Privacy policy

Last updated: 24 October 2026. DRAFT: this text describes the public release and is not final until the diagnostics change (Mind #19596) has landed.

D.A.D. Button (Digital Accessibility Device) is an accessibility tool for people with disabilities. This policy lists exactly what the app collects, where it goes, and why. It is written in plain language on purpose. "We" means the developer of the app. The contact address is hello@dadbutton.app.

What the app collects and where it goes

• Voice requests. The app listens through the microphone only to hear the user's request. Speech is turned into text by the speech recognition service on the user's Android device, which the app asks to work offline. That service is provided by the device maker or Google and may process audio under its own privacy policy. The app itself sends no audio to our servers. The wake word is detected on the device.
• Request text. The text of what the user said is sent to our server so the app can work out what to do (for example, which app to open). For some requests our server also sends the request text to Google Gemini, a language model service, to answer it. The list of apps installed on the device, the user's favorites, the app version, and an anonymous device identifier are sent with it.
• Questions. When the user asks a general question, the text of the question and the anonymous device identifier are sent to our server, which passes the question to Google Gemini, an AI language model service, to write an answer. Questions may be about health or other personal subjects if the user chooses to ask them. Our server keeps a record of each question and its answer so we can run and fix the service. These records are deleted automatically 30 days after the question is asked, and sooner on request.
• Approximate location. If the user allows location access, the approximate location of the device is sent with a request, only to answer weather questions. Our server passes the coordinates to the United States National Weather Service to look up the forecast. We do not store it as a location history.
• Contacts. If the user allows contacts access, the app reads names and phone numbers on the device to place a call the user asked for. Contacts stay on the device and are not sent to our servers.
• Spoken replies. Text the app speaks aloud may be sent to a text-to-speech provider (Microsoft Azure Speech) to produce the voice. Otherwise the Android voice on the device speaks it.
• Accessibility service. With the user's explicit permission, the accessibility service reads the screen of a short, fixed list of streaming apps and the Android Recents screen, and taps or swipes for the user after the user makes a voice request. What it reads stays on the device, is used only to choose the next tap, is not stored beyond the current request, and is not shared or sold.
• Usage log. The app records, for each request, the time, the request text, the outcome, how long it took, and the app version, and sends it with the anonymous device identifier to our server. The copy on the device is deleted after 30 days.
• Anonymous problem reports (optional, off by default). In settings, under Privacy, the user can turn on "Send anonymous problem reports". When on, the app sends a short report when something breaks, such as a crash or the microphone not working, plus a regular check-in with the time, app version, and device identifier. A report contains only a fixed label for the kind of problem, the name of the kind of error for a crash (never its message), the speech recognizer's package name when relevant, and a count of empty sessions. It never contains what the user said, contacts, a name, or other personal content. Nothing is stored for a crash unless this is on. When it is off, no problem reports or check-ins are sent, and turning it off stops any that are waiting. Alerts to the developer are sent only from a small number of developer-allowlisted test devices.
• Updates. The app checks for new versions and downloads them. This reveals the device's network address and app version to the update server, as any download does.

The anonymous device identifier

The first time the app runs it makes a random identifier. It is not the Android advertising ID, serial number, or any hardware value, and it does not identify the user by name. It lets us tell one device from another in our records and apply device-level settings. Uninstalling the app discards it.

What the app does not do

• It does not sell personal information.
• It does not read passwords, messages, or payment screens. The accessibility service is limited to the fixed list of apps. The app never types, reads, or keeps a login.
• It does not show advertising and does not use the data for advertising.
• It does not create accounts, and there is no sign-in to D.A.D. Button itself.

Sharing

We share information only with the service providers needed to run the app, and only for that purpose, or when the law requires it. These are: our hosting and database provider (Supabase); Google Gemini, which receives request text and question text to answer them; a text-to-speech provider (Microsoft Azure); the United States National Weather Service, which receives approximate coordinates from our server; and, for developer-allowlisted test devices only, the push notification service (ntfy) and email provider that deliver alerts to the developer. Data is sent over encrypted connections (TLS), and is encrypted at rest by our hosting provider.

Retention and deletion

The log on the device is deleted after 30 days. Question text is deleted automatically 30 days after it is asked, and sooner on request. The request text in our usage log is erased on the same 30-day schedule; the rest of that log entry (time, outcome, how long it took, app version) is kept without the text. The user, or a family member acting for the user, can ask us to delete the data tied to the user's device identifier by emailing hello@dadbutton.app with "Privacy request" in the message, or through the contact page. To help us find the records, include the device identifier if it is known; if not, we will work with the user to find them.

Permissions the app asks for

• Microphone, and a foreground service of the microphone type, to hear requests.
• Accessibility service, as described above.
• Notification access, only to see which media is playing; the app does not read notification content.
• Contacts, to place calls by name.
• Phone calls, to place a call the user asked for.
• Approximate location, for weather.
• Notifications, to tell the user about updates and reminders.
• Display over other apps, to show the on-screen button.
• Internet and network state, to reach the services above.
• Foreground services for media playback and the on-screen button, wake lock, and start at boot, to keep the button available.
• Set alarms, to set reminders and alarms the user asks for.
• Change system settings, for brightness requests.
• Install packages, to install app updates.

Each can be refused or turned off in Android settings; the app tells the user what will not work.

Children

The app is not directed to children under 13 and is not designed for children.

Changes

If this policy changes, we will update the date above and, for material changes, tell users in the app.

Contact

Questions about this policy: email hello@dadbutton.app or see the contact page.