Privacy Policy
The short version: Dougout is a budgeting habit game. Every financial number in Dougout is typed in by you — we never connect to your bank. Your data lives on your device and in your private cloud save. We don't sell data, show ads, or use advertising trackers. We record limited first-party product events so we can improve Dougout. If you installed Dougout from one of our App Store ads, Apple tells us which ad campaign it was. You can export or permanently delete everything yourself, inside the app.
1. Who we are
Dougout ("the app", available at app.dougout.money and as an iPhone app) is operated by Grove Digital Inc. This policy also covers our public marketing site at dougout.money. For anything in this policy, contact support@dougout.money.
2. What Dougout stores
On your device: the budgeting numbers you enter (income, fixed costs, savings goal), the expenses you log, and your game progress (tree level, streaks, badges, cosmetics). This lives in your browser's or the app's local storage.
In your account (cloud): when you sign in, we store your email address and a securely hashed password (or your Google or Apple sign-in identity), your public player handle, and a backup copy of your dougout — including the budget and expense entries you typed — so you can restore it on another device. If you share a dougout, we also store the name you give yourself there, and a partner name you add to a seat. With Google sign-in, our authentication provider also keeps the name on your Google profile. With Apple sign-in, we securely store an encrypted Apple credential so we can revoke access when you delete your account; it is removed with your account and is never shared with other players. Social features additionally store your friendships, encouragement stickers you send or receive, weekly challenge participation, and milestone events (like level-ups) shared with friends. If you block or report another player, we store which account you blocked or reported, the reason you chose from a fixed list, and where in the app you did it; the other player is never told, and these records are deleted with either account.
Product analytics: Dougout records limited first-party events in our own Supabase database — for example, that a subscription button was tapped, or that you confirmed a day for the first time — plus basic error and performance reports (including reports when the interface stops responding) when something breaks. These may carry simple context about the action, but never your budget amounts, expense descriptions, or bank information. We use them to understand whether Dougout works and where players get stuck.
Your monthly Dougout Recap. While you are signed in, Dougout records that you opened a monthly recap and, if you tap share, what the share sheet returned — shared, copied, dismissed, or unavailable. Each event carries the month it was about (for example 2026-07) and nothing else. No amount, no shop name, no category, no income, no savings balance and no figure from the month itself is recorded, and the recap card you share carries none of those either — it holds days, streak lengths, badges and the stages your tree reached, and nothing about money. Nothing is recorded while you are signed out.
Invite links. Dougout can give you a short invite code — eight characters, no meaning, generated at random by our server. If you follow somebody else’s invite link, the code from that link is kept on your device only, on its own, for at most thirty days, so that it survives the sign-in page and can be sent once when you create an account. Nothing else is kept with it: no name, no address, no sign-in token, no figure from your budget. It is erased as soon as the server has answered, when it expires, when you sign out, and when you delete your account.
Once the link is used, our server stores one small row recording that two accounts are connected by that invite, when it was made, and later whether it qualified and whether each side’s reward was given. Neither person is shown the other’s identity. The person who invited you never learns your handle, your email or anything about your dougout — only a count of how many invites they have sent and how many took root. You are told nothing about them at all. No friendship is created, no friend request is sent, and nothing appears in anybody’s feed. The whole reward is one bonus streak freeze each: no money, no discount, no currency and nothing that can be exchanged for any of those. Both rows are deleted with either account.
The reward only unlocks on real activity. To stop invented invites, the connection only counts once the invited dougout shows genuine use — a harvest, plus at least one logged expense or confirmed day — and that is checked on our server against the backup copy of the dougout you already store with us. Nothing extra is collected to make that check.
Email from Doug. Dougout is built to be able to send two kinds of non-essential email to a signed-in account with a confirmed address: a gentle nudge if your dougout has been quiet for a while, and a weekly “Sunday postcard” showing which days you checked in and your current streak. Neither is switched on: no such email has ever been sent, and no retention email provider is configured for them — no sending key and no schedule. When they are switched on, every message will carry a working unsubscribe link and a one-click unsubscribe header, opting out will be recorded against your account and honoured by both kinds, and it will never require you to be signed in or to contact us. Those emails will contain no dollar amount, no shop name, no category, no income and no savings figure — days, a streak and nothing else — and they will never be sent to an address you have not confirmed. Account and billing email (sign-in, password reset, receipts) is separate, is not marketing, has no opt-out, and is delivered by the provider named in section 4.
How long logging takes. When you save an expense, Dougout records how long the entry screen was open, rounded to the nearest tenth of a second and capped at five minutes. That is the whole event: no amount, no shop name, no category, no date. Speed is what decides whether logging every day stays bearable, so it is the one thing about the entry screen we measure — and only when a save succeeds. If you close the screen without saving, nothing is recorded.
The daily Forest Find. Dougout fetches its own small catalog of money-saving tips and recipes from our Supabase database so the day’s find can appear — a read-only request that sends no account information, no budget figures and nothing you have typed. While you are signed in, Dougout records that you opened, saved or tried a find, carrying only which find it was and whether it was a tip or a recipe. Finds are the same for everyone — what you read says nothing about your money, and nothing about your dougout travels with the request. Nothing is recorded while you are signed out.
Error reports carry a code, not a message. When something breaks, Dougout sends one fixed error code from a short, pre-agreed list — things like “type error” or “the app files were out of date” — together with where in the app it happened. It sends no error message and no exception text at all — no stack trace, no file name, no web address. That is deliberate: an error message is whatever the code happened to say, and it can quote a shop name, an amount, a note you typed or your email address. Sending a code instead means there is no way for those to travel with a crash report, rather than a promise that they usually do not.
Before you have an account, Dougout records no product events. Setup runs before sign-in; an account is required to enter your dougout. While you are signed out no product event and no error report is recorded — not sent, and not stored on your device for later. An event that happened before an account existed could only ever be attached to an account by guessing which person it belonged to, and on a shared device that guess can be wrong. We would rather measure less.
The one exception is anonymous setup counts. Before you create an account, the app sends anonymous, aggregate counts of the setup steps reached — opening the app, starting setup, planting your tree, reaching the sign-up screen, which sign-up option you tapped and, if it failed, a general reason such as “no connection” — with the app version and platform, and no identifier. Each one only adds 1 to a daily total; nothing about you or your device is stored with it, so it cannot be linked to you. Your device keeps a short list of which steps it has already counted, so each is counted once. If you never create an account, those totals are all we receive.
The retry buffer. Once you are signed in, an event that cannot reach us straight away — you were offline, or the request failed — is held briefly on your device in a small buffer (at most 50 entries) and sent again later. Every entry in it is stamped with your account from the moment it is written, and that stamp never changes. Every upload also names that account explicitly, so if the signed-in account has changed in the meantime the server rejects the write rather than filing it under someone else — and Dougout keeps the entry for its real owner instead of deleting it. The buffer therefore only ever holds your own account's events: signing in with a different account on the same device can neither send nor be attributed anything of yours. Dougout cannot run while it is closed, so nothing is deleted on a timer; entries older than seven days are discarded the next time you open Dougout. Clearing the app's storage or uninstalling removes the buffer immediately. Deleting your account clears the entire buffer on that device — every entry in it, including any left behind by an older version of Dougout. Before the deletion even starts, Dougout sets a marker on the device that blocks all further analytics writing, including from a request that was already in progress and from any other tab you have open; the buffer is then removed and the removal is checked. The marker stays until a different account signs in, so nothing can re-create the deleted account's data in between. On older devices whose browser lacks the coordination feature Dougout needs to manage this buffer safely, Dougout does not use it at all, and it deletes any buffer an earlier version left behind the next time you open the app.
The widget and the Live Activity. On an iPhone, Dougout can put a few of its numbers outside the app. If you add the Dougout widget, it draws today’s daily gold and what is left of it, your streak, your Lumina, and what you spent on each of the last seven days. If you turn on the Daily Gold Live Activity, it shows today’s gold and today’s spending on your Lock Screen. Both are opt-in, and both are worth one plain warning: those are dollar figures sitting where somebody holding your phone can read them, and a Lock Screen one does not need unlocking. Dougout writes them into a small private container that only Dougout and its own widget can open. Nothing in it is sent to us, and signing out or deleting your account takes it down with everything else. The one thing kept with your account is your answer to the Live Activity offer — on or off, nothing else — so a new phone signed in to your account does not ask again; it is deleted with your account.
Reminders. On an iPhone, Dougout can send you two reminders: one in the evening if nothing is logged yet, and one later if a streak is about to break. You turn them on and choose the times, which are saved with your dougout. Both are written and scheduled by the app on your phone — nothing about a reminder is sent to us, and neither one ever names a dollar amount, a shop or a category. Reminders can only be set between 8am and 10pm, and that limit is enforced where the reminder is created, so nothing can wake you in the night to talk about money.
No bank connections. Dougout has no access to your bank, cards, or financial institutions. Every dollar figure in Dougout exists because you typed it.
Which ad brought you here (iPhone only): once you are signed in, the app asks Apple for an attribution token and sends it through RevenueCat. Apple uses that token to tell us whether Dougout was installed after tapping one of our ads in the App Store and, if so, which campaign, ad group and search keyword it came from. RevenueCat keeps this with your account identifier so we can tell which ads lead to subscriptions. This uses Apple's AdServices system, which Apple does not treat as tracking: it needs no tracking permission, never uses your device's advertising identifier, and does not record when you saw or tapped the ad. If you did not come from one of our ads, Apple simply reports that.
3. What we do NOT do
- We do not sell or rent your data — to anyone, ever.
- We show no ads and use no advertising SDKs inside Dougout.
- We use no third-party SDK to measure how you use Dougout, and we do not track you across other companies' apps or websites. The one third-party SDK in the app is RevenueCat, which handles App Store subscriptions, reports subscription analytics to us, and passes on Apple's answer about which of our App Store ads, if any, led to your install — see sections 2 and 4. (Our public marketing site may use a single advertising-measurement pixel while ad campaigns run — see section 6.)
4. Service providers (processors)
Dougout runs on infrastructure providers who process data on our behalf: Supabase (database, authentication, cloud saves and first-party product events), Vercel (web hosting), Cloudflare (network and security), and Resend, which delivers account email — sign-in confirmations, password resets and the like — and handles your email address for nothing else. Native App Store subscriptions are processed by Apple and managed through RevenueCat, which uses your account identifier and purchase history to validate purchases, provide subscription access, and report subscription analytics to us, including the Apple Ads campaign, if any, that led to your install (section 2); web payments are processed by Stripe. Your card details go directly to the payment provider and never touch Dougout's servers.
5. Cookies & local storage
Dougout sets no advertising or third-party analytics cookies inside the app. We use storage on your device for your save data, your sign-in session, one-time product-event flags, an invitation you have opened but not yet accepted — a household join link or a friend link — and the bounded signed-in retry buffer described in section 2. On an iPhone it also writes the widget container described in section 2. Signing out and deleting your account clear all of it.
6. This website & launch updates
Waitlist: the website no longer accepts waitlist signups. If you previously joined, we hold the email address and campaign source you provided (for example, which ad or link you clicked). We use it for exactly one thing: emailing you about your Dougout invite and launch updates. To be removed, email support@dougout.money and we'll delete it.
Advertising measurement: while we run ad campaigns, this marketing site (not the app) may load the Meta Pixel so we can tell whether our ads work. It sets cookies and shares standard event data with Meta — such as that a page was viewed. It never sees your email address or anything you type. When no campaigns are running, no pixel loads.
7. What other players can see
If you use the social features, friends can see your player handle, dougout name, tree stage and level, streak count, badge count and shared milestones. Ordinary friendship does not share your income, expenses, budget or balances.
Burrow Links accountability: sending and accepting a Burrow Link includes sharing recent confirmed budget results as status bars with that partner. Bars show within budget, used rollover, over budget, or a neutral confirmed check-in when there is not enough evidence to score the day. For a shared Dougout, these are the shared household budget’s results; no separate household approval is required. The invitation flow explains this before you link. We derive up to seven completed days from the current synced personal or shared save. Corrections to confirmed logs update the results. These are self-reported check-ins, not bank-verified records.
Burrow check-ins include no dollar amounts, income, full spending totals, balances, merchants, purchases, categories, receipts or notes. We store your time zone so dates follow your calendar. Removing the link or friendship removes access on subsequent reads; it cannot erase information someone already saw. Extra check-in sharing pauses if neither person has the required Plus access. Check-ins never appear in public profiles, activity feeds, share cards, analytics, push notifications or emails. Historical sharing preferences may remain in your account export; they no longer enable dollar sharing. Your export does not include a copy of your partner’s results. Deleting either account removes its links.
Shared dougouts: when you link accounts with a household partner, both members can see every shared expense, budget, savings goal and game-progress entry, and either member can update the shared dougout. This does not give friends access to those details. If you join with an existing dougout, a copy of your pre-join dougout is archived privately for your account, is never shared with your partner, and can be restored when you leave.
Household invitations: to invite a partner, you enter the email they use (or will use) for their account. We store that address with the invitation and deliver the invitation in-app to the account with that verified email. Viewing records when it was read; joining still requires explicit confirmation. The invitation preview contains names, not financial details. Invitations expire after seven days and can be revoked by the sender. Addressing an invitation does not send an email; you can separately share its link.
8. Your rights
You control your data, in line with GDPR, PIPEDA and similar laws:
- Export: YOU → your @handle → SETTINGS → ACCOUNT → EXPORT MY DATA downloads a complete JSON copy of your dougout.
- Deletion: YOU → your @handle → SETTINGS → ACCOUNT → DANGER ZONE → DELETE ACCOUNT permanently erases your cloud save, profile, friendships, invite rows on both sides of any invite you sent or accepted, and any feedback you sent while the in-app form existed — with no support ticket needed. It also erases everything Dougout stored on that device — the local copy of your dougout, the whole analytics retry buffer, a quarantined copy Dougout keeps if a save ever fails to load, your sign-in session for this Dougout account, and every other setting or marker Dougout wrote. A sign-in session belonging to a different app on the same browser is never touched. Each of those is removed and then read back to check the removal actually took effect. If your browser or device refuses to give something up, we tell you so plainly instead of claiming it is gone, and clearing this site’s stored data in your browser settings (or deleting and reinstalling the app) removes the rest.
One technical marker deliberately stays: a counter. It records how many times an account has been deleted on this device, and that is all it is — a small number. It holds no account id, no email, no date and no data of any kind, and it does not identify you or your account. It exists for one reason: if Dougout is open in a second browser tab when you delete your account, that tab still has the old dougout in its memory, and without the counter it would write your deleted data straight back to the device moments after we had removed it. Comparing the counter is how Dougout tells that tab to stop. It is not used for analytics, advertising or recognising anyone, and it never leaves the device.
Deleting your account also cancels a Dougout Plus subscription you bought on the web, and it does that first. If we cannot confirm the state of that subscription — the payment provider is unreachable, its answer is incomplete, or a cancellation does not go through — the deletion is blocked and your account is left intact so you can try again. That is deliberate: an account that is gone but still being charged is something neither you nor we could put right afterwards, whereas an account that is still here can simply be deleted again in a moment.
An App Store subscription never blocks deletion: your account goes immediately, exactly as Apple requires. But deleting it cannot cancel that subscription — it cannot cancel one bought in the iOS app, only you can, through Apple — so cancel it there first or you will keep being charged. - Correction & access: all of your numbers are editable in-app; for anything else, email us.
9. Retention
Account data is kept until you delete your account. Deleted data is removed from the live database immediately; provider-level backups expire on their standard schedules. Dougout used to let testers send us a note from inside the app, and only while signed in, so no anonymous submission was ever possible; that form was removed in September 2026 and no new feedback can be sent. Every note we still hold is attached to the account that wrote it and is deleted together with that account, in the app, with no support ticket needed. Waitlist emails are deleted on request, and the list is retired after launch. Invite records — the invite code you were given and any connection made through it, on either side — are deleted with the account, automatically, on both ends.
10. Children
Dougout is not directed at children under 13, and you must be at least 13 to create an account.
11. Community board
The community board at dougout.money/community is a public place to suggest ideas, vote on improvements and report bugs.
- What we collect: your posts, comments, upvotes and reports, with the time of each. The app version and platform (for example “1.0.1 · iOS”) are recorded only when you post a bug after opening the board from the app, and they are shown on that post.
- What is public: posts, comments, statuses and vote counts, with your username. Your email, level, budget and spending are never shown.
- What is not shared: the board loads no advertising code and no Meta Pixel.
- Storage and deletion: board data lives in the same database as your account. Deleting your account deletes all of it.
- Signing in: the board keeps your sign-in only for the open browser tab, and it is cleared when you close the tab. It is never kept in your browser’s long-term storage. Signing out removes it sooner.
- Signing in without a Dougout account: if you continue with Apple or Google and have no Dougout account, a sign-in record is still created, holding your email address, that provider’s account id and, for Google, the name on your Google profile. That login can’t post. There is no in-app way to delete it, so email support@dougout.money and we’ll delete it.
12. Changes
If this policy changes materially, we'll note it in the app and update the effective date above. Continued use after a change means you accept the updated policy.