# Trust and privacy (/docs/products/dash-dots/trust-and-privacy)

Customers have the final say on what your dot can see.

## What Dash protects

- Your dot uses their camera, photos, files or contacts, or sends them reminders, only after they say yes. They can delete a dot's reminders in Dash.
- Your dot learns their name and their phone number or email address from Dash only after they say yes.
- Your dot can only reach websites your developers list in advance.
- Customers confirm every payment in Dash's payment sheet. Your dot never sees their card, bank or mobile money details.
- What your dot saves on the phone is for your dot alone, and isn't backed up.

## What your dot can ask for

| Permission    | The customer lets your dot                                                        |
| ------------- | --------------------------------------------------------------------------------- |
| Camera        | Take a photo or scan a QR code                                                    |
| Photo library | See only the photos they pick                                                     |
| Files         | See only the files they pick                                                      |
| Contacts      | See only the numbers they pick, like who to send airtime to                       |
| Account       | Know them by their name, and the phone number or email address they use Dash with |
| Reminders     | Remind them with a notification that opens your dot, like when a bill is due      |

Dash asks the first time your dot needs each one. People can say no, so give them another way, like typing the number in.

## About, feedback and reports

**About**, in [the dot's menu](/docs/products/dash-dots/how-customers-find-dots#the-dots-menu), shows who's behind your dot and each permission it uses, with a switch beside it. Customers can turn one off at any time.

**Feedback** goes to your business.

**Report Dot** goes to Monime, not to you. It's for scams and dots that could cause harm.

## What's up to you

- Keep API keys and passwords on your server. Anyone can open a dot and read its code.
- Keep orders, balances and other records that matter on your server, not on the phone.
- Ask for a permission only when a feature needs it, and give a reason a customer will understand.
- Set prices on your server. Someone could tamper with a dot, so never trust a price it sends.
- Tell customers what you collect and why.

Your developers will find the technical side in [Security](/docs/products/dash-dots/developers/security).