Privacy Policy

Last updated: August 20, 2026

PebbleCare ("we", "our") connects families with home daycare providers. This policy explains what data we collect, how we use it, and the choices you have. By using PebbleCare you agree to this policy.

1. Information we collect

Account: name, email, password hash, role (provider or guardian), and authentication identifiers (e.g. Google sub).
Provider profile: daycare name, address, hours, capacity, rates, photos, amenities — content you choose to publish.
Family profile: child names, dates of birth, allergies, dietary and medical notes, emergency contacts, and custody/pickup details — entered by a guardian, or by the daycare when the daycare sets the family up.
Care records your daycare creates about your child: daily logs (meals, naps, diapering, mood, incidents), health entries (temperature, symptoms, severity, action taken), check-in and check-out records including location when location capture is switched on, photos and videos, and the daycare's own care notes.
Operational data: messages, invoices, applications, ratings.
Technical: browser/device info, log data, and cookies needed for authentication. We hash the IP address used for waitlist sign-ups. We store the plain IP address and browser user-agent alongside the records that need to evidence who agreed to what — signing a daycare's policy, and accepting these terms during daycare-managed onboarding.

2. How we use information

To run the service: matching families with providers, processing enrollments, sending notifications, generating invoices.
To authenticate and secure accounts (including via Google OAuth, when you choose to use it).
To send transactional and product emails (invitations, alerts, confirmations) — never marketing without your opt-in.
To investigate abuse, enforce our terms, and comply with legal obligations.

3. Sharing

We share information only where necessary to operate the service:

With other users: when you enroll or apply, the relevant provider and the family's authorized guardians see the child and family profile data they need to provide care.
With service providers: Supabase (database/auth/storage), Resend (transactional email), Vercel (hosting), Sentry (error monitoring). They process data on our behalf under their own privacy commitments.
For legal reasons: when required by law, court order, or to protect rights and safety.
We do not sell personal information.

4. Google user data

If you sign in with Google, we receive your email address, profile name, and Google account ID. We use these solely to authenticate your PebbleCare account. We do not access Gmail, Drive, Calendar, or any other Google service data, and we do not share Google-derived data with third parties except the infrastructure providers listed above.

5. Retention

We keep account and care data while your account is active. Specific windows:

Deleted daily-log entries and deleted attendance records: recoverable for 30 days, then kept for audit for 3 years, then permanently deleted.
Photo attachments in chat: removed 180 days after sending — except attachments on a message hidden by moderation, which are kept as evidence.
Notifications: removed after 90 days.
Photos and videos in daily logs: kept until your daycare deletes them — there is no automatic expiry, and guardians cannot remove them. Ask your daycare, or email us, if you want one taken down.
Child profiles, current daily logs, and attendance records: kept as long as the account exists. Deleting your account does not remove them — see “Your choices” below.
A family record a daycare created that is never claimed: removed after one year with no activity on it. While it is still being used it is kept.
Family history records: a summary a daycare keeps after a family leaves — 7 years.
Invoices and financial records: kept for as long as the family record exists, and they survive account deletion — both sides of a care relationship may need them for tax, accounting, and dispute resolution. The exception is the daycare-created family record below: when that is purged, its invoices go with it.

6. Your choices

Access & correction: view and edit most data inside the app.
Export: download a copy of your core account data anytime from Settings → Account → Privacy. Photos and videos, attendance records, and calendar data are not included in the export yet.
Deletion: deleting your account from Settings → Account → Privacy deactivates it — we remove your name, photo, and phone number from your profile, unpublish any daycare you run, and permanently block sign-in. Records shared with the other side of a care relationship — child profiles, daily logs, photos, attendance, invoices — stay with that daycare or family under the retention windows above. To ask us to remove specific records beyond that, email support@pebblecare.app.
Email: transactional emails (invites, alerts) are required for the service; we will add a marketing opt-out before any marketing email is sent.

7. Security

Data is encrypted in transit (TLS) and at rest. Database access is gated by row-level security and service-role tokens. We do not store plaintext passwords. Despite reasonable safeguards, no system is perfectly secure — promptly report suspected incidents to support@pebblecare.app.

8. Children

No child holds a PebbleCare account or uses the service — every piece of information about a child is entered by an adult. Guardians add the child's profile: name, date of birth, allergies, dietary and medical notes, emergency contacts. Daycares add records in the course of providing care: daily logs, health entries, attendance, photos and videos, and care notes. Where a daycare sets a family up before the guardian has an account, the daycare may create the child's record and the guardian completes it. Child information is visible only to the daycares and guardians authorized for that child's family. We do not knowingly collect any information directly from a child under 13.

9. Changes

We may update this policy. Material changes will be announced in-app or via email. The "Last updated" date above reflects the latest revision.

10. Contact

Questions or requests: support@pebblecare.app.