Security and privacy

Last updated August 2026

Children’s data deserves the care you bring to your classrooms.

Clear Day is built for schools where the director knows every kid’s name, and the privacy and security choices reflect that. This page covers how customer data is handled, the practices we’ve seen elsewhere that we don’t adopt, and the subprocessors that touch the system.

Encrypted in transit and at restUS-hostedNever used to train AI models
The posture

How customer data is handled inside Clear Day.

Your data is not used to train AI models

Clear Day uses Anthropic's API for drafting work. Your data is not used to train models, ours or theirs. Every call to the model provider goes through a single wrapper that has no training parameter to pass, and a build check fails if any other part of the codebase reaches the provider directly. Most childcare software's policy either stays silent on model training or leaves itself an exception. Clear Day's doesn't.

What exactly the AI can see

Sunny drafts from attendance records, teacher notes, and scheduling data. The photos teachers post to families are never sent to a model. The one exception is when a staff member uploads an image on purpose (a scanned form or a photo attached to a question in the tray), and then it's read only to answer that request. Health details stay out of drafts unless a staff member types them in.

Encrypted in transit and at rest, US-hosted

Customer data is encrypted in transit and at rest on US-based cloud infrastructure with role-based access controls. The hosting region is the United States; we do not replicate customer data outside US regions.

Role-based access, with a record of what changed

Parents see only their own child. Staff see their own school (teachers and directors share a school-wide view), and no school's data is visible to another. Changes to a child's record, to billing, and to billing policy are each recorded with who changed what and when. The permissions are part of the product from day one, not an enterprise upgrade.

Magic-link access to the parent portal

Accepting an offer, scheduling a tour, or checking on an application happens through a one-time link sent to the parent's email: no account to create, nothing to reuse or forget. The full parent app is a regular account with a password, and that one account follows a family across every school they're linked to.

Your data, exportable

Parents export their family's photos, milestones, and message history from inside the app: one export every 24 hours, each downloadable for 7 days. Schools ask us for a full export of roster, family records, and history and we deliver it in standard formats: during the trial, while you're a customer, and for 30 days after you cancel. (Payment and card data live with Stripe, not in the export.)

Some AI runs entirely on your device

Voice notes are transcribed on the phone. The recording is never uploaded. The server only ever receives the text. On capable iPhones, two features also run their first pass on the device itself: turning a dictated note into classroom events, and summarizing a voice recap. Older iPhones and every other AI feature run on Anthropic's API instead.

Practices we don’t engage in

Practices common in childcare software that we won’t build.

Advertising trackers on the marketing site

No Meta pixel, no Google Ads remarketing tag, no LinkedIn Insight Tag.

Selling or sharing data for behavioral advertising

We do not sell personal information, and we do not share it for cross-context behavioral advertising. The subprocessor list below is the full set of services that touch customer data, and none of them receive customer data for advertising purposes.

Mandatory autopay that locks parents out of the card on file

Some childcare platforms have a setting that prevents parents from removing their saved card. Autopay in Clear Day is opt-in for the parent, and they can turn it off whenever they want.

Claiming ownership of your content

Your photos, daily reports, and records are yours. We only access them to operate the service for you, and we do not keep using them once you leave. After your account closes, your data is exported and then deleted on the schedule described below.

Subprocessors

Who touches your data, and why.

These are the services that handle parts of the product on our behalf. Each one has a specific role, and none of them are advertising platforms.

Email [email protected] to be notified when the list changes.

Railway

Application hosting, managed Postgres database hosting, and encrypted S3-compatible bucket storage for uploads and parent data exports

United States

Cloudflare

CDN, DDoS protection, and WAF at the network edge

Global edge

Stripe

Payment processing for tuition and parent payments (PCI Level 1; we never see raw card numbers)

United States

Resend

Transactional, outbound, and inbound email delivery and processing

United States

Expo

Push notification delivery to mobile devices

United States

Anthropic

AI inference for drafting. Prompts are not used to train models, ours or theirs.

United States

Sentry

Application error reporting. Stack traces only; PII is stripped before send.

United States

PostHog

Product analytics on anonymized event volumes. No PII or customer content.

United States

DocuSign

E-signature. Schools connect their own account via OAuth.

United States

Dropbox Sign

E-signature. Same per-school OAuth model as DocuSign.

United States

Giphy

Client-side GIF search in the messaging composer. Only the term a staff member types into the GIF search box is sent; no roster or child records are shared.

Global

Apple WeatherKit

Weather forecast for the staff morning view. Receives the school's coordinates only; no roster or child records are shared.

United States

OpenStreetMap / Nominatim

Geocodes a school's address to coordinates so the forecast can be looked up. Only the school's city, state, and ZIP are sent.

Global

Compliance and certifications

The rules a license already holds you to.

Clear Day is built for the way a licensed childcare center runs day to day. Role-based access keeps child records separate from any marketing data. Staff only see the center they belong to. Changes to a child’s record, to billing, and to billing policy are each recorded with who changed what and when. Children’s information is collected through authorized staff at the center, not directly from children.

Payment processing runs on Stripe, a PCI Level 1 certified processor. Card and ACH details never traverse Clear Day’s own infrastructure. Stripe holds the PCI attestation. Clear Day handles everything around it correctly.

Reporting and contact

How to report a concern, and how to reach us.

If you believe you’ve found a security vulnerability in Clear Day, email [email protected]. Responsible disclosure is appreciated, and we’ll credit you when we publish the fix.

If you believe your data has been mishandled, email [email protected]. We will respond in good faith and make it right if we’re in the wrong.

Parents are welcome here too. If your child’s school uses Clear Day and you have a security or privacy concern, email us directly. We don’t bounce parent questions back to the school.

Security and privacy questions, answered

Does Clear Day sell my data or use it to train AI?
No. Clear Day never sells your data, never shares it for advertising, and never uses it to train AI models: not yours, not ours, not the model provider's. AI drafting runs on Anthropic's API, and prompts are not used for training. The commitment is in writing in the privacy policy and terms, and it's enforced in the code: one wrapper handles every call to the model provider, with no training parameter a developer could pass.
What exactly does the AI see, and what does it not see?
Sunny drafts from attendance records, teacher notes, and scheduling data. The photos teachers post to families are never sent to a model. The one exception is when a staff member uploads an image on purpose (a scanned form or a photo attached to a question in the tray), and then it's read only to answer that request. Health details stay out of drafts unless a staff member types them in.
Where is my data stored, and is it encrypted?
Customer data is encrypted in transit and at rest on US-based Railway infrastructure, with role-based access controls. Clear Day does not replicate customer data outside the United States.
Can I export or delete my data if I leave?
Yes. Parents export their family's records from inside the app: one export every 24 hours, downloadable for 7 days. Schools ask us for a full export of roster, family records, and history, delivered in standard formats. Payment and card details live with Stripe rather than in the export. Export access holds during the trial, while you're a customer, and for 30 days after you cancel. Then the school's data is deleted, including the records its families read in their own accounts, so export before that window closes. A family enrolled at another Clear Day school keeps that school's records. Immediate deletion is available on request. Deleting an individual account is immediate and can't be undone, so export first.
Do parents need a password?
For the parent app, yes: it's a regular account with a password, and that one account follows a family across every school they're linked to. The parent portal is different: accepting an offer, scheduling a tour, or checking on an application runs off a one-time link sent to the parent's email, with no account to create.
Who can see a child's information?
Parents see only their own child. Staff see their own school (teachers and directors share a school-wide view), and no school's data is visible to another. Permissions are built in from day one, and changes to a child's record, to billing, and to billing policy are each recorded with who changed what and when.
Does any AI run on my device?
Some of it. Voice notes are transcribed on the phone and the recording is never uploaded. The server only ever receives the text. Two features also run their first pass on capable iPhones: turning a dictated note into classroom events, and summarizing a voice recap. When the on-device path isn't available (older iPhones), Clear Day falls back to Anthropic's API, and every other AI feature runs there to begin with.

Read the policy.

The privacy policy and terms of service are short and written to be readable. If you find a place where this page and the policy disagree, the policy is the binding document and we want to hear about it.

Privacy policyTerms of service

Security questions? Email [email protected]. A person answers.