Effective October 1, 2026 · Version 1.0
Published September 1, 2026. Until October 1, 2026, the version dated August 2026 continues to apply — you can read it under Previous versions below.
daybell is built for the adults who run and use childcare and learning centers. This policy says what information we hold, why, who sees it, how long we keep it, and what happens if something goes wrong. It is written to be read.
daybell is made by ThinkUncommon LLC ("daybell", "we", "us"). Most of the information in daybell is entered by a childcare or learning center about its students, families and staff. That information belongs to the center, not to us. The center decides what goes in, who may see it, and how long it is kept; we process it on the center's instructions to provide the service, and for no other purpose. Our obligations to centers are set out in our Data Processing Addendum, which applies to every center automatically.
For a small amount of information we are responsible in our own right: our website visitors, prospective customers, center owners' account and billing details, and support correspondence.
Entered by your center, or generated as the service runs:
Optional fields are genuinely optional: a center can run daybell without entering a date of birth, a photo, or a medical or free-text note.
daybell has no child users. Children do not sign in, have no accounts, and no information is collected from a child. We do not collect or process biometric identifiers of any kind.
A small number of companies process data on our behalf: cloud hosting and database (in the United States), email delivery, text messaging, payments, and error monitoring. Each is bound by written contract to protections at least as strong as our Data Processing Addendum. The current list, and a way to be notified of changes, is at daybell.app/subprocessors. We disclose information beyond that only where the law requires it, and where lawful we will tell the affected center first.
We keep information only as long as we need it, and we do not keep it indefinitely. This table is our retention schedule. It says what we collect, why we keep it, and when we delete it.
Some of these periods are set by your center rather than by us. Childcare and learning centers have to keep attendance and enrollment records for a period set by their state licensing rules, and those periods vary widely. So retention for children's records is a setting each center controls, within the limits below. The default we apply if a center makes no choice is seven years after a child leaves the center. A center can shorten it, and some centers are required to keep records longer.
| What we hold | Why we keep it | How long we keep it |
|---|---|---|
| Center account and owner details | To operate the account and bill for the service | For the life of the account, then 7 years for tax and accounting records |
| Staff accounts and PINs | So staff can record arrivals and departures | For the life of the account. Deleted within 30 days of a staff member being removed by the center |
| Parent and family member accounts and contact details | To give you access and send the messages you have asked for | For the life of the account. Deleted within 30 days of being removed by the center |
| Records of accepting our Terms and Privacy Policy | To show which version you accepted, when, and on which screen | 7 years from the date of acceptance |
| Child enrollment records, including name, date of birth and family links | So the center can identify a child and reach the right adult | Set by the center to meet its state licensing rules. Default 7 years after the child leaves the center |
| Attendance records, including arrival and departure times | This is the center's daily attendance record, which its licensing authority requires it to keep | Same as the child's enrollment record. Minimum 4 years for a center that uses these records to support a claim under a publicly funded program |
| Authorized pickup lists and custody restrictions | So the center has a current record of who may collect a child | Same as the child's enrollment record |
| Allergy, medical, dietary and incident notes, where a center records them | So staff can keep a child safe | Same as the child's enrollment record. A center can choose to delete these earlier without affecting its attendance records |
| The audit trail attached to a child's record: who viewed or changed an authorized pickup list, and every correction to an attendance entry with its original value | So a center can show what its records said at any past moment, which protects the center and the family | Same as the child's enrollment record. We do not delete the audit trail before the record it describes |
| Records of consent to receive messages, and of any request to stop | To show that you agreed to receive messages, and to make sure we honor a request to stop | 5 years after consent is withdrawn or the account closes |
| The content of messages we send | So a center and a family can see what was sent | 12 months |
| Message delivery records: the number or address, the time, and whether it was delivered | To show what was sent, to whom, and whether it arrived | 5 years |
| Photos, where a center uses them | So a family can see their own child's day. A photo of a child is never shown to another child's family | Deleted on request. Otherwise deleted with the child's enrollment record |
| Support messages you send us | To answer your question and resolve the problem | 3 years from the last message |
| Security and system logs, including records of who accessed data | To detect and investigate misuse, and to work out what happened during a security incident | 12 months |
| Records of deletion requests and what we deleted | To show that we did what you asked | 3 years |
| Encrypted backups | So we can restore the service and a center's records after a failure | Deleted on a rolling 30 day cycle. Information you delete stays in a backup until that cycle completes, and is not restored to the live service |
| Billing records | Tax and accounting obligations | 7 years |
When a center stops using daybell. For at least sixty days after a center's account ends, the center can export its complete records at no charge. We will not withhold that export for any reason, including an unpaid bill. After sixty days we delete or return the center's data as set out in our Data Processing Addendum.
When we keep something longer. We will keep information beyond these periods only where we are required to by law, or where we need it for a legal claim or an investigation that is already under way. If that happens, we keep only what is needed, and we delete it when it is no longer needed.
Asking us to delete something sooner. A center can ask us to delete information at any time, and we will, subject to the licensing rules that require the center to keep records. If you are a parent, ask your center first, because they can do it directly. If they cannot help, contact us at hello@daybell.app.
We maintain administrative, technical and physical safeguards designed to protect the information we hold on behalf of the childcare and learning providers who use daybell, including encryption in transit and encryption of our nightly backups. No system can be guaranteed completely secure, and we do not represent that ours is.
We maintain a documented incident response process, and we review it.
If we determine that information we hold on behalf of a provider has been subject to unauthorized access or acquisition, we will notify that provider without unreasonable delay. We will give them the information they need to assess what happened and to meet their own obligations, and we will keep them updated as we learn more.
Because your relationship is with your childcare or learning provider, and they control the information they hold about you and your child, that provider is generally responsible for notifying you and any regulator where notification is required. Where the law requires us to notify individuals or regulators directly, we will do so as and when required by applicable law.
Parents and family members: your relationship is with your center, and your center can view, correct or delete information about you and your child directly — ask them first. To stop receiving messages, reply STOP to any text, use the unsubscribe link in any email, change your settings in the app, or tell your center. You can delete your parent app account yourself, in the app.
Centers: you can export your complete records at any time from Settings, remove a single student with all their records, configure retention for children's records, and ask us to delete anything sooner at hello@daybell.app.
If you contact us with a privacy request, we will acknowledge it promptly, and where the information belongs to a center we will pass your request to them within two business days and help them respond.
A change that reduces your rights or changes what happens to data is a material change: we will give at least thirty days' notice and ask for acceptance again, as described in Section 16 of the Terms of Service. Smaller changes are published and notified. Every version is archived with its effective date.
ThinkUncommon LLC · 21229 Noric Cove, Mount Dora, FL 32757, USA Email hello@daybell.app — a person answers.