What this app knows, and who can see it

What is stored

• A child's first name or nickname, their birth month, and a record of visits, tests, things tried, and things noticed: whatever a parent types in.
• Voice notes: the sound file, the text it was turned into, and the entries a parent accepted from it.
• Documents a parent uploads (reports, letters, lab printouts): the file itself, and a plain-words version of what it says with the names taken out.
• For each adult: a name, an email address or a username, a password (stored only as a bcrypt hash, so nobody, including us, can read it back), and the notes and ticks that adult made.
• A daily mood number and private notes on the "For you" page.
• If you turn on evening reminders, a push address for your phone.
• Ordinary sign-in records: browser, IP address, last time used.

There is no analytics, no tracking pixel, no advertising, and no third-party script that watches what you do here.

Who can see what

• Parents (owner, editor) see the whole record and can change it.
• Viewer sees the record but cannot change it.
• Helper (for example someone at daycare) sees only the day's goals and can tick them and leave a short note. A helper does not see medical history, test results, doses, or the doctor's brief.
• Your own notes on the "For you" page are yours. The other parent sees them only if you press share. Your mood number is shared only if you switched that on.
• Whoever runs the server can technically read the database, as with any app. That is one person: the parent who set this up.

What leaves this server

Almost nothing does. Four things do, and only when you ask for them:

• A voice note is sent to OpenAI to be turned into text, and the text is sent back a second time to suggest entries. This leaves Australia and is processed in the United States. OpenAI's API terms say it is not used to train their models. If you would rather not, type instead of recording. Everything works the same.
• A document you upload is sent to OpenAI to be read, the same way. It is read under an instruction never to copy a name, an address, a phone number, a patient or Medicare number, or the name of a clinic into the record. What comes back is the dates and the numbers. The file stays here.
• A question you ask the record is sent to OpenAI together with the entries that match it.
• A reminder is sent through Expo's push service so it can reach your phone. It never names a treatment, a symptom or the child, and it never says how many things are left: it asks whether anything was noticed today, and nothing else.
• A payment, if someone buys a plan or a gift, goes through Stripe. Stripe sees the buyer's name, email address and card. We never do, and no card number ever reaches this server. Nothing about the child is sent with it: a gift carries a code, not a name.
• An email goes out through SendGrid, a mail service in the United States, so SendGrid sees the address and the message. What those messages are is listed just below.

Nothing is ever sent to a clinic, a supplement seller, a researcher, or anyone else. There are no affiliate links. Children's data is never sold or shared. That rule is not up for discussion.

The emails we send

Five kinds, and no others. There is no newsletter, and your address is never given to anyone.

• A sign-in code, when you ask for one. Six digits, good for a few minutes. It only comes because you pressed the button, so there is nothing to turn off.
• A quiet-week note, if nothing has been written for a week. At most one a week. It never says what was missed or how many days went by. Every one has a Turn it off link at the bottom, which works without signing in; you can also turn it off in the app under You.
• One note before the free month ends, five days before, to the parents on the record. It comes once, never again, and never to a family that already has a plan. It says that nothing you wrote goes anywhere, and where the plan is. Its subject line names no child.
• When someone joins: if a person you invited opens the link and makes their account, the parents on the record are told: on the phone if the app is installed, by email if it is not. It names the person who joined and what they can see, never the child. It answers an invitation you sent, so there is nothing to turn off; you can remove that person on the same page you invited them from.
• About deleting your account: when you ask for it, if you call it off, and when it is done. These answer something you did, so they cannot be turned off, but they stop with the account.

Where it lives

One small server in Sydney, run on Fly.io. The database and the sound files sit on a disk attached to it. Backups are kept on the same disk and the oldest are deleted automatically. Everything travels over HTTPS.

You stay signed in for 30 days of not using the app; after that you sign in again. Passwords must be at least 12 characters.

Deleting things

• Any entry, goal, note, voice note or document can be deleted from inside the app by whoever can edit it. Deleting one deletes the sound file or the document with it.
• A parent can remove a person at any time, from the journey's settings page. That person loses access immediately.
• Anyone can delete their own account, in the app (You → Delete account) or on the web (Delete account, at the bottom of every page). You are signed out everywhere at once, and the account is deleted from the database 30 days later. Signing in before then calls it off.
• What goes with you: your private notes (shared ones too), your daily number, your practices, the questions you asked, and your sign-ins and phones. What stays: what you added to the child's record (entries, ticks, spoken notes and documents), so the other parent doesn't lose half of it. It stays without your name on it.
• If you are the only owner of a child's record, you choose first: hand it to another parent who is already on it, or delete the record with your account.

One more thing

This app is a notebook. It is not medical advice, it does not diagnose anything, and it does not decide anything for you. It only keeps track of what you and your doctors already did, so you can see it in order.

Questions, or something here that does not match what you expected? Ask the parent who sent you the invite, or write to us on the support page.