All data is encrypted at rest by Supabase and encrypted in transit via HTTPS/TLS.

Every query is scoped to your account — parents can only access their own data, or shared family data when invited. Database row-level security (RLS) provides an additional layer of protection.

Rate limiting and input sanitisation protect against abuse, spam, and injection attempts.

Strict Content Security Policy (CSP) headers, clickjacking protection, and locked-down permissions keep the app secure in-browser.

No advertising pixels and no data sales — ever. We use PostHog for privacy-focused product analytics (to see which features help parents) and Sentry for error monitoring. Neither receives the content of your emails or your children's details, and we never share data with advertisers.

Event extraction uses OpenAI for document/image processing. Data is not retained or used for training.

Parents can view, edit, export, and delete their data any time from Settings.