Summary
Booger does not send a family's care log to its developer. Child profiles, medicine entries, temperatures, notes, reminders, corrections, and device-sync status stay on the devices the user chooses and transfer directly between nearby devices the user explicitly pairs.
Booger has no developer account system, cloud-sync service, advertising, behavioural analytics, or third-party data-collection or crash-reporting SDK. Logging care and nearby exchange do not use a Booger server.
Information handled on the device
The app handles information a caregiver chooses to enter, including a caregiver display name, child name or nickname, care entries, reminders, entry times, and correction history. It also stores random family and device identifiers, encryption material, purchase state supplied by Apple, and device-sync status needed for direct nearby exchange.
These records are saved in the app's protected local storage. Family and device secrets are held in Keychain and bound to the current app installation. Care records and the installation binding are marked to be excluded from device backup where supported, although operating-system and user-controlled backup behaviour is ultimately controlled by Apple and the device owner.
Direct nearby exchange
With the user's explicit pairing approval, Booger uses Bluetooth to transfer an encrypted care log directly between nearby paired devices. The transfer is not routed through a Booger server. Nearby advertising is designed not to include child names, medicine data, or family names.
Every paired device holds its own copy. Deleting a local copy on one device cannot erase a copy held by another device that is offline.
Booger has no remote account, remote wipe, or cryptographic device-revocation service. Moving a device to Past devices changes only the sync summary and does not revoke that device's family access. Pair only devices controlled by people you continue to trust. If a device is lost, stolen, or no longer trusted, use Apple's device-protection and erase tools where available, stop nearby sync on the remaining devices, and create a new Booger family before recording further information. Existing history is not automatically moved into that new family.
Apple services and permissions
- Bluetooth finds approved nearby Booger devices and exchanges the encrypted family care log.
- Camera scans a short-lived pairing invitation. Booger processes the image for pairing and does not upload it.
- Clipboard is used only when a user chooses to copy a pairing invitation. Booger marks it as local to that device and gives it a ten-minute expiration. It contains one-time pairing material, not family care records. Do not retain or reuse copied text or screenshots after pairing.
- Notifications deliver generic reminders created by the user. Default lock-screen text avoids child and medicine details.
- StoreKit lets Apple process an App Store purchase. Booger receives a verified entitlement and relevant transaction date on the device, not payment-card details, and does not send that information to its developer.
- App Store diagnostics may give the developer crash or diagnostic information when a user chooses to share it under Apple's settings and terms. Booger contains no third-party crash-reporting SDK.
Apple's services are governed by Apple's own privacy policies.
Developer collection and sharing
Booger's developer does not collect, receive, sell, or share the care log or nearby family exchanges. The app contains no developer-operated network endpoint or third-party data-collection SDK.
If a future version adds any remote service, analytics, crash reporting, export destination, HealthKit integration, or other data path, this policy and the in-app explanation will be updated before release.
Support correspondence
If a user emails for support, the developer receives the sender's email address and the information they choose to include, such as device model, operating-system version, Booger build number, approximate time, and a description of the problem. This information is used only to answer the request, diagnose the reported problem, protect the service, and maintain related support records. It is not used for advertising or sold.
Do not include child names, medicine details, temperatures, symptoms, screenshots containing care records, or other private family or health information. Support correspondence is retained only as long as reasonably needed for those purposes and any legal obligations. A sender may request deletion using the address under Contact, subject to records the developer must retain by law.
Website hosting
Cloudflare hosts this privacy and support website. When someone visits it, Cloudflare may process ordinary web-request and security information such as IP address, requested URL, date and time, browser or device information, and network or error diagnostics to deliver and protect the site. This is separate from care information handled locally by the Booger app. See Cloudflare's privacy policy.
Retention, deletion, and consent
Care data remains on each paired device until the user removes that family's local copy or deletes the app, subject to Apple's operating-system behaviour. The in-app deletion control removes and verifies the reusable family access from Keychain before deleting that family's local files. The user must repeat deletion on every device that holds a copy.
iOS may retain a Keychain item after an app is deleted. Booger binds family access to a random marker in the app container; without that marker, a reinstalled copy rejects and deletes retained family access instead of using it to sync again. Offloading an app is different from deleting it and is designed by Apple to preserve app data.
Pairing and system permissions are user-controlled. A user can stop nearby exchange by turning off Booger's Bluetooth permission, stop reminders by turning off notification permission, and revoke camera permission in iOS Settings. Removing permission does not itself erase existing local records.
Children
Booger is for adult caregivers and is not directed to children. It does not ask a child to create an account or provide an email or postal address, date of birth, sex, weight, health identifier, or photograph. A caregiver may choose to enter a first name or nickname and factual care information locally.
Safety and intended purpose
Booger is a factual notebook, not medical advice, a clinical monitoring system, or an emergency service. It does not calculate doses, interpret temperatures, diagnose, triage, recommend treatment, or say when medicine is safe or due. Rely on medicine labels, appropriate clinicians or pharmacists, and local emergency services for medical decisions.
Contact and complaints
For privacy, deletion, support, or policy questions, email feedback@stephenson.tools. Please do not include private family or health information.
The developer will consider applicable privacy rights and complaints based on the user's location. Australian users can also find information from the Office of the Australian Information Commissioner.