Loading page
Last updated: October 23, 2026
The operator is a sole proprietor doing business as Domi Ops (no limited liability company).
Domi Ops Cloud (domi-ops.com, app.domi-ops.com, demo.domi-ops.com): the sole proprietor doing business as Domi Ops is the data controller for accounts and household data stored on hosted infrastructure.
Self-hosted instances: the person or household who operates that server is the controller. Domi Ops (the project) does not operate a central database for self-hosted deployments and does not see that data.
Security procedures are in place to protect the confidentiality of your data. We use encryption to protect your information when it is stored or sent over the network.
ENCRYPTION_KEY. Dates, member assignment, and schedule times stay queryable without storing those values in plaintext.Self-hosted: the person who operates the server is responsible for HTTPS, backups, and protecting ENCRYPTION_KEY. The same encryption behavior applies when the key is configured.
If you choose Google sign-in or connect Google services, Domi Ops accesses only the Google user data needed for the features you enable:
drive.file scope and the Google Picker), not your entire Drive.We use this Google user data only to provide those features, for example signing you in, showing synced events, or exporting reports you request. We do not use it for advertising, and we do not use it to train general-purpose artificial intelligence or machine learning models.
We do not sell or transfer Google user data to third parties except service providers that help us run Domi Ops Cloud (for example hosting and email), and only as needed to operate the service. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
drive.file (Docs/Picker). See Google's Privacy Policy. See the token storage and legacy-token limits described above.Optional. Sensitive fields (titles, notes, medication names, dosage, instructions) are encrypted at rest with the instance ENCRYPTION_KEY. Dates, member assignment, and schedule times remain queryable. Access follows per-record visibility and segment ACL. There is no admin override of private health data. Domi Ops is not a healthcare provider and is not HIPAA-compliant.
MyAllyFile (optional). If you link a household member to a MyAllyFile profile, Domi Ops sends that profile the name, dose, instructions, schedule type, and paused status of that person's current medications, and sends an update whenever they change. Nothing is sent until you link, and nothing is read back. Anyone with that profile's emergency PIN can see the synced medications, as with any MyAllyFile profile data. The link is stored as an encrypted credential that you can revoke from either product; unlinking removes the synced medications from the MyAllyFile profile. MyAllyFile is a separate service with its own privacy policy.
Withings (optional). If you connect a household member to a Withings account, Domi Ops imports that person's blood pressure readings (systolic, diastolic, pulse), blood oxygen, body temperature and workouts (the activity, how long, and distance and calories when Withings has them), daily activity summaries (steps, distance, active minutes, active and total calories), and sleep summaries (start/end, time asleep/in bed, stages, awake time/count and sleep score), with when each was taken, as ordinary health entries, including past ones from the period you choose when you connect, and new ones as the cuff or watch syncs. They are protected like any other health entry. Withings' permission for this covers body measurements and activity generally. Domi Ops reads these supported categories and registers notifications for new data; it does not upload or edit your Withings health records. Readings Withings cannot attribute to one person, such as on a cuff shared by a household, are left out until they are assigned in the Withings app. The connection is stored as encrypted credentials that you can revoke from either product. Unlinking stops new readings and asks Withings to stop notifying Domi Ops; readings already imported stay in Domi Ops until you delete them, and Withings keeps its own copy under its own privacy policy. Domi Ops does not change or delete health records at Withings. Import behavior varies by category: activity and sleep summaries may update when Withings reports a newer version; previously imported individual readings and workouts are deduplicated. Disconnecting stops future imports and leaves existing Domi Ops records until you delete them.
Homeschool and family coursework only. Domi Ops is not a school of record, not an accredited institution, and does not issue official transcripts to third parties.
Households may provision child or student accounts (including username-only members). A parent or guardian who owns or administers the household is responsible for those accounts and for deciding what data is stored.
Members see household-visible content per module permissions. Private notes, Drive objects, and health records are limited to owners and people you explicitly share with (or grant ACL access).
An adult member can connect a supported assistant after the instance operator and household administrator enable the integration. Each member approves their own connection and permissions. Approved reads send connection labels and timezone, shopping items, chores, and only explicitly selected planning notes to the chosen assistant provider. Current membership and record permissions still apply. The current integration does not directly access Calendar, School, Health, Drive or attachments, and cannot change household records. Do not select notes containing copied Google-derived, health, child or other excluded information for this workflow.
The assistant is a separate service you choose. Its account settings and terms govern its retention, human review and model training. Review those settings and the provider-specific notice before approving access; Domi Ops cannot verify those settings or promise that the provider will not retain or use shared conversation content. Connection setup does not share your Domi Ops password, login session or Google credentials with the assistant.
AI connections settings lets you review permissions, remove access or disconnect. Disconnect stops future reads; it cannot erase copies already held by the assistant. Security activity records tool names, outcomes, timing and response sizes rather than returned record content or raw tool arguments, with a 30-day activity retention window. Self-hosted operators administer their own deployment and retention.
Off by default on every household, self-hosted or Cloud. An owner or admin can turn it on in Settings → Privacy. When on, we collect:
These events carry a randomly generated id stored in your browser (not your account, household, name, or email). The event store has no account or household identifier. Turning it off stops new collection and drops queued events; turning it on later starts a new random id, not a resumed history. We do not sell this data, or any data, to anyone, ever. It is used only to find bugs and decide what to build next.
Separately, anyone can send a bug report or feedback from their Profile page at any time, regardless of this setting. That message (and an optional reply email, if you choose to leave one) is sent because you chose to send it, not collected passively.
Configured Sentry error diagnostics are separate from this opt-in setting, as described under Processors. Turning optional metrics off does not disable connected services, transactional email, billing, or operator diagnostics.
Feedback uses a separate random id for each submission, so an optional reply email is not joined to your browser metrics id. Operators can also produce monthly activation counts from opted-in hosted households, using record existence and membership counts, without names or record contents. Cohorts smaller than five are suppressed. Random ids reduce direct identification; they are not a promise of formal anonymization.
Cloud: email privacy@domi-ops.com to update profile data, revoke Google connections, or request account and household deletion. You may request deletion of your Cloud account and associated household data by emailing that address; we will delete or anonymize hosted records within 30 days of verifying your request, unless we must retain specific records for legal, security, or billing disputes (for example open invoices).
Self-host: the instance operator manages retention and deletion. An encrypted household archive can be restored to an empty self-host instance with the same schema, including referenced stored files.
Cloud household archives are operator-assisted because they include other members' private records. Contact the privacy address above; we verify the recipient and affected adults' authorization. The archive uses a separate transfer key; hosted service keys, payment details, login sessions and external-service credentials are excluded. Report exports within your existing permissions remain available in the app.
Canceling renewal does not delete records. Backup copies expire through the service's backup rotation; we confirm the applicable backup and diagnostic retention windows when handling a deletion request. Deleted data must not be reintroduced during disaster recovery.
You can disconnect Google Calendar or Docs in household settings, revoke Domi Ops in your Google Account, disconnect a Withings cuff or watch from Health (Checks), disable Web Push, turn off optional modules (within what the instance enables), and turn anonymized metrics on or off. See also the Terms of Service.
Cloud privacy questions: privacy@domi-ops.com. For a self-hosted instance, contact the person who administers that server.