Security & Privacy Practices

The most sensitive fields in your records — diagnoses, medications, allergies, care team contacts, incident descriptions, IEP notes, and phone logs — are encrypted individually in the database using AES-256-CBC encryption before they are ever written to disk.

This means that even if someone gained direct access to the database (e.g. a database backup file), they would see only unreadable ciphertext for these fields. The encryption key is stored separately from the database, not in it.

All communication between your browser and our servers is encrypted using HTTPS (TLS). Your data is never transmitted in plain text over the network.

Your password is never stored in plain text. We use bcrypt — a slow, salted hashing algorithm specifically designed for passwords — so that even we cannot recover your password, only verify it.

Child profile photos are stored in a private, non-web-accessible location on the server — not in a public folder. Photos are served only through an authenticated route, so they cannot be accessed by guessing a URL. Only the account owner can view their children's photos.

You can enable TOTP-based two-factor authentication from your profile settings. When enabled, signing in requires both your password and a time-based code from an authenticator app (Google Authenticator, Authy, 1Password, etc.). We strongly recommend enabling it.

Your session automatically expires after 30 minutes of inactivity. You'll receive a warning before the timeout so you can stay logged in if you're still working. This protects your account if you step away from a shared or public device.

We do not sell your data. We do not share it with advertisers. We do not use it to train AI models. The only third parties who ever touch your data are:

You can download a full export of all your records (child profiles, incidents, events, and logs) as an encrypted-field-decrypted ZIP file from your profile settings at any time. You can also permanently delete your account — doing so removes all your data, including child profiles, incident records, and photos, immediately and irreversibly.

Sensitive actions — including data exports, PDF/CSV report generation, and contact form submissions — are rate-limited to prevent automated abuse. All requests are protected by CSRF tokens to prevent cross-site request forgery.

In the unlikely event of a security breach that affects your data, we will notify you by email as quickly as possible — describing what happened, what data was involved, and what steps we are taking. We will not delay notification to manage our own reputation.

If you discover a security vulnerability, please report it responsibly through our support form. Include as much detail as you can — steps to reproduce, affected area, and potential impact. We take all reports seriously and will respond promptly.

Please do not publicly disclose the vulnerability until we've had a chance to address it.