DadSteps Privacy Policy
Last updated: 3 September 2026
1. Who we are
DadSteps ("DadSteps," "we," "us," "our") is provided by DadSteps Ltd, a private limited company registered in Ireland (company number 822421), with its registered office at Unit 2, 2 Bridge St, Athlone, Co. Westmeath, N37 V8N7. DadSteps Ltd is the data controller for the personal data described in this policy.
If you have questions about this policy or how we handle your data, contact us at info@dadsteps.com.
DadSteps is not required to appoint a statutory Data Protection Officer, but we've named Garrett Lee, Director, as the person accountable for data protection at DadSteps.
2. What DadSteps is — and isn't
DadSteps is a non-clinical confidence and education app for fathers of children from birth to around two and a half years old. It provides general information, encouragement, and content organised by your child's developmental stage.
DadSteps is not a medical device, a diagnostic tool, or a substitute for professional healthcare advice. We collect the minimum information needed to run the app well and to personalise content to your child's stage — we are not building a health record. See our Terms of Service for the full non-medical-advice disclaimer.
3. Information we collect
We collect the following categories of personal data:
| What we collect | Why we collect it | Where it comes from |
|---|---|---|
| Your email address | To create and secure your account, log you in, and send essential service communications (e.g. password resets) | You provide it when you sign up |
| Your password | To authenticate you when you log in. We never see or store your password in readable form — it's handled by our authentication provider, Firebase Authentication (a Google service), using industry-standard hashing | You provide it when you sign up |
| Your Google account details (only if you choose "Sign in with Google") | An alternative, faster way to create and access your account | Provided by Google, with your permission, if you choose this sign-in method |
| Your display name (optional) | To personalise how the app addresses you | You provide it, optionally |
| Your notification preferences | To record whether you've switched milestone reminders on or off | You set these in the app |
| Basic technical data (device type, app version, and similar operational information generated automatically as you use the app) | To keep the app working reliably and keep the service secure | Generated automatically by the app as you use it |
What stays on your device and never reaches us
Two kinds of information are deliberately stored only on your own device, and are never transmitted to, collected by, or accessible to DadSteps:
- Your child's date of birth. You enter it during setup so the app can show content matched to your child's stage — but the date is saved locally on your phone and never sent to our servers. The stage calculation happens entirely on your device. The same is true of the optional milestone reminders: they are scheduled on your own phone, not by us.
- Your journal entries. Everything you write in the journal is saved only on your phone. We cannot read, access, or recover your journal — it never leaves your device.
Because this information never reaches us, it is not personal data DadSteps processes — but we tell you about it here anyway, because knowing what doesn't leave your phone matters as much as knowing what does. This locally-stored data is included in your phone's own backup (iCloud or Google), under your own account, if you have device backups enabled — that backup is between you and Apple/Google, not us. One honest consequence: because we never hold this data, we cannot restore it for you — if you delete the app from a device with no backup, journal entries are gone.
We do not collect any payment information. DadSteps includes a single, one-off in-app purchase to unlock full access to the app — this is handled entirely by Apple's App Store or Google Play's own payment systems under their own terms and privacy practices; DadSteps does not receive or store your card details, only confirmation that a purchase was made.
We do not use analytics or crash-reporting tools. DadSteps does not track how you use the app.
4. A specific note about your child's information
We know that information about a child deserves extra care. Our answer to that is architectural, not just procedural: DadSteps holds no information about your child at all.
- The only child-related information the app uses — your child's date of birth — is stored solely on your own device (see Section 3) and is never transmitted to us. We cannot see it, and we have no copy of it.
- It is used for one purpose only: showing you content appropriate to your child's current stage, calculated entirely on your device. Nothing about your child is used for advertising, shared with anyone, or profiled — nothing about your child ever reaches us in the first place.
- If you write about your child in your journal, that content likewise never leaves your device — see Section 3.
- If your child (or you on their behalf) ever asks what information we hold about them, the accurate answer is: none.
5. Who we share information with
We use a small number of trusted service providers ("processors") to help run DadSteps. They only process your data on our instructions, for the purposes described in this policy — they don't get to use it for their own purposes.
| Service provider | What they do for us | What they can access |
|---|---|---|
| Firebase / Google Cloud (Google) | Authentication, and our database, which stores your account data | Account credentials, display name, notification settings, and basic technical data — not your child's date of birth or journal entries, which never leave your device (Section 3) |
| Sanity.io | Manages DadSteps' own editorial content (articles, stage-based tips) shown in the app | Does not receive or process any of your personal data — it only holds content we've written ourselves |
| Formspree | Powers the email sign-up form on our website (separate from the app) | Name/email you submit through that website form, if you use it |
| Zoho Mail | Our business email | Anything you include if you email us directly |
| Apple / Google (as app store operators) | Distribute the app and process in-app purchases | Governed by Apple's and Google's own privacy terms, not this policy — see their respective privacy policies for how they handle app store account and payment data |
We do not sell your personal data. We do not share it with advertisers or data brokers. We do not disclose it to third parties for their own marketing purposes.
We may disclose information if required to by law, or to protect the rights, safety, or property of DadSteps, our users, or others (for example, in response to a valid legal request).
6. International data transfers
Your core account data (our database, via Google Cloud) is stored in the EU (the europe-west2 region, London) — this is not an international transfer.
Two of our processors do involve a transfer outside the European Economic Area, and we describe each accurately rather than treat them the same:
- Zoho (our business email provider) is hosted in the EU (Zoho.eu, based in the Netherlands), under a signed Data Processing Addendum incorporating the EU Standard Contractual Clauses. One nuance worth stating plainly: under that same agreement, data may be accessed by Zoho's India-based support and engineering teams for troubleshooting purposes, under the agreement's own SCC-covered transfer mechanism. This is a limited, contractually governed transfer, not an unprotected one.
- Formspree (which powers the email sign-up form on our website) is hosted in the United States, on AWS. For this transfer we rely on Standard Contractual Clauses as the safeguard.
7. How long we keep your information
- Account data (email, display name, notification preferences): for as long as your account is active. When you delete your account, this data is deleted immediately and irreversibly — there is no recovery window, so please be certain before confirming deletion. The app also clears the locally-stored data (your child's date of birth and your journal entries) from your device in the same step.
- Your child's date of birth and journal entries: not retained by DadSteps at all — they are stored only on your device (Section 3) and never reach our systems, so there is nothing on our side to retain or delete. Deleting your account, or the app itself, removes them from your device.
- Website sign-up data (Formspree): until you unsubscribe, or 24 months from the date you submitted your details, whichever comes first.
- Support emails (Zoho): retained for up to 24 months, then deleted in periodic reviews. Separately, if DadSteps ever stops using Zoho as a provider, personal data is deleted from Zoho's active systems on its next routine clean-up cycle, with backups purged shortly after, under our signed data processing agreement.
- Basic technical data: we don't use analytics or crash-reporting tools, so there is no analytics retention to describe. Basic operational records (for example, our authentication provider's own login records) are retained according to our infrastructure providers' standard practices and are not used for any purpose beyond running the service.
8. Keeping your data secure
We take reasonable technical and organisational measures to protect your data, including access rules that restrict your data to your own account — enforced and tested, not just written down — and relying on our infrastructure providers' security certifications (Google Cloud maintains ISO 27001 and SOC 2 certifications, among others). No method of transmission or storage is completely secure, and we can't guarantee absolute security, but we take this seriously and treat it as an ongoing responsibility, not a one-time setup.
9. Your rights
Because DadSteps processes personal data subject to the GDPR, you have a number of rights in relation to your information. You can exercise any of these by contacting us at info@dadsteps.com.
- Access — you can ask us for a copy of the personal data we hold about you.
- Rectification — you can ask us to correct inaccurate or incomplete data (you can also update most of this yourself in the app).
- Erasure — you can ask us to delete your data. You can also delete your account directly within the app (Profile → Delete Account, a two-step confirmed process). Deletion is immediate and irreversible: it removes your account data from our systems and clears the locally-stored data from your device in the same step.
- Restriction — you can ask us to limit how we use your data in certain circumstances.
- Portability — you can ask us for your data in a structured, commonly used, machine-readable format, or ask us to transmit it to another service where technically feasible.
- Objection — you can object to processing based on our legitimate interests, or to any use of your data for direct marketing.
- Withdrawing consent — where we rely on your consent (for example, for optional notifications), you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
We'll respond to requests within one month, as required by the GDPR (this can be extended by a further two months for complex requests, in which case we'll tell you why).
If you believe we haven't handled your data properly, you have the right to complain to the Irish Data Protection Commission (the lead supervisory authority for DadSteps Ltd), or to your own country's data protection authority if you're located elsewhere in the EEA. Contact details for the Irish DPC: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland — www.dataprotection.ie.
10. Children's use of DadSteps
DadSteps is intended for use by adults — specifically, parents and other caregivers of young children. It is not directed at children, and children should not create their own DadSteps accounts. We hold no information about any child: the only child-related information the app uses (a date of birth, entered by the parent) is stored solely on the parent's own device and never reaches DadSteps — see Sections 3 and 4.
11. Changes to this policy
We'll update this policy as DadSteps changes — for example, if we add new features or service providers. We'll update the "last updated" date at the top of this policy and, for material changes, let you know in-app or by email before the changes take effect.
12. Contact us
DadSteps Ltd, company number 822421, Unit 2, 2 Bridge St, Athlone, Co. Westmeath, N37 V8N7, Ireland. Email: info@dadsteps.com.