Security & privacy

• Your email address and (optional) name.
• Information you enter about your child — first name or nickname, age, notes, safety plan, check-ins.
• Questions and situations you type into Ask, Repair, and other coaching features, used to generate a response for you.
• Subscription state (active / trialing / canceled). All billing runs through Apple In-App Purchase — we never see your card number.

We do not sell your data. We do not run third-party ad trackers. We do not share your child's information with anyone outside the tools that make the app work.

• Traffic is encrypted in transit (HTTPS/TLS everywhere).
• Data is stored in an encrypted managed database with row-level security — each row is tagged with the account that owns it, and the database itself refuses to return one account's data to a different account.
• Sensitive actions (subscribe, cancel, delete, admin work) run through server-side checks that re-verify who you are on every request, not just what the browser claims.
• Passwords are checked against the public Have-I-Been-Pwned breach list at signup and change, so a password known to be leaked cannot be reused here.
• Public endpoints (contact form, newsletter signup) are rate-limited to prevent scraping and abuse.

• Supabase — managed database, authentication, and email delivery infrastructure.
• Apple — all subscriptions. Handled by Apple's StoreKit; we receive a receipt, not payment data.
• Lovable AI Gateway — the model that powers Ask and Repair responses. Prompts are sent to generate a reply and are not used to train models.

• Account data (profile, children, check-ins, safety plans): kept while your account is active.
• Contact-form messages: kept up to 90 days after resolution.
• Subscription records: kept for as long as tax and billing law requires (typically 7 years), then removed.

You can request deletion or an export of everything tied to your account at any time by emailing support@parentrescueroom.com. Deletion removes your profile, children, check-ins, safety plans, support threads, and usage counters, and revokes any active sessions. Some records tied to tax or fraud obligations may be retained for the period the law requires.

If you believe you've found a security issue, please email support@parentrescueroom.com with the words "security report" in the subject. Please do not test against other people's accounts, and give us a reasonable window to respond before disclosing publicly. We appreciate the help.

This page is app-owned editable content, not a third-party audit. Parent Rescue Room is not HIPAA, SOC 2, or PCI certified, and does not claim to be. It's a wellness and parenting support tool, not a medical record system — please don't enter clinical diagnoses or legal-case detail here.