Privacy Policy

Last updated: 4 November 2026

This Privacy Policy explains how SK7 Ltd (“we”, “us”, “our”) collects, uses, and shares information when you use Bothly: the Android app, the web app and the website at getbothly.com (“Bothly”, the “App”). If you do not agree with this policy, please do not use the App.

For any privacy question or request, contact us at hi@sk7.si.

Who we are

Bothly is a shared custody calendar for two homes. Two co-parents, of kids or of pets, keep one schedule of who has them when, agree on changes to it, chat, and confirm handoffs, and can let other people view the agreed schedule. It is published by SK7 Ltd. For the purposes of the EU/UK General Data Protection Regulation (GDPR), we are the “data controller” of your personal data.

Information we collect

We only collect what the App needs to work. We do not use analytics or advertising, we do not track you across other apps or websites, and we do not sell your personal data.

• Account information. Your email address, which you give when you create an account with a password, or which Google provides if you choose “Continue with Google”, together with an account identifier that Firebase Authentication generates. With Google, Google also gives Firebase Authentication your name and profile picture; the App uses only your first name, to suggest the name others see. You choose that name, and you can add a photo of yourself, which we store with your profile. Your password is kept by Firebase Authentication, which stores only a hash of it; we never see or store it ourselves.
• Your calendars. For each calendar: whether it’s for kids or pets, its time zone, who is on it as a co-parent or a viewer (with the label a co-parent gave a viewer, such as “Grandma”), and when each of them joined or left; on a calendar you keep on your own, the name you gave the other parent; the usual rotation, meaning whose days are whose, the handoff time and the handoff place (which can be a place you name, such as a school); and the changes to it that were agreed.
• Your kids or pets. What co-parents enter about them: each one’s name and whether they’re a child, a dog, a cat or another animal, and if you add them, a birthday, a photo and notes.
• Requests, chat and history. Change requests and their answers, with any note written with them; chat messages, which are text only; when each co-parent last read the chat and the updates; “Got them” handoff confirmations; and the calendar’s history, the log of what was asked, agreed, declined, withdrawn, recorded and confirmed, and of who joined and left.
• Invite codes. The codes co-parents make to invite the other co-parent or a viewer, when each one expires, the label given to a viewer’s code, and the preview shown to whoever enters a code: kids or pets, their names, the inviter’s name and, on a calendar kept on your own, the name of the other parent.
• Notifications. Which notifications you want from each calendar, and for each phone or browser you’re signed in on, a push token from Firebase Cloud Messaging and whether it’s an Android phone or a browser.
• Handoff reminders on the web. A browser can’t wake a closed tab, so while Bothly is open in a browser it saves your handoff reminders for the next two weeks, each with its time and the words it will show, for our server to send when they’re due. Each one is deleted once it’s sent.
• Requests to our servers. Joining, leaving, answering a request and similar actions reach our servers as small request records that hold your account identifier, the calendar’s identifier and what was asked.

Bothly doesn’t access your contacts or your location, and of your photos only the one you pick, made smaller first.

Notes about a kid or pet are free text. If you write health information in them, such as an allergy or a medicine, it is stored like any other note and seen only by the co-parents. Please write only what the other co-parent needs to know. Keep in mind that what you put on a calendar is seen by the others on it, as described below.

What stays on your device

• A copy of your calendars, so the App works offline: on your phone, or in your browser’s storage. Signing out deletes it.
• A calendar kept without an account (Android only) stays on your phone and is never sent to us. If you sign in later, the App moves it to your account, and from then on it’s stored like any other calendar.
• Your own calendars, as described in the next section.
• Handoff reminders on Android, which are alarms set on your phone.
• Choices that belong to the device: light or dark appearance, the calendar shown last, an invite code waiting for you to sign in, and your notification choices. They stay on the device when you sign out.
• Your password, if you let your phone’s password manager save it (Android): that password manager keeps it, such as Google Password Manager, which can also keep it in your Google account. We never see it.
• A history PDF, if you export one: it’s made on your device and goes only where you send it.

If your Android phone backs up app data to your Google account, Android’s backup can include what the App keeps on the phone. That backup is between you and Google.

Your own calendars

In the Android app, you can show your own events beside the schedule, to you alone, read-only. The App asks for Android’s calendar permission and reads the calendars on your phone, from whichever accounts it syncs, such as Google or Exchange, and those kept only on the phone. You can turn the permission off at any time in your phone’s settings.

The web app doesn’t show your calendars. If you connected your Google Calendar in a browser before 4 November 2026, Bothly no longer uses that access, and you can take it back at any time in your Google Account (myaccount.google.com/permissions).

Your events are never sent to us, never shown to the other co-parent or to viewers, and never written back: Bothly can’t change your calendars. What the App has read is kept on your device and deleted when you sign out or disconnect.

Bothly’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where your data is stored

• On your device, as described above.
• In Google Firebase. Profiles and calendars are stored in Cloud Firestore in Google’s eur3 multi-region, in the European Union. The Cloud Functions that answer requests, send notifications and delete data run in Google’s europe-west1 region, in Belgium. Sign-in (Firebase Authentication) and push delivery (Firebase Cloud Messaging) are Google services that may process data outside the EU (see “International data transfers”).
• The website and the web app at getbothly.com are served from a server we rent from Hetzner Online in Helsinki, Finland, in the EU. It keeps no access log of visits. Its system log records the server’s own events, such as certificate renewals, and the IP address of any request that ends in a server error. The website’s pages use no cookies, analytics, or third-party requests. The web app talks only to Google Firebase, and to Google itself when you sign in with Google, and keeps its copy of your calendars in your browser’s storage.
• Invite links at handoff-sk7.web.app are answered by Firebase Hosting, part of Google Firebase.

How we use your information

We use your information to:

• create and secure your account and sign you in;
• store, sync, and show your calendars on your devices, and to the people on them as their role allows;
• carry requests and answers between co-parents, apply the changes you agree on, and keep each calendar’s history;
• send the notifications you’ve asked for (see “Notifications” below);
• move a calendar kept on your phone to your account when you sign in;
• delete data when you ask us to, as described below;
• operate, maintain, debug, and protect the App; and
• comply with legal obligations and enforce our Terms of Service.

We don’t use your information for advertising or profiling.

Legal bases (EEA/UK users)

Where GDPR applies, we rely on these legal bases:

• Performance of a contract. To provide the App you ask for: your account, your calendars and sharing them, requests, chat, history, and the notifications that are part of them.
• Legitimate interests. To keep the App secure and prevent abuse; to hold what co-parents enter about their kids or pets, so they can organise their care together; and to keep a calendar’s shared record (its history and chat) for the co-parent who stays after the other leaves or deletes their account. We do this in a way that does not override your rights.
• Consent. For push notifications on your phone or in your browser, and for reading your own calendars. You can withdraw either at any time: notifications in the App or in your device or browser settings, your calendars by disconnecting them or turning off the calendar permission.
• Legal obligation. Where we must retain or disclose data by law.

How your information is shared

We do not sell your personal data. We share information only as follows:

• With the people on your calendars. The other co-parent sees everything on a calendar you share: the schedule, your kids’ or pets’ details and notes, requests and their notes, the chat, and the history. Viewers see only the agreed schedule: who has them when, handoff times and places, the kids’ or pets’ names, kinds, birthdays and photos, and the names of the people on the calendar. They never see notes, requests, the chat, or the history. Your name shows on each calendar you’re on; your email address is never shown to anyone. A co-parent is told when the other adds a viewer. Whoever enters an invite code sees its preview.
• With service providers (processors). We use Google Firebase for authentication, the cloud database (Cloud Firestore), the server code that answers requests (Cloud Functions), push notifications (Cloud Messaging) and invite links (Hosting), and Google Sign-In for signing in with Google. We rent the server for getbothly.com from Hetzner Online GmbH. They process this data on our behalf. In a browser, a push notification is delivered by the browser maker’s push service (for example Google’s, Mozilla’s or Apple’s), encrypted as the Web Push standard requires. See Google’s Privacy Policy at https://policies.google.com/privacy, and how Google uses data from apps that use its services at https://policies.google.com/technologies/partner-sites.
• App stores. Google may collect information related to app downloads under its own policies. If you open an invite link on an Android phone without the App, Google Play passes the invite code to the App when you install it.
• For legal reasons. We may disclose information if required by law, or to protect the rights, safety, or property of our users or us.
• Business transfers. If we are involved in a merger, acquisition, or asset sale, your information may be transferred, subject to this policy.

International data transfers

Your calendars are stored in the EU, but some of your data may be processed on servers outside your country, including in the United States, by Google: for example by Firebase Authentication and Firebase Cloud Messaging. Where required, such transfers are covered by appropriate safeguards (for example, the European Commission’s Standard Contractual Clauses or the EU–U.S. Data Privacy Framework).

Data retention and deleting your data

We keep your personal data for as long as your account is active, and for as long as a calendar you shared is kept by the people on it, as described here. We don’t keep it for a fixed period.

• Stopping sharing. When you stop sharing a calendar and leave it, the other co-parent keeps it with its full history: your name as it was, your messages, and the requests you made stay on it, as part of the record you both kept. The viewers you added and the viewer codes you made go with you. If you were its last co-parent, the calendar is deleted with everything on it, its history, chat, photos and notes included, and its viewers lose it.
• Viewers can leave a calendar at any time, and a co-parent can remove them. Their name goes from the calendar; only its history, which the co-parents see, still says they were added and removed.
• Deleting your account (in the App: Account › Delete account) leaves every calendar you co-parent as stopping sharing would, takes you off the calendars you view, and deletes your profile with your name and photo, your push tokens, your notification choices and your planned web reminders, and finally your sign-in at Firebase Authentication. You can also ask us to delete your account by email.
• Removing a kid or pet deletes their photo and notes with them.
• Signing out deletes the copy of your calendars on that device, and what it read from your own calendars.
• What stays behind. A few small records outlive an account or a calendar, and you can ask us to delete them: the request records the App sent our servers for you (each holds your account identifier, the calendar’s identifier and what was asked; a change request or an answer to one also holds the note written with it), and the invite codes made for a calendar (each holds the inviter’s name and the kids’ or pets’ names as its preview showed them).
• The web server’s system log is kept by size, not for a set time.

Deleted data may take a short while to disappear from our service providers’ systems. Some minimal records may be retained where required by law.

Your rights and choices

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data (you can edit your name, your photo and your kids’ or pets’ details in the App);
• delete your data (you can leave calendars and delete your account in the App, or ask us);
• object to or restrict certain processing;
• data portability (you can also export a calendar’s history as a PDF in the App); and
• withdraw consent (for example, turn off notifications or disconnect your calendars) at any time.

Some of what’s on a shared calendar is also the other co-parent’s, such as its history and the chat you both wrote. A request to delete it may have to be weighed against their interest in keeping that record.

To exercise any of these rights, or to request account deletion, email us at hi@sk7.si. We will respond within the timeframe required by applicable law. You also have the right to complain to your local data protection authority.

California residents: we do not sell or “share” personal information as those terms are defined under the CCPA/CPRA, and we do not discriminate against you for exercising your privacy rights.

Notifications

The App can send:

• Handoff reminders. On Android, alarms scheduled on your phone from the calendars on it. In a browser, the reminders described under “Information we collect”, sent by our server.
• Push notifications about requests and answers, changes to the usual rotation, chat messages, the other co-parent’s “Got them”, the other co-parent joining or leaving, a new viewer, and, for viewers, changes to the schedule. They’re delivered through Google Firebase Cloud Messaging and, in a browser, its push service. A notification carries what it needs to show: the names of the people involved and of your kids or pets, the dates and times of a change, the note written with a request or an answer, and up to the first 500 characters of a message.

You can turn each kind off for each calendar in the App, and turn notifications off at any time in your device’s or browser’s settings.

Security

We use reasonable technical and organisational measures to protect your data, including encryption in transit (TLS) and access rules in our cloud database that let each person read only what their role on a calendar allows, and that leave writing a calendar’s history to our servers alone. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

Children’s privacy

Bothly is for parents and pet owners. It is not directed to children under 13, and we do not knowingly collect personal data from children under 13 who use it. Bothly does hold information about children that their parents enter (names, birthdays, photos and notes) to organise their care between two homes. Only the co-parents see the notes; the viewers they add see the names, birthdays and photos with the schedule. A parent can remove a child’s details in the App, or contact us to have them deleted. If you believe a child has provided us personal data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you in the App. Your continued use of the App after changes take effect means you accept the updated policy.

Contact us