Good Boy Ben is a reminder and record-keeping app for people and pets, with optional meal and walk checklists. The core reminder experience works without an account. Private medication details stay on your device unless you choose to share a report or a routine through Family & Friends. Optional Safety Net sends limited reminder status and contact information as described below. This policy explains what the iOS and Android apps handle, when information leaves your device, and the choices available to you. Features described here apply only where offered in your installed version; some are limited to supported versions or controlled testing and are not available in every public release.
The app stores the following locally in its private storage:
We do not receive this local information merely because you use ordinary reminders. Removing the app normally removes its local data, subject to your device backup settings.
In-app dictation requires on-device speech recognition; it does not fall back to server-based transcription. Good Boy Ben does not save or upload the audio. If on-device recognition is unavailable, you can type. Your device's keyboard dictation is controlled separately by your device settings.
Reports are assembled locally. If you choose Share, the contents are passed to the destination you select, which may apply its own privacy and retention rules. Review the report and recipient before sending. Saved diary entries can be read, corrected, deleted and included in factual reports even after Premium ends.
AI care tools are not enabled in the current release. The app does not send diary or medication text to an AI provider. Any future activation will require updated disclosures and appropriate user choices.
Where available, this optional feature lets a Premium group owner invite up to five other members to share medication, meal and walk routines. Creating or joining a group asks you to accept the sharing disclosure. We process the group name, each member's chosen name and installation identifier, membership and invitation records, shared pet/person profile names, types and identifiers, routine names, dose or portion descriptions, schedules and time zones, reminder preferences, and confirmation or skipped status. History includes who recorded an action, when it was recorded, and any correction reason.
Shared information is stored in our Cloudflare-hosted database and made available to current group members. Invitations use one-use codes that expire after 24 hours; share them only with the intended person. Apple Push Notification service on iOS and Google Firebase Cloud Messaging on supported Android versions process a device delivery token, reminder identifiers and delivery information to send shared reminders and refresh shared status. Our push messages do not contain profile names, medication names, dose text or GPS routes. Android retrieves the current shared record from our authenticated service before displaying a shared reminder. Internet access and notification permission are needed for shared reminders, and delivery is not guaranteed.
Pausing reminders on a device stops its shared alerts, not access to shared records. It can still receive silent refresh signals for changed records or membership. Leaving, removal or group deletion ends server access; a device clears its cached group information when it next receives and completes a refresh. An offline device may retain its last downloaded copy until it reconnects.
Ordinary private schedules are not automatically added to the group. If you choose to share an existing pet medication, the app explains the move before sending its routine details. Profile photos, private diary entries, pet weight and GPS routes are not included in shared routines. Finishing a linked walk shares its completion, not its coordinates. Devices may keep a local copy of shared information to display previously refreshed status while offline.
Leaving a group or being removed ends your access and shared reminders, but actions you previously recorded remain in the group's history. Archiving a routine stops future reminders while preserving history. The owner can use Stop sharing to delete the group's shared routines, confirmations, invitations and memberships from the service. Members can export shared history; exported copies are controlled by their recipients and are not recalled when the group is deleted.
These are separate, per-walk choices, off by default. Sharing a finished walk uploads a sampled precise route, start and finish times, pet name, distance, duration, elevation and step/calorie estimates, with your family and installation identifiers and member name, to our Cloudflare-hosted service. Current family members, including members who join later, can view it until you or the family owner remove it. Pet weight, profile photos and weather records are not included in this upload.
Live sharing uploads only your latest precise position, accuracy and GPS timestamp, with the pet name, member name and family/installation identifiers. It does not create a server-side route history. Only current members can view live positions; there are no public tracking links. The app shows the last GPS update time. Stop sharing, Pause, Finish or Discard stops further location uploads. An online stop removes the position from the active service. If a stop cannot be delivered, the last position expires from access within two minutes without successful updates. A live share has an absolute eight-hour limit. Expired coordinates are cleared by service cleanup; infrastructure backups may retain prior data under their retention arrangements.
Leaving or being removed from a family removes your shared walk routes and stops your live shares in the active service. Deleting the family removes its shared walk data. Removing a shared route does not delete the local original or undo a walk check-off. Deleting a local walk alone does not remove an existing family copy: use Family walks to remove that copy. Non-location request identifiers and revocation records remain while the family exists to prevent delayed requests from re-enabling a removed share. Live/map viewers keep fetched locations in memory, clear them when the view closes or backgrounds, and refresh access periodically. A member may still retain a screenshot or an independently exported copy; these cannot be recalled.
Location sharing is optional convenience, not emergency monitoring. Connectivity, permissions, GPS accuracy, battery and operating-system restrictions affect updates. We do not include coordinates in analytics, push payloads or application diagnostic messages.
Purchases are processed by Apple App Store or Google Play. We do not receive your card details. RevenueCat processes a pseudonymous app user identifier, product and transaction information, country or storefront information, and subscription entitlement status so the app can provide Premium features and restore purchases.
Safety Net is an optional Premium feature currently available for eligible mobile numbers in the United States, Canada and United Kingdom. The app identifies other planned countries as coming soon until a compliant local messaging route is active. If a scheduled dose remains unconfirmed after the grace period you choose, Safety Net can send one private check-in text to each active trusted contact who has consented. Automated alerts require an active Premium entitlement and pause if the app installation has not checked in for seven days.
Uninstalling the app does not immediately notify our service or delete its server records. Turn off Safety Net or use Delete Safety Net data while connected before uninstalling if you want it stopped then. Otherwise alerts may remain eligible until the seven-day check-in expires or Premium ends; an SMS already handed to a carrier cannot be recalled.
When you set up or use Safety Net, we process:
Medication names, doses, profile names and notes are not sent to Safety Net. The default alert wording says that a dose was “not confirmed”; it does not identify the medication or claim that it was missed.
You must have your contact's permission before sending an invitation. The contact must confirm by replying to the invitation before alerts can be enabled. The contact can reply STOP to opt out. Carrier message and data rates may apply.
We use service providers only to operate requested features:
These providers may process information in the United States and other countries where they operate. Where required, we rely on appropriate contractual and legal safeguards for international transfers. Each provider also publishes its own privacy information.
We process information to provide the features you request and fulfil our contract with you; for our legitimate interests in proportionate service security and abuse prevention; and to meet applicable legal obligations. Optional sharing and device access use the choices and permissions described above. Human medication or health-related reminder information may be special-category personal data and requires an additional legal condition, such as explicit consent, where applicable. Accepting the Terms is not blanket consent to disclose health information. Do not share another person's information unless you have the necessary authority and permission. Pet care information is not automatically human health data, but names, contact details and routes can still be personal information.
Local reminders, private meal/walk checklists, optional weight, walk routes and saved weather snapshots remain on your device until you delete the relevant record or remove the app, subject to device backups. Archiving a routine preserves its history. A GPX file or report you deliberately share is controlled by the destination you select. Safety Net contact, schedule and SMS delivery records remain while needed to operate the feature and are deleted when you use “Delete Safety Net data.” Pseudonymous installation, entitlement, security and webhook records may be retained where reasonably necessary to operate subscriptions, prevent abuse, resolve disputes or meet legal obligations. Stopping a subscription does not itself delete local or shared records.
Family & Friends records remain while the group exists, including earlier member actions, unless removed through supported controls. Owner deletion removes the group's records from the active service; previously exported copies and offline caches cannot be remotely recalled. Service-provider backups and legally required compliance records may persist under their retention arrangements. Contact us if you need help identifying the relevant deletion control.
You can also email us to request access, correction or deletion. We may need enough information to verify and locate your record. Because the app deliberately uses pseudonymous identifiers, we may be unable to associate a record with you unless you provide the installation information shown by the app or other suitable evidence.
Release versions use Google Firebase Analytics and Crashlytics to help us understand whether core app flows work and to diagnose crashes. This may process a pseudonymous app-instance or device identifier, app version, device and operating-system information, locale, approximate region derived from masked IP addresses, screen names, typed product events, purchase/subscription events and crash diagnostics. Analytics does not request your GPS location. Events may be associated with an app-instance identifier, so pseudonymous does not mean anonymous. Our event boundary deliberately excludes medication or treatment names, dose descriptions, quantities, notes, schedule times, person or pet names, phone numbers, invitation codes, message contents and the Safety Net installation identifier. We do not set a Firebase user ID. Debug builds keep remote analytics and crash collection disabled; App Store and TestFlight Release builds use the release configuration.
We do not sell personal information. We do not use third-party behavioural advertising SDKs or combine app data with information from other companies for tracking. Firebase analytics is used for our own product measurement, not cross-app advertising.
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, obtain a copy of your data, or withdraw consent. Withdrawing consent does not affect processing that was lawful before withdrawal. UK users may complain to the Information Commissioner's Office at ico.org.uk. Residents of other jurisdictions may contact their local privacy regulator.
Good Boy Ben is not directed to children under 13. Purchases, group administration and Safety Net should be managed by an adult with authority to provide the relevant information. Do not invite a child or upload a child's information without the legally required authority and consent. An app-store content rating is not a privacy consent or permission to share a child's records. Contact us if you believe a child has provided information without the required permission.
We use measures including encrypted transport, encrypted phone-number storage, keyed hashing, pseudonymous installation credentials, restricted secrets and webhook authentication. No system is completely secure, so Safety Net must not be treated as an emergency or guaranteed-delivery service.
The data controller is QLG Media Ltd, registered in England and Wales.
We may update this policy as the app changes. We will update the date above and provide additional notice where required. Questions or privacy requests can be sent to [email protected].