Status: WIP — this document is a working draft and has not been reviewed by a solicitor; it may change without notice.
Doddle — Privacy Notice
Status: draft for solicitor review. Not legal advice.
Version: 0.2 · drafted 5 September 2026 · last updated 11 October 2026 · effective [DATE]
Status: WIP — this document is a working draft and has not been reviewed by a solicitor; it may change without notice.
Audience: the adults in a household that uses Doddle, and anyone reading the website.
1. Who we are
Doddle is run by [OPERATOR LEGAL NAME], trading as Doddle, of [OPERATOR ADDRESS], United Kingdom.
We are the controller for the data described here: we decide what is collected and why, and we are who you complain to. Contact [privacy@doddlefamily.com]. ICO registration [ICO REG NUMBER]. We have not appointed a Data Protection Officer; we are not required to.
Doddle is for adults in the UK. Children have no account and never talk to it. Adults tell Doddle about their children — section 6.
2. The short version
| What we hold | Your family's group chat, the school and club email you forward, and the schedule built from them. |
| Where it lives | Your household gets its own separate database, not a row in a shared table. Nothing of yours sits alongside another family's. |
| Who can see it | The adults in your group. An AI language-model service, briefly, to read each message. And the person who runs Doddle — section 9, the honest part. |
| Training | Your family's data is never used to train any AI model, by us or by our providers. |
| Getting rid of it | In the app, Settings → Delete my account, at once. Or ask, in the chat or by email, and we delete your database and calendar. Section 11. |
3. What we collect
From the app, and from Telegram if you connect it
You sign up in the Doddle app and the household is yours to control. A household may also connect a Telegram group from inside the app. We store message text, who sent it (for Telegram, the Telegram ID and display name), when, button taps, and what Doddle sends — the evening plan, the Sunday digest, task lists, questions and confirmations. We keep message text so Doddle can look back at what you told it. Where a Telegram group is connected, we read no other Telegram chat: Telegram only delivers messages from the bot's own groups, and messages sent to it directly.
From WhatsApp, if you choose it
An adult can use Doddle on WhatsApp instead of the app or Telegram. You join by sending Doddle the "Join" message from an invite link; nobody's number is added any other way, and that message is your agreement to hear from Doddle there. We store your WhatsApp number, what you send (text, photos, documents, voice notes — a voice note is turned into text on our own server) and what Doddle sends you: tomorrow's plan, and answers and questions meant for you. Other kinds of message (task lists, the week ahead, reminders) come only if you switch them on in Settings.
Doddle is never a member of any WhatsApp group — WhatsApp's own rules don't allow that for a service like Doddle, by design. It has no access to your class-group chats or any other group you're in; it only ever sees a message you forward to it, or send it directly, one-to-one. Only what you forward reaches Doddle.
Meta, which runs WhatsApp, sees these messages. On this leg Meta holds the encryption keys on Doddle's behalf, so WhatsApp's usual end-to-end encryption promise does not describe it. Meta keeps message content for up to 30 days to deliver the service, on servers in Meta data centres, and says it does not use these messages to decide which ads you see. So the plan Doddle sends you — which names your children, their school and times — passes through Meta. If that matters to you, use the app instead: nothing there goes through Meta.
Someone you invite
When you invite someone new, you type their name. Until they join, that name is held with the invite in Doddle's central database — the one that knows which household a link belongs to — not in your household's own database. It is deleted 30 days after the invite is used or expires, whichever comes first; if they join, their name moves into your household's database like everyone else's.
From email you forward
Your household gets an address like yourfamily@doddlefamily.com. Cloudflare relays mail sent there straight into your database, encrypted. There is no Doddle mailbox.
We store the sender, recipients, subject, date and body, plus what Doddle extracts: dates, deadlines, amounts, kit lists, closures and tasks. Calendar invitations are shown in plain English. School mail is written by others, so it names other children, parents and staff — section 6.
The schedule Doddle builds
Household members: names, adult or child, Telegram ID, birthday where you tell us, school or nursery. Each adult's working pattern — days, rough hours, whether bank holidays are off. Commitments — school runs, clubs, appointments, one-offs and standing weekly rules — each with an owner and the children it concerns. Tasks with owners and due dates. Term dates, closures, INSET days, family holidays, childcare day by day and who is covering it. Facts you tell Doddle (shoe size, teacher, doctor, allergies) and preferences like "keep replies short".
Your calendar
Doddle creates a Google Calendar for your household on its own account and shares it with the adult email addresses you give us. It writes to that calendar only, never reads your own calendars, and has no access to your Google account.
Running the service
Logs, errors and alerts. AI usage per call — tokens and cost, no message content. Platform backups (section 8). And bug reports: when you tell Doddle something is broken, a de-identified one-line title goes to a backlog we read across households, names and schools stripped first. Your words stay in your database.
The website
The waitlist sends your email address, and any optional questions you answer, to Netlify. It saves your address as soon as you have typed a complete one, before you press the button, so you keep your place if you get interrupted; the page says so under the field. Ask us and we delete it.
The welcome page, if you are invited into the pilot, collects your family name, one contact email, and your acceptance of the pilot agreement — with the versions of that agreement and this notice, the time and your IP address, so we can show later what you agreed to. We copy that into our own systems and delete it from Netlify.
4. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Read your chat and forwarded email, hold your schedule, send the plan and task lists, write your calendar | Contract — it is the service you asked for |
| Hold data about the children in your household | Legitimate interests — the service is about who has which child on which day |
| Handle other people's details arriving inside a school email | Legitimate interests — minimal, unavoidable, used for nothing else |
| Keep the service running: logs, alerts, backups, security, the bug backlog | Legitimate interests |
| Take payment after the pilot | Contract; legal obligation for accounting records |
| Email you about Doddle | Consent |
| Handle health, allergies, medical appointments, religion or a child's extra support at school | Explicit consent — section 5 |
Overnight, Doddle reviews its own replies to your household's messages to find and fix its mistakes (the bug backlog above), and may keep scrubbed examples of what Doddle understood — names, schools, clubs and venues replaced by placeholders — as tests its changes must pass; switch Help me learn off in the app's Settings and your household's messages are left out of that review, and the examples already kept from them are retired.
You can object to anything we do on legitimate interests — section 10.
5. Health and other sensitive details
School mail carries things the law treats as more sensitive: allergies, medical appointments, "she's been sick", a child's extra support at school. We ask for your explicit consent to handle those, once, in the group chat when Doddle joins. Yes turns on your family email address; no means Doddle works from the chat only, and nothing else changes.
Any adult can withdraw at any time, in the chat or by email. We then stop accepting mail at your family address and delete the email bodies we stored. Dates already in your plan stay unless you ask.
School forms pre-filled as a draft
Draft for legal review — this purpose is in testing with pilot families only and is not offered to anyone else until that review is done.
When a school form arrives (a consent slip, a trip form), Doddle can offer to fill in a draft for you to check. It uses only what your household has already told Doddle — a child's name, date of birth, year group, school, and your name, email and phone — and tells you where each answer came from. Anything it does not know is left blank. Health, allergy, medical, dietary and extra-support answers are left blank unless your household has separately and explicitly agreed to Doddle putting them on drafts; you can withdraw that at any time. Doddle never signs, pays, submits or emails a form: the draft is put in your Doddle chat for you to read, correct, sign and send yourself. We use this data on the same basis as the rest of the service (contract), and health details only with your explicit consent. The draft file is deleted 14 days after the form's return date, or 60 days after it arrived if the form gives no date.
6. Children, and other people's children
Children have no account and Doddle never messages them. Everything we hold about them came from you or your school, and any adult in your group can ask what we hold and have it removed. We do not profile children, market to them, or use their data for anything but your plan.
A class newsletter names other families' children. We hold that only because it sat inside a message we had to read. We build no records about children outside your household, and it goes when everything else does. A parent elsewhere who asks has the same rights (section 10).
7. Who else sees it
| Provider | What it does | Where | How the transfer is covered |
|---|---|---|---|
| An AI language-model service — today, OpenAI; Anthropic (Claude) when we test a change against past messages | Reads each message. Does not train on it; keeps it at most 30 days | USA | Their processing terms, with the UK transfer addendum |
| Railway | Hosts Doddle and your household's database | EU (Amsterdam); backups [VERIFY] | Their processing terms, with the UK addendum |
| Holds your household's calendar | EU/USA | [to confirm] | |
| Cloudflare | Our domain, and the relay carrying your forwarded mail; stores no message | Global / USA | Their processing terms, with the UK addendum |
| Telegram | The group chat itself, only for a household that connects it | Outside the UK | Not our processor — see below |
| Meta Platforms Ireland (WhatsApp) — only for an adult who joins on WhatsApp | Carries the messages between Doddle and that adult; keeps their content up to 30 days; holds the encryption keys for this leg | EU/USA (Meta data centres) | Meta's WhatsApp Business terms, with the WhatsApp Business UK Data Transfer Addendum |
| Netlify | The website and its forms; no household data reaches it | USA | Their processing terms |
The AI service above is the one we use today. If we change it we will tell you and update this notice, and its terms will say your data is not used for training. We do not sell your data, and share it with nobody outside this list unless the law requires it or we must defend a claim.
Telegram is not our processor. If you connect it, it is your own chat platform — you made the group, and Telegram holds those messages under its own terms rather than ours. Telegram groups are not end-to-end encrypted, and everyone in your group sees everything in it.
8. How long we keep things
| What | How long |
|---|---|
| WhatsApp messages at Meta | Up to 30 days, set by Meta, not by us |
| The name of someone you invited who has not joined | 30 days after the invite is used or expires |
| Message text, from the chat and forwarded email | Rolling 12 months, then erased automatically. We keep the date and who sent it, not what was said |
| Our record of each WhatsApp message we sent you (your WhatsApp number and a fingerprint of the text, never the text) | The same rolling 12 months, then deleted |
| The schedule: commitments, tasks, closures, childcare days, facts | While you use Doddle |
| The calendar events Doddle created | While you use Doddle |
| A pre-filled school form draft (in testing) | 14 days after the form's return date, or 60 days after it arrived if it gives none |
Backups (the hosting platform's snapshots: daily kept 6 days, weekly 27, monthly 89; point-in-time recovery window [VERIFY]) | Up to 89 days |
| Logs and alerts | 90 days |
| AI usage and cost records (no message content) | 24 months |
| Payment and accounting records | 6 years after the tax year |
| Your consent record, and your acceptance of the agreement — the exact words you were shown, and what you replied | 6 years after you leave; it is our proof we had your permission |
| De-identified backlog titles | Indefinitely — they contain nothing about you |
| Waitlist entries | Until the beta closes, or 24 months, whichever is sooner |
| An invite link's name and whether it is for an adult or a child, if it names someone not yet in your household | Up to 37 days: the link itself expires after 7 days unused, and we clear the record 30 days after that |
When you leave, your database and calendar go within 30 days, ageing out of backups within a further 89 days. Accounting records are the exception.
9. What the person who runs Doddle can see
Doddle is run by one person, who:
- can read your household's database, because they administer the server it runs on;
- is in your Telegram group, if you connect one, through the bot, and so sees what the bot sees;
- sees per-household running costs and the de-identified bug backlog.
There is no team, no tiered support desk, and no technical control that would stop them looking. Isolation in Doddle is between families — your database cannot be reached from another family's — not between you and us.
In practice they look when something is broken and you have asked for help, when a fault alert fires, or when a database has to be restored. Not otherwise. But that is a promise and a small number of households, not an access-control system. Decide knowing it: if you would rather not be seen at all, Doddle is the wrong product for you today.
10. Your rights
You can ask us to tell you what we hold and give you a copy (Article 15); correct anything wrong (Article 16), or just tell Doddle in the chat; delete it (Article 17); restrict or object to what we do, including anything on legitimate interests (Articles 18 and 21); or send your data to you or someone else in a machine-readable file (Article 20). You can withdraw consent — for section 5, or for our emails — at any time.
Ask in the group chat, or email [privacy@doddlefamily.com]. We answer within one month; if a request is unclear we may ask what you mean, which pauses that clock. A request from any adult is a household request, and we say so in the chat rather than acting silently.
Automated decisions. Nothing reaches your calendar without a yes from one of you. One thing to know: if a day has nobody covering it, Doddle asks the group, asks again on days two and three, and on day four puts a name against it and says so. One message undoes that.
Complaints. Tell us first and we will answer within 30 days. If you are not satisfied, complain to the Information Commissioner's Office — ico.org.uk/make-a-complaint, 0303 123 1113. You can go to them without coming to us first.
11. Deleting everything
In the app. Any adult can delete their own account in Settings → Delete my account, by typing DELETE to confirm. It happens at once, with no waiting period: your name, sign-in email, phone and Telegram links, sessions, passkeys and notification subscriptions are deleted, and so are the words and files of the messages you sent. The plan stays for the other adults. If your email also signs you in to another Doddle household, that household's sign-in stays. If you are the household's last parent, the screen says so, asks for a code we email you, and the whole household is erased at once, by the same single operation as below; the group is told and Doddle leaves it. A receipt goes to your sign-in email. We keep only the record that your household accepted our terms (section 8).
Or ask us. Say "Doddle, delete everything" in the group, or email us. This is a single operation we run, not a process we assemble:
- We confirm in the group, so every adult sees it. Never silently, on one message.
- Your household's database is dropped, and the Doddle calendar deleted with its events.
- Your family email address stops accepting mail.
- You get written confirmation of what was deleted and when, within 30 days. Backups age out within a further 89 days.
Events already copied into your own calendars, and the messages in your own group, are yours — deleting a connected group is something you do in Telegram.
12. Security
- Your own database and no mailbox, as above; everything encrypted in transit, databases and backups encrypted at rest.
- Doddle only accepts messages from people it recognises in your group; an unrecognised sender is ignored, not guessed at. If a message could belong to two households, it refuses and alerts us.
- Credentials live in environment variables, never in the code, and every change is reviewed and tested before it reaches live data.
- Honestly, the limits: one person holds the keys (section 9), and one Telegram bot serves every household, so its token is guarded and rotated on any doubt.
13. Cookies and advertising
The site sets no analytics or advertising cookies and runs no tracking pixel, so there is no consent banner. It does load typefaces from Google Fonts, so your IP address reaches Google when a page loads.
If we ever add tracking — an advertising pixel, say — we will ask your consent before it loads, make refusing as easy as accepting, publish a notice of what is set and by whom, and name the recipient in section 7. Until all four exist, no pixel.
14. Changes to this notice
If we change something that matters — a new provider, a new purpose, a different retention period — we will tell you in your group chat before it takes effect, not by quietly updating a web page. The version and date at the top are the live ones.