Privacy Policy

What we collect

Dose Pop needs no account, and we do not use advertising or tracking. Apart from Apple's own services (your iCloud sync, and the App Store rating sheet, which the app may ask Apple to show once after you have used it for a while, and through which you can choose to rate the app), the app sends information beyond your device in three cases. When you search for a medicine name, when you save a medicine and the app checks its ingredients against your other medicines, and when you look up a medicine's drug label or the app refreshes a saved one, the app makes anonymous lookups to public drug databases, which carry the text you searched for, the medicine's name or its database identifier (see Medication search below). If you turn on Caregiver Alerts, the app sends a limited amount of information, and we collect the caregiver name and email you enter so we can send them the invitation and any missed dose alerts (see Caregiver Alerts below). And while the switch Share anonymous usage and crash reports is on, as it is by default, the app sends anonymous usage events and crash reports to PostHog, which never include your medicines, doses, schedule or caregiver, and, in a later version that shows an optional feedback survey, the fixed choices you pick in it, never text you write (see Usage and crash reports below). The app sends us nothing else. Anything you choose to send us yourself, such as an email, reaches us as you send it, and if you have chosen in your iPhone or iPad settings to share analytics with app developers, Apple may also pass crash reports to us under Apple's privacy policy.

Data stored on your device

Dose Pop stores your medication list, dosages, dose history, notification preferences, and app settings locally on your device using Apple frameworks. The app may also keep technical reports about crashes and other problems that Apple's system gives it. The app never sends those reports anywhere; you can export and share them yourself with Export Diagnostics in Settings. While usage and crash reports are on, your device also holds the random installation identifier and any reports waiting to be sent; when you turn them off, the app also saves a small record of that choice in the device's Keychain. Both are described under Usage and crash reports.

iCloud sync

If iCloud sync is enabled in your Apple system settings, app data may sync through your own iCloud account. The developer does not have access to your iCloud data.

Caregiver Alerts (only if you turn it on)

Caregiver Alerts is off unless you choose to turn it on. When you do, you name one caregiver and give your express agreement on a consent screen before anything is shared. You can stop sharing at any time from within the app.

What is shared: the caregiver name and email you enter, plus the names of your medicines, their colors and scheduled times, and whether each dose was taken, skipped, or missed. Your dosages, instructions, and notes are never shared. The app removes them before anything is sent, and there is no place to store them on our side.

How your caregiver sees it: your caregiver receives an email with a private link to a simple web page that shows the shared information. After that, they receive an email when a dose looks missed, after the grace period you set, and a notice the first time sharing pauses on its own after you set them up (see below). If sharing is set up again, for example when you update your caregiver or choose Share from this device, the old links stop working and the caregiver you name is sent a new invitation. If their link has expired, they can ask for a fresh one by email on the page the old link opens, a limited number of times a day; a link you have revoked, or sharing that has paused, cannot be renewed this way. They cannot see the app, cannot change anything, and never receive your dosages.

Who processes it: to make the link and the alerts work, the shared information is stored by Cloudflare (Cloudflare Workers and the D1 database), and the invitation and alert emails are sent through Resend, which receives the caregiver email address and the message. These companies process this data only to provide the feature, under their own terms. We do not sell or rent your information, we do not use it for advertising, and no one other than your named caregiver and these service providers receives it.

Turning it off and deletion: when you remove your caregiver in the app, the app records the request and sends it to our server straight away, and the private link stops working as soon as the server has processed it. If the request cannot get through, for example because your device is offline, the app keeps it and tries again the next time you open the app. Sharing also pauses on its own if our server receives no update from the device that shares your information for about 14 days. That device sends updates on its own while sharing is on, for example when you open the app or mark a dose from a notification banner, so sharing does not depend on opening the app alone. Shared medicine data is deleted after about 180 days of inactivity. We keep a small record that you consented and when you revoked, together with the caregiver name and email you entered, as evidence that the sharing was authorized by you. That record contains no medicine data. Removing your caregiver in the app ends the sharing and keeps only that record. To have the record and any shared data deleted at any time, ask us through the Support page and we will delete it.

Security: the private link uses a long random token that is stored only in hashed form and expires, an unknown or revoked link shows a neutral page with no information, and we keep a breach notification procedure ready. No online service can promise perfect security, but if we suspected that shared information was exposed, we would act on it and notify affected people as required.

For California residents

Where the California Confidentiality of Medical Information Act (CMIA) applies, Dose Pop treats your medication and adherence information as confidential medical information. We disclose it only at your direction, to the caregiver you name, after your express agreement, and we honor your revocation. The service providers named above (Cloudflare and Resend) process this information only to deliver the feature you turned on, not for their own purposes. We do not disclose your medical information for advertising, sale, or any purpose other than providing Caregiver Alerts.

Medication search

When you search for a medication name, Dose Pop may make anonymous, read only requests to public medication databases such as RxNorm and OpenFDA. These requests contain the search text you type and do not include an account, advertising identifier, or tracking identifier.

Notifications

Dose Pop uses Apple local notifications to remind you when it is time to take a medication. Your reminders are scheduled and shown by your own device and do not pass through a Dose Pop server. Caregiver alert emails are separate and are covered above.

Usage and crash reports

Dose Pop sends anonymous usage events and crash reports to PostHog, Inc., a product analytics service, which holds them for us in its United States cloud, where we can read them. We use them to see whether people get through setup and keep using the app, how often reminders are at risk of not reaching people, how caregiver invitations turn out, and which crashes to fix. PostHog processes them for us under its own terms. The widget on your Home Screen and Lock Screen does not include PostHog's library and sends nothing to PostHog.

Usage events. A usage event records that one of these things happened in the app:

• the app was installed, updated, opened (recording whether it was launched fresh or returned from the background), or sent to the background;
• a screen was shown, by a fixed name from the app's own list (today, medications, history, settings, add medication, edit medication, reminder checkup, caregiver alerts, caregiver consent and onboarding), never by its title, so never by the name of a medicine;
• onboarding was finished, recording whether notifications were allowed, declined or not yet asked about;
• you answered the system's request to allow notifications, recording whether you allowed them and whether the request came from onboarding or from Settings;
• a medicine was added, recording only whether it was picked from search results, whether supply tracking is on for it, whether it has its own reminder sound, and how many medicines the app holds after saving it, as a range: 1, 2 to 3, 4 to 6, or 7 or more;
• a caregiver invitation finished, after you confirmed it on the consent screen, recording only how it ended: sent; sharing set up but the invitation email was not sent; your daily allowance of invitations used up; the allowance shared by everyone on the same network used up; the service asking the app to slow down; sharing stopped meanwhile, for example from another of your devices; a connection problem; or another error;
• caregiver sharing was stopped;
• a reminder checkup found a problem, recording only its kind from a fixed list: notifications are off, banners are off, sounds are off, Sound Even on Silent may not cover every reminder, snoozed reminders will be silent, lock screen alerts are off, Time Sensitive is off, notifications are held for a scheduled summary, or reminders the app expected to find scheduled are missing; each kind is recorded at most once each time the app starts;
• a backup was handed to the share sheet, or an import finished, recording whether it worked, found nothing new, or failed;
• Export Diagnostics was tapped;
• one of six settings was changed (Notification Type, Play Sound, Snooze Duration, Missed Dose Alert, Keep Reminding Me, or Sound Even on Silent), recording which one and its new value: on or off for a switch, or the option chosen, such as 10 minutes;
• the reporting switch was turned off.

What reports never carry. Neither usage events nor crash reports carry the names of your medicines, what they are for, their doses, units, instructions, notes or colors, their schedules, reminder times or how often you take them, your supply counts, anything you searched for or read on a drug label, whether or when you took a dose or skipped, snoozed or missed one, any reminder or what you did with it, your caregiver's name or email address, your own name, any invitation link or the identifiers and keys Caregiver Alerts uses, the contents of a backup or an import, the contents of the diagnostic reports, or anything you typed into the app. The only exception is the part of the app's code a crash report shows, described under Crash reports. Each report carries the time it happened, so the times the app is opened are recorded, but no report says why it was opened. Acting on a reminder from its notification banner, for example with Snooze or Skip, can start the app in the background without opening it. PostHog's library starts then too, so a crash during that start can be reported, reports already waiting on the device may be sent, and, if it is the first start since the app was installed or updated, the event recording the install or update may be recorded then. No usage event says that a reminder was acted on or which action was chosen; a crash during such a start shows only where in the app's code it happened, as described under Crash reports.

No medical information. Usage events and crash reports carry no medical information: no report names a medicine or says what it is for, how much of it you take, when you take it, or whether you took it. The only figure about your medicine list in any report is the range of how many medicines the app holds, sent when you add one. A crash report can show that the app crashed in the code that handles a reminder action, such as Snooze or Skip, but not which medicine or dose was involved, or whether the action was saved. This is why the For California residents section above holds as written: these reports disclose no medicine, dose, schedule or record of whether a dose was taken.

Details on every report. Usage events and crash reports include these details where available: the time it happened, a random identifier for the event itself, the random identifier for the installation, a session identifier, the app's name, bundle identifier, version and build, the name and version of PostHog's library, the device's manufacturer and model, the device category (phone, tablet, or desktop when the app runs on a Mac), the operating system and its version, the screen size, the time zone, the type of network connection (for example Wi-Fi or cellular), your language setting (the language only, not the region), whether the app was installed from TestFlight or from outside the App Store, and whether it runs on a simulator or on a Mac. The device model is sent as a model name or hardware code, never as the personal name you give your device. Reports also carry markers PostHog's library uses to process them, such as whether the installation has been identified to PostHog, which in this app it never is. Reports never carry your phone number, your Apple Account, or your device's advertising identifier. When PostHog's library first runs in a newer build than the one it last ran in, the update event also carries that earlier version and build; the first time the library runs at all, including after an update from a version without it, it records an install instead.

Crash reports. While reporting is on, the app can report crashes: a crash is saved on the device and sent the next time the app starts with reporting on. A report of the same kind may also be sent for an error the app catches and chooses to record. It carries the kind of error, how it was caught and how severe it was, the number of the thread it happened on, and the stack trace (the list of the app's functions that were running at the time, with their memory addresses), which shows where in the app's code the crash happened, for example in the code that handles a reminder action such as Snooze or Skip. So that the trace can be turned back into readable function names, it also carries a description of each piece of program code involved: its build identifier, its size, where it was loaded in memory and, where available, the processor architecture it was built for, and it can carry the code's file path on the device, which includes the folder name the system assigns to the app's installation. The app removes the error's message from every crash report before it leaves the device, because a message written by the system can quote a value the app was handling, such as the name of a medicine. The report also carries the details above.

The installation identifier. The random identifier is created by PostHog's library inside the app the first time it runs with reporting on. It is not taken from your device or your Apple Account. It lives in the app's own storage on the device, and PostHog's library marks its files as excluded from device backups. Uninstalling the app removes it; after a reinstall, or a restore from a backup, a new one is created only when reporting next starts. It is not synced through iCloud, so each of your devices has its own. The app never tells PostHog who you are, so PostHog keeps no profile of you, only events under that identifier.

IP address. Every connection to PostHog, like any internet connection, gives PostHog your device's IP address. Our PostHog project is set to discard client IP addresses, so the address is not stored with the reports, and no location is worked out from it or stored. PostHog's library also contacts PostHog to fetch its settings for the app; that request names only our PostHog project, not your installation, and reaches PostHog from your IP address in the same way. When surveys are enabled in a version of the app, the library also asks PostHog whether a survey applies to this installation, whether or not one is then shown; that request carries the installation identifier, the app's version and build, its bundle identifier, the operating system and its version, the device category, the time zone, and the name and version of PostHog's library.

How long they are kept. PostHog keeps these events available to us for seven years, the retention period of PostHog's paid plans, as its events retention page sets out. PostHog describes that period as the window within which events can be queried, not as a date on which they are erased, so we do not promise that reports are deleted when it ends. We may delete data sooner by deleting it from our PostHog project. PostHog handles them under its privacy policy.

Turning them off. You can turn usage events and crash reports off in the app under Settings > Privacy, with the switch Share anonymous usage and crash reports. The switch is on when you install the app, and when you first update to a version that has it, unless an earlier choice to turn it off is still on the device, for example after a reinstall or a restore from a backup, both described below. Whenever the app cannot read your choice reliably, it treats reporting as off. Turning it off also saves a small record in your device's Keychain that holds only the fact that reporting is off, with no identifier. That record is never synced and never moves to another device; an encrypted backup of the device can bring it back only when restored to the same device. Because the Keychain outlives the app, once that record is saved, deleting and reinstalling the app on the same device keeps reporting off until you turn the switch back on. Turning it off while reporting is running stops new usage events at once and, for up to five seconds, tries to send one last event recording that the switch was turned off, together with any reports still waiting on the device; a request already under way can still arrive a few seconds after that. The app then closes PostHog's library and deletes any report that was not sent; anything it cannot delete then is deleted before reporting starts again, and reporting does not start until it is. While it stays off, the app does not start PostHog's library at all, and a crash that happens while it is off is never reported, even after you turn it back on. Turning it back on removes the Keychain record and resumes usage events straight away; if the app cannot remove the record, save your choice or delete what was left from the switch-off, reporting stays off until it can. Crash reports, and the events recording that the app was opened or sent to the background, may resume only from the next time the app starts. Deleting a medicine, turning the switch off or uninstalling the app does not remove reports already sent; they stay under the retention terms above. Reports already sent carry no name or account, only the random installation identifier, which the app never shows you, so we cannot look reports up by name or account, or find the ones that came from your device. Email support if you have questions about them.

Feedback survey. The app may show a short, optional survey inside the app, asking for your feedback on Dose Pop. It asks about the app, never about your medicines or your health, and every question offers only fixed choices, with no place to type your own words, so an answer cannot carry a medicine's name or a health detail. Answering is up to you, and you can dismiss it. The choices you pick are sent to PostHog with the same random installation identifier as the usage events. Showing the survey and dismissing it are recorded as events too, with the survey's identifier, name, round and, where available, the date that round started, and answers are sent with the survey's questions and whether it was completed; if you dismiss it after answering part of it, the choices you had made are sent with the dismissal. The survey is shown only while usage and crash reports are switched on. The check for whether a survey applies, described under IP address above, may itself be recorded as an event naming the survey rule and its result, and that result may be attached to later reports from the same installation, even when no survey appears. Because answers are fixed choices that many people share and carry no name or account, we cannot tell which answers came from you, so we cannot find or remove them one by one; they stay under the retention terms above.

Earlier versions. Versions of Dose Pop that do not have the Share anonymous usage and crash reports switch do not include PostHog's library and send nothing to PostHog: no usage events, no crash reports and no survey answers. Everything else in this policy applies to them as written.

Children

Dose Pop is not directed at children under 13, and we do not knowingly collect personal information from a child under 13.

Medical disclaimer

Dose Pop is a reminder tool. It does not diagnose, treat, prescribe, or provide medical advice. Always follow instructions from your doctor, pharmacist, or other qualified healthcare professional.

Changes to this policy

If we change how Caregiver Alerts or any other feature handles your information, we will update this policy and the App Store privacy answers before the change takes effect.

Contact

Questions, or want your shared data deleted? Email support@freedom-terminal.com, or see the Support page.