Privacy Policy
Last updated 12 August 2026
DiaryRobo connects to a robot and turns its telemetry into a readable diary. For eldercare use, that diary contains information about a person's health. This document describes what actually happens to that information — not what a generic policy template would say.
Read this part even if you skip the rest
An eldercare diary records heart rate, blood pressure and whether medication was taken. It is about the person being cared for, who is usually not the person who registered the robot. If you register an eldercare robot, you are stating that this person has agreed, or that someone legally able to agree on their behalf has done so. We cannot verify that, and we do not pretend to. It is your responsibility.
1. Who we are
DiaryRobo is an early-stage project operated by an individual, contactable at hello@diaryrobo.com. There is no company behind it yet, no legal department and no data protection officer. If that matters for your situation — and for a care organisation it might — that is worth knowing before you connect anything.
2. What we collect
If you join the waiting list
Only the email address you type in. It is submitted to Formspree, a third-party form service, and forwarded to us. We use it to tell you when the product opens up, and for nothing else. Reply to any message, or write to us, to have it deleted.
If you register a robot
- The robot's name, platform and mode (companion or eldercare)
- A contact email, only if you choose to give one
- Your chosen retention period
- For eldercare: the date you confirmed consent, and the name or role you entered as confirming it
- A cryptographic hash of the robot's access token — never the token itself
What the robot then sends
Each diary entry stores a timestamp, a category, a severity, the readable text, and the ROS topic it came from. Alongside it we store the original telemetry message that produced the entry — the raw numbers, unchanged.
For an eldercare robot, that includes heart rate, blood pressure and medication adherence. Under UK and EU data protection law this is special category data, and it concerns someone who is not our user.
What we do not collect
No audio. No video. No images. No location beyond how far the robot moved. No account passwords — there are no accounts. We do not use cookies for tracking, and there is no analytics script on this site.
3. Where it is stored
| What | Where | Region |
|---|---|---|
| Diary entries, raw telemetry, robot records | Supabase (Postgres) | United States (us-east-1) |
| The API that receives and serves them | Render | United States |
| This website | Netlify | Global CDN |
| Waiting-list emails | Formspree | United States |
If you are in the EU or UK, this means personal data — including health data — leaves your jurisdiction and is stored in the United States. We have not put a transfer mechanism in place. For a personal companion robot that may be an acceptable risk to you; for a care organisation with regulatory obligations it very likely is not, and you should not connect real patients' robots on that basis.
4. Why we hold it
Only to produce and serve the diary. We do not sell data, do not share it with advertisers, and do not use it to train machine learning models. There is no commercial use of this data at all, because there is no commercial product yet.
5. The optional narration feature
The diary can optionally be rewritten as connected prose by a large language model. This is off unless you turn it on and run it yourself with your own API key. When you do, the diary text for that day is sent to Anthropic's API. The raw telemetry is not sent. If you never enable it, no data leaves our own infrastructure.
6. How long we keep it
You choose the retention period when you register — 30 days, 90 days, one year (the default) or three years. Entries older than that are deleted when the expiry endpoint runs.
Be aware: expiry is not automatic
Our hosting plan has no scheduled jobs, so nothing runs on its own. Old entries are
removed when POST /diary/{robot_id}/expire is called — which means when
you call it, or schedule it. We would rather say this plainly than let you
believe data disappears by itself when it does not.
7. What you can do with your data, right now
These are not requests you send us and wait on. They are endpoints, authorised by your robot's own token, and they take effect immediately.
Get everything we hold
curl -H "Authorization: Bearer $TOKEN" \
https://diaryrobo.onrender.com/diary/$ROBOT_ID/exportReturns every diary entry and every raw telemetry payload, as JSON.
Delete the diary, keep the robot
curl -X DELETE -H "Authorization: Bearer $TOKEN" \
https://diaryrobo.onrender.com/diary/$ROBOT_IDDelete everything
curl -X DELETE -H "Authorization: Bearer $TOKEN" \
https://diaryrobo.onrender.com/robots/$ROBOT_IDRemoves the robot, its entries, its raw telemetry and its access records. This is immediate and cannot be undone. Database backups may retain copies for a short period before rotating out.
Replace a leaked token
curl -X POST -H "Authorization: Bearer $TOKEN" \
https://diaryrobo.onrender.com/robots/$ROBOT_ID/rotate-tokenThe old token stops working immediately; the diary is untouched.
If you have lost the token and cannot use these, write to hello@diaryrobo.com and we will do it for you. We will ask you to demonstrate that the robot is yours.
8. Who can see it
Anyone holding a robot's token can read, export and delete that robot's diary. There are no user accounts yet, so the token is the identity. Treat it the way you would treat a password. Roles like "family member" and "doctor" exist in the database design but are not yet reachable through the API.
We can also see the data. Operating the service requires a key that bypasses the database's own access rules. Data is encrypted in transit and encrypted at rest by our hosting providers, but it is not encrypted in a way that would prevent us from reading it. Nobody else at all can — there is nobody else.
9. Your rights
Depending on where you live, you may have rights to access, correct, delete, port or restrict processing of your data, and to complain to a supervisory authority. The export and deletion endpoints above cover access, portability and erasure directly. For anything else, write to hello@diaryrobo.com.
Where the diary concerns a person being cared for, those rights belong to that person. If they, or someone acting for them, asks us to delete their data, we will — regardless of who registered the robot.
10. Children
DiaryRobo is not intended for use by anyone under 18, and not intended to record data about children. If you believe a robot is recording a child's data, tell us and we will delete it.
11. If something goes wrong
If we discover a breach affecting your data, we will contact you at the address you gave when registering the robot, and describe what happened and what data was involved. If you did not give an address, we have no way to reach you — which is a reason to give one.
12. Changes
If this policy changes materially, the date at the top changes and we will email everyone who gave us an address. We will not quietly broaden what we do with data already collected.