Privacy

Last updated 2026.

Privacy is the whole design, not a setting we added later. Counts and trends appear once at least 3 separate reports of the same illness come in nearby. We never know who you are, so we count each phone or internet connection once a day: one parent reporting on three different days counts as three reports. With fewer than that, the most an area ever says is that a bug has been reported there: never a number, and never anywhere smaller than a whole postcode area. Public pages and the free emails only ever show whole areas and never name a nursery. Plus members who watch a nursery also see that nursery’s numbers, once at least 3 separate reports have tagged it.

What we store about a report

The most precise location we keep is a rough area, a few thousand households around a postcode, never the exact spot. If you pick your nursery, we also keep which nursery it was. We never store a full postcode, an address, a child’s name, or a date of birth: whatever you type, we reduce it to that area and drop the rest.

Reports aren’t linked to your account. To stop trolling and duplicate reports we use a temporary, anonymous check that resets each day, is never shown to anyone, and is never tied to you.

Why we can use a report

Reporting is voluntary. To send a report you tap “Agree and post”, under a line saying it can be used to show what’s going round your area. Because a report is about a child’s health, that tap is your explicit consent (UK GDPR Article 9). You don’t have to report, and you never give a name, a date of birth, or a full postcode to do it.

Your account

If you sign up to check, we store:

• your email, for sign-in and the alerts you ask for;
• the places you pin (up to 3);
• your preferences.

Sign-in is passwordless: we email you a magic link, valid for about an hour.

We hold this account data on the basis of our legitimate interests in running the service you signed up for (UK GDPR Article 6), and we send the alert emails because you chose to receive them. The anonymous usage counts above aren’t personal data.

Who we share data with

We use a few trusted providers to run the service:

• Stripe: handles payments. We never see or store your card details.
• Resend: sends your sign-in links and alert emails.
• Render: runs the app and its database.
• postcodes.io: turns a postcode into an area when you look one up.

Some of these may process data outside the UK. We don’t pin hosting to a single region, so we won’t pretend your data only ever sits in the UK or EU.

We don’t track you

No advertising pixel, no third-party tracker, and no following you around the web. To see how the service is being used and improve it, we keep anonymous, aggregate counts, for example how many people checked an area or signed up. Totals only: no profiles, no IP addresses, no individual postcodes. The only cookies we set are the essential ones that keep you signed in and protect forms.

How long we keep things

We keep your account data until you delete it. Reports are kept with no name and no link to any account, and are only ever shown as totals, so even after you leave, nothing points to your family.

Your rights

You can see and update your pins and preferences, and delete your account and everything in it (your email, your pins, your alert history) at any time from your account page. For anything else, just email us.

If you think we’ve mishandled your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator. We’d appreciate the chance to put things right first.

Children’s data

Reports are about children’s illnesses, but no child is ever identified. Accounts are for adults: parents and carers. We only ever use a report with your explicit agreement, given when you send it.

Security

There are no passwords to be guessed or leaked, and everything is served over HTTPS.

Changes

We may update this page. When we do, we’ll change the date above.

Contact

Questions? Email [email protected].