Privacy

Last updated October 16, 2026

CareBoard is a family caregiver board. It is not a clinical record, not a medical device, and not a HIPAA product.

Who you are

CareBoard does not use a separate sign-in. The person on this iPhone is the iCloud account. CareBoard stores that iCloud user record name so the same account is the same caregiver when they rejoin. It is not an email address.

What the app stores

• The household board: the parent’s profile, medication names and times, who gave a dose, visits, wall posts, chores, a house shopping list, and caregiver faces.
• The name you type when you start or join, and when you change it.
• The app build that member’s phone published, on the shared caregiver row.
• Subscription status on the shared household record: when CareBoard Unlimited expires, and which product it is. Members can read those two fields. There is no transaction id.
• A demo board stays on that iPhone.
• If you turn on the app lock, that choice and a hashed PIN stay in the iPhone Keychain. They do not sync.
• The appearance color stays on this iPhone. The widget does not follow it.

Leaving and deleting

• Leave household removes you. The board stays for everyone else.
• Delete for everyone, for the owner, deletes the shared board for the whole household.
• Remove from this iPhone deletes the copy on this phone. The owner is told the family board still exists.
• Sharing is paused is the only lapse state. A free plan, a missing renewal date, and Apple’s billing-retry window do not make anyone read-only. While sharing is paused, an invited member is not syncing the rest of the board. Nothing is deleted.

What leaves the iPhone

• A live household syncs through iCloud so the care crew sees the same board. Medicine names, doses, instructions, notes, and wall photos also write encrypted iCloud values. Dates and ids stay plain.
• If you allow Calendar, visits can be written to an Apple Calendar you pick. You can refuse.
• Due-dose notifications have Given and Snooze 15 min. Given opens CareBoard to log it. Face ID or the passcode is asked only when the phone is locked. A Given tapped on the lock screen stays on this iPhone until it is logged. If it cannot be logged, the phone says that dose wasn’t logged. It is not dropped after a day.
• The widget reads a snapshot in the App Group group.com.careboard.app. A dose is “Med due” or “Med overdue” plus the time, with no medicine name. The file stays protected until the first unlock after a restart.
• Share care summary builds a PDF on this iPhone when you tap share, then deletes it when the share sheet closes. The PDF can include the person’s name, medicines, recent doses, meals, notes, visits, and emergency contacts.
• A caregiver photo, if you add one, is a small image on the shared household. Photos permission is asked only when you pick a picture.
• Copy or share of the house shopping list is plain text you send. Look up opens Walmart or Instacart search in Safari or their app. CareBoard does not upload the list to a retailer.
• Weather uses the household home address, or this iPhone’s location if you allow it. Address suggestions use Apple’s MKLocalSearchCompleter on this iPhone. That home address or precise location is sent to Apple, OpenStreetMap Nominatim, the US Census geocoder, Open-Meteo, Zippopotam.us (when only a ZIP code is known), and the US National Weather Service. It is used for weather, not for ads.

What we do not do

We do not sell household data. We do not use the board for advertising. We do not claim to be the only place to decide medicines.

Contact

Privacy: privacy@thistledew.app. Support: support@thistledew.app.