Privacy Policy

This Privacy Policy explains how ShareBuggy, LLC (“ShareBuggy,” “we,” “us”) collects, uses, shares, and protects information when you use ShareBuggy.

We built ShareBuggy around photographs and daily details of children. We understand what that means. This policy is written to be read, not to be skimmed past. If anything here is unclear, email privacy@sharebuggy.co and we will answer plainly.

1. Information We Collect

1.1 Information you give us directly

Account information (all users): name, email address, phone number (optional), password (stored hashed, never in readable form), profile photo (optional), role (Family Administrator or Caregiver), and time zone.

Child profile information (entered by adults): first name or nickname, date of birth or age, and any information a parent chooses to add — allergies, dietary restrictions, medications, medical notes, routines, sleep and feeding preferences, emergency contacts, and doctor information.

Care coordination content: schedules, calendar entries, activity plans, checklists and daily log templates, daily log entries (feedings, diaper changes, naps, medications given, mood, notes), supply levels, and documents a family uploads.

Photos and videos: images and video of children uploaded by parents or caregivers, including any metadata embedded in the file (see Section 1.4).

Messages: the content of messages exchanged between family members and caregivers within a Workspace.

Billing information: handled by Stripe. We receive and store your billing name, billing address, subscription status, plan, renewal date, and the last four digits and brand of your payment card. We never receive or store your full card number, expiration date, or security code.

Support communications: anything you send us when you contact support.

1.2 Information collected automatically

• Device and app information: device type, operating system and version, app version, browser type, and a device identifier for push notifications.
• Log data: IP address, timestamps, pages or screens accessed, and errors encountered.
• Usage information: features used and general activity patterns, used to operate and improve the Service.

We do not collect precise geolocation. ShareBuggy does not track where you or your child are. We do not offer, and do not intend to offer, child location tracking.

1.3 Information from others

If a Family Administrator invites you as a Caregiver, we receive the name and email address they provide in order to send the invitation. If you are added to a Workspace, the family may enter information about your schedule and role.

1.4 Photo and video metadata

Photo files often carry embedded metadata (EXIF), which can include the GPS coordinates where the photo was taken and the device that took it. Because that location data would reveal where a child is, we strip GPS and location metadata from every photo and video on upload. We retain non-location technical metadata (dimensions, format, timestamp) needed to display and organize media.

2. Children’s Information — Read This Section

2.1 Children are not our users

ShareBuggy is a service for adults. It is not directed to children, is not marketed to children, and children cannot create accounts, log in, or interact with the Service. We do not knowingly collect any information from a child.

ShareBuggy does, however, hold a great deal of information about children — provided by the parents and guardians responsible for them, and by the caregivers those parents have authorized. That information is treated as the most sensitive category of data in our system, and Section 8 describes how we protect it.

2.2 Parental control

A parent or legal guardian who is a Family Administrator has complete control over their child’s information. At any time, a Family Administrator may:

• View everything stored about their child, including everything contributed by a caregiver;
• Correct or delete any of it;
• Export the full record;
• Revoke any caregiver’s access instantly;
• Delete the child’s profile and all associated content permanently.

No caregiver can override, hide, or restrict a parent’s access to their own child’s information.

2.3 Authority to add a child

Only a parent or legal guardian, or someone they have authorized, may add a child to a Workspace. If you believe a child has been added to ShareBuggy without proper authority, contact privacy@sharebuggy.co immediately and we will investigate and, where warranted, delete the information.

2.4 If a child creates an account

If we learn that someone under 18 has created a ShareBuggy account, we will delete that account and its information promptly.

3. How We Use Information

We use information to:

• Provide the Service — display schedules, deliver messages, store and show photos, sync content across devices;
• Send notifications you have asked for, including push and email notifications;
• Authenticate you and keep accounts secure;
• Process subscriptions and prevent payment fraud;
• Respond to support requests;
• Diagnose problems, fix bugs, and improve reliability and performance;
• Detect and prevent abuse, fraud, and activity that may endanger a child;
• Comply with legal obligations.

3.1 What we will not do

We commit to the following, and will not change them without giving you notice and a meaningful choice:

• We will not sell your personal information, and we will not share it for cross-context behavioral advertising.
• We will not use your content — photos, videos, messages, logs, or a child’s information — to train artificial intelligence or machine learning models, whether ours or anyone else’s.
• We will not use photos or videos of children in marketing, advertising, promotional material, case studies, social media, or investor materials.
• We will not serve advertising in ShareBuggy or share information with advertising networks or data brokers.
• We will not read your messages except where necessary to investigate a specific reported safety violation, respond to valid legal process, or where you ask us to for support.

4. Who Can See What

This is the part users most often get wrong, so we state it plainly.

4.1 Family Administrators can see

• Everything in their own Family Workspace — all posts, photos, logs, schedules, and messages, including everything a caregiver contributes;
• A caregiver’s name, profile photo, and contact information as provided;
• When a caregiver completed a log entry or posted content, and when they were last active in the Workspace.

4.2 Family Administrators cannot see

• A caregiver’s activity in any other family’s Workspace;
• A caregiver’s private messages with anyone outside that Workspace;
• A caregiver’s personal device data, location, contacts, photos outside the app, or any activity outside ShareBuggy.

4.3 Caregivers can see

• The Workspace content of families that have invited them, within the permissions those families set;
• Their own profile and their own contributions.

4.4 ShareBuggy staff

Access to user content by our staff is restricted, logged, and limited to what is necessary to operate the Service — investigating a support request you raise, diagnosing a specific technical fault, responding to a reported safety concern, or complying with valid legal process. We do not browse user content.

5. When We Share Information

We share information only in these circumstances:

5.1 Within your Workspace

With the people you have invited or been invited by, as described in Section 4.

5.2 With service providers

We use third parties to run the Service. They are contractually restricted to using information only to provide services to us:

• Supabase — database, authentication, file storage, real-time infrastructure
• Vercel — web application hosting and cookieless, aggregate site analytics
• Stripe — payment processing
• Expo — mobile push notification delivery
• Resend — transactional email delivery
• Apple — App Store distribution and, if you subscribe through iOS, payment

5.3 Legal and safety

We may disclose information where we believe in good faith it is required to comply with law or valid legal process, to enforce our Terms, to protect our rights, or to prevent imminent harm. Where a child’s safety is at risk, we will act first and notify later.

We report suspected child sexual abuse material to NCMEC as required by federal law.

Where legally permitted, we will notify you before disclosing your information in response to legal process, so you have an opportunity to object.

5.4 Business transfers

If ShareBuggy is acquired or merged, information may transfer as part of that transaction. Any acquirer would be bound by this Policy for information collected before the transfer, and we would notify you before any material change in how your information is handled, with an opportunity to delete your account first.

5.5 With your direction

If you use a feature that shares content outside ShareBuggy — such as generating a share link for a photo — that content becomes accessible to anyone who has the link. Share links are unlisted but not password-protected. Treat them accordingly, and revoke them when you are done.

6. How Long We Keep Information

• Active accounts: for as long as your account is active.
• After cancellation or deletion: full access for 30 days to allow export; restricted storage for a further 90 days, restorable on request; permanent deletion after 120 days, including from backups on their normal rotation.
• Immediate deletion: available on request to privacy@sharebuggy.co.
• Caregiver removed from a Workspace:access ends immediately. Their contributions remain the family’s content. Their personal account data remains theirs.
• Billing records: retained as long as required by tax and accounting law, typically seven years. These contain no child information.
• Support communications: two years.
• Server logs: 90 days.
• Legal holds: information subject to legal process is retained until the matter resolves.

7. Your Rights and Choices

7.1 Available to everyone

Regardless of where you live, you may:

• Access and review the information we hold about you;
• Correct inaccurate information;
• Export your data in a portable format;
• Delete your account and associated content;
• Control notification settings;
• Withdraw consent where processing is consent-based.

Most of this is available in your account settings. For anything else, email privacy@sharebuggy.co. We respond within 30 days.

7.2 California residents

Under the CCPA/CPRA you have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to limit use of sensitive personal information; and to be free from discrimination for exercising these rights.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We collect the categories described in Section 1, including — for children — information that may be treated as sensitive. We use it only for the purposes in Section 3.

7.3 Other U.S. states

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect — have comparable rights of access, correction, deletion, portability, and opt-out. Contact privacy@sharebuggy.co to exercise them. You may appeal a denial by replying to our response.

7.4 Outside the United States

ShareBuggy is operated from and intended for use in the United States. Information is stored and processed in the United States, which may have different data protection laws than your country. By using the Service you understand that your information will be processed in the United States.

8. How We Protect Information

Security measures include:

• Encryption in transit (TLS) and at rest;
• Row-level security enforcing strict isolation between Family Workspaces — one family cannot access another family’s data;
• Hashed password storage; we never store passwords in readable form;
• Role-based access control determining what each user can see;
• Automatic stripping of location metadata from uploaded photos and videos;
• Restricted, logged internal access to production data;
• Regular backups and monitoring.

8.1 No facial recognition or biometric processing

We do not perform facial recognition, face detection, face grouping, automatic tagging, or any other biometric identification on photos or videos. We do not create, collect, or store biometric identifiers of any kind, from adults or children. If we ever consider such a feature, it would require your separate, explicit, written consent before any processing occurred.

8.2 Limits

No system is perfectly secure. We cannot guarantee absolute security. Use a strong, unique password and enable available security features.

8.3 Breach notification

If a breach affects your information, we will notify you and any required regulator without undue delay and in accordance with applicable law, and we will tell you what happened, what was affected, and what we are doing about it.

9. Cookies and Similar Technologies

Our web application uses cookies and similar technologies that are strictly necessary to operate the Service — keeping you signed in, remembering preferences, and maintaining security. We use limited, cookieless first-party analytics (Vercel Web Analytics) to understand how the Service is used and where it fails — it sets no cookies and does not track you across other sites.

We do not use advertising cookies, tracking pixels, or third-party advertising or social media trackers.

10. Changes to This Policy

We may update this Policy. For material changes — particularly any change to how we handle children’s information — we will give at least 30 days’ notice by email and in the app before the change takes effect. Prior versions will be available on request.

11. Contact Us

Questions, requests, or concerns about privacy:

ShareBuggy, LLC
42-12 28th St
Long Island City, NY 11101

Privacy: privacy@sharebuggy.co • Support: support@sharebuggy.co

We respond to privacy requests within 30 days.