How we protect kids’ info

The short version

• We never sell your family’s data, and we don’t give it to advertisers, data brokers, or other families.
• Another family using the app cannot open your schedule. Database rules enforce that.
• Private calendar links are encrypted before they are saved.
• The app never texts anyone. It does not email or message other people on its own.
• The website is served over HTTPS. Supabase, which hosts the database, encrypts stored data on disk.
• The family owner can delete the family from settings, and can download a JSON copy first.

What we collect

• The email address you use to sign in. There is no password. Supabase emails you a sign-in link.
• The family name, each kid’s first name, and a color you pick so the week view is easy to scan.
• The private calendar link you paste. We store it encrypted. The app screens do not show it back to you.
• Event titles, times, places, and whether a practice was cancelled, taken from the calendars you connect.
• If you join the homepage waitlist: your name, email, how many kids, and which team apps you use. That list is separate from a family account.

What we don’t collect

• Passwords.
• Your contacts, photos of your kids, or live location.
• Card numbers. The founding-family payment button opens Stripe. We don’t see the card.
• We don’t run ads, and this site doesn’t load a third-party analytics script.

Who can see a schedule

People signed in to your family can see the kids and the week. Row level security on the database is what stops another signed-in family from reading those rows. The browser is not given the service key that bypasses those rules.

The app server does read calendar links, using that server key, so it can refresh the week. Someone who administers the Supabase project can also open the database. Calendar links stored there are encrypted with a key that lives on the app host, not in the database.

Calendar links

A team calendar link is a secret. Anyone with it can often see the schedule. We accept https and webcal links, turn webcal into https, and refuse links that point at private networks, link-local addresses, or cloud metadata addresses. Downloads are size-limited, time-limited, and only follow a few redirects. New links are encrypted with AES-256-GCM before they are saved. A refresh rewrites an older unencrypted link the same way once the encryption key is set.

Refresh now is limited to about once a minute per family. The daily refresh skips calendars it already updated in the last few hours, so a repeated call does not keep hitting team websites.

Messages

The app does not send text messages or emails to coaches, schools, or other parents. There is no background sender. Ride notes on the marketing page are something you would send yourself from your own phone or email.

Deleting your data

In settings, the family owner can download JSON and can delete the family by typing its name. Deleting removes the kids, calendar connections, and imported events. When the server key is configured, we also remove that sign-in. A homepage waitlist row is not tied to the family and is not removed by that button.

Adding or removing a calendar, exporting data, and deleting a family are written to an audit log your family can see. The summary does not include the calendar link. Deleting the family keeps a short note that the family was deleted, then clears the account id from that note when the sign-in is removed.

What we are not claiming

We do not have SOC 2, ISO 27001, or a COPPA certification. Nothing here is “military-grade” or “unhackable.” Google sign-in is off unless we explicitly turn it on. This page needs a real inbox at the address below before you treat it as the public contact.

Questions and vulnerability reports: security@carpoolbrain.com. That address is a placeholder until the mailbox exists.