This policy explains how Smith's Taylored Solutions LLC ("we", "us") collects, uses and protects information in Kiddo Flow, including the website at kiddoflow.app and the Kiddo Flow mobile apps (together, the "Service"). The same policy is shown inside the app at kiddoflow.app/privacy.
The short version: Kiddo Flow is childcare software. Centers use it to keep the records their license requires and to tell families about their day. We handle children's information on a center's behalf and for no other purpose: we do not sell it, we do not advertise with it, and we do not train AI models on it.
Who is responsible for a child's information
The childcare center a family is enrolled with decides what is recorded about a child, who at the center can see it and how long it is kept. Under US privacy law the center is the business (or controller) and we are its service provider (or processor). Under the Children's Online Privacy Protection Act (COPPA), the center has the direct relationship with the parent and obtains the parent's consent.
We use information about a child only to provide Kiddo Flow to that center, to keep it secure and to meet our own legal obligations. To have a record corrected or removed, the fastest route is your center. You can also email us at [email protected] and we will work with the center.
Who uses Kiddo Flow
Every account belongs to an adult: a center director, a teacher or other staff member, a parent or guardian, or an authorized pickup contact. Kiddo Flow is not directed to children, and children do not have accounts.
Information we collect
Only what running a childcare record needs. We do not ask for Social Security numbers, and we do not collect precise location, advertising identifiers or biometric data.
About a child
Entered by the center or a guardian: name, birthday, classroom, guardians and authorized pickup contacts, allergies, medications and other health notes, immunization and enrollment paperwork, check-in and check-out times, daily-log entries (meals, naps, diapers, activities), learning observations, incident and injury reports, and photos if the center chooses to add them.
About an adult
Name, email address, phone number, role at the center and sign-in credentials (held by Firebase Authentication; we never see your password). Staff kiosk PINs are stored only as a salted hash. We also keep messages sent in the app, staff timesheet entries, and electronic signatures along with the time and network (IP) address they were made from. If a family asks to join a center's waitlist, we store the contact details they enter for that center.
About billing
Invoices, amounts and payment status. Invoices are display-only unless a center turns on card payments. When it does, card numbers go straight to Stripe and are never stored by Kiddo Flow, and tuition settles to the center's own Stripe account.
About the app itself
Crash reports and error diagnostics used to keep the app working, push notification tokens for devices that turned notifications on, and, only if you allow it, anonymous usage counts such as "a child was checked in." Usage counts never include a name, an email address or anything about a child.
How we use information
- To provide the Service: attendance, ratios, daily logs, documents, messaging and billing for your center.
- To create and secure accounts and enforce who can see what.
- To send service notifications and account email (password resets, security notices, invitations and replies you asked for). We do not send marketing email.
- To fix bugs, prevent abuse and improve the Service.
- To respond to support requests and meet legal obligations.
Who can see information
Access is enforced on our servers, not just hidden in the app. A family sees only their own children, and a center sees only its own families.
- Directors and teachers at the child's own center, limited by their role.
- A child's guardians, for their own children only.
- An authorized pickup contact, who can check a child in and out and sees nothing else: no health details, documents, messages or billing.
- Our service providers, listed below, only as needed to run the Service.
- Our staff, only when a center asks us for support or when we must investigate a security or reliability problem, and only with the access needed.
- Anyone we are legally required to disclose to, such as under a valid court order or a mandated report of suspected abuse or neglect. We tell the center unless the law forbids it.
| Provider | What it does for us |
|---|---|
| Google Firebase (Google LLC) | Sign-in (Firebase Authentication), database (Cloud Firestore), photo and document storage (Cloud Storage), server code (Cloud Functions), push notifications (Cloud Messaging), crash reporting (Crashlytics), optional usage analytics (Analytics), App Check / reCAPTCHA Enterprise to block requests that do not come from the real app, and website hosting |
| Stripe, Inc. | Card payments for tuition invoices, and the center's payout account |
What we never do
We do not sell or share personal information, and we do not use it for targeted or cross-context advertising. We do not use children's information to train machine-learning or AI models. We do not send marketing email to families.
Cookies and browser storage
Kiddo Flow stores a small amount of information on your device to keep you signed in, to work offline, to remember whether you turned notifications on and to remember your analytics choice. These are strictly necessary and are not used to track you. Usage analytics stay off until you choose "Allow usage analytics," and you can change your answer at any time in Settings. Stripe sets its own fraud-prevention cookies on the payment step. We use no advertising cookies, social media pixels, session replay or fingerprinting. The full list is in the Cookie Policy.
Notifications
Push notifications are optional. Turn each topic on or off in Settings, then Notifications, or switch them off in your device settings.
How long information is kept
An automated job deletes records on the schedule below. Records a childcare license requires are kept for at least 7 years by default, which covers every US state's licensing period we have found (Arkansas requires 3). A center may keep records longer but cannot shorten the licensing minimum, and a legal hold pauses deletion.
| Record | Kept for |
|---|---|
| Attendance, daily logs and photos, incident reports, documents and signatures, invoices | 7 years |
| Learning observations | 3 years |
| Messages and announcements | 2 years |
| Calendar events | 1 year |
| Invitation codes and device push tokens | 90 days |
| Child records | While the child is enrolled; removed by the center when the family leaves |
| Crash reports and server logs | Expire within 90 days |
Deleting a record also deletes its photos. Backups roll off within 14 weeks, so a deleted record can remain in a backup until then.
Deleting your account
You can delete your account yourself in the app: open Settings, scroll to Leaving Kiddo Flow, choose Delete my account and type DELETE to confirm. Your profile, sign-in, saved payment method, notification tokens and the links between you and any child's record are deleted right away. The center's licensing records about a child stay with the center for as long as its license requires. If you cannot sign in, or want a child's records removed, see our account deletion page.
Your rights
Whatever state you live in, we support these requests. Ask your center first, because they can act immediately. You can also email [email protected]; we will verify you through the center before acting.
- See everything held about your child and get a copy.
- Correct anything that is wrong.
- Have information deleted, subject to the records the center must keep by law.
- Refuse or withdraw consent to photos of your child without losing access to the rest of the Service.
- Close your own account from Settings in the app.
- Be told about a breach affecting your child within the deadlines the law sets.
How information is protected
- Encrypted in transit (HTTPS) and at rest.
- Server-enforced separation between centers and between families.
- Kiosk PINs stored only as salted hashes and checked on the server.
- Attendance, daily-log and incident times recorded by our servers, so a record cannot be back-dated from a device.
- Signatures stored with the exact wording the signer accepted and a cryptographic hash of the signed record, so a later change can be detected.
- App Check, so requests from anything other than the real app are refused.
- Crash and error reporting that does not include children's records.
Where information is stored
Kiddo Flow runs on Google Cloud in the United States. If you use it from outside the United States, your information is processed in the United States.
Changes to this policy
If we change this policy in a way that materially affects what we do with a child's information, we will tell centers before the change takes effect and update the date at the top.
Contact
Smith's Taylored Solutions LLC, Arkansas, United States
Email: [email protected]