Privacy
Privacy
In plain language first, then the policy in full.
Rookery is used by a household and by the people it employs to look after its children. It holds a care record about a child and an employment record about a caregiver, and those two things are the reason it is built the way it is.
What is collected
Names, email addresses and phone numbers of the people in a household. Journal entries, routines, learning notes and incident reports about the child. Shifts, hours, pay rates and payments for a caregiver. Messages between members of the household. Photos attached to any of the above.
Location is recorded ONLY while a caregiver is clocked in, and only if they have granted it. It stops the moment they clock out. They can withdraw that consent from their own phone at any time, and nobody in the household can turn it back on for them: there is exactly one handler in the system that writes that setting and it takes the identity from their own session.
What is not done with it
None of it is sold, rented, or shared with advertisers. There is no analytics service, no advertising identifier, no third-party tracking of any kind, and no data broker. Nothing about a child is sent to any third-party service.
We can see who is using Rookery and how to reach them: names, email addresses, roles, and which household somebody is in. That is true of caregivers as well as parents, so that when something does not work for a caregiver they can be helped directly instead of through their employer. We can see whether things are working, and we may write to you about Rookery itself, which during the beta is part of the arrangement. We cannot see what is in your household: not the journal, not the messages, not the photos, nothing about your child. That is not a promise to behave. The part of Rookery we use to support you has no way to ask for those things. If a fault ever cannot be found without looking at a record, you are told, the reason is written down, and you can read that record yourself.
Where it lives
In one database belonging to the household, on Cloudflare. Two things leave it, both because they cannot work otherwise: notifications go through Apple's Push Notification service, and sign-in codes go by email through a transactional mail provider. Neither carries the contents of the care record. A notification says that a message arrived, never what it said.
Who can see what
A caregiver sees the child's care record, the routines, the house information they need, and their own hours. They do not see the household's private material and they do not see another caregiver's record. What the household can see about them, they can see about themselves, in the same words.
How long location is kept
Location recorded during a shift is kept as part of that shift's record. It is not deleted after a few days, and the reason is worth stating plainly rather than burying: where a child was, and when, is occasionally the only way to answer a question nobody could have anticipated. A measles exposure notice naming a place and a window is the ordinary example. A household that cannot say whether its child was there has to assume the worst.
It is kept for that purpose and used for no other. It is not analysed, not scored, not used to evaluate anybody's work, and never leaves the household's own database. A caregiver can see exactly what is held about them, in the same words the household sees, and they can stop it being recorded at all from their own phone at any time.
Keeping and deleting
A person can ask for their account to be closed, and the household must do it. Sessions, passkeys, notification tokens and device credentials are revoked immediately. Employment records that a household is obliged to keep, such as hours worked and payments made, are retained for as long as the law requires and no longer. Anyone can ask what is held about them by writing to the address below.
Children
Rookery is used by adults. The record it holds is about a child, and it is kept on behalf of that child's parents, who decide who may see it.
In full
Privacy Policy
Last updated 30 August 2026.
1. Who is responsible for your information
Rookery is software licensed to a household. The household that operates an installation decides what is recorded in it, who may see it, and how long it is kept. In the language of data protection law the household is the controller of that information, and Rookery is the processor acting on its instructions. Where an installation is operated for the developer's own household, the developer is the controller of that installation and no other.
Rookery is operated by Robb Dixon, an individual, in Pasadena, California. There is no company between the developer and this software, and this policy names the person who actually operates it rather than an entity that does not. Written contact: Robb Dixon, 45 S Arroyo Pkwy, Pasadena, CA 91105. By email: privacy@rookery.haus.
2. Categories of information processed
- Identity and contact. Name, email address, telephone number, postal address where a household records one, and emergency contact details.
- Care records concerning a child. Journal entries, routines, learning notes, milestones, incident reports and photographs.
- Health information about a child. A journal entry can record that medicine was given, what it was and at what time, and an incident report can describe an injury and what was done about it. Both are kept as part of that child's care record, held by the household on that child's behalf, and used for no other purpose. They are never transmitted to any third party.
- Employment records concerning a caregiver. Shifts, hours, pay rate, payments, agreements signed, certifications, and records of scheduling changes including who made them and when.
- Communications. Messages exchanged between members of a household, and the times at which they were read.
- Precise location. Recorded from a caregiver's own device, only while that person is clocked in to a shift, and only where that person has granted permission on that device.
- Authentication material. Session tokens, public keys for passkeys, single-use sign-in codes, and notification tokens.
Information concerning a child, including anything recorded about medicine or an injury, and precise location, are treated as sensitive throughout. None of it is used for any purpose beyond the one stated here.
3. Purposes and legal bases
- Operating the household's care record so that the people responsible for a child can see what happened and when. Performance of the arrangement between the household and the people it engages, and the legitimate interests of a parent in the welfare of their child.
- Operating the household's employment record so that hours are accurate and payment is correct. Performance of a contract, and compliance with the household's own record-keeping obligations.
- Recording location during a shift so that a household can establish where a child was at a given time. Consent, given on the device from which the information is sent, and withdrawable there at any time.
- Authenticating a person so that a household's records are not readable by strangers. Necessity, and legitimate interest in security.
- Operating and supporting the service, which means knowing who uses Rookery, being able to reach them, and being able to see whether the software is working for them. Legitimate interest in running a service people can be helped with, and, during the closed beta, the arrangement between the operator and the people testing it. Section 10 sets out what this does and does not include.
4. What is never done
Information held in Rookery is not sold, rented, licensed, or disclosed to advertisers, data brokers, or any party seeking it for marketing. No advertising identifier is collected or generated. No analytics, telemetry, session replay, profiling or behavioural tracking of any kind is performed, by Rookery or by any embedded third party. No information concerning a child is transmitted to any third party service. Rookery does not train, and does not permit any third party to train, a machine learning model on a household's records.
Rookery does not make automated decisions producing legal or similarly significant effects. Where the software applies a rule to a schedule, such as a notice period, the outcome is presented to the people affected and can be overridden by a person, with the reason recorded.
5. Recipients and transfers
A household's records are stored in a database dedicated to that household, hosted by Cloudflare, Inc. Two categories of information leave that database because the corresponding function cannot operate otherwise:
- Notification delivery. Apple Push Notification service and standard web push services receive the fact and the destination of a notification. Notification content is deliberately minimal and does not carry the contents of a care record, a message, or a sign-in code.
- Sign-in codes by email. A transactional email provider receives the recipient address and the code. It receives nothing else.
- The operator, for support. Robb Dixon operates Rookery and can see operational information about a household in order to keep it working: whether people can sign in, whether messages are being delivered, how many people are in a household and when they were last active. Not its records. Access to a record itself is exceptional, disclosed to the household, and recorded. Section 10 sets out exactly what is and is not visible.
Processing takes place in the United States. Where a household or a person is located in a jurisdiction requiring a transfer mechanism, the household as controller is responsible for putting one in place, and Rookery will execute a data processing agreement on request.
6. Retention
Care records are retained by the household for as long as the household determines, and are deleted on its instruction. Employment records, including hours worked and payments made, are retained for the period the household is obliged to retain them and no longer. Location recorded during a shift is retained with that shift's record for the purpose stated in section 3, and is not used for any other. Authentication material is revoked immediately when a person leaves a household, and sign-in codes expire on use or within a short window. Identification documents submitted by an applicant who is not engaged are deleted.
7. Rights of the people whose information is held
Any person whose information is held may request access to it, correction of it, deletion of it, a copy of it in portable form, restriction of its processing, or may object to processing. A caregiver may withdraw consent to location at any time from their own device, and the household cannot restore it on that person's behalf. Requests are made to the household, or to privacy@rookery.haus, and are answered within thirty days.
California residents have the rights described in the California Consumer Privacy Act as amended, including the right to know, to delete, to correct, and to opt out of sale or sharing. Rookery does not sell or share personal information as those terms are defined, and processes Global Privacy Control signals as an opt-out where they apply. Exercising any right will never result in a person being treated differently.
8. Children
Rookery is not directed to children and is not offered to a child as a user. It is used by adults, and it holds records concerning children on behalf of the parents or guardians who are responsible for them and who determine who may see them. Rookery does not knowingly permit a person under sixteen to create an account.
9. Security
Access is authenticated and scoped. Within a household, a person sees the records their role and their own ownership entitle them to see, and nothing else. Credentials are stored only as hashes or public keys. Where an access decision cannot be evaluated, the software refuses rather than assuming.
10. Support access by the operator
Rookery is operated by one person, and operating it means being able to answer the question "why did this not work". That is stated here rather than left to be discovered, because a policy that omits an access route the software has is worse than no policy at all.
Who you are, and how to reach you. The operator can see the people using Rookery and their contact details: name, email address, role, and which household they belong to. Also when they joined, when they last signed in, whether a sign-in succeeded or failed and at which step, whether email and notifications are reaching them, and how much storage a household uses.
This includes caregivers, and that is worth saying plainly, because it is the least obvious part. A caregiver did not sign up with Rookery; a household added them. Their name and email are visible to us for the same reason a parent's is, and only that reason: so that when something does not work for them, there is somebody who can find their record and fix it rather than asking their employer to relay the problem.
What is not visible. The household's own records. Not the care journal, not messages, not photographs, not the learning record, not incidents, and nothing concerning a child. Knowing who somebody is and being able to reach them is a different thing from reading what they wrote, and Rookery treats them as different things.
When more is needed. If a fault cannot be diagnosed without looking at a record, that is a deliberate, exceptional step and it is not silent. The household is told, the reason is recorded, and the record of it is shown to the household inside the product rather than kept in a log they cannot see. It is limited to what the fault requires and it is not a standing permission.
Being contacted. The operator may write to you about Rookery itself: that something went wrong and has been fixed, that a change is coming, or to ask how it is going. During the closed beta this is part of the arrangement rather than an extra, because the beta is a two-way one and finding faults before a wider release is the point of it. It is not marketing and your address is not given or sold to anybody. You can ask to be left alone and still keep using the product.
Every action the operator takes is recorded, including the ordinary ones.
11. Changes
A material change to this policy is announced in the product to the people affected before it takes effect, rather than published silently and dated.