Privacy policy

Effective October 27, 2026 · Operation Pathfinders

This policy describes the current Operation Pathfinders web app. Contact [email protected] about privacy, access, correction, withdrawal of consent, or deletion.

Information you choose to provide

Parent accounts use an email address and authentication credentials. Teams can contain parent/child nicknames, optional interests, goals, training preferences, routines, exercise completions, meal and nutrition entries, calendar titles/notes, help requests, feelings, Field Notes, and discovery reflections, per-child task plans and visual instructions, family huddle goals, proud moments, and groundings (what a child has lost, from which day, until which day, and an optional reason). A separate child login uses a parent-controlled email or alias and an invitation. We do not require real child names, dates of birth, precise location, photos, or contacts. Do not enter unnecessary identifying or sensitive details into notes.

How we use information

We use records to sign you in, keep each family’s records private, save routines and progress, personalize the themes and suggestions you select, display weekly summaries, provide requested calendar feeds, handle account deletion, and support the service. Discovery suggestions use your saved choices and reflections; they do not assign careers or personality labels. Nutrition and feelings are not used for advertising or reward eligibility.

Who can see family records

The adults in your household can read its family records, including the child’s feelings and journal: a second parent you invite can help run the app, and a view-only adult (such as a grandparent you invite) can read but not change. Your login and household are shared with The Everyday Compass’s other apps (Cairn and Chuckbox), so people you add in one appear in the others; those apps’ records are covered by their privacy policy. A linked child can access only their assigned profile and permitted actions. Parent notes and administration are protected separately. Other families cannot read those records. Support requests disclose whatever you choose to send by email; avoid including child records.

Service providers and sharing

Supabase provides account authentication and database storage. Cloudflare hosts the app and its server functions and handles network requests and security. Resend delivers account emails. Stripe handles web billing when a parent explicitly uses checkout; it receives parent billing/contact information and payment details, not the child’s meals or journal. Card details are entered on Stripe’s pages, not stored in the Pathfinder database. Providers process service data under their applicable agreements and security/privacy terms; their network and security logs can include IP addresses and request information. When a parent buys a membership in the iPhone app, Apple takes the payment and RevenueCat keeps track of the subscription for us, identified by the household’s ID rather than a name or email; Apple and RevenueCat never receive children’s records.

The app does not include advertising, public leaderboards, cross-app tracking, or advertising/behavioral analytics SDKs. We do not sell family records. We may disclose information if legally required or necessary to protect the service. There is no HealthKit, location, camera, microphone, or contacts integration in the web app or the iPhone app. The iPhone app keeps your sign-in session on the phone, and Expo delivers its updates. If you add the Pathfinders widget to your Home Screen, the app keeps a short summary of today’s missions on the phone for the widget to show; it isn’t sent anywhere and is cleared when you sign out.

Calendar and grandparents’ links

Creating a private calendar subscription link is an explicit sharing action. Anyone holding that link can read that profile’s active event titles, dates/times, and calendar notes. It excludes meals, journals, other profiles, and completion history. You can replace or disable the link. Calendar apps may keep imported copies after revocation or account deletion.

A grandparents’ link for groundings is also an explicit sharing action. It opens without a sign-in, so anyone holding it can see the family name and each current or upcoming grounding: the child’s name, what was taken away, and the start and return dates. The reason appears only where a parent chose to share it. It shows nothing else. The link is stored only as a one-way hash, and a parent can replace or turn it off at any time.

Device storage

Local browser storage holds your sign-in session and device alarm settings. Temporary tab storage can hold timer state. Demo edits stay in browser storage and are separate from real accounts. The service worker caches app files; real account records require a connection. Sign out on shared devices. Clearing site data on one device does not delete the server account or clear other devices.

Retention and deletion

Live account records remain while your account exists unless you remove individual records. Some in-app archive/remove controls preserve records so you can restore or review them. Use Delete account for permanent removal of the login and associated live personal records. A parent deletion also removes the private team and linked child logins; a child deletion removes the child login and child-profile personal records, leaving a blank slot and the parent’s records intact.

Deletion closes the corresponding Stripe customer/subscriptions. Stripe may retain invoices and transaction records for legal/accounting obligations. Minimal non-content event receipts may remain for duplicate-processing protection. Infrastructure backups and operational/security logs may persist until the relevant provider’s retention periods expire. Deletion does not remove imported calendars, screenshots, records downloaded onto other devices, or information another service is legally required to retain.

Children and parent control

The app is intended for parent-managed family use. Children use nicknames and may use the app with a parent; separate child access requires a parent invitation and confirmed parent-controlled email. Parents should explain that they can read the child’s records. Parents can pause access, correct records, or delete the family account. Child accounts can also initiate deletion of their own login and personal profile records. Parental consent and any applicable age/region requirements must be satisfied before collecting a child’s personal information.

Your choices and changes

You can leave optional questions blank, change interests, stop using the app, revoke calendar links, or delete an account. Contact support for access/correction questions or to withdraw consent where applicable. We will update this page if practices change; material changes affecting consent will require notice and any legally required consent. An iOS release with different integrations will require an updated disclosure before those integrations are used.