Privacy Policy

01 Who this policy covers

This Privacy Policy explains what Dibs Labs ("Dibs," "we," "us," or "our") collects when you use the Dibs iOS app — including the TestFlight beta — and the justcalldibs.com website (together, the "Service"), why we collect it, who we share it with, and the choices you have.

By using the Service, you agree to the practices described here. If you don't agree, please don't use Dibs. If you're using Dibs on behalf of your household, we assume you have your household members' understanding that their name, chores, and messages will be visible to other members of that household — that visibility is the point of the product.

02 Information we collect

We collect information in three ways: what you give us directly, what we collect automatically as you use the app, and what we receive from the sign-in provider you choose. Every category below is something a real, currently-shipping part of Dibs actually does — not a hypothetical.

2.1 Account & sign-in information

Dibs requires an account to use. You can create one with:

• Sign in with Apple — we receive your name (if you choose to share it — Apple only provides this on your very first sign-in) and an email address, which may be a real address or Apple's private relay address if you choose to hide your email.
• Google Sign-In — we receive your name, email address, and profile photo URL from your Google account.
• Snapchat (Snap Login Kit) — we receive a Snap-issued external ID and your Snapchat display name through Snapchat's own sign-in flow. We do not receive your Snapchat password, friend list, or Snap content.

Facebook Login and passwordless email-link sign-in exist in our codebase but are turned off and not offered to users as of this policy's date. The underlying Meta (Facebook) SDK ships in our app for that future option, but we've explicitly disabled its automatic event logging and advertiser-ID collection, so it does not report your app opens or activity to Meta on its own. We collect nothing through Facebook today. If we turn Facebook Login on: any information Facebook provides to us about you ("Platform Data") will be used only to operate your Dibs account, will never be sold or used for advertising, and you'll be able to ask us to delete it or revoke Dibs' access via your Facebook settings at any time. We will update this policy before either sign-in method goes live.

Whichever method you use, we create a Dibs account identified by a unique ID issued by our authentication provider (Firebase Authentication, operated by Google).

2.2 Profile information

• Display name — the name your household sees. Encrypted at rest (Section 5).
• Avatar — either a photo URL from your sign-in provider (we store a link; we do not host or re-encode your photo) or a monogram (your initials on a chosen or randomly assigned color).
• Preferences — your chosen week-start day and notification settings (Section 2.7).

2.3 Household, chore & message-board content

The core of the product. When you create or join a household, we store:

• Household name — encrypted at rest (Section 5).
• Household membership — which accounts belong to the household and who has admin rights.
• Invite codes — generated codes used to join a household are never stored as plain text; only a salted cryptographic hash is kept, so we cannot recover a live invite code from our database.
• Chores — title, notes, category, effort/skill/energy level, location label (a short description like "Kitchen," not a GPS coordinate), duration, repeat schedule, who it's assigned to, and completion status.
• Message-board posts — text posts are encrypted at rest (Section 5); drawings/sketches posted to the board are stored as stroke/path data and are not separately encrypted, since they aren't a text string. Both are visible to your household members.
• Notification-center entries — in-app records of chore reminders, team-up requests, and similar household activity.

All of this content is, by design, visible to the other members of your household — that's what makes Dibs work.

2.4 Calendar & Reminders (optional)

If you turn on Calendar Sync, Dibs asks iOS for access to your device's Calendar and Reminders. This is the one place in the app where device-permission data does more than stay on your phone, so we want to be exact about each direction:

• Calendar, read & import: Dibs reads your existing calendar events so it can show them alongside your chores, and imports the current week's events into your household's chore list. That means an imported event's title, time, duration, and location are written to Dibs' servers as a new chore — visible to your household members, the same as any chore anyone adds by hand.
• Calendar, write: chores you create in Dibs can also be added to your device's Calendar app, so they show up there too.
• Reminders, read-only: Dibs reads your due Reminders locally so it can surface them alongside your chores. This content is not uploaded to Dibs' servers, and Dibs never creates, edits, or deletes anything in your Reminders app.

You can revoke Calendar/Reminders access at any time in iOS Settings → Privacy & Security, or turn off Calendar Sync inside Dibs — turning it off stops future imports but doesn't retroactively delete chores already created from past imports (those are chores like any other; delete them the same way).

2.5 Voice & speech input (optional)

If you use voice entry to add a chore, Dibs requests microphone access and uses Apple's Speech Recognition framework to convert your speech to text (this may be processed on-device or by Apple's speech recognition service, depending on your device and settings — that step is governed by Apple's own privacy practices, not ours). Dibs receives only the resulting text, which becomes the chore's name; we do not store audio recordings.

2.6 AI-assisted features

Dibs offers optional AI features: chore breakdown ("Think Out Loud"), an AI daily planner, AI-generated starter chores, and AI batch chore generation. When you use one of these, we send the relevant text to one of our AI providers — currently Anthropic (Claude models) or OpenAI (GPT models), depending on the feature — to generate a response. What's sent depends on the feature, but is limited to:

• The free-text goal, task, or note you typed (capped in length by the feature).
• Your household's chore catalog (names and durations) and, where relevant, your existing schedule for the day.
• For starter-chore generation: your stated household type, member count, chosen priorities (chosen from a fixed list, not free text), plus any free-text notes you added.

We do not send your name, email address, exact location, or any other household member's personal information to Anthropic or OpenAI as part of these requests. Both process this content under their own privacy and data-use terms, acting as our service providers. We do not authorize either of them to use it to train their models on our behalf. Their own policies govern how long they retain API request content.

2.7 Notifications

Dibs uses local, on-device notifications — scheduled by the app itself using Apple's UserNotifications framework — for chore reminders, team-up alerts, and daily summaries. Dibs does not use push notifications and does not register your device with, or send notification content to, any push-notification service. Your notification preferences (which types are on, how many minutes before a chore to remind you) are stored in your account so they sync across your own devices.

2.8 Analytics

We use Firebase Analytics (a Google product) to understand product usage. Our analytics implementation is deliberately narrow: it logs a fixed, closed set of product events — things like completing sign-up, adding or claiming a chore, viewing a screen, generating an AI day plan, or opening the paywall — plus three account-level properties: a bucketed household size ("1," "2," "3-4," or "5+" — never the exact count or member names), your subscription tier ("free" or "plus"), and whether you're a household admin (true/false). Analytics events are associated with a Firebase-issued user ID, not your name or email.

We do not use analytics data for ad personalization — ad-personalization signals are explicitly disabled in our configuration — and we do not use an advertising identifier (IDFA) or any cross-app/cross-site tracking. Because Dibs does not engage in tracking as Apple defines it, the app does not show an App Tracking Transparency prompt.

2.9 Diagnostics & crash reports

We use Firebase Crashlytics (a Google product) to receive crash reports if the app crashes or hits an unexpected error. A crash report can include: your Firebase user ID, your household ID, the app screen you were on, short log breadcrumbs we write for debugging, and standard technical diagnostics such as device model, OS version, app version, and a stack trace. This exists to help us fix bugs, not to profile you.

2.10 Subscription & payment information

Dibs plans to offer an optional premium tier ("Dibs Plus"). As of this policy's date, purchasing is not yet available — no payment can currently be made in the app. When it does launch, all payment will be handled entirely by Apple through the App Store's In-App Purchase system. Dibs will never receive or store your credit card number or other payment details — Apple will. We will receive only your subscription status (e.g., active, tier, renewal state) from Apple, or from a subscription-management service acting on our behalf using that Apple-provided data, so we can unlock the features you paid for. If we bring on a subscription-management service, we'll name them in the table in Section 4.1 before your data ever reaches them.

2.11 Website & waitlist

The justcalldibs.com website uses Plausible Analytics, a privacy-focused analytics service that does not use cookies and does not collect or store personal data or IP addresses, to measure page views. If you join our pre-launch waitlist, we store the email address you provide, the time you submitted it, and that it came from the landing page, so we can email you when Dibs is ready. We don't use this list for anything else, and submitting the same address twice does not create a duplicate entry. We keep waitlist emails until we've sent our launch notice or you ask us to remove yours sooner. To prevent automated abuse of the waitlist form, we briefly associate your IP address with your submission for rate-limiting; it's not linked to your email and is discarded automatically within hours. Our web server's standard access logs may also record visitor IP addresses for security purposes, separately from Plausible's cookie-free analytics. Our website doesn't track individual visitors, so we don't respond differently to a "Do Not Track" browser signal — there's nothing to opt out of.

2.12 Information we do not collect

03 How we use information

We use the information described in Section 2 to:

• Create and maintain your account and household, and let household members coordinate chores.
• Operate features you choose to use — calendar sync, voice entry, AI planning, notifications, subscriptions.
• Send you service-related communications, such as household activity notifications (on-device) and, if you're on our waitlist, a launch notice.
• Diagnose and fix bugs and crashes.
• Understand aggregate product usage so we can prioritize what to build next.
• Detect and prevent abuse — for example, rate-limiting repeated invite-code attempts or waitlist submissions.
• Comply with legal obligations and enforce our terms.

We do not use your household's chore or message content, or any AI-feature input, to serve you ads. We do not sell your personal information to anyone, for any purpose.

04 How information is shared

We do not sell your personal information. We share information only with the service providers who help us run Dibs, each bound to use it solely to provide their service to us, and in the limited other circumstances described below.

4.1 Service providers

We don't yet use a third-party subscription-management service (Section 2.10) — if we add one, we'll add it to this table before your data reaches them.

4.2 Other household members

Your display name, avatar, chores, message-board posts, and admin status are visible to the other members of your household. That's the product working as intended, not a third-party disclosure — but you should know it before inviting people to your household.

4.3 Legal & safety

We may disclose information if required by law, subpoena, or legal process, or if we believe in good faith it's necessary to protect the rights, property, or safety of Dibs, our users, or the public.

4.4 Business transfers

If Dibs Labs is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We'll let you know via this policy or direct notice if your information becomes subject to a different privacy policy as a result.

05 Data security

We take the following concrete measures, and we're deliberately specific here because vague security claims aren't verifiable:

• Per-household field encryption. Household names, household-member display names, and message-board text posts are encrypted at rest (AES-256-GCM) using an encryption key that is uniquely derived for your household and never leaves our server environment. A raw export of our database would show ciphertext for these specific fields, not readable names or message text. (One related exception, in the interest of being exhaustive: when a new message-board post is created, we write a short unencrypted preview of it — the author's name and the first ~75 characters — into your household's in-app notification feed, so members can see "who posted what" without opening the board. That preview is plaintext in that one place, even though the message itself is encrypted at rest.)
• This is not end-to-end encryption. We want to be precise about this rather than let a stronger-sounding term do the work: Dibs, as the operator of the service, holds the master key and has the technical ability to decrypt this data server-side to operate the app (for example, to show your household name back to you). We are not claiming a "zero-knowledge" or "we can't read your data" system. A small number of authorized Dibs staff also have internal tooling to look up account and household records for customer support and abuse investigation — this tooling does not decrypt the fields above, but it can read everything else (chore titles and notes, for example, are not encrypted). What the encryption above does protect against is a raw data leak or backup exposure — in that scenario, these specific fields are unreadable without our server-side key.
• Invite codes are hashed, never stored. We generate a code, give it to you once, and store only a salted one-way hash of it — we can verify a submitted code matches, but we cannot look up or recover a live code from our database.
• Server-enforced access rules. Our database security rules deny household data to anyone who isn't an authenticated member of that household, and deny client-side writes to the encrypted fields above entirely — only our backend functions can write them.
• App attestation and rate limiting. Sensitive operations use request rate limits (for example, on invite-code attempts) to raise the cost of automated abuse, and are designed to use Apple/Google App Check, which verifies requests come from a genuine copy of the Dibs app, as an additional layer where enabled.
• Encryption in transit. All communication between the Dibs app and our servers uses TLS.

No system is perfectly secure, and we can't guarantee absolute security. If we experience a data breach that affects you, we'll notify you as required by applicable law.

06 Data retention & deletion

We keep your information for as long as your account is active, plus a reasonable period afterward for backups, fraud prevention, and legal compliance.

What happens when you delete your account

You can delete your account from within the app, or by emailing us. When you do, we:

• Delete your user profile document and remove you from your household's member list.
• Unassign any chores that were assigned to you (the chores themselves stay with the household, since they're shared household content — but they're no longer linked to you).
• Remove your authorship from message-board posts you wrote (the post's text remains visible to your former household, since it's shared content, but is no longer attributed to your name).
• Remove you from any pending notifications, and delete notifications that were only for you.
• Delete your authentication account entirely, so you can no longer sign in.

What happens when a household is deleted — read this before you tap it

Separately from leaving or deleting your own account, any member of a household — not only an admin — can delete the entire household at any time. Deleting a household is more consequential than it may sound: it permanently deletes the household's chores and message board, and permanently deletes the Firebase sign-in account of every member of that household — not just the account of the person who deleted it — so none of them can sign in again. If you're a member of a household and aren't ready to lose your account, the safer move is to leave the household yourself (another member can still delete it later, but at least the choice to lose your own account stays yours until then).

Some information may persist briefly in backups or logs after deletion, and we may retain minimal records where required for legal, security, or fraud-prevention purposes. Abuse-prevention rate-limit records, for example, are keyed to an account ID (or, for the public waitlist form, an IP address) and a short time window — typically a few hours — and expire automatically.

07 Your rights & choices

• Access & correction — you can view and edit most of your profile and household information directly in the app. For anything you can't self-serve, email us and we'll help.
• Deletion — delete your account in-app, or email us; see Section 6 for exactly what that removes.
• Device permissions — Calendar, Reminders, Microphone, Speech Recognition, Face ID, and Notification access can each be reviewed or revoked at any time in iOS Settings → Privacy & Security (or Settings → Notifications), or by toggling the corresponding setting inside Dibs.
• Analytics — analytics collection does not currently have an in-app toggle. If you'd like your account excluded from analytics, email us at the address in Section 13 and we'll action it manually.
• Marketing email — if you're on our pre-launch waitlist, every email we send will include a way to stop receiving them.

08 Children's privacy

Dibs is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Creating a Dibs account requires signing in through Apple, Google, or Snapchat, each of which has its own age requirements; we don't independently verify age beyond what they provide. If we learn that we've collected personal information from a child under 13 without the consent required by law, we will delete it. If you believe a child has provided us with personal information, please contact us at the address in Section 13.

For users in the European Economic Area, the United Kingdom, or Switzerland: the age below which you need a parent or guardian's consent to use a service like Dibs varies by country (roughly 13 to 16). If you're under your country's threshold, please have a parent or guardian create the account or agree on your behalf.

09 International data transfers

Dibs Labs is based in Odisha, India. Our infrastructure and service providers (Google Cloud / Firebase, Anthropic, OpenAI) process data primarily in the United States and potentially other countries where they operate data centers. Whether you're in India, the United States, or elsewhere, using Dibs means your information is transferred to, stored, and processed in countries other than your own, including the United States, which may have data protection laws different from those where you live. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

India

As an Indian company, we intend to handle personal data consistent with India's Digital Personal Data Protection Act, 2023 (DPDPA) as its provisions come into force and its rules are finalized. In summary: we process your personal data for the specific purposes described in this policy, based on your consent or another lawful basis (such as performing our agreement with you); you have the right to access, correct, and request erasure of your personal data, and to withdraw consent, by contacting us at the address in Section 13; and you have the right to file a complaint with the Data Protection Board of India if you believe we've mishandled your personal data. We'll update this section as the DPDPA's implementing rules are finalized and as our own compliance program matures.

10 California privacy rights

If you're a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you additional rights over your personal information.

What we collect and why (CCPA categories)

Based on the categories defined by the CCPA, in the past 12 months we have collected: identifiers (name, email, account ID, IP address — the last only briefly, for abuse prevention); internet/network activity (app usage events, device/diagnostic data); audio information (voice input, transiently, for speech-to-text); commercial information (subscription status); and inferences (for example, a bucketed household-size category derived from your account). We collect these for the business and operational purposes described in Section 3. We do not sell or "share" (as that term is defined under the CPRA, including for cross-context behavioral advertising) personal information, and we have not done so in the preceding 12 months. We do not collect Sensitive Personal Information as defined by the CPRA, so the right to limit its use doesn't apply to our practices.

Your rights

• Right to know what personal information we've collected, used, and disclosed about you.
• Right to delete personal information we've collected from you, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing — not applicable today, since we don't sell or share personal information, but we'll honor this right if that ever changes.
• Right to non-discrimination for exercising any of these rights.

To exercise any of these rights, email us at the address in Section 13. We'll verify your request using your account's authentication method before acting on it.

Other U.S. states

If you're a resident of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, or another state with a comprehensive privacy law, you generally have similar rights to know, delete, correct, and port your personal information, and to opt out of targeted advertising or profiling (neither of which we do). To exercise these rights, contact us using Section 13 — we'll honor requests consistent with applicable law regardless of which U.S. state you're in.

11 EEA, UK & Swiss users

If you're located in the European Economic Area, the United Kingdom, or Switzerland, the following applies in addition to the rest of this policy.

Purposes and legal bases for processing

• Creating/maintaining your account and household features (Section 2.1–2.3) → Contract.
• Product analytics, crash diagnostics, and abuse/rate-limit prevention (Section 2.8, 2.9) → Legitimate interests — our interest in understanding usage and keeping the service reliable and secure, which we limit by using a fixed, closed event list, bucketed rather than raw account properties, and short-lived rate-limit records, rather than broader profiling.
• Calendar Sync, voice input, and AI features (Section 2.4–2.6) → Consent — each is off until you turn it on, and you can withdraw consent at any time by turning it back off, without affecting anything we already did while it was on.
• Responding to legal process and enforcing our terms → Legal obligation or legitimate interests, as applicable.

Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR. Our AI features (Section 2.6) generate suggestions — a proposed chore breakdown, a draft daily plan, starter chores — that a household member reviews and separately chooses whether to accept; nothing is automatically assigned or decided on your behalf.

International representative & data protection officer

We have not appointed an Article 27 EU/UK representative or a Data Protection Officer, as we don't believe our processing currently meets the thresholds that require either at our size. We'll revisit this as Dibs grows.

Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or port your personal data, to object to certain processing (including processing based on legitimate interests), and to withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing before you withdrew it. To exercise these rights, contact us using Section 13. You also have the right to lodge a complaint with your local data protection supervisory authority.

12 Changes to this policy

We may update this policy as Dibs changes — for example, if we add a new sign-in method, a new AI provider, or launch subscriptions more broadly. We'll update the "Last updated" date at the top of this page, and for material changes (such as a new category of data collection, or a new third party receiving your data), we'll take reasonable steps to notify you in-app or by email before the change takes effect. We keep this policy at this same address so it's easy to check back.

13 Contact us

Questions, requests, or concerns about this policy or your data? We're a small team and read every message ourselves.

↑ Back to top