Privacy policy
Ridgeback is a household assistant. The people who live together share a home in it, with Bobby, the assistant, and the things a house needs to remember. This policy says what that means for the data you put into it.
One
Not Hotdog LLC runs Ridgeback, decides what happens to your data, and is answerable for it. It also builds the software, so no second company stands behind this one.
Questions about your data, and every request described below, go to rob@not-hotdog.com.
We handle personal data under the privacy laws that apply to us and to you where you live. The rights in section eight are open to everyone who uses Ridgeback, wherever you are.
Two
Listed the way the software stores it. Each says where it sits, who can see it, whether Bobby reads it, and how long it stays. Nothing here is used for advertising, sold, or used to track you across other companies' apps or sites.
Your email address and a one-way scrambled copy of your password.
The name you go by and any other details you choose to fill in, all of them optional, and what you have told Bobby about yourself.
Your place in each home and what you are allowed to do there. A Personal Space is a home with only you in it.
Everything anyone types, everything Bobby answers, and what gets saved along the way.
Pictures and files you send in a conversation or back up from your phone, and the smaller copies made for browsing.
Pictures and video frames are read on your phone first, with Apple's or Google's on-device tools. When your phone cannot read one, Ridgeback sends it to its own server, where Ridgeback's model reads it once and keeps nothing. Location details inside the picture are removed before it is read. Speech is only ever turned into text on your phone and is never uploaded.
Your phone's location is shared only when you tap Share my location for a request. It is used for that answer and is not stored in messages or in the record of what Bobby did. A home's address is stored if someone in the home adds one, so Bobby can give its weather and find places near it.
You can turn on location sharing for a home you belong to, in Settings. Once it is on, your phone reports its position in the background, with the app closed, until you turn the switch off. Only the home or homes you turned it on for can see it. A home you have not shared with sees nothing. Only your latest spot is kept. Each report replaces the one before it. Turning the switch off, leaving or closing the home, or asking to be forgotten clears it. Without permission, background location data for sharing location is not stored. Someone in that home can ask Bobby where you are; he answers that you are home or how far away, and never reads coordinates aloud.
A push token for each phone that allows notifications, your notification settings, and the alerts in your inbox. With message previews on, a notification carries the words of the message.
An id Ridgeback gives each phone or computer you sign in on, its platform, and when it was last used.
What you write, any screenshots you attach, and the app version, system version, device model, language and time zone, so a bug can be reproduced. Never posted in a conversation.
When you report one of Bobby's answers: the reason you chose, any details you add, and which reply it was. The reply is not copied.
A record of each action Bobby takes, such as adding to a list or setting a reminder: which action, what it was given, what came back, and whether it worked. When a safety check stops a message, the record says which check and why, without the words.
A count of something happening in an app: it was opened, a registration finished, a home was created. The name of the thing, never what was said or typed.
Notes the servers write about each request and about anything that goes wrong: the time, the address a request came from, the page asked for, and the result. They are not meant to hold what you write. Calendar subscription links are removed before a request is logged. An email address can appear if an email to it fails to send.
If you joined the waitlist on this site: your email address and the answers you gave on the form.
Three
Your login, your details, your homes, conversations, files, notifications and the rest exist so Ridgeback can do what you use it for. Where the law asks for a reason, this is the contract between you and us.
Server logs, the record of what Bobby did, safety checks, bug reports and the usage counts are how problems are found and fixed and how misuse is stopped. Where the law asks for a reason, this is our legitimate interest in a service that works and is safe for the children in it.
A shared location, a bug report, a report about a reply, a waitlist sign-up. Each is sent only when you act, and you can ask for it to be removed.
Ridgeback does not use what you put into it to train AI models. A home would have to switch that on, and the apps do not offer the switch.
Four
These companies handle data so Ridgeback can work. Each one gets only what its job needs.
Rents Ridgeback the server that runs its service, its database and this website.
Stores photos, videos and files in its R2 storage for every home that has not connected storage of its own.
Bobby runs on an open model, Qwen, on a GPU server that Not Hotdog LLC owns and operates. Your messages are not sent to any AI company.
The Apple Push Notification service delivers notifications to iPhones, iPads and Macs, carrying the message words when previews are on. Apple WeatherKit and Apple Maps receive the location a request needs, and Maps receives the search phrase. The app loads map images from Apple Maps.
The Locations map on Android and the desktop loads its map tiles from OpenFreeMap (OpenStreetMap data). Your device asks for the tiles of the area on screen, so OpenFreeMap sees that area and your internet address. No account, home, name or location of anyone is sent; the pins are drawn on your device.
Firebase Cloud Messaging delivers notifications to Android phones, carrying the message words when previews are on.
Sends password reset emails, so it receives your email address and the reset link.
When you press Search in the GIF picker, your phone sends the search words to GIPHY directly, and GIPHY sees your phone's internet address. No account, home or message goes with it. A GIF sent from GIPHY plays from GIPHY, so GIPHY sees the internet address of every device that shows it. See GIPHY's privacy policy.
Two more depend on choices someone in your home makes.
A home can connect its own AI model, hosted or on a machine of its own. That model then gets the home's questions, and what it keeps is between the home and whoever runs it. Ridgeback's safety check does not send those questions or answers to any model of its own.
A home can connect its own storage. Its files then go there, under that provider's terms, and Ridgeback holds a sealed copy of the key that lets it reach them.
If you subscribe Apple Calendar, Google Calendar, Outlook or another calendar app to a Ridgeback calendar, that calendar's event titles, times and places go to the company behind that app. Turning the link off in Ridgeback stops it.
We share personal data with anyone else only when the law requires it.
Five
Most of what a home holds stays until someone removes it. Conversations stay in the thread, files stay in storage, and what Bobby knows about you stays until you change it. A few things have a clock of their own.
30 days.
90 days, then nothing in them points at you or the reply.
30 days. The record that an action happened stays without the words.
Until you delete your account.
Until you turn notifications off, the phone replaces the token, or you delete your account.
For your account's life, as a sign-in history. Deleting the account removes their tokens.
Only for the request it was shared with.
Until the log store discards its oldest entries as it fills. No fixed period.
As long as they are useful. They name nobody.
Six
Bobby is handed what he needs to answer. Recent messages in the conversation and what he knows about you go to him. Your login and your permissions never do.
A thread Bobby is kept out of never reaches him. The request to the model is built without it.
The model keeps nothing between one question and the next. What it held while writing your answer is gone when the answer is finished.
Every question and every answer is checked by Ridgeback's own model before and after Bobby answers, with a stricter check for anyone in safe mode. A home that brings its own model is not read by that check; only a fixed pattern check for things like passwords and keys runs on its answers, and no model sees them.
Bobby runs on Ridgeback's own server unless your home brings its own model. Your messages are not sent to any AI company, and they are not used to train any model.
Seven
Ridgeback is built for households, and households have children in them. It is not directed at children under 13 on their own.
A minor joins a home only when an adult of that home adds them, and that adult gives consent as the child's parent or guardian. Every minor is in safe mode.
Safe mode is set on the person, not on a group they belong to, so no group a child is added to later can switch it off. Spending and outward messages are unavailable, Bobby's answers are held to a stricter check, and Bobby says when he is answering with less.
A parent or guardian can ask to see, correct or delete a child's data by writing to rob@not-hotdog.com. If you believe a child under 13 is using Ridgeback without a parent or guardian's consent, write to the same address and we will remove their data.
Eight
You can ask what we hold about you, ask for a copy, have it corrected, and have it deleted. You can also ask us to stop using it for a purpose, or object to how it is used. Some of this has a button; the rest is an email.
Your conversations and details are in the app. For a single file of everything we hold about you, across every home you are or were in, email us. We send it in a common machine-readable format.
Edit your details in Settings. To correct something Bobby remembered about you, email us.
In the app, open Settings, then Clear your record, then Delete account and personal data. Or follow the account deletion steps, which work without the app. Section nine says what happens and how long it takes.
Email us and say what you want stopped. We will tell you what we can stop and what the service cannot run without.
Write to rob@not-hotdog.com, preferably from the address on your account. We confirm the account is yours before acting, and we reply within 30 days. Never send a password or a sign-in code.
Nine
When you delete your account, your access ends as soon as the request is accepted. In the same step, your login and details are removed, the words of every message you wrote are replaced with "[Deleted]", what Bobby knew about you is cleared, your bug report text goes, and your Personal Space is closed.
Files in your Personal Space are removed from storage after a 24-hour wait, which lets any short-lived links to them expire. If the storage provider cannot be reached, removal is retried. In shared homes, things you added, such as list items, events and photos, stay for the rest of the home without your name. If you are a shared home's last manager, give another member management or close that home first.
Other deletions, and the places a deleted thing can still sit:
Removing a message hides it from everyone at once. Its words stay in the database until the conversation is deleted or you delete your account. Deleting a conversation replaces the words of every message in it.
Deleting a photo from the library moves it to the trash, and its browsing copy is removed from storage within a day. The original stays in storage until you email us to have it removed. Deleting your account removes everything in your Personal Space, originals included.
Copies of the database kept in case something breaks. A deleted item can sit inside one until that copy is replaced. Backups are kept for no more than 30 days.
Logs are not searched when you delete something. They are not meant to hold what you write, and they are discarded as the log store fills.
Whatever the model held while writing a reply is already gone. It keeps nothing between one question and the next.
Ten
Ridgeback's database and service run on a server rented from OVHcloud. Bobby's model runs on Not Hotdog LLC's own GPU server. Files are in Cloudflare R2 or your home's own storage. Your data may be stored and processed outside the country you live in.
Everything between the apps and Ridgeback travels over HTTPS. Passwords are stored as a one-way hash, never as you typed them. Signing out ends that device's session and clears the app's credentials. A sign-in token already issued stays valid until it expires, within 15 minutes.
One home cannot see another. The database itself enforces which home a row belongs to, through row-level security, so a mistake in the app's own code cannot show one home's data to another.
Keys for storage or a model your home brings are sealed with encryption before they are stored, and the apps never get them back. Bobby never receives them. When something needs a file, the server hands over a link that works for that one file and expires in minutes.
No system is perfect. If your data is lost or exposed, we will tell you and any authority the law requires, without undue delay.
Eleven
When this policy changes, the date at the top changes with it and the change is described in the release notes. If a change affects what we do with data you have already given us, we will tell you in the app or by email before it takes effect.
The Data and AI Transparency page covers the same ground in more detail. For help with anything else, see Support.