Privacy Policy

The short version

We store the least we can get away with. There is no advertising and no advertising pixels anywhere, and no analytics and no third-party scripts in the GoButtons app or in our internal tools — not on a station, not on a receiver's phone, nowhere a person pressing a button could be affected by one. This website is the exception, and we will not pretend otherwise. If you agree to it, this site uses cookies for analytics and for advertising — which means measuring which pages work, and showing GoButtons ads to people who visited. Nothing loads until you say yes, refusing is one click, and you can change your mind whenever you like. We do not sell personal information for money, and nothing you do inside GoButtons is ever used for advertising. Advertising cookies on this website count as “sharing” under California law, so there is a plainly labelled way to refuse them in the footer of every page, and we honour your browser’s Global Privacy Control signal automatically. The person pressing the buttons gives us nothing about themselves at all — no name, no email, no account.

Who is responsible

Eventually Right LLC operates GoButtons and decides what is collected and why. Questions, requests, or complaints go to hello@gobuttons.app.

What we collect

If you hold the account

You give us an email address, a password, and a display name when you sign up. We store the email address and the name; the password is stored as a hash by our authentication provider and we never see it.

Stations and the people you add

A station is a device showing the buttons. It has a name that you choose — meant to be a place, like “Kitchen” — and an anonymous session identifier. It has no email address, no password and no account. Each person you add has a display name that you or they choose, and likewise no email address of their own.

The person pressing the buttons never tells us who they are. There is no name field for them, no sign-in, and nothing to type. If a person's name ends up in our records, it is because the account holder typed it into a station or button name.

What the buttons say, and what happens when they are pressed

We store, because the product cannot work otherwise:

• the label and confirmation message on each button, which you write;
• each press, and the time it happened;
• the reply somebody types back, if they type one;
• which person acknowledged or cleared it, and when.

That last one is deliberate and worth knowing about: presses record who answered, so that several people on the same account do not all act at once or all assume somebody else did.

Notifications

To send a notification we store a push token for each device that should receive one, and which platform it is. We also keep a short-lived record of each notification we hand to Apple or Google so we can find out whether it was actually delivered.

Security records

When somebody tries to use a setup code, we record the attempt, whether it worked, and the IP address it came from. This is what stops somebody connecting to your account by guessing codes.

Payment

We never see your card. Paddle takes the payment and is the merchant of record. From them we receive and store a subscription identifier, event identifiers, when the subscription expires, and how many stations and people it entitles you to. We do not store card numbers, billing addresses or tax identifiers — Paddle collects those directly, under their own privacy policy.

Cookies, analytics and advertising on this website

Nothing is loaded and no cookie is set until you agree. Not when the page loads, not while you are deciding. If you close the banner without answering, or refuse, this website behaves exactly like the rest of GoButtons and tracks nothing at all.

If you accept, this website uses Google Tag Manager to load cookies and scripts for two purposes, and we would rather name them plainly than bury them in a category list:

• Analytics. Counting visits — how many people arrive, which pages they read, and roughly where they came from. We have no budget for advertising, so this is the only way to know whether writing a page was worth the hours.
• Advertising and remarketing. Measuring whether an ad led to a signup, and showing GoButtons ads to people who have visited this website, on other websites and in other apps. This involves advertising companies setting their own cookies and receiving your identifier, and it is the part that most people mean when they say “tracking”.

What is set, and what each thing is for:

• Your answer to the banner — gb_consent. One cookie, holding the word “granted” or “denied” and nothing else — no identifier, nothing that distinguishes you from anyone else. It is set only once you have answered, it lasts six months, and it exists so we do not ask again on every page. It is set whichever way you answer, including when you refuse.
• Analytics and advertising cookies — set by Google, with names beginning _ga, and only if you accept. These carry a random identifier so that two page views can be recognised as one visit, and so an ad can be matched to a visit. The companies named below receive that identifier and your IP address as part of the request.
• Where you came from — gb_src, and only if you accept. One cookie of ours holding the search or link that brought you here — the campaign tags on the address, the website that linked to you, the first page you landed on, and the date. It carries no identifier and nothing about who you are.
  It exists for one question: if you later create an account, we want to know whether the hours we spent writing a particular page were worth spending. It is readable across gobuttons.app and its subdomains for that reason, it is kept for 90 days, it is never updated once set, and it is deleted the moment you refuse.

That last one is the only thing on this website that can end up attached to your account, and it is worth being exact about what that means. If you accept, and later sign up, the account record gains a note saying which page or campaign you first arrived from. It never contains anything you did inside the app, and it is not used to advertise to you — it is counted, in aggregate, to decide what to write next.

Nothing from inside GoButtons is ever used for any of this. No press, no reply, no button label, no station name and no account detail leaves our database for an advertising purpose. This is about which pages of a public website somebody read before deciding whether to buy — nothing more, and there is no version of this where a message somebody sent asking for help becomes advertising data.

You can change your mind at any time, and it takes one click: reopen the cookie banner . Refusing after having accepted also clears what was set. If that link does nothing, JavaScript is blocked in your browser — in which case none of this ran in the first place.

Tracking on this website started on 27 August 2026. Before that date nothing here was counted at all. The Google Analytics property is G-JW4QQTJMS2.

None of this exists in the GoButtons app, or on a station, or in the tools we use to run the service. There is no analytics, no tag manager, no advertising pixel and no third-party script in any of them, and there is not going to be. Somebody pressing a button to ask for help is not a marketing audience, and that is a rule we hold ourselves to rather than a promise about the current build.

What we do not collect

• No analytics, tracking or advertising in the app or our internal tools. Not on a station, not on a receiver's phone, not in the tools we use to run the service. This public website is the one exception, it is described in full above, and it happens only if you agree to it.
• No advertising built on anything you do inside GoButtons. This website uses advertising cookies if you agree to them; presses, replies, button labels, station names and account details are never part of that, and no advertising identifier is ever attached to them.
• No location beyond whatever an IP address implies about a country.
• No contacts, photos, microphone or camera access.
• No date of birth, and no health information — despite what people often use this for, we ask for none and store none.

Who else sees it

We use other companies to run the service. They only receive what they need to do their job, and they are not permitted to use it for anything else.

• Supabase — hosts the database, the accounts and the sign-in system. Almost everything described above is stored there.
• Expo, and through them Apple and Google — deliver notifications. See the note below about what is inside one.
• SendGrid — sends account emails, so they handle your email address and the contents of those messages, including sign-in codes.
• Paddle — takes payment. When you start a purchase we pass them your account identifier and your email address so the subscription can be matched to your account.
• Expo Application Services and Cloudflare — host the app's web version, this website, and our internal tools. Like any web host they will see request information such as IP addresses in their own logs, under their own policies.
• Google, and any advertising companies we use — measure visits to this website and deliver GoButtons advertising, and only if you agreed to it. They receive the pages you looked at on this website, a random identifier, and your IP address. They receive nothing from the GoButtons app, nothing about your account, and nothing about any press or reply. If we start using an advertising company not already named here, this page is updated before the tag goes live, and the date at the top moves.
• Apple and Google — distribute the app through their stores, under their own terms.

What is inside a notification, exactly. A push notification contains the station's name and the button's label — for example “Kitchen · I need help” — because otherwise it would tell you nothing. Those words travel through Expo and through Apple's or Google's notification service. A reply typed back is never put in a notification and does not leave our database that way.

We do not sell personal information for money. We do use advertising cookies on this website if you agree to them, which California law defines as “sharing” — so it is named as such below, with a way to refuse it that does not depend on you reading this far.

Where it is stored, and how it is protected

Data is held in the United States by the providers above. Connections are encrypted in transit, and access to the database is restricted by row-level security rules so that one account cannot read another's.

To be straight with you about the limits of that: we do not apply our own encryption on top of what our providers give us, and GoButtons is not end-to-end encrypted. We can technically read what is in the database, and so can our hosting provider. Do not use button labels or replies for anything you would not want a system administrator to be able to read.

How long we keep things

Honestly, longer than we would like in a couple of places. As it stands today:

• Presses and replies are kept indefinitely while the station they belong to exists. Removing a station deletes its buttons and its presses with it.
• Notification delivery records are deleted after 30 days, and a push token is deleted as soon as a device tells us it is no longer valid.
• Setup-code attempt records, including IP addresses, are deleted after 24 hours. A job runs every hour, so the longest anything survives is about 25 hours. This page said until 27 August 2026 that they were not deleted on a schedule and that we had it written down as something to fix; that is now done.
• Account and billing records are kept while your account exists, and billing records for as long as tax law requires after that.

Deleting your account

You can delete your account yourself, in the app. Sign in as the account owner and go to Account, then Delete account. You will be asked to type a word to confirm, because a dialog is answered by the same reflex that opened it. Until 27 August 2026 there was no button and this page said so; there is one now.

It happens immediately and cannot be undone. There is no grace period and nothing is kept hidden in a deleted state, on purpose — data that is still there while a page says it is gone is the worse arrangement of the two.

Deleting the account removes the account holder's record and, with it, the account's stations, their buttons, every press and reply ever sent, the people you added, your push tokens and your subscription records. It also removes the anonymous logins the account handed out to its stations and seats. Somebody who joined with their own email address keeps their own login — deleting your account never deletes another person's.

A station that was signed in when you delete does not show an error. It asks to be set up again, the same screen it shows before it has ever been used.

A message waiting for an answer does not stop the deletion. The screen tells you how many people are waiting before it asks you to confirm, and deleting will not answer them. We do not refuse, because the only people who could clear those messages are the ones being deleted.

Some records may persist briefly in backups, and billing records that we are legally required to keep will remain with Paddle. If you would rather not do it yourself, email hello@gobuttons.app from the address on the account and we will do it and confirm when it is done.

Note that removing GoButtons from a station is not deletion. It signs that device out and stops the buttons working there; the station keeps its name, its buttons and its history so that it can be set up again on a new device.

Your rights

Wherever you live, you can ask us to show you what we hold about you, correct it, delete it, or give you a copy in a portable form. Email hello@gobuttons.app and we will do it. We will not charge you and we will not make the service worse for you because you asked.

If you are in California

California residents have the right to know what personal information is collected and who it is disclosed to, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising those rights. This page is the notice of what we collect and who receives it.

Do Not Sell or Share My Personal Information

We do not sell your personal information for money, and we never have. We do use advertising cookies on this website if you agree to them, and under California law that counts as sharing for cross-context behavioural advertising. You have the right to refuse it, and refusing costs you nothing — the site works identically.

Do Not Sell or Share My Personal Information — this opens the same control as the link in the footer of every page. Choosing “Reject” is the opt-out. You do not need to give us your name or your email to use it, and we do not ask who you are.

We honour Global Privacy Control automatically. If your browser or an extension sends the GPC signal, this website treats it as a refusal before anything loads, and you are not shown the banner at all. You do not have to do anything, and you do not have to tell us. If you would nevertheless like to opt in on this one site, the footer control still works — a specific yes can override a general no, and never the reverse.

Two things this opt-out is not, so that it is not mistaken for them. It does not affect anything inside the GoButtons app, because there is nothing there to opt out of. And it is not a data-deletion request — for that, email hello@gobuttons.app, described under “Your rights” above. You may make any request through an authorised agent.

If you are in the UK or the European Economic Area

We handle your information because it is necessary to provide a service you asked for, and to keep it secure. You have the rights above, plus the right to object to processing and to complain to your data protection authority.

The one exception is the analytics and advertising cookies on this website, where our lawful basis is your consent and nothing else. You may withdraw it at any time using the “Cookie choices” link in the footer of every page, and withdrawing is as easy as giving it was — one click, in the same control, with refuse and accept the same size. Withdrawing does not affect anything collected before you did, and it does not affect the service in any way.

Children, and people who cannot speak for themselves

The account holder must be 18 or over. GoButtons is not aimed at children, and we do not knowingly collect information from one.

The design does most of the work here: a station asks for nothing and stores nothing about the person pressing it. If a child, or an adult who cannot manage an account, is the one using the buttons, they are giving us no information about themselves. What is in our records about them is whatever the account holder chose to type — which is a good reason to name a station after a room rather than a person.

Changes to this policy

If we start collecting something new, or use a new provider that receives your information, we will update this page and change the date at the top. If the change is significant we will email account holders rather than rely on you noticing.

Getting in touch

hello@gobuttons.app reaches a person. Requests about your own data are answered within 30 days, and usually a lot sooner.