Privacy

Who runs this

The site is run privately by Dan Winnick at kidtracker.ai. It is not a product and it is not offered to anyone else. Questions about anything on this page go to dannywinnick@gmail.com.

What the site keeps

Three things, and nothing beyond them:

• Who you are. Your Google account's email address and the name on it, handed over by Google when you sign in. That is the whole of the account — there is no password here, no profile and no photo.
• What you write into the calendar. Change requests and the schedule records behind them: the kind of change, its title and details, the dates it covers, who raised it, when, whether it was approved or rejected, who decided and the reason given for a rejection.
• A session. A signed cookie that says you are logged in, valid for twelve hours, plus a short-lived cookie used only to carry a login safely from this site to Google and back.

Anything typed into a change request is stored as typed, so treat those boxes the way you would treat a shared document: put in what the other parent needs to decide, and leave out what neither of you needs recorded.

What it does not keep

• No analytics, no tracking pixels, no advertising, no fingerprinting.
• No cookies except the two described above — none of them for measurement.
• No location, no contacts, no calendar access on your device, no uploaded files.
• Nothing is sold, rented or handed to anyone for marketing. Ever.

Who can see it

Two Google accounts can sign in, set by hand in the site's configuration. There is no sign-up: an address that is not on that list is turned away at the login callback, before any session exists, and again on every request afterwards. Adding a third person is not something the site can do — it takes a change to the configuration and a deploy.

Beyond the two of you, the only parties who can technically reach the data are the service providers below, in the ordinary course of hosting it.

Where it lives

• Amazon Web Services, in the us-west-2 region. Change requests and schedule records sit in DynamoDB; the pages and the dashboard file sit in a private S3 bucket served through CloudFront; the API runs on Lambda.
• WorkOS handles the sign-in handshake with Google and tells this site the email address and name that came back.
• Google authenticates you. Google sees that you signed in to this site; it does not see the calendar.

AWS and CloudFront keep their own operational logs, which include IP addresses and requested URLs and are retained on their normal schedule. The application itself writes only sparse diagnostic logs and does not log the contents of change requests.

Data is stored in the United States. If you are in Israel or elsewhere, using the site means your data is handled there.

How long it is kept

• Change requests and schedule records — kept until deleted on request. They are the record of what was agreed, so they are not expired automatically.
• Sessions — twelve hours. Logging out clears the cookie immediately.
• Provider logs — on AWS's and WorkOS's own retention schedules, which this site does not set.

The version you download

The standalone custody-calendar.html file is a different thing: it runs entirely in your browser and keeps everything in that browser's local storage. Nothing leaves the device, there is no account, and clearing the browser's site data erases it. Nobody, including the person who wrote it, can see what is in it.

A calendar about a child

This calendar is about a child's time between two homes, which makes it exactly the kind of information that should stay small and stay closed. That is why sign-in is limited to two addresses, why there is no sharing feature, and why nothing here is analysed, profiled or used for any purpose other than showing the two of you the schedule.

The child is not a user of this site and does not have an account.

What you can ask for

Either parent can ask to see everything held about them, to have something corrected, or to have it deleted, and it will be done — subject to one honest caveat: a decided change request is the record of an agreement between two people, so deleting one is a decision for both of you rather than for one.

Ask at dannywinnick@gmail.com. To stop using the site altogether, say so and the address comes off the list; existing sessions stop working straight away.

Security, told straight

The origin bucket is private and readable only by the distribution in front of it, the site is served over HTTPS only, sessions are signed cookies that expire after twelve hours, and the check on who may sign in fails closed — if the accounts cannot be read, everyone is locked out rather than let in.

None of that is a promise that nothing can go wrong. It is a small private site, not a bank. If something does go wrong in a way that affects the data here, you will be told directly, because there are only two of you to tell.

Changes to this page

If what the site keeps changes, this page changes with it and the date at the top moves. There is no mailing list to notify — the two people affected will be told.