Privacy policy
Last updated October 4, 2026
Who we are
CubbyFront is operated by Anurag M, an individual based in India. We provide front-office software to childcare programs. Our customers are centers.
The center decides what to record about its children, families and staff, and who can see it. CubbyFront stores and processes that information on the center's behalf, only to provide the service. Parents see only their own children.
Children don't use CubbyFront
Every login belongs to an adult: center owners and staff, and the parents or guardians a center invites. The check-in kiosk is run by staff and authorized adults. We don't collect information from children.
Centers and parents enter information about children: names, dates of birth, attendance, daily activity, photos, health and emergency details, and forms signed by parents.
What we collect from you
Account details (name, email, password or sign-in provider), the information you enter, technical logs (IP address, device, time) needed for security and to record electronic signatures, and billing information handled by Dodo Payments, our reseller and merchant of record. We never see card numbers.
On this website and its sign-in pages, Vercel Web Analytics counts visits without cookies: the page, the site or campaign link that sent you, your approximate location (country, region and city), and your browser, operating system and device type, reported to us as totals. Its script never loads inside the app, on family pages, on the check-in kiosk or on a center's inquiry form. We also count a few actions, such as opening the sandbox, creating an account or choosing a plan, with no name, email or center attached. Choosing a plan happens inside the app, so our server reports that count, with the same location, browser and device details.
How we use it
To run the product, send the emails you ask for (daily reports, invites, reminders, incident notices), keep the service secure, and support you. We look at a center's records only to support that center or to keep the service running.
Our commitments about children's information
We make these commitments to every center, in every state:
- We don't show ads, and we don't use information about children or families for advertising.
- We don't sell information about children, families or staff.
- We don't build profiles of children or families.
- We don't use children's information to train or develop AI systems.
- We delete a center's information when the center asks, within 30 days.
- CubbyFront's built-in forms don't ask about a child's reproductive or sexual health, immigration status, sexual orientation or gender identity. Please don't record these in notes, messages or incident reports.
Where it lives and who handles it
Each center's records are kept apart from every other center's by row-level security rules in the database, which we test on every change. Photos are private and served through links that expire.
Service
What it does and holds
Where
Supabase
Database, sign-in and photo storage. Everything a center enters, including children's records and photos.
Where: United States (Northern Virginia)
Vercel
Runs the website, the app and its scheduled jobs, and counts website visits and a few actions. Requests and pages as they pass through, and visit and action counts kept without cookies.
Where: United States (Washington, D.C.)
Zoho ZeptoMail
Sends email: daily reports, invites, notices and sign-in links. Email content, which can include a child's name.
Where: India
Sentry
Error reports. Technical details of an error, with form contents, cookies and web-address queries removed before sending.
Where: United States
Dodo Payments, our reseller and merchant of record, handles checkout, invoices and payment details under its own privacy policy. Google runs our support mailbox, so anything you email to hello@cubbyfront.com is stored there, and confirms who you are if you choose Sign in with Google.
Support is provided from India. Before a new service starts handling children's information, we add it here and email center owners.
How long we keep it
This schedule is our written data-retention policy. Email us for a copy.
- Photos: kept according to the center's plan (90 days on Home, 2 years on Center, 5 years on Academy), then deleted automatically.
- A center that stops paying: we keep its records for 12 months after the paid period ends. We email the owner 30 days and 7 days before deleting them, with a link to export everything.
- A center that never paid: once its account is read-only, we keep its records for 90 days after the last activity, email the owner 30 days and 7 days before deleting them with an export link, then delete them.
- A center that asks us to delete its data: we do it within 30 days, except records we must keep for legal or billing reasons.
- A log of the emails we send: 30 days, then deleted automatically. For each email it keeps when it was sent, which center sent it, which person there sent it (if a person did), what kind of email it was, whether it went out, and a one-way code made from the address instead of the address itself. We use it to limit invitations and to look into reports of misuse.
- Backups: we are setting up daily backups. This page will say how long they are kept once they run.
Your rights
To see, correct or delete information about you or your child, ask your center; the center asks us at hello@cubbyfront.com; we act within 30 days. If you can't reach the center, for example because it has closed, email us directly.
Changes
We'll email center owners at least 14 days before a material change to this policy.