Security & Privacy

Childcare Alerts helps families see public Minnesota child care licensing records. We take the security and privacy of your information seriously. Here's how we handle it.

What we collect

• Your email and the centers you follow — so we can send you alerts.
• Payments are handled entirely by Stripe. We store only a Stripe customer reference — never your card number or payment details.
• The licensing records we show are public information from Minnesota state sources.

We practice data minimization: we collect only what we need to send you alerts, nothing more.

How we protect it

• All traffic is encrypted over HTTPS (HSTS enforced), and our database connection requires TLS.
• No passwords. You sign in with a single-use, time-limited link sent to your email; sessions use secure, http-only cookies.
• Secrets and API keys live only in our server environment, never in our code.
• Rate limiting protects the sign-in and follow forms from abuse.
• Baseline browser security headers (Content-Security-Policy, HSTS, anti-clickjacking, and more) are sent on every page.
• Card data is out of scope for us — Stripe handles PCI-compliant payment processing.

Your choices

• Every alert email has a one-click unsubscribe.
• You can manage the centers you follow, pause notifications, or delete your account — contact us and we'll remove your data.
• See our Privacy Policy for the full details.

Reporting a security issue

Found a vulnerability? Please email support@childcarealertsapp.com with details and steps to reproduce, and give us a chance to fix it before public disclosure. Please only test against your own account — no accessing others' data, no denial-of-service testing. We're grateful for good-faith reports.

Childcare Alerts surfaces public records and is not a safety judgment about any center. The official government record always controls.