Security and privacy are not features. They are the foundation.
Parenting Path handles sensitive family law data, DV survivor records, and child information. Here is exactly how we protect it.
Encryption in transit and at rest.
- In transit: All data between your device and our servers is encrypted via TLS 1.3.
- At rest: Database encryption for all stored records. Backup encryption for all automated snapshots.
- Safety journal: The offline safety journal is encrypted on your device using your biometric credentials. It never leaves your device and never reaches our servers.
- OAuth tokens: Google and Apple Calendar sync tokens are encrypted at rest and deleted immediately upon disconnection.
Immutable audit logs.
Every action in the app is permanently logged: messages sent, expenses submitted, calendar events created, court order rules activated, professional access events, and safety events. These logs are append-only — no one, including Parenting Path staff, can modify or delete them.
Audit logs are retained for 7 years after account closure to support ongoing legal proceedings.
Integrity-verified court reports.
Every generated PDF report is passed through a SHA-256 cryptographic hash function. The resulting hash — a unique fingerprint of that exact document — is stored in the database and printed on every page. If anyone alters the document after generation, the modification is provable.
DV safety is a system-level commitment.
Safety Mode is not a checkbox in settings. It is a parallel operational mode that changes how the entire app behaves: notification content, app icon, profile display, app switcher behaviour, message previews, and location handling.
- The co-parent can never detect that Safety Mode is active
- EXIF metadata is stripped from all uploaded images before server transmission
- Push notifications suppress all message content and sender names
- The offline safety journal is device-encrypted and never synced to the server
- Core safety features are free on every plan — permanently
Children’s privacy (COPPA).
Parenting Path is designed for adults. You must be 18 or older to create an account. Child profile data (name, date of birth, school, allergies) is entered by parents, not by children. Child mood check-in data is visible to both parents and, with explicit consent, to a verified therapist. It is never shared for advertising or commercial purposes.
Child profile data is retained until the child turns 18 plus 7 years for family law compliance. Parents can request correction or deletion at any time.
Data retention.
We retain your data for as long as your account is active and for defined periods afterward to preserve records that may be needed in legal proceedings. Full retention schedules are published in our Privacy Policy.
Account deletion is available from Settings. After deletion, your account is closed within 30 days. Messages, expenses, and audit logs are retained for 7 years post-closure. The safety journal (device-local only) is deleted when you uninstall the app.
Professional access is scoped, logged, and revocable.
Attorneys, mediators, GALs, and therapists access family data through a separate security context with TOTP two-factor authentication. Every page view, download, and report access is logged with timestamp and IP address. Parents can revoke professional access immediately at any time.
Infrastructure and compliance.
- Hosting: US-based infrastructure
- Security headers: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
- Session management: Users can view active sessions, revoke individual devices, and force logout of all sessions
- Biometric authentication: Optional Face ID / fingerprint login
- AI data handling: Message text sent to AI tone analysis is not retained by the AI provider after scoring
Questions about security? Contact security@parentingpath.net.
Your data is safe. Your children are the priority.
Read the full details in our legal documents.