Privacy Policy

1. Introduction

Braidly Technologies LLC ("Braidly," "we," "us," or "our") operates the Braidly co-parenting platform (the "Service"). We are committed to protecting the privacy of our users and the children whose information may be shared on our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

By creating an account or using the Service, you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, parent role (mom/dad)
• Family information: children's names, dates of birth, and school information
• Custody and schedule data: custody rotation, holidays, and special dates
• Co-parenting communications: messages sent through the in-app messaging system
• Financial information: expense records, payment amounts (not payment card numbers — those are handled by Stripe)
• Health and medical information: medical decisions, medications, and health notes you enter voluntarily
• Legal documents: court orders or parenting plans you upload for document summarization
• Journal entries: private notes and records you log in the app

2.2 Information Collected Automatically

• Log data (IP address, browser type, pages visited, timestamps)
• Device information (operating system, device type)
• Usage data (features used, session duration, error reports)
• Cookies and similar tracking technologies for authentication and session management

2.3 Payment Information

Subscription payments are processed by Stripe, Inc. Braidly does not store credit card numbers or full payment card details. We receive and store a Stripe customer ID and subscription status for account management purposes. Stripe's privacy policy governs their handling of payment data.

3. How We Use Your Information

• To provide, operate, and improve the Service
• To manage your account and family workspace
• To process subscriptions and billing through Stripe
• To send transactional emails (account confirmations, billing receipts, co-parent invitations)
• To send push notifications based on your notification preferences
• To generate AI-powered features (see Section 4)
• To respond to customer support requests
• To monitor for fraud, abuse, and security incidents
• To comply with legal obligations

We do not sell your personal information. We do not use your data to serve third-party advertisements. Braidly products are ad-free.

4. AI Features and Data Processing

Braidly uses the Anthropic Claude API to power AI features including Message Tone Coach, AI Expense Categorizer, Legal Document Summarizer, Braidly Assist (AI Mediator), and Co-Parenting Advisor.

Data routing: All AI requests are routed server-side through Braidly's infrastructure. Your data is never sent directly from your device to Anthropic. Each AI feature processes only the specific data needed for that function (e.g., the message you're analyzing for tone — not your entire message history).

Data retention by Anthropic: Anthropic may process the data submitted to their API in accordance with their own privacy policy and data processing terms. We encourage you to review Anthropic's privacy practices at anthropic.com.

Sensitive data: We strongly advise against submitting children's personally identifiable information (full names, birthdates, school names) directly into AI prompt fields. When possible, use the app's structured data entry forms rather than free-text AI prompts for sensitive information.

5. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We share data only as follows:

• With your co-parent: Information you enter is shared with the other parent in your family workspace (e.g., custody schedule, expenses, messages). This is the core function of the Service.
• With invited family viewers: If you grant viewer access (to grandparents, attorneys, caregivers, etc.), they can view the specific information you authorize — nothing more.
• With service providers: Supabase (database and authentication), Stripe (payments), Anthropic (AI features), Resend (transactional email), OneSignal (push notifications), and Vercel (hosting). Each is bound by data processing agreements.
• Legal compliance: We may disclose information if required by law, subpoena, or to protect the safety of any person or to prevent illegal activity.
• Business transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you of any such change via email and/or a prominent notice on the Service.

6. Children's Privacy (COPPA)

Braidly is a platform for adults (parents and legal guardians aged 18+) to coordinate the care of their children. Children do not create accounts on Braidly and do not directly interact with the Service. The Kids View feature is accessed by parents who may hand their device to a child to view; it does not constitute a separate child account and no additional personal information is collected from the child through that view.

We do not knowingly collect personal information directly from children under 13 within the meaning of the Children's Online Privacy Protection Act (COPPA). Information about children — names, ages, medical notes, school schedules — is entered by adult parents acting as the responsible party under COPPA. This information is protected by the same security and access controls as all other family data, accessible only to family members and authorized viewers designated by the parent.

If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will delete that information as quickly as practicable. If you believe this has occurred, contact us at support@braidly.co.

7. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS 1.2 or higher
• Database data is encrypted at rest (AES-256) in Supabase (AWS us-east-1)
• Row-Level Security (RLS) enforced on all database tables — each family's data is logically isolated
• Authentication handled by Supabase Auth (OAuth 2.0 + Magic Link)
• No server access to Stripe payment card data
• Regular security audits of all API endpoints and edge functions

No system is 100% secure. If you believe your account has been compromised, contact us immediately at support@braidly.co.

8. Data Retention and Deletion

We retain your data as long as your account is active. When you request account deletion:

• Your deletion request is recorded with a 30-day waiting period
• During the 30-day window, you may cancel the deletion request by logging in
• After 30 days, all family data (messages, expenses, journal entries, documents, custody data, children's profiles) is permanently deleted from our systems
• Anonymized usage analytics may be retained for statistical purposes
• Stripe billing records are retained for tax and compliance purposes as required by law

To request account deletion, contact support@braidly.co or use the account deletion option in Settings. Both parents must independently manage their own accounts; deletion by one parent removes that parent's profile but does not delete the entire family workspace.

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Request deletion of your personal information
• Object to or restrict certain processing activities
• Data portability (receive your data in a machine-readable format)
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at support@braidly.co. We respond to all requests within 30 days.

US Residents: The Service is available in the United States and Canada. California residents may have additional rights under the CCPA; contact us for a CCPA-specific data request.

EU/EEA Residents: The Service is not currently available in the European Union. We do not knowingly accept users subject to GDPR at this time.

10. Cookies

We use strictly necessary cookies for authentication (session tokens) and security. We do not use third-party advertising cookies or tracking pixels. Cookie preferences can be managed through your browser settings, though disabling authentication cookies will prevent you from logging in.

11. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will notify you by email and by posting a prominent notice in the app at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

12. Contact Us

For privacy questions, data requests, or concerns, contact: