How we protect your data — precisely.

Everything travels over TLS. The database and file storage are encrypted at rest. On top of that, the things that matter most — message bodies, your documents, and your children’s health and contact details — are encrypted with a key belonging to your family alone, which is itself protected by a managed key service. A leaked database copy would contain ciphertext.

End-to-end encryption would mean the server could never read your content — which would also mean it could never produce your exportable record, your integrity check, or your formatted report. Those are the reasons the product exists. So we made a different trade-off and we describe it accurately rather than borrowing a phrase that would sound better and be untrue.

Our own admin tools cannot return message bodies, document contents, child details, calendar contents or expense line items. This is not a permission setting that someone could change: the admin code lives in a separate part of the system that is structurally unable to reference that data, and an automated test fails the build if that ever stops being true.

Every record is filtered by family identity at the lowest level, and there is an automated test for every single endpoint that proves a member of one family is denied access to another’s data. Those tests run on every build, permanently.

Export everything, free, at any time. Delete your account for real — your personal data erased or anonymised, completed within 30 days including your stored files. Where a shared record has to be retained because your co-parent co-owns it, you appear as “Former co-parent”, and we tell you that before you confirm, not afterwards.

No ads. No selling or sharing your data. No third-party analytics library in the app. On this website, analytics cookies load only with your consent. No continuous location. No covert recording — if a recorded-call feature ever ships, both parents are notified, always.