What we hold, and what we never do.

What we hold about you

• Your name and email address, so you can sign in and we can reach you.
• The Telegram chat we alert, so a ring can be delivered.
• A list of when your doorbell rang, kept for 30 days and then removed.
• A record of what you paid, but never your card. If you take a paid plan, the card details are typed into Paystack and never reach us — we have no card number, no expiry, no CVV and no billing address. What we keep is the boring half: the amount, the currency, which plan, whether it succeeded, a reference so it can be traced if something goes wrong, and the codes Paystack uses to identify your subscription. On the free tier none of this exists for you at all.
• A short-lived counter of sign-in attempts. When you ask for a sign-in code we note that a request happened, against a one-way scrambled version of your email address and of the internet address you asked from. We do not keep the address or the email itself in those records — only the scrambled marker — and we clear them after about a day. It is there so nobody can flood your Telegram with sign-in codes or sit there guessing at your code, and there is no way to run it backwards to build a list of who signed in from where.

What we hold about a visitor

As little as we can while still stopping abuse. A visitor does not need an account, an app, or to tell us who they are. To enforce the ring limits we keep a short-lived, one-way scrambled marker rather than a plain record of the device.

That marker goes after about a day — not after 30 days. The ring itself stays in your list for 30 days so you can see that somebody came to your door, but the thing that could group one visitor's rings together is wiped long before that. An earlier version of this page said the marker was discarded "on the same 30-day cycle", which undersold what actually happens; the code has always cleared it on the shorter clock. We do not build a profile of anyone and we do not track visitors across other websites.

The website itself

The fonts, images, styles and scripts on this site are served by us, from our own server. There is no third-party analytics script, no advertising pixel, no social widget and no content delivery network. That is a deliberate choice: pulling a font or a script from someone else's server would hand a stranger's IP address to a third party before they had agreed to anything. We count visits ourselves, in aggregate, to know whether the thing works.

What that counting actually is, in full: for each day we keep a tally of how many times each page was opened, a tally of how many separate visitors we saw, and a tally of how many times things like a doorbell ring or a sign-in happened. They are numbers and nothing else — no name, no address, no record of which pages any one person looked at. There is no cookie and no fingerprint. To avoid counting the same person twice in a day we briefly keep the same scrambled version of your internet address described above, and it is deleted on the same 24-hour clock; the numbers it produced stay, the scrambled address does not. Because of that, “visitors” is a good estimate rather than a headcount: two people on one wifi look like one, and one person on wifi and then mobile data looks like two.

Who else sees it

Telegram, because that is how a ring reaches you and you chose it. Our hosting provider, because the server runs there. And Paystack, if you take a paid plan — they handle the card, so they see your payment details and we do not. That is the whole list. We do not sell your information and there is nothing here worth selling.

And anyone you invite into your household — see below. That is a person, not a company, and it is the one case where somebody other than you can see and hear a visitor at your door.

Households — who else can answer your door

You can invite other people into your household so they can answer the door too. This is the most significant thing you can do to the privacy of anyone who rings your bell, so it is worth being exact about it.

A housemate you invite can see and hear a visitor's live video and audio when they answer, exactly as you can.

• They can see the door in their own dashboard, see when it rang, and answer a call.
• They cannot create or replace the QR code, change the door's settings, invite anyone else, or remove anyone. Those stay yours.
• You can remove them at any time, from your dashboard. Removal is immediate: their access stops, any call they are already in ends, and an invite you had not yet given out stops working.
• They can leave on their own, and you are told when they do.

A visitor is not told which member of a household answered. If that matters to you, tell the people you invite — we cannot tell a stranger at your gate who is on the other end.

Deleting all of it

You can delete your account and everything in it from your dashboard, at any time.

You do not have to ask us and you do not have to explain. It removes your account, your doors, your codes and your ring history. Backups roll over on their own cycle, so a copy can persist there briefly before it is overwritten.

Your rights

South Africa's Protection of Personal Information Act applies. You may ask what we hold about you, ask us to correct it, or ask us to delete it — the dashboard does the last one instantly. If you think we have handled something badly, tell us, and you may also complain to the Information Regulator of South Africa.

Children

Doorbell is for adults running a household. We do not knowingly collect information about children.

Changes

If this changes materially we will say so here and update the date at the top. We will not quietly start doing something this page says we do not do.