What we keep, and for whom.

The shape of the thing

NannyLore is a family’s book of their child’s days, written by the family’s own nanny in her own language and delivered to each reader in theirs. The family owns the book. The nanny owns her career record. We hold both, carefully, and we built the walls first.

What we keep

• The book — moments, milestones, care notes, photos, replies, and hearts, each tied to one family’s private space. A child’s record carries their first name, birthdate, and what the family chooses to record about their days.
• People — each account’s email address, display name, role in the family, and reading language. Grandparents and other invited viewers are read-only.
• The caregiver’s record — her profile, credentials she chooses to add, references a family has approved, and when her engagements began. It is hers and travels with her.
• Consent records — who agreed to documentation and photo-sharing, and when. Visible to the family at any time on the Account page.
• The practical chapter — care facts the family chooses to keep for enrollment day: allergies and care steps, medications, the doctor’s contact, emergency contacts, authorized pickups. Family-entered, family-owned, shown to the family’s own caregiver (allergy care steps must reach the person holding the child), and carried in the child’s passport only when the family exports it.
• Billing — handled by Stripe. Card numbers never touch our servers; we keep only Stripe’s identifiers and the subscription’s dates, out of reach of every account.
• The waitlist — an email address and, if offered, whether you’re a parent or a nanny, a note, and a language. We count the crowd; we don’t read the room — individual entries are only opened when a family is welcomed in person.

What we never do

• No cameras. Ever. NannyLore is the caregiver’s own professional voice, not a surveillance product.
• No face recognition, and no biometric processing of any kind.
• No selling of data, no advertising, no trackers beyond what running the product requires.
• No training of AI models on your family’s data — the models we use translate and transcribe at the moment of delivery, and our agreements with those providers do not permit training on your content.
• The in-app camera and photo library turn images into new metadata-free JPEGs on your device; our server strips the JPEG metadata again and refuses any file it cannot prove safe before anything is stored.
• A caregiver’s pace of writing is never turned into a scorecard for anyone.

Where it lives, and who helps us run it

Your data lives in a private database and private photo storage hosted by Supabase in the western United States, behind per-family walls enforced by the database itself. The app is served by Vercel. Delivery-time translation runs on Anthropic; voice transcription on Groq and OpenAI (Whisper); payments on Stripe; email on Resend. Each processor receives only what its job requires, only when its job runs.

Children

Accounts belong to adults: parents, guardians, the caregivers they work with, and the family members they invite. A child’s record exists because that child’s own parent or guardian created it and consented to its documentation — the consent is recorded, dated, and visible to the family. Children do not hold accounts and we knowingly collect nothing from a child directly.

Your rights — built in, not requested by letter

• Take a copy — a family owner can download the whole book, and a caregiver her whole record, any time, from the Account page.
• Erase — a family owner can erase the family’s entire space: every page, every photo, and the family’s texts from our translation cache, permanently. Anyone can delete their own account.
• Neither right ever lapses — a paused or ended subscription never gates export or deletion.
• What stays when a caregiver leaves — the words she wrote remain in each family’s book with her name, as the family’s own record of their child’s days; her sign-in, credentials, and references leave with her.

Retention

The book keeps until the family erases it — that is the product. A photo uploaded but never attached to a moment is swept within a day. If a subscription lapses, nothing is deleted; the book waits, whole, for the family’s return.

Changes, and reaching us

If this policy changes in a way that matters, families are told before it takes effect. Questions, requests, or concerns: privacy@nannylore.com.