Privacy policy

This policy explains what Toddler Daybook (toddler-daybook.web.app) does with information when you read the site and when you use the family plan at /app/. It describes what the code does today, in plain words.

The short version

• What you enter in the family plan (your child’s nickname, birth date, logs and notes) is encrypted in your browser before it leaves your device. We cannot read it.
• The key exists only in your family’s share link, after the # sign. Browsers do not send that part of a link to a server.
• We count page visits with a small first-party script that sets no cookies and never receives family data.
• There are no ads, no advertising or social-media trackers, and we never sell or share data.
• If you join the Pro early-access list, your e-mail address is used only to tell you when Pro opens.

What the family plan holds

When you create a family plan you enter details such as the child’s nickname, birth date, weeks born early and home languages; each caregiver’s name, role, colour and time blocks; and the daily routine (wake time, naps, meals, bedtime). Over time the plan also holds what caregivers log: observations on the 0-4 learning scale, new words, milestone notes, care events such as naps, meals and books, swaps and skips, and handoff notes for the next caregiver. We suggest a nickname rather than a full name.

Kept on your devices

Each phone, tablet or computer that opens the plan keeps its own readable copy in the browser’s IndexedDB storage, or in localStorage when IndexedDB is unavailable (some private browsing modes). The device also remembers the family’s secret so the plan opens again without the link, and which caregiver uses it (“I am …”). Clearing this site’s data in your browser removes all of it from that device.

Synced end-to-end encrypted

To share one plan between caregivers, the app syncs it through an encrypted vault. This is how it works:

1. When you create a plan, your browser generates a random 256-bit secret.
2. From that secret the browser derives two things with HKDF-SHA256: a space identifier (a long random-looking code that names your family’s storage) and an AES-GCM 256-bit encryption key. The key is created inside the browser’s Web Crypto engine as non-exportable and is never sent anywhere.
3. Every item (the profile, one observation, one note) is encrypted on its own with AES-GCM and a fresh random 12-byte IV before upload. The encryption is bound to the space and the item’s id, so an item cannot be moved into another plan unnoticed.
4. Our vault, a Google Cloud Firestore database that Google operates for us as a processor, receives only the space identifier, a random item id, the encrypted item, its IV, the site name and a server timestamp. It holds no names, dates, logs or notes in readable form, and we have no way to decrypt them.
5. The secret travels only inside the share link (/app/#k=…). The part after #, the fragment, stays in the browser and is not sent to our servers when the page loads. After the plan opens, the app removes it from the address bar; Settings can show the link again.

Anyone who has the link can see and change the plan, so share it only with the people who care for your child, through a private channel. Because only your family holds the key, we cannot recover a plan if every device and every copy of the link is lost; the backup export in Settings is the safeguard.

Family data never appears in page titles, in addresses (apart from that fragment), in analytics events or in error messages, and the app does not write it to the browser console. The activity library the app downloads is the same public data as this website and is fetched without any personal information. A service worker keeps copies of site pages and files so the app also opens offline; family data stays in the app’s own storage described above.

Backups and erasing

Export in Settings saves a JSON file to your device with the plan in readable form. It contains your child’s data, so store it as carefully as any private family document. Import reads such a file back into the plan.

Erase this family’s data in Settings deletes every encrypted item of the plan from our vault and then the copy on that device. Other devices that opened the plan keep their own local copy until it is erased there too or the browser’s site data is cleared.

Page statistics, without cookies

A small first-party script records an event when a page loads and when a few things happen: a tool is used, a Pro button is clicked, someone joins the Pro list or clicks a checkout link. Each event contains the site name, the page path (without query string or fragment), the referring page (origin and path only), the event type, a timestamp and a random visit identifier. That identifier is generated in your browser, kept in session storage (not a cookie), replaced every day and gone when you close the tab; it only lets us count distinct visits.

The script sets no cookies and records no name, e-mail address or device identifier. From the family plan it sends at most one “tool used” event per page view, never what you entered. Automated browsers and known bots are skipped. The events are stored in Google Cloud Firestore and used only to see which pages help people. Like any web request, the connection exposes your IP address to the hosting and storage providers; we do not store it in the events.

No ads, no third-party trackers

The site shows no ads and loads no advertising, social-media or third-party analytics scripts; Google Analytics is not used. Fonts and icons are served from this site, so reading a page does not contact other companies. We never sell, rent or share information about visitors.

Pro early-access list

If you join the Pro early-access list, we store the e-mail address you enter, your optional answers (what would make Pro worth it and what you would pay), the site name, a timestamp and the random visit identifier, in Google Cloud Firestore. We use the address for one purpose only: to e-mail you when Pro opens, with your founder price. No newsletters, no sharing, and the list cannot be read from the website. Removal requests need a contact address, which the contact page will list; none is published yet.

Payments

No payment is taken on this site today. When Pro opens, it will be sold through Link, Stripe’s reseller, as the merchant of record: checkout will happen on a Stripe-hosted page, and Link will collect your payment details and share with us only what is needed for Pro, refunds and support. We will never see or store your full card number. The Link privacy policy and Stripe’s privacy policy will apply to the data they process.

What is stored in your browser

• The family plan: its items, pending changes waiting to sync, the family secret and which caregiver uses this device (IndexedDB or localStorage).
• Small app preferences, such as tips you dismissed.
• Your light or dark theme choice, if you changed it (localStorage).
• The random visit identifier for page statistics (session storage, replaced daily).

Hosting

The site is served by Google Firebase Hosting, which processes standard request data such as IP address and browser type to deliver pages and protect against abuse.

Children’s information

The site is for parents and caregivers; it is not meant to be used by children. The family plan holds information about a child that an adult enters, and it is encrypted on that adult’s device before it is stored. We do not knowingly collect personal information directly from children.

Your choices and rights

Because family-plan data is encrypted with a key we never receive, we cannot look it up, correct it or hand it over: you control it directly, by editing it in the app, exporting it or erasing it. For anything we can read, such as a Pro-list address, you may ask to access, correct or delete it, depending on where you live. Contact us through the contact page and we will answer within 30 days.

Related pages

The rules for using the site are in the terms of use. Where the activities and milestones come from is on sources and method, who runs the site is on the about page, what Pro will include is on the pricing page, and how refunds work is in the refund policy. Operated by Deljan Bregasi, Salem, Massachusetts, USA.

Changes

If this policy changes, the new version will be posted on this page with a new date.