Willowbell privacy policy

Effective 17 October 2026. Applies to the version of Willowbell that runs in a web browser, to the Willowbell iPhone app when it is available, and to this website.

The short version

Willowbell is a household medication list, schedule and dose log. Everything you enter is stored on your device and nowhere else. There is no account, no sign-in, no analytics, no advertising and no server of ours that ever sees what you record. You can save a backup file of your records, and delete everything, from Settings inside the app.

Buying is the one thing that involves anyone else, and what happens depends on where you bought. The section below called "What leaves your device" says exactly what, for each way of buying. Nothing you type into Willowbell is part of it.

What the app stores, and where

Willowbell keeps the following in a private database on your device:

• the people you add: a first name, a color, an optional age band (adult, child, older adult) and nothing else. Never a birthdate
• each medication as you typed it, or as Apple Health named it if you import it: name, strength text, form, notes, prescriber, pharmacy, refill date and quantity left
• schedules, and the dose records the app keeps for you: due, taken, skipped, snoozed or missed, with the time you acted
• in the phone app only, a reminder log: each reminder that was scheduled, snoozed or cancelled, or that could not be scheduled because notifications are turned off, so you can check what the app did

The database and any files are in the app's private storage on your phone or tablet, or in your browser's storage if you use the web version. They are covered by your device's own backup settings (for example an iCloud or Google device backup, if you have one turned on); we have no access to those backups.

What leaves your device

Nothing you record. The app itself makes no network request of ours at any point, and there is no server of ours that holds a copy of anything you typed. Specifically:

• No account. We do not ask you to sign up with a name, email address, phone number or password.
• No analytics, no crash reporting, no advertising identifiers. No third-party analytics or advertising code is included in the app. The vendor identifier named below is not an advertising identifier.
• Sharing is yours to start. When you export a printable medication list or a backup file, your phone's Share menu opens and you choose the destination. The app does not send the file anywhere by itself.
• Buying in the iPhone app, when it is available. The one-time unlock is sold by Apple through the App Store. Apple handles the payment and knows what you bought, under its own privacy policy; we see a sales figure, not a buyer. To check purchases, the app uses RevenueCat, a purchase-checking service. The app contacts it when it starts and when you buy or restore a purchase. It is given an anonymous, randomly generated app user ID (we never pass it anything of yours to use as an identifier), your device's vendor identifier (an identifier iOS gives every app from the same developer on a device), and the store receipt, and nothing about the content of your records. It is used to check purchases. Like most such services it also sees the technical details of the request itself, such as your app version, device model, country and network address. RevenueCat's privacy policy is at revenuecat.com/privacy.
• Buying in the web version. A browser has no app store, so the web unlock is sold through Stripe Managed Payments: Link, LLC (a Stripe company) is the merchant of record and the seller, and Kehr & Co. LLC makes the app. Payment details go to Stripe, never into the app or to us. Pressing the unlock button sends your browser to a small service we run at pay.kehrandco.com, which opens a Stripe Checkout page. Stripe takes the payment and asks for your email address so it can send a receipt; Stripe holds your name, email, card details and country under its own privacy policy at stripe.com/privacy, and we can see in Stripe's dashboard that a purchase happened, for which app, and the email and country on it. Our own service then writes one small record: a keyed, one-way scramble of your email address, which we can match against an address you give us but cannot read back into the address (a record from before we added the key uses the same one-way scramble without it), the Stripe session reference, the unlock reference and the time. Not the address itself, not your name, not your card, and nothing whatsoever from inside the app — the app never contacts that service; your browser walks there, to Stripe, and back. The record exists for two reasons: so we can give you your unlock code again if you lose it (you give the email address and the last four card digits printed on your Stripe receipt), and so a refund can be traced to a sale. Ask us and we will delete it.
• Support email. If you write to us, we receive what you send and use it only to help you. Please do not include health details in support email; we do not need them to help.

Permissions the app may ask for

• Notifications: none on the web version, which asks for no notification permission and sends no reminders. In a phone app, asked once, after you add the first medication, so reminders can reach you. Reminders are local notifications scheduled on your phone; no server is involved. If you decline, the app still works and Settings shows how to turn them on. In the iPhone app, a setting that is on by default (Remind me again if a dose is not recorded) sends one gentle repeat, 15 minutes later by default and at most twice, for a scheduled dose that has not been recorded; it stops once you record the dose, says only that the dose is not recorded, and is also a local notification on your phone.
• Hide names on the Lock Screen: a Settings switch in the iPhone app, on by default. While it is on, a reminder or alarm on a locked phone says only "Medicine reminder" and the time, with no medicine, strength or person; open Willowbell to see who and which medicine. Turn it off and they show the medicine and the person. It changes only what the phone displays.
• Alarms: only in the iPhone app on iOS 26 or later, and only if you turn on Ring like an alarm in Settings and allow alarms when iOS asks. Off by default. This is the alarm permission iOS asks for (the app declares it as NSAlarmKitUsageDescription, with the text "Willowbell rings an alarm for your scheduled doses, even in Silent mode and Focus, when you turn on Ring like an alarm in Settings"). Willowbell then asks iOS to ring a system alarm at each scheduled dose time, even in Silent mode and Focus, with Stop and Taken buttons. The alarms are scheduled on your phone by iOS; no server is involved and nothing is sent to us. The Taken button records the dose the same way the app's Take button does. Doses that do not get an alarm get a notification instead.
• Files and sharing: when you print or share the medication list or your backup file, your phone's Share menu opens and you choose where it goes.
• Siri and Shortcuts: only in the iPhone app. If you use Willowbell's actions in Siri or the Shortcuts app (log a dose, what's next, the medicine list), they read and write the same database on your phone, and only when the phone is unlocked; nothing is sent to us. Apple's handling of what you say to Siri is covered by Apple's privacy policy.
• Widgets: only in the iPhone app, and only if you add Willowbell's Next dose widget or control. The control only opens today's doses. The widget shows the next doses' times on your Home Screen or Lock Screen. The same Hide names on the Lock Screen switch applies to it: while it is on (the default) each row says only "Medicine" and the time, with no medicine or person, on every widget size; if the widget cannot read the switch it hides names. Turn the switch off and the widget shows the medicine names as you typed them (never the strength or notes) and the names of the people they are for, where anyone holding your phone can see them. It reads them from Willowbell's file on your phone and keeps a copy of the list it last showed in the app's shared App Group storage on your phone (without names while they are hidden; it is in your device's own backup like the rest of Willowbell's data), so it can still draw while that file is briefly locked; Delete everything removes the copy. Its Taken button records a dose the same way the app's Take button does, and needs the phone unlocked. Nothing is sent to us. Remove the widget at any time to stop it.
• Apple Health: only in the iPhone app on iOS 26 or later, and only if you choose Import from Apple Health (at the first medication or in Settings). Health then asks which of your medications to share; Willowbell reads only those, as Health names them (the name with its strength and form, any nickname you gave it, and whether Health has a schedule for it), and adds the ones you tick to the person you choose. Willowbell never writes to Apple Health. What it adds is stored like a medication you typed, in Willowbell's file on this device, and Willowbell never sends it to us or anywhere else. Because it is then part of your list, it is in anything you print, share or export yourself (the medication list, a calendar file, a care handoff or a backup file) and in your device's own backup. Willowbell marks each imported medication as coming from Health. You can stop sharing in the Health app at any time; medications already added stay in Willowbell until you delete them.
• Calendar file: only when you choose Add doses to Calendar. Willowbell makes a calendar file on your device with each medicine's name, strength and notes, the dose times, and the names of the people they are for. You open it in the calendar app you choose; from then on that calendar app and its account (for example Apple's or Google's, which may sync it to their servers) hold those details under their own privacy policy. Nothing is sent to us.
• Care handoff file: only when you choose Care handoff (.json). The file holds your people, their medicines and schedules as typed, and the doses you marked as taken or skipped. It is not encrypted and goes only where you save or send it; Willowbell does not upload it, and nothing is sent to us.
• Share a copy: only when you choose Share a copy for a person. Willowbell makes a QR code and a link that hold that person's first name and, for each medicine you tick, its name, strength, form and schedule (times, days, start and end dates), and its notes only if you turn on Include notes. Never their full name, age, prescriber, pharmacy, refill date, quantity or dose history. The list travels inside the code and the link itself, after the # sign, which a browser does not send to any server, so nothing is sent to us, including when the link opens our website. Anyone who scans the code or has the link can read the list. You pick the recipient in the iOS share sheet, and Willowbell itself sends the list to no one. The app or service you send the link with (for example Messages or email) keeps it under its own privacy policy, and a web browser that opens the link can keep the full link, list included, in its history like any page it opens, until that history is cleared; the page takes the list out of the address bar once it has read it. The copy does not stay in sync with your list.

Each of these is optional and the app keeps working if you decline.

Health information and the FTC Health Breach Notification Rule

Willowbell holds health information you choose to enter. It is not offered to you by a healthcare provider or a health plan and we have no contract with either, so HIPAA does not apply to it — HIPAA covers providers, plans and clearinghouses and the people who handle records on their behalf, not an app you buy for yourself. The rule that does reach apps like this one is the Federal Trade Commission's Health Breach Notification Rule, 16 CFR Part 318, as amended in 2024.

We treat ourselves as covered by that Rule and design around it, rather than argue about whether it reaches an app that transmits nothing. Our design is the safeguard: your records live only on your device, are never sent to us, and we hold no copy, so there is no store of your health information at our end for anyone to breach.

If we ever did come to hold health information about you and it were acquired or disclosed without your authorization, we would tell you, and the Federal Trade Commission, and where the Rule requires it the media — without unreasonable delay and within 60 calendar days at the outside. One practical consequence of having no accounts is worth saying out loud: we have no email or postal address for you, so we could not write to you individually. We would use the substitute notice the Rule provides for exactly that situation — a clear notice on the front page of this website, kept up for 90 days, and a free phone number staffed for at least as long — and we would say so in the app's update notes as well.

If this page ever stops saying "nothing is transmitted", the reason will be written here before the change is made, not after.

Consumer health data policy

Washington's My Health My Data Act and Nevada's SB 370 require a distinct, plainly labeled statement about consumer health data, and require it whether or not much data is involved. This is that statement, for Willowbell. It is short because the answer is mostly "none".

What we collect and why. Those laws define "collect" very widely — to buy, rent, access, retain, receive, acquire, infer, derive or otherwise process. Measured that way we collect none of what you enter in Willowbell. We never see it. It is written by you, held on your device, and read by nobody but you and whoever you hand it to yourself.

There is one thing we do hold, and only if you bought Willowbell in the web version rather than from an app store: the record described under "What leaves your device" — a keyed, one-way scramble of the email address you paid with (one we can match but cannot read back), the Stripe session reference, the unlock reference and the time. It is not a health record and it says nothing about your health. But because Willowbell is a household medication list, schedule and dose log, the bare fact that a particular person bought it can imply something, so we treat that record as consumer health data rather than split hairs about it. We collect it for two purposes and no others: so we can give you your unlock code again if you lose it, and so a refund can be matched to a sale.

Where it comes from. From you, at the checkout page, and from Stripe, which takes the payment. Nowhere else. We buy no data, and we receive none from any data broker, advertiser, analytics company or other app.

What we share. Nothing. We share no consumer health data with anyone and we have no affiliates to share it with; the developer is a one-person company. We have never sold consumer health data, we do not sell it, and we will not sell it, at any price, to anyone — selling it would need your signed authorization under those laws and we will not be asking for one.

The categories of company that necessarily see something in the course of taking your money are these, and they are the whole list: payment and store processing (Stripe for a web purchase; Apple and RevenueCat for an in-app purchase in the iPhone app, when it is available), and hosting (Cloudflare, which serves the checkout page and this website). Each handles that under its own privacy policy, none of them is given anything you recorded in the app, and none of them is given this data for their own advertising.

Your rights, and how to use them. Write to hello@kehrandco.com and you can: confirm whether we hold consumer health data about you, and get a copy of it; get the list of all third parties with whom we have shared it, and how to contact each — today that list is empty; withdraw your consent to our collecting or sharing it; and have it deleted, including by anyone we passed it to. We answer within two business days and complete within 30 days at the outside. There is no charge, no account needed, and asking changes nothing about your app or your purchase. If we ever refuse, we will say why in writing, and you can appeal by replying with "appeal" in the subject line for a written decision within 45 days. If we deny the appeal we will give you a link for complaining to the Washington Attorney General, and you can complain to your own state's Attorney General wherever you live.

Children

Willowbell is for adults. A parent may enter a child's medication as data the parent manages; the child is never a user, the app never asks for a child's birthdate (only an optional age band), and nothing is collected online from anyone. We do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information, write to hello@kehrandco.com and we will delete it.

Your choices and rights

• Take your records with you. Settings, Save a backup of everything, produces one backup file with every record, in a standard, machine-readable format; it is yours to keep or move to another app.
• Delete everything. Settings, Delete everything, removes every record from the device in two steps, and on a phone or tablet removes the files the app stored too. Uninstalling the app does the same. Because we hold no copy, there is nothing for us to delete on our side; that is also why we cannot recover data you delete. One honest detail: the app clears the records out of its database, and the operating system reuses that space over time, but we cannot promise the bytes are unrecoverable by someone with the unlocked device and forensic tools. If that matters to you, erase the device rather than the app's data.
• Access, correction, portability. All of it is in the app, editable by you, exportable at any time. Nothing you entered is held by us, so there is nothing for us to give you a copy of. If you bought in the web version we hold the purchase record described above, and if you have written to us we hold that email; both are yours to see, correct or have deleted.
• Ask us. One address does everything: hello@kehrandco.com. Tell us what you want — to know what we hold, a copy of it, a correction, or deletion. Someone may ask on your behalf if you say so in writing. We do not charge for any of it and we do not treat anyone differently for asking, and asking never affects what the app does or what you paid.
• If we say no. We will say why, in writing. You can appeal by replying with the word "appeal" in the subject line, and you will get a written decision from us within 45 days. If you are still not satisfied you can complain to your state Attorney General, or, in the European Union or the United Kingdom, to your data protection authority.

Tracking, and Do Not Track

California's Online Privacy Protection Act asks every commercial site to answer two questions plainly, whatever its size, so here they are.

• How do we respond to a Do Not Track signal? We do not track you across websites or over time in the first place, so there is nothing for the signal to switch off. The app has no analytics and no advertising code, the only script on this website is a same-origin Print button helper on the printable guide pages, and neither sets a cookie for tracking. We therefore do not act on Do Not Track signals, because there is nothing to stop. If that ever changes, this paragraph changes first.
• Do third parties collect personal information about you across sites through us? No. No third party is given a way to observe you here — there is no advertising network, no analytics provider, no social widget and no embedded tracker anywhere in the app or on this site.

How long things are kept

• What you record: for as long as you keep it. Nothing expires, nothing is deleted on a schedule, nothing is removed when a free period ends and nothing is removed if a purchase is refunded. Deleting is always your decision.
• Support email: kept while we are helping you and for up to twelve months after, so a follow-up makes sense, then deleted. Ask sooner and we will delete it sooner.
• A web purchase record (the scrambled email, the two references and the time): kept for up to seven years, because a business has to be able to evidence its own sales. Ask us to delete it and we will, and after that we can no longer hand your unlock code back to you.
• Stripe, Apple and RevenueCat keep their own records under their own policies and their own legal duties. We cannot delete those for you; their policies say how to ask them.

Price, stated plainly

Willowbell is free for one person with unlimited medications, every schedule type, the dose log, history and the printable medication list. Adding a second person needs a one-time purchase of $14.99, which unlocks unlimited people. Nothing already entered is ever hidden, locked or deleted, including if a purchase is refunded.

Changes to this policy

If the app ever changes what it stores or where, this page will change first, the effective date at the top will move, and the in-app privacy screen will say what changed. We will not start collecting data quietly.

Contact

hello@kehrandco.com. Support answers within two business days.

Willowbell is made by Kehr & Co. LLC, a Georgia limited liability company. Purchases in the web version are sold by Link, LLC (a Stripe company) as merchant of record, through Stripe Managed Payments; purchases in the iPhone app, when it is available, are sold by Apple. More about us at https://kehrandco.com.