Skip to content

Privacy

Privacy Policy

This Privacy Policy explains how Dashbd Inc. ("Dashbd", "we", "us", or "our") handles information when you use dashbd.com, the Dashbd, Calendar by Dashbd, Countdown by Dashbd, Weather by Dashbd, Stocks by Dashbd, and Sticky Notes by Dashbd applications, and related pairing, local editing, user-media, feedback, weather, market-data, app-access, and support services (together, the "Services"). It should be read with our Terms of Service.

This is one policy for every current Dashbd application. It applies separately to each of Dashbd, Calendar by Dashbd, Countdown by Dashbd, Weather by Dashbd, Stocks by Dashbd, and Sticky Notes by Dashbd on every supported platform and distribution channel, as well as the website and related Services identified above. A feature-specific section below applies only when you use that feature in an application that offers it.

The Services do not use advertising trackers, sell personal information, or use your information to train artificial-intelligence models. Some features do use the service providers described below.

1. Information we handle

Website and network information

When you access the Services, our hosting and security provider may process your IP address, request time, URL, browser or device type, referring page, and security or error information. We use this data to deliver, secure, troubleshoot, cache, and rate-limit the Services. We do not currently run Google Analytics, Amplitude, or Sentry on the public website.

Feedback account and public roadmap

If you choose to sign in to the roadmap with Google, we receive your Google account identifier, email address, name, profile image, and locale. We store these details with your feature requests and votes. A signed, HTTP-only feedback-session cookie keeps you signed in for up to 14 days. The public roadmap and its public data response include the content of your request, profile image, and a display label derived from your first name or the part of your email address before the “@” symbol. Your full email address and locale are not included in that public response. We may email you when a request you created or voted for is completed.

App settings and connected services

The apps store settings on your device, including widget layouts, selected locations and market symbols, note text and layout, appearance, calendar and provider metadata, and app-access state. Depending on the feature you enable, the apps may also store calendar URLs, OAuth tokens, or service credentials locally. iCloud CalDAV credentials entered directly in the app are stored using the device secure-storage facility and are removed when you disconnect that provider. Google and Microsoft OAuth tokens are stored in app-local storage so the app can refresh and display your calendars.

Calendar event data is requested from Google Calendar, Microsoft Graph, Apple iCloud CalDAV, or an iCalendar URL that you provide and is used to render the calendars and meeting widgets you select. Google Calendar is requested with read-only access. Microsoft requests the Calendars.ReadWrite permission, although the current app uses the connection to read calendars and events. We do not use connected-calendar data for advertising or AI training.

TV pairing

The browser-to-TV pairing service may temporarily process a calendar URL, Google or Microsoft OAuth access and refresh tokens, or an Apple ID and app-specific password that you enter on the pairing page. This data is placed in a short-lived pairing record so the intended device can retrieve it. Pairing records are valid for up to one hour and are normally removed when pairing is cancelled or during expired-record cleanup. After retrieval, the connected app stores the information locally as described above. Do not enter your primary Apple account password; the iCloud flow is designed for an app-specific password.

Location, weather, and other widgets

The apps do not request precise device-location permission. If you use automatic location, FreeIPAPI derives approximate coordinates from your public IP address. Those coordinates are reused locally for 12 hours and may remain on the device until overwritten, cleared, or the app is removed. You can instead choose a city manually.

Coordinates, units, and locale are sent to Dashbd's Cloudflare-hosted weather endpoint, which may cache rounded-coordinate results for about 15 minutes and send coordinates to the configured weather provider, currently Open-Meteo or WeatherAPI. Location-based tide, sun, air-quality, and travel-time widgets may send coordinates to Open-Meteo, TomTom, or the public OSRM routing service. Other widgets may contact USGS, Frankfurter, or a remote image, feed, API, or calendar host you choose. Those providers receive the request information needed to respond and may receive your IP address when the app connects to them directly.

Home information

Apple Home access is read-only and handled by Apple's HomeKit framework on the device. If you connect the Google Home feature, Dashbd may store your account identifier, connection status, and one current read-only device snapshot in Supabase so your app can display it. The stored Google Home snapshot is removed when that connection is disconnected.

Market data

If you use Stocks by Dashbd, the app sends the symbols, requested chart range, and refresh interval needed for your selected widgets to Dashbd's Cloudflare-hosted market-data endpoint. The endpoint sends the necessary request to the configured market-data provider and may cache responses by symbol, range, and permitted refresh period. It uses a pseudonymous RevenueCat app-user identifier to verify available app access. Market-data responses can include the provider's quote time and data-delay status so the app can show freshness directly.

Sticky Notes and private photos

Sticky Notes stores note text, colors, positions, and other layout data on the TV device. When you open its phone editor, the TV runs a temporary local-network server and shows a QR link. Note changes travel directly between your phone and TV while that session is open and are not sent to Dashbd. The local connection may process the devices' local IP addresses and short-lived session credentials in memory. Anyone with the QR link and network access during the session may be able to edit the board, so close the editor when finished.

If a user adds a photo, the app sends the image, content type, dimensions, an opaque installation identifier, and a pseudonymous RevenueCat app-user identifier to Dashbd's Cloudflare-hosted private media service. The service verifies upload access server-side, accepts only JPEG, PNG, or WebP images up to 5 MB, and stores the image under an opaque key in a non-public Cloudflare R2 bucket. Short-lived, signed capabilities protect upload and read requests. Note text and layout are not included with the photo object.

App analytics and error reporting

Production apps use Amplitude for product analytics and Sentry for crash and error reporting. These services may receive a pseudonymous device or session identifier, app version, platform, locale, app state and page, interaction and purchase events, widget types and layout, subscription tier, calendar/provider counts, install date, and sanitized diagnostic context. Calendar credentials and OAuth tokens are redacted from structured logs. Analytics and error data is used to operate and improve the Services, not for advertising.

Purchases

Apple, Google, or Amazon processes your payment and store account data. RevenueCat processes a pseudonymous app-user identifier, product, entitlement, purchase, and subscription status so the apps can offer, validate, and restore purchases. Dashbd does not receive your full payment-card details.

Support and communications

If you email us, we receive the information in your message. If you choose "Send diagnostic data" in an app, the report may include app and device details, version, timezone, calendar and provider names and IDs, subscription/customer information and sanitized logs. The current diagnostic payload is designed to exclude authentication credentials and calendar-event content. Reports are stored in Supabase and processed through Cloudflare. Feedback emails are delivered through Resend.

2. How we use information

  • provide, personalize, maintain, and secure the Services;
  • connect the calendars, home services, feeds, and widgets you choose;
  • provide local note editing, private photo storage, weather, market data, routing, app access, feedback, and support;
  • diagnose errors, measure feature use, and improve the Services;
  • communicate with you about feedback or requests you send us; and
  • comply with law and protect users, Dashbd, and third parties.

Depending on where you live, we rely on performance of a contract, consent, compliance with law, and our legitimate interests in operating, securing, supporting, and improving the Services. You can withdraw an optional connection or permission, but the related feature may stop working.

3. When we disclose information

We disclose information to service providers only as needed for the purposes above. These include Cloudflare (hosting, security, cache, and private photo object storage), Supabase (database, storage, and authentication), Google and Microsoft (sign-in and connected calendars), Apple/iCloud (store, HomeKit, and CalDAV), RevenueCat and the applicable app store (access validation), Amplitude (analytics), Sentry (error reporting), Resend (email), and the location, weather, market-data, routing, feed, and content providers selected by a feature.

We require service providers that process personal information for us to protect it consistently with this policy and applicable law and to use it only for the services they provide to us, subject to their independent legal obligations.

We may also disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or complete a financing, merger, acquisition, reorganization, or sale, subject to appropriate safeguards. We do not sell personal information or disclose it for cross-context behavioural advertising.

4. Retention

  • Pairing records expire after one hour and are removed through cancellation or cleanup.
  • The feedback login cookie expires after 14 days; logging out clears it sooner.
  • Feedback profiles, votes, and requests remain until deleted or a valid deletion request is completed. Removed roadmap items may remain in restricted records or backups for a limited period.
  • Support reports currently have no automatic expiration and remain until manually deleted or a valid deletion request is completed.
  • App settings and connected-service information remain locally until cleared, disconnected, overwritten, or the app is removed.
  • Unattached Sticky Notes photo uploads expire after 24 hours. Attached photos remain until you remove or replace the photo, delete its note, or complete a verified deletion request. Replacement cleanup is retried by a private scheduled cleanup process if an immediate storage deletion fails. Existing attached photos remain readable if app access changes; new uploads require verified access.
  • Analytics, error, email, network, and store-access records are retained under our or the relevant provider's settings for as long as reasonably needed for the purposes described above.

We may retain limited information longer when required by law or reasonably necessary for security, fraud prevention, disputes, or enforcing agreements. Backup deletion may take additional time.

5. Security and international processing

We use reasonable administrative, technical, and organizational safeguards appropriate to the information involved, including transport encryption, restricted administrative access, secure cookie settings, short-lived pairing and media capabilities, private object storage, and log redaction. No system is completely secure, and we cannot guarantee absolute security.

Dashbd and its providers may process information in Canada, the United States, the European Economic Area, and other countries where they operate. Those countries may have different privacy laws. Where required, we use recognized safeguards for international transfers.

6. Your choices and rights

  • You can avoid Google feedback sign-in and use most Services without a website account.
  • You can log out, disconnect providers, select a city manually, reset local settings, or remove an app.
  • You can revoke Google, Microsoft, Apple, or other provider access in that provider's account settings.
  • You may request access, correction, deletion, or a copy of personal information and object to or restrict certain processing where applicable.
  • You may withdraw consent where consent is the basis of processing and complain to your local privacy regulator.

To exercise a privacy right, email privacy@dashbd.com. We may need to verify your identity and may retain information where permitted or required by law.

7. Children's privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If local law requires parental consent at an older age, a parent or guardian must authorize the child's use. Contact us if you believe a child provided personal information without the required permission.

8. Changes to this policy

We may update this policy as the Services or legal requirements change. We will post the revised policy and update the date below. If a change is material, we will provide additional notice when reasonably required.

9. Contact

Dashbd Inc.'s Privacy Officer can be reached at privacy@dashbd.com. General product support is available at support@dashbd.com.

Last updated: August 14, 2026.