What we hold

A first name and an age. That is all. No surname, no birthday, no photograph, no address, no school name, no contact details of any kind. We never ask, so we could not hand any of it over if we were asked to.

Alongside that: the buttons you chose, the prizes you set, and which of them were tapped on which days. That is the app working.

Your device also tells us which time zone you are in. It is used to cut their week at your midnight rather than a server’s, and to send a reminder at the hour you chose rather than the middle of your night. It is not a location: it says “New York”, not where you are.

Your email address, so you can sign in and we can send you a link. There is no password to store. If you pay, Stripe holds your card — we never see a card number and we could not store one if we tried.

The app is the same board you already use, in a window of its own. It exists for one reason: a note in your inbox at six o’clock is read at nine, by which time the moment has gone. The app can reach your phone at the hour you chose.

To do that, your phone gives us a delivery address — a long code Apple or Google issues for this app on this phone. It is not an advertising identifier. It cannot be used to recognise you on any other app or website, and we never send it anywhere except to Apple or Google to carry the note back. We keep the last five phones you have used and forget the rest.

Turn notifications off in your phone’s Settings and it stops. The next time we try, the phone tells us it is gone and we delete the code. The app asks for nothing else — no contacts, no camera, no microphone, no location, no advertising permission. There is no analytics in it, and nothing about your child ever leaves for anyone but you.

A child can write themselves a private note. It is theirs. It never leaves their device — it is not sent to us, so it is not on your dashboard, not in an email, and not in a backup. We could not read it if we wanted to.

Nobody. Nothing is sold, nothing is shared with advertisers, and there is no analytics company watching your child use this.

Two suppliers do their part and see only what they need: Stripe handles payment, and Resend delivers our emails. A teacher only ever sees a child's first name, the date, and the buttons they are asked to tap — and only if you invite them.

Take a copy of everything, any time, from your own page. Close the account and it is really deleted — every row, straight away, no soft delete and no copy kept for analytics.

One honest exception: we take a backup every night so a family never loses a year of their child’s work to a broken disk. Those backups are kept 30 days and then destroyed, so a deleted account can persist in them for up to 30 days and no longer. Nobody reads them; they exist to be restored from and nothing else.

If you stop paying we still hold nothing back: every point ever earned, every prize won and every prize still owed, the child's world, their companion, and their whole history, the ability to open the app and look at all of it.

Every email we send is about your own child. There is no newsletter, no product news, and nothing is ever sent to a child.

In the first week, up to four short notes about getting started. On a Sunday, how the week went. And — only if you pick a moment for it — one line a day at the time you chose, which never arrives on a day they have already tapped something.

If you have the app and have allowed notifications, that daily line arrives on your phone instead of your inbox, not as well as it. One moment, one note.

Turn the daily one off in one tap on their page. We would rather you switched it off than stopped reading us.

Reply to any email we send you and it reaches a person.