Privacy
Privacy
In plain language first, then the policy in full.
Rookery is used by a household and by the people it employs to look after its children. It holds a care record about a child and an employment record about a caregiver, and those two things are the reason it is built the way it is.
What is collected
Names, email addresses and phone numbers of the people in a household. Journal entries, routines, learning notes and incident reports about the child. Shifts, hours, pay rates and payments for a caregiver. Messages between members of the household. Photos attached to any of the above.
Location is recorded ONLY while a caregiver is clocked in, and only if she has granted it. It stops the moment she clocks out. She can withdraw that consent from her own phone at any time, and nobody in the household can turn it back on for her: there is exactly one handler in the system that writes that setting and it takes the identity from her own session.
What is not done with it
None of it is sold, rented, or shared with advertisers. There is no analytics service, no advertising identifier, no third-party tracking of any kind, and no data broker. Nothing about a child is sent to any third-party service.
Where it lives
In one database belonging to the household, on Cloudflare. Two things leave it, both because they cannot work otherwise: notifications go through Apple's Push Notification service, and sign-in codes go by email through a transactional mail provider. Neither carries the contents of the care record. A notification says that a message arrived, never what it said.
Who can see what
A caregiver sees the child's care record, the routines, the house information she needs, and her own hours. She does not see the household's private material and she does not see another caregiver's record. What the household can see about her, she can see about herself, in the same words.
How long location is kept
Location recorded during a shift is kept as part of that shift's record. It is not deleted after a few days, and the reason is worth stating plainly rather than burying: where a child was, and when, is occasionally the only way to answer a question nobody could have anticipated. A measles exposure notice naming a place and a window is the ordinary example. A household that cannot say whether its child was there has to assume the worst.
It is kept for that purpose and used for no other. It is not analysed, not scored, not used to evaluate anybody's work, and never leaves the household's own database. A caregiver can see exactly what is held about her, in the same words the household sees, and she can stop it being recorded at all from her own phone at any time.
Keeping and deleting
A person can ask for their account to be closed, and the household must do it. Sessions, passkeys, notification tokens and device credentials are revoked immediately. Employment records that a household is obliged to keep, such as hours worked and payments made, are retained for as long as the law requires and no longer. Anyone can ask what is held about them by writing to the address below.
Children
Rookery is used by adults. The record it holds is about a child, and it is kept on behalf of that child's parents, who decide who may see it.
In full
Privacy Policy
Last updated 29 August 2026.
1. Who is responsible for your information
Rookery is software licensed to a household. The household that operates an installation decides what is recorded in it, who may see it, and how long it is kept. In the language of data protection law the household is the controller of that information, and Rookery is the processor acting on its instructions. Where an installation is operated for the developer's own household, the developer is the controller of that installation and no other.
Rookery is operated by Robb Dixon, an individual, in Pasadena, California. There is no company between the developer and this software, and this policy names the person who actually operates it rather than an entity that does not. Written contact: Robb Dixon, 45 S Arroyo Pkwy, Pasadena, CA 91105. By email: privacy@rookery.haus.
2. Categories of information processed
- Identity and contact. Name, email address, telephone number, postal address where a household records one, and emergency contact details.
- Care records concerning a child. Journal entries, routines, learning notes, milestones, incident reports and photographs.
- Health information about a child. A journal entry can record that medicine was given, what it was and at what time, and an incident report can describe an injury and what was done about it. Both are kept as part of that child's care record, held by the household on that child's behalf, and used for no other purpose. They are never transmitted to any third party.
- Employment records concerning a caregiver. Shifts, hours, pay rate, payments, agreements signed, certifications, and records of scheduling changes including who made them and when.
- Communications. Messages exchanged between members of a household, and the times at which they were read.
- Precise location. Recorded from a caregiver's own device, only while that person is clocked in to a shift, and only where that person has granted permission on that device.
- Authentication material. Session tokens, public keys for passkeys, single-use sign-in codes, and notification tokens.
Information concerning a child, including anything recorded about medicine or an injury, and precise location, are treated as sensitive throughout. None of it is used for any purpose beyond the one stated here.
3. Purposes and legal bases
- Operating the household's care record so that the people responsible for a child can see what happened and when. Performance of the arrangement between the household and the people it engages, and the legitimate interests of a parent in the welfare of their child.
- Operating the household's employment record so that hours are accurate and payment is correct. Performance of a contract, and compliance with the household's own record-keeping obligations.
- Recording location during a shift so that a household can establish where a child was at a given time. Consent, given on the device from which the information is sent, and withdrawable there at any time.
- Authenticating a person so that a household's records are not readable by strangers. Necessity, and legitimate interest in security.
4. What is never done
Information held in Rookery is not sold, rented, licensed, or disclosed to advertisers, data brokers, or any party seeking it for marketing. No advertising identifier is collected or generated. No analytics, telemetry, session replay, profiling or behavioural tracking of any kind is performed, by Rookery or by any embedded third party. No information concerning a child is transmitted to any third party service. Rookery does not train, and does not permit any third party to train, a machine learning model on a household's records.
Rookery does not make automated decisions producing legal or similarly significant effects. Where the software applies a rule to a schedule, such as a notice period, the outcome is presented to the people affected and can be overridden by a person, with the reason recorded.
5. Recipients and transfers
A household's records are stored in a database dedicated to that household, hosted by Cloudflare, Inc. Two categories of information leave that database because the corresponding function cannot operate otherwise:
- Notification delivery. Apple Push Notification service and standard web push services receive the fact and the destination of a notification. Notification content is deliberately minimal and does not carry the contents of a care record, a message, or a sign-in code.
- Sign-in codes by email. A transactional email provider receives the recipient address and the code. It receives nothing else.
Processing takes place in the United States. Where a household or a person is located in a jurisdiction requiring a transfer mechanism, the household as controller is responsible for putting one in place, and Rookery will execute a data processing agreement on request.
6. Retention
Care records are retained by the household for as long as the household determines, and are deleted on its instruction. Employment records, including hours worked and payments made, are retained for the period the household is obliged to retain them and no longer. Location recorded during a shift is retained with that shift's record for the purpose stated in section 3, and is not used for any other. Authentication material is revoked immediately when a person leaves a household, and sign-in codes expire on use or within a short window. Identification documents submitted by an applicant who is not engaged are deleted.
7. Rights of the people whose information is held
Any person whose information is held may request access to it, correction of it, deletion of it, a copy of it in portable form, restriction of its processing, or may object to processing. A caregiver may withdraw consent to location at any time from her or his own device, and the household cannot restore it on that person's behalf. Requests are made to the household, or to privacy@rookery.haus, and are answered within thirty days.
California residents have the rights described in the California Consumer Privacy Act as amended, including the right to know, to delete, to correct, and to opt out of sale or sharing. Rookery does not sell or share personal information as those terms are defined, and processes Global Privacy Control signals as an opt-out where they apply. Exercising any right will never result in a person being treated differently.
8. Children
Rookery is not directed to children and is not offered to a child as a user. It is used by adults, and it holds records concerning children on behalf of the parents or guardians who are responsible for them and who determine who may see them. Rookery does not knowingly permit a person under sixteen to create an account.
9. Security
Access is authenticated and scoped. A person sees the records their role and their own ownership entitle them to see, and nothing else. Credentials are stored only as hashes or public keys. Where an access decision cannot be evaluated, the software refuses rather than assuming.
10. Changes
A material change to this policy is announced in the product to the people affected before it takes effect, rather than published silently and dated.