Security & data practices

Account protection

Passwords are stored as salted PBKDF2 hashes (200,000 iterations) — never in plain text, and we can't see them either.

Sessions use random 256-bit tokens in HttpOnly cookies, marked Secure on HTTPS and SameSite=Lax, so other sites can't ride your login.

Logins are throttled — repeated failed attempts from the same address are temporarily blocked, and error messages never reveal whether an email is registered.

Every state-changing form carries a per-session security token, so a malicious site can't submit actions on your behalf.

Payments

We never see your card. All billing is processed by Stripe; card details go directly to them and never touch our servers. Subscription changes from your Billing page go through Stripe's own secure portal.

Messages

Twilio callbacks are signature-checked — we verify that delivery reports and parent replies actually came from Twilio before acting on them.

STOP is honored immediately and automatically. An opted-out number is never texted again unless the parent replies START.

Consent attestation is recorded — when you add a family, we log who added them and when. The underlying proof of consent (your signed form or verbal-consent record) stays with you.

Data handling

We collect only what's needed to send reminders and run your account: your profile, the family information you enter, message logs, and your settings. We don't sell your data or share it with advertisers. Your number lists are shared only with Twilio (to deliver messages) and your own staff view. Campaign measurement uses hashed identifiers, not identities.

Deletion: cancel anytime and ask us to delete your account data — contact our support team. Message logs needed for compliance disputes may be retained as required by law.

Honest limits

We're a small, focused product — not a bank. We don't claim certifications we haven't earned (no SOC 2 audit), and we don't verify tuition payments (a parent's PAID reply is recorded as reported paid until you confirm it). If you spot a security issue, contact our support team and we'll take it seriously.