Trust and security

Written for the person at a school who has to decide whether this is safe to let parents use. If you are a parent, the privacy page is the one you want. Last updated 20 August 2026.

We never receive a student roster

This is the most important thing on the page, so it is first. The school does not send us a list of students, and there is no way for it to. The only information we hold about a child is a first name, and optionally a teacher's name, typed by that child's own parent into their own account, and only for orders that go home with a student rather than out to a car.

That is enforced by the database rather than by policy: a student record cannot exist without a parent account attached to it. No surname, no date of birth, no student ID, no grades, no attendance, nothing from your SIS.

How long a child's name is kept

Thirteen months after an order is finished, the child's first name and teacher are removed from it automatically. The order itself stays, with its amounts, because the parent group has to be able to reconcile money that actually moved — but the child is no longer named on it.

Thirteen months is a school year plus one, so a "we never got the hoodie" conversation the following August can still be answered. An order that is still outstanding keeps its name for as long as it takes, however long that is: if a family is owed an item, the name is how a volunteer knows who to hand it to.

A parent who deletes their account has their child's name removed from their past orders at that moment, rather than waiting.

One school cannot see another

Every table that holds school data is protected at the database level, not by the app remembering to filter. A signed-in parent, a volunteer runner, and an administrator of a different school each see nothing belonging to a school they are not part of, and cannot change it either.

We test that by trying it — signing in as each kind of account and attempting to read and write another school's records — rather than by reading the rules and assuming. Where a test could not be run honestly, we record that instead of claiming a pass.

Card details

We never see or store a card number. Cards are entered into Stripe's own payment sheet, inside Stripe's software, and the money settles into the school's own Stripe account rather than ours. Because of how that is built, card data never reaches our servers at any point.

The school is the merchant. Its name is what a parent sees on their bank statement, and its account is where the money lands.

Who we rely on

Supabase (database and sign-in), Stripe (payments), Resend and Amazon SES (email), Railway and Vercel (hosting), Expo (notifications) and Sentry (crash reports). Crash reports are configured not to carry personal information. The full list, and what each is used for, is on the privacy page.

What we do not do

• No advertising, anywhere in the product.
• No selling, renting or sharing of anyone's data.
• No profiles built about students for any purpose.
• One position reaches us, and only when an order is placed — enough to tell the pickup queue from the sofa at home. To decide whether it can offer pickup-line items at all, the app reads the phone's location while it is open, and that reading stays on the phone: the only position ever sent to us is the one attached to an order.
• Nothing runs in the background. The app asks for "while using the app" location only, so when it is closed it cannot see where anyone is, whatever it is asked to do.
• No child accounts. Children do not sign in and cannot use the app.

What we have not done

A page like this is more useful if it says where the edges are.

• No SOC 2 report. We do not hold one and do not claim one. It is the right ask for a district-wide rollout and we would expect to be asked for it at that point.
• No signed data privacy agreement yet. We can work through a district's DPA, including the SDPC National Data Privacy Agreement, and would expect to before serving a district rather than an individual parent group.
• Saved student names do not expire. The children a parent has saved in their own account stay until the parent removes them or deletes the account. The retention rule above applies to orders.

Reporting something

If you believe you have found a security problem, or you want a copy of what we hold, or you want data deleted, write to support@carlinemarket.com. Please include enough detail to reproduce a security issue. We would rather hear about it than not.