Last updated: 15 October 2026
Effective date: 15 October 2026
Version: 1.1
1. Who we are
George Henty, an individual developer trading as dadmode, is the controller responsible for personal information used to provide dadmode.
Business correspondence address: 16 Goughs Lane, Knutsford, Cheshire, WA16 8QL, United Kingdom
Privacy contact: admin@dadmode.net
Website: https://dadmode.net
This policy explains how the dadmode mobile app and website handle information. It covers people who use the app, visit the website or contact us.
No login does not mean no personal data. dadmode creates a random account identifier rather than asking you to register with an email and password. Photos, project information and purchase status linked to that identifier can still be personal information. Your saved projects are not automatically backed up to an Apple ID or synchronised through iCloud by dadmode.
2. Information we handle
| Information | Source and purpose |
|---|---|
| Technical account and session information | Generated when the app establishes your account. Identifiers and authentication records connect your installation to your own projects and subscription access. |
| Photos and project content | Photos you take or choose to submit, descriptions, clarification answers, additional context, generated guidance and progress through a task. Used to analyse and save your DIY projects. |
| Home and DIY preferences | The country you select, whether you rent or own, property type, DIY experience and available tools. Used to tailor guidance. We do not request precise GPS location for this feature. |
| Local preferences and drafts | Appearance, onboarding choices, unsent drafts and reminder settings stored on your device. Relevant preferences are also included with an analysis request. |
| Subscription information | Store and RevenueCat customer/transaction identifiers, plan, purchase and renewal events, trial eligibility and entitlement status. Used to verify access, restore purchases and understand subscription performance. Limited hashed purchase/customer identifiers link usage allowances across restored accounts and help prevent abuse. We do not receive your full payment-card details or store password. |
| Technical and security information | Our infrastructure and providers may process IP addresses, device/operating-system and app-version information, request times, error/status information and usage counts needed to deliver and protect the service. |
| Support correspondence | Contact details and the information you choose to send when asking for help or making a privacy request. |
The app does not need your contacts, microphone recordings or continuous camera access. Camera and photo-library access are used for the photos you choose to take or select; we do not upload your entire library. A photo or description can itself reveal personal information, so avoid including faces, addresses, documents or sensitive information unrelated to the task.
3. How we use information and our legal bases
For processing covered by UK or EEA data-protection law, we rely on the following bases:
| Purpose | Information involved | Basis |
|---|---|---|
| Provide the service you request, save projects and generate personalised DIY guidance | Account, project content, relevant home/DIY preferences | Performance of our contract with you, or steps you request before entering it. |
| Process subscription access and restore eligible purchases | Account and subscription information | Performance of our contract. |
| Respond to service enquiries | Contact information and relevant project/account details | Contract where related to your service; otherwise our legitimate interest in answering enquiries. |
| Prevent misuse, secure systems, diagnose failures and measure service reliability | Identifiers, technical information and usage records; relevant content only where needed to investigate a particular issue | Our legitimate interests in running a secure, reliable service and preventing fraud, balanced against your rights. |
| Understand subscription performance | Purchase and entitlement events | Our legitimate interest in operating and improving the subscription service; consent instead where applicable tracking rules require it. |
| Deal with legal obligations and privacy requests | Information necessary for the obligation or request | Compliance with applicable legal obligations. |
| Handle or defend legal claims | Relevant correspondence, transaction or incident records | Our legitimate interest in establishing, exercising or defending legal rights. |
| Optional device notifications | Local reminder information and device permission | Your choice and permission; consent where required by applicable law. |
We do not treat agreement to the Terms of Use as consent to every use of information. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing. Device permissions can be changed in your device settings.
Some information is necessary to provide the requested feature: without submitting the relevant photos/context, we cannot analyse them; without verifying purchase status, we cannot enable premium access. You can contact us about privacy or request deletion without an active subscription.
4. AI processing
When you request analysis or further guidance, relevant photos, your task description, clarification answers, relevant earlier project context and home/DIY preferences are sent through our backend to OpenAI to generate a response. We do not deliberately include your payment-card information or store password. Personal information visible in an image or entered in text is part of what is sent.
The app asks for your permission before sending guidance requests to OpenAI. You can change this choice in Account → Photos & privacy → AI guidance. Turning it off stops new guidance requests; requests already sent may finish. Withdrawal does not undo processing already completed or delete your saved fixes. You can request data deletion separately as explained below.
Our API requests disable optional response storage. Optional sharing of inputs/outputs, model feedback, and evaluation or fine-tuning data for model improvement is disabled in our OpenAI API account. OpenAI states that API content is not used to train its models by default unless the customer opts in.
This is not a promise of zero retention. OpenAI may retain content in abuse-monitoring records for up to 30 days by default, or longer for legal or safety reasons; flagged image content can be retained for review. Other limited technical processing, such as temporary prompt caching, can also involve retention. See OpenAI's API data controls.
dadmode saves the resulting guidance with your project. We do not use your project photos as public examples or advertising without separate permission.
AI tailors suggestions using the information you provide. It does not make credit, employment, insurance or similar decisions about you. DIY and risk ratings are estimates, not professional findings. Subscription access is checked automatically using purchase status; contact us if you believe access has been refused incorrectly.
5. Who receives information
We use providers to deliver the service:
| Recipient | Role and information |
|---|---|
| Supabase | Authentication, database, private photo storage and backend processing: account identifiers, project content, relevant preferences and operational records. |
| OpenAI | AI analysis of the photos and context described above. |
| RevenueCat | Subscription validation, customer and purchase management, and subscription reporting: pseudonymous app user ID, purchase/entitlement events and relevant device/technical data. We do not deliberately send project photos or descriptions to RevenueCat. |
| Apple | App distribution, store transactions, subscription management and platform functions, under Apple's own privacy notices. Apple's records may include information collected directly from you that we do not receive. |
| Amazon Web Services (AWS Amplify Hosting) | Website delivery and security: connection and request information needed to serve pages, diagnose delivery failures and investigate misuse. |
| Google (support email) | Correspondence you send us and information needed to respond. |
Providers acting as our processors handle information under their applicable processing agreements. Providers and stores may also process limited information for their own legal, fraud-prevention or security purposes under their own notices. We may share necessary information with professional advisers, authorities or courts where legally required or justified to protect rights and safety.
If the business changes ownership, relevant information may be transferred as part of that transaction with appropriate protections and notice. This does not authorise an unrelated use inconsistent with this policy without the steps required by law.
6. Shopping links, advertising and website technology
The app does not currently include an advertising SDK or Apple Ads attribution-token collection, and we do not sell your project photos. We do not sell personal information or share it for cross-context behavioural advertising.
Opening a product-search link sends the search term to the selected retailer or search provider; a local shopping search can also include your selected country. That website receives normal connection information such as your IP address and may use its own cookies. This does not send your complete saved project as part of the link. Review that website's privacy information before using it.
The mobile app stores native session credentials and deletion-recovery credentials using secure device storage. Ordinary preferences, unsent drafts and reminder settings use local app storage. It does not use browser advertising cookies. Optional trial reminders are scheduled on the device; they do not require uploading your photo library or registering a remote advertising profile.
Website: The website saves your chosen light or dark theme in browser local storage until you clear site data or change that preference. It does not include analytics, advertising pixels, a mailing list or a contact-submission form. AWS serves the website and may process connection and request information for delivery and security.
We do not currently sell personal information or share it for cross-context behavioural advertising, including when you send a Global Privacy Control signal. Our website does not implement a separate response to browser Do Not Track signals. These signals do not prevent processing needed to deliver the service or meet legal obligations. If our practices change, we will explain the change and implement any opt-out handling required by applicable law before starting it.
7. International processing
Our business is based in the UK. Our primary Supabase project is hosted in Ireland (AWS eu-west-1). Providers may process or access information in other countries, including the United States. Choosing a UK or European hosting region does not mean every provider operation occurs there.
Our providers' processing agreements include protections for international transfers. For Supabase, OpenAI and RevenueCat, these include the European Commission's Standard Contractual Clauses and UK transfer addenda where applicable. The mechanism depends on the recipient and transfer; an applicable adequacy decision may also permit a transfer. Contact us for information about the safeguards relevant to your information or a copy, with confidential information appropriately redacted.
8. Retention and deletion
We keep information for the purposes described here. Where there is no single fixed period, the criteria below determine how long it is needed. We review information we control and delete or anonymise it when those reasons no longer apply.
| Record | Retention |
|---|---|
| Saved projects, submitted photos, guidance and account records | Kept to provide your saved project history until you delete your account. There is currently no automatic deletion after a fixed period of inactivity. Cancelling a subscription, moving a fix to Past fixes or uninstalling does not itself delete server data. |
| Local preferences and drafts | Remain on the device until cleared through app functionality, data deletion or device/app storage controls, subject to any device backup behaviour. |
| Abandoned uploads and incomplete projects | Unfinished projects follow the same account-retention rule. The app attempts to remove photos when an initial project save fails; if that cleanup is unsuccessful, uploaded files can remain until account deletion. No routine automatic expiry for abandoned uploads is currently implemented. |
| Account usage counters and request-control records | Kept with your account to apply usage limits, prevent misuse and diagnose access problems. Current day and minute counters are updated as you use the service. Records tied directly to your account are removed when the account is deleted; the limited purchase-based abuse records below are separate. Provider operational logs are also separate. |
| Purchase-based abuse records | Hashed subscription identifiers and a limited association with the accounts holding saved projects/photos let us apply one allowance to the same restored subscription. We keep the association while that inventory remains. When the associated data is gone, these limited records remain for a 48-hour period after relevant activity to prevent repeated account resets. They are removed during subsequent request-driven cleanup, which can be delayed while the service is inactive. These records contain no project photos, descriptions or payment-card details. |
| Operational and security logs | Used to diagnose failed requests, investigate misuse and protect the service. Provider-managed logs follow the retention cycle of the relevant service and configuration. If we retain a separate incident record, we keep only what is needed while the issue, investigation, legal obligation or reasonably anticipated claim remains outstanding. These logs are not a separate saved-project history. |
| Website access logs | Under AWS Amplify's published retention practice, request logs remain until the hosted Amplify app is deleted. Any separate incident records we retain follow the specific investigation, claim and legal-obligation criteria above. |
| Backup copies | Restricted recovery copies may remain until overwritten, expired or deleted under the provider's backup cycle. They are not available as ordinary live project records. If a backup is restored, we reapply completed deletion requests before the affected information returns to normal service. We cannot promise immediate erasure of individual records from every provider backup. |
| Support and privacy-request records | Kept while handling your request or complaint, and afterwards only as needed to record our response, meet legal or privacy obligations, or deal with a reasonably anticipated dispute. We consider the subject and sensitivity, whether the matter is resolved, outstanding obligations and applicable legal claim periods, then delete or anonymise information when those reasons no longer apply. |
| Our legally required financial records | Where we hold business financial records, kept for the period required by applicable tax and accounting law, measured from the relevant accounting or tax period. Longer retention applies only to a specific unresolved audit, dispute or other legal requirement. Apple maintains its own billing records separately. |
| OpenAI processing records | See the AI processing section above. Deletion from dadmode does not instantly erase provider safety or legally retained records. |
Use Account → Settings → Delete data to request removal of the account associated with your current installation, its saved fixes, uploaded photos and related history. The process also requests deletion of the associated RevenueCat customer record and clears app-managed local profile/draft data. Wait for the completion screen; if it fails, retry or contact us. A minimal local completion marker may remain until you choose to start fresh.
Supabase's operational log retention depends on the service plan and configuration; its database backup arrangements also vary by plan. See Supabase's log information and backup information. A database backup is not a separate backup of the uploaded photo files. Contact us if you need information about the retention arrangements relevant to a particular request.
Deletion does not remove original photos from your device's photo library, cancel store subscriptions, erase a store's legally retained purchase records or immediately erase all provider backups/logs. Starting fresh or restoring purchases can create new service/subscription records. Information retained for an applicable legal obligation or specific dispute will be restricted to that purpose and deleted when no longer needed.
9. Your choices and rights
You can change home/DIY preferences in Account and manage device permissions in system settings. For access, correction, a copy of your information, deletion, restriction, objection or portability, contact admin@dadmode.net. These rights apply as provided by the law relevant to you and can have exceptions. Where processing relies on consent, you may withdraw it.
We may need proportionate information to verify that you control the relevant account. Because dadmode has no email login, contact us before clearing the installation if you need help locating your records. We will explain what verification is needed and any reason we cannot safely locate or disclose records. Do not email session tokens, passwords or full card details.
For UK/EEA requests, we normally respond within one month, with any permitted extension explained. We do not normally charge for exercising rights. You may complain to the UK Information Commissioner's Office or your relevant EEA supervisory authority. You do not have to contact us first.
Depending on your US state and the laws that apply to our business, you may have rights to know/access, correct, delete or obtain a portable copy, and to opt out of sale, targeted-advertising sharing or certain profiling. We do not currently undertake the sale or advertising sharing described above. We will not unlawfully discriminate against you for making a request. Where applicable, authorised agents may contact us with evidence of authority, and you can appeal a refusal by replying to our response requesting a privacy appeal. We will explain the result and any further complaint route within applicable deadlines.
10. Children
dadmode is intended for adults aged 18 or over and is not directed to children. We do not currently ask for your date of birth or carry out age verification. Do not submit children's personal information unnecessarily. If you believe a child has provided personal information, contact us so we can investigate and take appropriate steps, including deletion where required.
11. Security and policy changes
We use access controls, encrypted connections and private photo storage to help protect information. No service or device can be guaranteed completely secure. Access for support or investigation is limited to what is needed for the task; an automated AI response does not mean that no authorised person could ever access relevant records.
We will update this policy when our practices or legal requirements change. The effective date will identify the current version. For material changes, we will provide an appropriate notice through the app or website and seek consent where required before starting a new use that needs it.
For any privacy question, contact admin@dadmode.net.