Legal

Privacy Policy

Privacy · Terms · Washington Health Data Privacy

Version 1.0 — Effective August 23, 2026

1. Scope and adult-directed service

This Privacy Policy explains how the developer identified as the Seller on Potty Watch Tracker's App Store product page ("Potty Watch," "we," "us," or "our") handles information through the Potty Watch Tracker app and related service.

Potty Watch is for adult caregivers coordinating one child's toilet-training records. It does not create child accounts, and children must not use the app or submit information directly. An adult caregiver enters information about the child.

Potty Watch is not acting as a health-care provider, health plan, health-care clearinghouse, or business associate of one. This policy—not HIPAA—describes how we handle information. Other privacy and consumer-protection laws may apply. Washington consumers should also read our separate Washington Consumer Health Data Privacy Policy.

2. Information we handle

Information entered by caregivers

• caregiver display name;
• bathroom-event date and time;
• whether the event involved pee, poop, or both;
• whether it occurred on the toilet or was an accident;
• optional accident details, including pee-accident amount category, poop-accident category, accident contents, and caregiver-selected likely reason;
• whether the physical watch, the child, or a caregiver prompted the visit;
• the physical-watch interval associated with the record;
• optional free-text notes; and
• family or caregiver-group name where supplied.

Do not put a child's full legal name, address, school, contact information, diagnosis, medication, or other unnecessary identifying or medical information in a free-text note.

Account, family, device, and security information

• anonymous-authentication and account identifiers;
• family and membership identifiers;
• installation and device identifiers used to bind an authorized installation;
• caregiver invitation codes;
• short-lived family setup and recovery records, request identifiers, authorization tickets, throttling fingerprints, and category-level deletion receipts; and
• app version, request status, timestamps, and limited technical information needed to operate and secure the Service.

The app's own active tables do not retain a raw source IP address. Network and hosting providers may process IP addresses and similar connection information as needed to transmit and secure requests under their own service terms.

Current Potty Watch versions create one-time six-digit caregiver invitation codes. During a limited compatibility period, an older supported app version may still accept a legacy six-character family code that does not have the same one-use or 30-minute expiration. Keep either kind of code private and update all caregiver devices when the app asks you to do so.

Subscription information

Apple processes App Store purchases and payment information. We do not receive a payment card number. We receive StoreKit and App Store transaction or entitlement information needed to verify product, purchase, trial, renewal, grace-period, expiration, refund, revocation, and restore status.

Feedback information

If you use Send Feedback, we collect the category and message you choose to submit, app version and build, operating-system version, broad device class (such as iPhone or iPad), a random retry identifier, your app-account identifier, and the server submission time. Do not include a child's name or bathroom, health, medical, or record-identifying details. The app and database reject several obvious sensitive terms and identifier patterns, but automated filters cannot guarantee that free text contains no personal or consumer health data.

Legacy information

Older app versions may have stored care-event, medication, massage, stool-detail, or phone-timer fields. Current user interfaces do not create new care or medication records. Legacy values may remain in protected storage solely for deletion or a deliberate, separately disclosed migration and are subject to the retention and deletion practices below.

3. How information is collected

We receive information directly from adult caregivers when they set up the app, enter or edit records, create or join a caregiver group, export information, manage privacy choices, send in-app feedback, or contact support. The app generates account, installation, security, sync, feedback-retry, and request metadata when needed to provide those actions. Apple provides subscription status through StoreKit and App Store services. Authorized caregivers in the same group can add, edit, or delete shared household records.

We do not buy information about you or the child from data brokers. We do not import health records from a clinician, HealthKit, or iCloud.

4. How we use information

We use information to:

• authenticate an adult caregiver and bind an authorized installation;
• save, edit, delete, display, synchronize, and export bathroom records;
• provide counts, history, progress summaries, and physical-watch setting context;
• create, secure, expire, and audit current-version caregiver invitations, manage limited legacy family-code compatibility, and maintain caregiver membership;
• verify and restore subscription access;
• prevent abuse, protect accounts and households, troubleshoot failures, evaluate submitted product feedback, improve the app, and maintain service integrity;
• respond to support, privacy, access, withdrawal, appeal, and deletion requests; and
• comply with law and enforce our Terms.

We do not use bathroom records for advertising, marketing, data brokerage, cross-app tracking, credit, insurance, employment, or research. We do not train a general-purpose artificial-intelligence model on family records.

5. When information is disclosed

Authorized caregivers

If an adult creates or joins a caregiver group, authorized caregivers in that group can see existing and future household records, caregiver attribution, timer history, and membership information. They may also create, edit, delete, and export shared records. Do not enable household access unless the other caregivers are trusted and authorized to see the child's information.

Service providers

Cloud service providers process information on our behalf only to operate, secure, support, and synchronize the Service under contractual restrictions. We require service providers that receive user data to protect it consistently with this policy and applicable platform and legal requirements.

Apple processes purchases and provides transaction and entitlement information under Apple's terms and privacy notices. Potty Watch does not send bathroom records or free-text notes to Apple for billing.

If we enable a separate backup, hosting, support, or security provider that receives personal information, we will update this policy before use and obtain any consent required by law.

Legal and safety disclosures

We may disclose the minimum information reasonably necessary to comply with valid legal process, protect the rights and security of a child, user, household, or the Service, investigate fraud or abuse, or establish and defend legal claims. We may transfer information in a merger, acquisition, bankruptcy, financing, or sale only subject to applicable law and the commitments in this policy.

We do not sell personal information or consumer health data. We do not disclose it to data brokers, advertising networks, or third-party advertisers. We have no affiliates with whom we share consumer health data.

6. Retention

Bathroom records, notes, family membership, and timer history remain while needed to provide the Service, until an authorized user deletes the applicable record, leaves the family where that removes access, or completes an applicable deletion request.

One-time invitation codes created by current Potty Watch versions expire after 30 minutes or one successful join. Invitation rows are removed by the daily database retention job within approximately seven to eight days after code expiry. During the limited compatibility period described above, a legacy family code remains usable until that older access path is retired or the family is moved to the current invitation flow; it does not use the one-time invitation-row retention schedule. A family create-or-join recovery record is removed approximately seven to eight days after completion. One-use authorization tickets and throttling fingerprints are removed sooner, normally within approximately one to three days. We do not retain a raw source IP address in these app tables.

In-app feedback and its fixed technical metadata are removed at 365 days by a daily retention job, normally within approximately 365 to 366 days, or sooner when the submitting caregiver account is deleted. A verified rights request may require earlier deletion.

When a caregiver deletes their account, active app tables remove that caregiver's cloud identity, in-app feedback, and bathroom and legacy-care records attributed to that caregiver. Records entered by other caregivers may remain only when another active caregiver keeps the family. Shared timer-change history may remain with the caregiver attribution removed, but only if retention is lawful for the scope of the request. A category-level deletion receipt containing request identifiers, completion time, and deletion counts may remain for up to 91 days to confirm completion, subject to applicable deletion rights.

When an authenticated caregiver deletes an individual bathroom record, a private integrity receipt temporarily retains that caregiver's app-account identifier, the deleted record's random event identifier, and the deletion time. It does not retain the bathroom outcome, event time, notes, child or family identifier, caregiver name, or device identifier. The caregiver account link is scheduled for removal after 90 days by a daily retention job, normally within approximately 91 days, or immediately if that caregiver account is deleted. The random event identifier then remains without the caregiver link only until the daily retention job removes it less than six months after the original record deletion. We use this limited receipt to confirm an interrupted retry and prevent an offline queue or restored local copy from recreating the deleted record.

A request made by or on behalf of the child to delete the child's consumer health data is broader than caregiver-account deletion. After the requester is authenticated and authority is verified, we delete all data within the scope required by applicable law and notify relevant processors and recipients.

Archived security and recovery copies may take longer to purge than active tables. Where Washington law applies, deletion from those backups will be completed no later than six months after the request is authenticated. Before any restored copy is returned to service, completed deletion requests are reapplied. We do not promise a fixed backup-retention period that has not been operationally verified.

7. Your choices and rights

Depending on where you live, you may have the right to know whether we process information, access or export it, correct it, withdraw consent from future collection or household disclosure, delete it, receive information about recipients, or appeal a denied request.

You can edit or delete individual bathroom records and export records in Settings. You can leave a caregiver group, remove a caregiver where authorized, withdraw health-data consent, or delete your caregiver account in Privacy & Account. For a whole-child record request, an access request that cannot be completed with those self-service controls, or an appeal, email support@pottywatchtracker.com with the subject "Privacy Request."

We authenticate requests using reasonable methods. We may ask for information needed to confirm that the request comes from the account holder or a person authorized to act for the child. We will not ask a person to create a new account solely to exercise a privacy right.

Withdrawing consent stops future collection or disclosure within the withdrawn scope after the withdrawal is confirmed. It does not automatically delete existing information or cancel an App Store subscription. The app will provide export and deletion choices.

Deleting your Potty Watch account does not cancel an Apple subscription. Use Apple's subscription settings for billing changes.

8. Children

The Service is directed to adults and is not designed for a child's direct use. An adult who enters records represents that they are the child's parent or legal guardian or are authorized by one. If you believe a child submitted information directly, contact us so we can investigate and delete it as appropriate.

9. Security

We use administrative, technical, and physical safeguards designed for the sensitivity and volume of the information, including authenticated access, family-scoped authorization, restricted database permissions, one-time invitations in current Potty Watch versions, and limited retention for security metadata. No system can be guaranteed completely secure. Protect your device with a passcode, keep invitation and legacy family codes private, remove caregivers who should no longer have access, and store exports securely.

10. No advertising or tracking

Potty Watch does not show third-party advertising, use an advertising identifier, track activity across other companies' apps or websites, or combine app data with third-party data for targeted advertising or advertising measurement.

11. Changes to this policy

We will display the version and effective date of this policy. We will provide notice of material changes. Before collecting, using, or disclosing an additional category of consumer health data or using it for an additional purpose, we will update the applicable notice and obtain affirmative consent where required. Prior versions will be archived.

12. Contact

Use the available Privacy & Account controls in Settings for self-service export, individual-record deletion, consent withdrawal, or caregiver-account deletion. Email other privacy questions, rights requests, and appeals to support@pottywatchtracker.com with the subject "Privacy Request." Service questions may be sent to the same address.