Settings — "Stop the old link from working" — and the old link stops working immediately.
How long we keep things
On your phone, things are kept until you delete them. Auto-delete is off by default so that nothing disappears without you asking. You can set it to delete conversations after a number of days in Settings.
On our servers, we keep what's listed above for as long as your device is active, and delete it when you delete your data.
[LAWYER] We should state a concrete retention period for server-side data rather than "as long as active". Also: we do not currently document what our vendors retain, and that gap should be closed before this is published.
Your choices
- Delete everything — Settings → delete all data.
- Turn features off — location, health, family sharing, and premium voice are each independently switchable.
- Revoke family access — Settings.
- Ask what we have — «privacy@domain». Because we have no accounts, we'll need your device to identify what's yours.
Depending on where you live you may have additional rights to access, correct, delete, or port your information, and to appeal a refusal. [LAWYER] — state-specific rights sections (CA, CO, CT, VA, and others) and whether a Global Privacy Control signal has to be honoured.
Children
Caradomi is not for children and we don't knowingly collect their information. Grandkid Bridge carries messages from family members to the senior; where a child sends one, «describe what is collected — this needs checking against the code and against COPPA before publication». [LAWYER]
Recording other people
Caradomi records conversations that include other people. Laws about recording vary by state, and in some places everyone in the conversation has to agree. See recording-consent.md (caradomi-docs) — this section cannot be finalised until that question is answered, and it may need to say something quite specific.
Changes
We'll post changes here and update the date. For anything significant we'll tell you in the app.
Contact
«privacy@domain» · «postal address»