Last updated October 2026
Clear Day is built for schools where the director knows every kid’s name, and the privacy and security choices reflect that. This page covers how customer data is handled, the practices we’ve seen elsewhere that we don’t adopt, and the subprocessors that touch the system.
Your data is not used to train AI models
Clear Day uses Anthropic's API for drafting work. Your data is not used to train models, ours or theirs. Anthropic's commercial terms prohibit training on customer data. Most childcare software's policy either stays silent on model training or leaves itself an exception. Clear Day's doesn't.
What exactly the AI can see
Sunny drafts from attendance records, teacher notes, and scheduling data. The photos teachers post to families are never sent to a model. Images reach a model only when a staff member uploads one on purpose (a scanned form or a photo attached to a question in the tray), which is used to answer that request and later messages in the same conversation, and when a school builds its website, whose draft screenshots are reviewed for design. Health details stay out of drafts unless a staff member types them in, and Sunny reads a child's allergies and medications when a staff member asks about them.
Encrypted in transit and at rest, stored on US infrastructure
Customer data is encrypted in transit and at rest on US-based cloud infrastructure with role-based access controls. The providers listed below as global edge or global (Cloudflare, Giphy, OpenStreetMap, Google, and Pexels) deliver web traffic, GIFs, maps, fonts, and stock photos, and receive the visitor's IP address and request details.
Role-based access, with a record of what changed
Parents see only their own child's records and the photos and posts shared with their family. Staff see their own school (teachers and directors share a school-wide view), and no school's data is visible to another. Changes to billing, to billing policy, and to key parts of a child's record (name, enrollment status, classroom, street address, allergies, medications, and immunizations) are recorded with who changed what and when. The permissions are part of the product from day one, not an enterprise upgrade.
Magic-link access to the parent portal
Accepting an offer, scheduling a tour, or checking on an application happens through a one-time link sent to the parent's email: no account to create, nothing to reuse or forget. The full parent app is a regular account with a password, and that one account follows a family across every school they're linked to.
Your data, exportable
Parents export their family's photos, milestones, and message history from inside the app: one export every 24 hours, each downloadable for 7 days. Schools ask us for a full export of roster, family records, and history and we deliver it in standard formats: during the trial, while you're a customer, and after you cancel. Canceling a plan deletes nothing beyond the short-lived records the privacy policy lists; email [email protected] to have your data deleted, and we complete it within 30 days. (Payment and card data live with Stripe, not in the export.)
Some AI runs entirely on your device
In the mobile app, voice notes are transcribed on the device. The recording is never uploaded, and the server only ever receives the text. The web app uses the browser's built-in speech recognition, which some browsers process through the browser maker's own service. On iPhones with Apple Intelligence, five drafting steps also run their first pass on the device itself: turning a dictated note into classroom events, previewing a voice recap, filling in an absence or an incident report from what you typed, and suggesting photo captions. Dictated notes fall back to Anthropic's API where the phone can't run them, and the saved voice recap is always written there; the absence and incident quick-fills and caption suggestions only appear on supported iPhones. Every other AI feature runs on Anthropic's API.
Advertising trackers on the marketing site
No Meta pixel, no Google Ads remarketing tag, no LinkedIn Insight Tag.
Selling or sharing data for behavioral advertising
We do not sell personal information, and we do not share it for cross-context behavioral advertising. The subprocessor list below is the full set of services that touch customer data, and none of them receive customer data for advertising purposes.
Mandatory autopay that locks parents out of the card on file
Some childcare platforms have a setting that prevents parents from removing their saved card. Autopay in Clear Day is opt-in for the parent, and they can turn it off whenever they want.
Claiming ownership of your content
Your photos, daily reports, and records are yours. We only access them to operate the service for you, and we do not keep using them once you leave. If you ask us to delete your data, we complete it within 30 days ([email protected]).
These are the services that handle parts of the product on our behalf. Each one has a specific role, and none of them are advertising platforms.
Email [email protected] to be notified when the list changes.
Railway
Application hosting, managed Postgres database hosting, and encrypted S3-compatible bucket storage for uploads and parent data exports
United States
Cloudflare
CDN, DDoS protection, and WAF at the network edge; a bot check on school websites' assistant and on connector sign-up (receives the visitor's IP address); custom domains for school websites
Global edge
Stripe
Payment processing for tuition and other parent payments, and billing for programs' Clear Day plans (PCI Level 1; we never see raw card numbers)
United States
Resend
Transactional, outbound, and inbound email delivery and processing
United States
Expo
Push notification delivery to mobile devices and app update delivery. Push notifications can include a child's name and are delivered through Apple's push service.
United States
Anthropic
AI inference for drafting, summaries, document reading, translation, answering staff questions about their records, sorting inquiries and support requests, the school-website assistant, and internal tools our staff use. Prompts are not used to train models, ours or theirs.
United States
Sentry
Application error and performance monitoring. Request bodies, cookies, and sign-in tokens are stripped before send; web-app session replays mask all text, inputs, and images.
United States
PostHog
Product analytics and AI-feature monitoring, using a pseudonymous numeric ID and carrying no message, record, or AI prompt content (web-app session replays show the app's interface text but mask form inputs and the text of records about children and families, and block images), and no child personal information. If someone chooses to send in-app feedback, what they type, the category, the screen, and their pseudonymous ID are sent to PostHog so the team can read it; we ask people not to include children's names or other personal details. The AI assistant connectors send metadata only, with no conversation content; for Clear Day for Parents, which has no sign-in, the ID is a pseudonymous hash that changes every day. On the school websites Clear Day hosts, PostHog records page views, where visits came from, and taps on the call, email, directions and inquiry links, in a separate project from Clear Day's own analytics; the visitor's cookie identifier is linked only to a pseudonymous inquiry ID, never to a name, contact details or anything about a child. Clear Day's internal operations tools, used only by Clear Day staff, also report the staff member's request and the tool's result, which can include an account's email address or a website visitor's IP address when staff look one up.
United States
DocuSign
E-signature for enrollment agreements and other documents a school sends for signature. Schools connect their own account via OAuth.
United States
Dropbox Sign
E-signature. Same per-school OAuth model as DocuSign.
United States
Giphy
GIF search in the messaging composer. Only the term typed into the GIF search box is sent; no roster or child records are shared. A GIF added to a message is loaded from Giphy, which receives the IP address of each person who views it.
Global
Apple
WeatherKit forecasts for the staff morning view and the parent home screen (receives the school's approximate coordinates and time zone only; no roster or child records are shared), and, in the iPhone app, address suggestions as a staff member types the school's address.
United States
OpenStreetMap / Nominatim
Geocodes a school's city, state, and ZIP to coordinates for the forecast, and serves the public directory's map tiles (receives the visitor's IP address).
Global
Web fonts for the app and school websites. Receives the visitor's IP address and browser details.
Global
Pexels
Stock photos in the school website builder. The photo picker loads previews from Pexels, which receives the signed-in user's IP address; published school websites do not load images from Pexels.
Global
Clear Day is built for the way a licensed childcare center runs day to day. Role-based access keeps child records separate from any marketing data. Staff only see the center they belong to. Changes to billing, to billing policy, and to key parts of a child’s record are recorded with who changed what and when. Children’s information is entered by staff at the center and by parents and guardians, not collected directly from children.
Payment processing runs on Stripe, a PCI Level 1 certified processor. Card and ACH details never traverse Clear Day’s own infrastructure. Stripe holds the PCI attestation. Clear Day handles everything around it correctly.
If you believe you’ve found a security vulnerability in Clear Day, email [email protected]. Responsible disclosure is appreciated, and we’ll credit you when we publish the fix.
If you believe your data has been mishandled, email [email protected]. We will respond in good faith and make it right if we’re in the wrong.
Parents are welcome here too. If your child’s school uses Clear Day and you have a security or privacy concern, email us directly. We don’t bounce parent questions back to the school.
The privacy policy and terms of service are short and written to be readable. If you find a place where this page and the policy disagree, the policy is the binding document and we want to hear about it.
Security questions? Email [email protected]. A person answers.