dooryard is running a pilot: a small group of households using the service together for a fixed stretch, in exchange for telling the operator what is wrong with it. This page is the deal. It says what the pilot costs, what is not being promised, what the operator can see, how you get your data out or delete it, how to report a problem, and who you are dealing with. It is written to be read once, in full, before you accept an invitation.
While the service is in testing you may also be shown a separate agreement to accept after you sign in. Where the two overlap, this page governs.
Nothing, through June 30, 2027. No subscription, no per-message charge, no card on file. Your feedback is the payment.
The model work behind your conversations runs on the operator's own provider account, under a monthly cap for each household, and the app shows you where you stand against that cap. If you would rather use your own provider key, that door is open; it is never the default and you are never asked for one.
The pilot has an end. What happens after it, including what dooryard costs, is decided before the pilot ends and put in writing to you first. Free through the pilot is the promise being made here. Free forever is not.
There is no uptime promise. dooryard runs at staging grade: a small service, one operator, no overnight rotation. It can be down, and a repair can wait until the operator is awake. Before planned downtime you get a heads-up. For unplanned downtime there is no service credit, no refund and no compensation, because there is no payment to give back.
Nothing here is a warranty. The service is what it is on the day you use it, and the honest reason you are being invited is that it is not finished.
Not your words. What the operator measures is counts and dollars: how many requests were made and what they cost. Usage and billing surfaces show numbers, never transcripts. Your conversations are never trained on, never sold and never mined.
The database keeps you separate. Every table that holds content carries row-level security keyed to the person making the request, enforced in the database itself. There is no administrator screen anywhere in the app that shows one person another person's content.
The operator door shows administrative events. The view the operator does have returns administrative records, who signed in, what was provisioned, what failed, and nothing a person wrote.
Break-glass leaves a receipt. Row-level security binds the application's database account. It does not bind somebody holding the server's own credentials, which is the operator. That is architecture and discipline rather than cryptography, and saying so is more useful to you than a promise the shape of this service cannot keep. Direct database access that could reach your content is for incidents only, never curiosity and never convenience, and it writes a record into the audit trail naming when it happened.
You open the one content channel yourself. The only way something you wrote reaches the operator on purpose is a feedback report you send, or something you deliberately share into a group the operator belongs to. You can stop sharing at any time.
The privacy policy covers what is collected and why. A full inventory of every class of data dooryard holds, where it sits, who can read it, how long it is kept and how it goes away is written and is coming to the app as a page of its own.
Export. One bundle holding your conversations, memories, people and facts, board items, calendar events, reminders and the files you uploaded, in a readable format, is being built and is ready before the pilot begins on January 1, 2027. It is yours to take whenever you want it, and it is what you would take with you if you stopped using dooryard tomorrow.
Deletion. You can delete a conversation, a document, a memory, a calendar date or a board item, and thirty days later it is destroyed for good. Deleting your whole account at once is on its way before the pilot starts. Each door says its window in plain words at the moment you use it, and until that window closes the record is recoverable rather than hidden behind a label. Until the account door lands, ask the operator and it is done by hand.
What we keep, and for how long. What you make is yours and sits on no clock: your conversations, memories, people and facts, board items, calendar events, reminders and files stay until you delete them. What ages out on its own is what you never asked us to keep. Mail forwarded to one of your dooryard addresses is destroyed after 90 days, and so is the small bookkeeping a mail watch leaves behind; saving a message as a document keeps the document. Diagnostics go after 90 days. A dead sign-in, an old access token, a used invite and a retired notification registration go 30 days after they stop working. Your record of what the assistant cost and what it saved you is kept, because it is your own number.
One honest limit on all of it: a deleted record can survive inside a database backup until that backup ages out on its own schedule.
Use Send feedback inside the app. That is the door the pilot is built around: a report goes straight to the operator, you can see what happened with it on your own reports page, and you are told when it ships or when it is dropped and why.
For anything urgent, or anything you would rather not type into the app, write to dan.obrien15@gmail.com.
If you believe you have found a security problem, a security contact address is published on this page before the pilot starts.
dooryard is operated by Dan O'Brien, who is forming a limited liability company to run it. That company will be the party on these terms, on the privacy policy, and on the accounts the service runs on.
The entity's registered name is added here as soon as the formation is complete.
A guarded member's account is created by their guardian, and the guardian's acceptance of these terms covers it; a guarded member is never asked for an account anywhere else in order to sign in.
If these terms change, the change is posted here with a new effective date, and anything that affects what you pay or what you can take with you is announced in the app before it takes effect.