What a teacher's phone reads
First name and last initial, room, family, the center's own child number, and an age band. That is the roster projection, and it is all an ordinary classroom query touches.
The boundary
Privacy, by having nowhere to put it
Child-care software collects information about children who cannot consent, for adults who have to trust the center. The most reliable protection we can offer is not a promise about how carefully we handle something — it is not having a place to record it at all.
What CubbyLoop has no field for
None of these is a setting a center can switch on. There is nowhere in the product to enter them.
- Health history, diagnoses, medication or immunization documents
- Government identifiers, custody documents or court orders
- Child accounts, child-facing chat or public child profiles
- Cameras, video streaming, facial recognition or biometric check-in
- Precise location tracking of children, staff or guardians
- Advertising identifiers, behavioural profiling or data sold to anyone
If a center ever genuinely needs one of these for a real operational reason — an allergy instruction, say — it gets its own restricted record, its own access rules, its own retention, and a review before it ships. It does not get bolted onto a general-purpose notes field.
Data minimization
A roster is not a file
The split between what a classroom needs and what the office holds is built into the data model, not into a permissions checkbox.
What stays in the restricted record
The exact date of birth, emergency contact references, consent and retention metadata. A twenty-child roster must not put twenty dates of birth on every phone in the building.
Who can see a family
A guardian reaches exactly one family, through a link created by accepting a one-time invitation. There is no writable family field that could point somewhere else.
What the audit trail stores
Identifiers, role names and the reason for a change. No child's name is copied into the stored detail of an audit entry, and no date of birth is copied into attendance or daily updates.
Honesty
What we deliberately do not claim
Everyone in this category says “secure” and “compliant”. Here is what we are not saying, and why.
We make no claim about COPPA
CubbyLoop is designed for authenticated adults — staff and parents or guardians. Children have no accounts and the product is not marketed to them. That reduces risk; it is a product decision, not a legal conclusion, and we will not present it as one.
We make no claim about FERPA
Whether FERPA applies depends on the institution and its funding relationship. Many private child-care centers are not covered; some programs may be. A blanket claim would be meaningless, so we do not make one.
We certify nothing about state licensing
Requirements vary by state and territory. Room staffing in CubbyLoop is measured against a target the center configured itself. It is an operational prompt, never a legal determination, and the product never blocks or authorizes real-world care on the strength of its own rule.
We do not call the current build secure
The access rules — classroom scope, family scope, the capability matrix, append-only attendance — are real, written once as pure domain code, and they now also run as deployed Firestore security rules, with an adversarial test suite that fails if a rule is weakened. That is a genuine step up from where this page stood a week ago.
It is still not “secure”. The app a person can click through is the offline demo and runs against its own in-memory data; the build that does talk to the server has had its data layer exercised there, not its screens. There is no attestation on the API, no monitoring, no alerting, and no restore drill — and nothing has been tried against real traffic, because there is none. The honest words remain “designed and tested”, not “secured”.
We do not say a pickup was verified
CubbyLoop records that the center released a child to a named authorized adult. The staff member performed the identity check in person. The product says exactly that, on the screen, every time.
Your records
Export and deletion
Two different things get confused here, so we keep them apart. Your account is yours, and you can end it yourself. A center's records about a child are the center's, and the center may be required to keep them.
Deleting your own account runs immediately. It is in the app under Settings → Account, for every role — a parent, a teacher, a director, an owner. No email, no phone call, no support form. Your access ends when you confirm, your sign-in is removed, your registered devices stop receiving notifications, and your name is removed from the center's records within 24 hours. That flow is deployed, and it was driven end to end against the live service before this sentence changed — including the case where you are a center's only owner, which is refused with both ways out named. There is a page explaining the whole thing, including what to do if you cannot sign in.
A request about a child's records still goes to the center for review, and that is deliberate rather than a gap. A licensed child-care center may be required to keep attendance and incident records for the period its state licensing authority sets, and that decision is the center's to make, not ours to make on its behalf. So the request is recorded and routed rather than executed. The review queue exists on the server; the screen a parent would file from does not exist yet, so for now that conversation starts with the center.
An owner can also delete a whole center. That is scheduled with a seven-day window any owner can cancel, every member of the center sees a notice for the whole window, and when it closes the records are really gone. Retention defaults and the deletion policy are still an open owner decision, not something we have quietly chosen for you.
This website
What this page itself does
Nothing. This is a static site: no analytics, no tag manager, no advertising pixels, no embedded third-party scripts, no web fonts loaded from anyone else, no cookies set by us, and no forms.
The only way to contact us from here is a plain email link to support@cubbyloop.com, which opens your own mail app. Nothing you type is captured by this site, because there is nothing here to capture it with.
No policy documents are published yet. Terms, a privacy policy, a data-processing agreement and a subprocessor list all require qualified review before any real family's information goes anywhere near this product, and that review has not happened. We would rather show you this page and the empty terms page than a template with the wrong company name in it.
Last updated 14 October 2026. When the reviewed documents exist they will replace these pages and carry their own effective dates.
Hold us to this
If any line on this page is vaguer than it should be, or a claim on this site outruns what the product does, we want to hear about it.
Writing to us starts an email to support@cubbyloop.com. There is no form on this site and nothing is collected by this page.