Privacy policy for the Firstep app

Last updated August 28, 2026

This policy covers the Firstep application — the mobile app and app.firstepapp.com — used by schools and by the families enrolled at them. The separate policy for this website covers firstepapp.com, the enquiries submitted through it, and the testimonial form — which is on that site even when you reach it from a link inside the app.

Who holds this information

Your school decides what is recorded about your child, and why. Firstep provides the software and stores the information on the school's behalf, under an agreement signed with them. In data-protection terms the school is the controller and Firstep is the processor.

That distinction matters when you want something changed or removed: ask your school first. They can correct what is held about your child, and they decide when records about your child are disposed of — within the limits their license sets, which are described under How long it is kept below. Firstep is operated by Bryan St. Clair, an independent software developer based in California, United States. Write to info@firstepapp.com with any privacy question.

What the app collects

Your account

• Your name, email address, and the password you set — stored as a hash, never in readable form
• Your role at the school, and which school you belong to
• If you turn on two-step sign-in, the secret your authenticator app uses — encrypted
• If you set a check-in PIN, a hash of it — never the digits themselves

Information about children, recorded by the school

Staff enter this; parents see what concerns their own children. Depending on what your school records, it can include:

• Name, date of birth, and the family a child belongs to
• Allergies, medical notes, medications, and immunization records
• Custody or collection arrangements, and who is approved to collect a child
• Arrivals and departures, including who dropped off or collected and at what time
• The day's record — meals, naps, diaper changes, mood, and learning notes
• Photographs taken by staff at the school
• Incident and injury reports
• Messages between families and staff
• Invoices, payments, and what is owed

Dates of birth, phone numbers, allergy and medical notes, custody notes, incident details, medication instructions, and the text of messages are encrypted where they are stored, so they are not readable from the database alone.

Notifications

If you allow notifications, the app registers a delivery token for your device so the school's messages can reach it. The token identifies the phone, not you, and it is deleted when you sign out. We record what was sent and whether it arrived, so that "I was never told" is a question with an answer.

Proving you were there

A check-in only counts if the person recording it is actually at the school, so the app asks for one of two things at that moment — whichever your school has turned on:

• The camera, to read the code posted at the door. The camera is used to recognize that one code and nothing else: no photograph is taken, and no image leaves your phone or is stored anywhere.
• Your location, checked once at the moment you tap check in or check out, to confirm you are within the boundary your school has set. It is never read in the background, never while the app is closed, and never used to follow where you go. What is kept is the reading from that one moment and how far it was from the school — a number staff can look at if an arrival is ever disputed.

Both are asked for the first time you use them, and you can refuse. Refusing means staff check your child in at the front desk instead — nothing else in the app changes.

What the app does not collect

• Your location in the background. Only at the moment you check a child in or out, and only if your school uses that method — see above.
• Photographs or video from your camera, if you are a parent. Your camera reads the school's check-in code and nothing else; no image is captured or kept. Staff accounts are different: staff use the camera and the photo library to share pictures of the day with families, which is the "Photographs taken by staff at the school" above. The app asks permission the first time, and only on the screen where a post is written.
• Your contacts, calendar, or microphone. None are accessed.
• Payment card or bank details. Paying a bill opens Stripe's own secure page. Card numbers never pass through Firstep and are never stored by us.
• Advertising or tracking identifiers. There is no advertising in the app, no third-party analytics, and nothing that follows you to other apps or websites.

Why it is used

• To run the school day — recording who is present, what happened, and telling families about it.
• To keep children safe — allergies, medications, and who may collect a child are recorded so the people responsible can see them.
• To bill for care — invoices, payments, and balances.
• To keep the service secure — sign-in attempts, an audit trail of who changed what, and a record of who viewed a photograph.
• To prove an arrival or a collection happened — the scanned code or the distance from the school at the moment it was recorded.

Firstep does not sell this information, share it with data brokers, use it for advertising, or use children's data to train anything. It exists to run your school and for no other purpose.

Who it is shared with

Only the services needed to make the application work:

• Our hosting provider, which operates the servers and the database.
• Cloudflare R2, where photographs are stored. Photographs are served through short-lived links rather than public addresses.
• Stripe, which processes card and bank payments. Stripe receives the payment details you enter on their page; we receive only the result.
• Expo, which delivers push notifications to your device.
• Our email provider, which delivers messages and daily summaries.

Information is also shared inside your own school, as your school decides: staff see the children in their rooms, administrators see the school. Families see their own children and nobody else's. We may disclose information where the law requires it, or where it is necessary to protect someone's safety.

How long it is kept

Records about a child belong to the school and are kept while they are enrolled, and afterwards for as long as the school's own record-keeping obligations require. That period is set by the school's licensing agency, not by us, and it varies a great deal — California requires three years after a child stops attending, Texas three months, and a school in the federal food program has its own longer obligation. Each school sets its own period in Firstep and can see the figure it chose.

When that period ends, the record stops naming anybody. Your child's date of birth, medical notes, allergy notes and custody notes are erased, their photographs are deleted from storage for good, and the pickup list is removed. The attendance and incident rows remain as a record that something happened, no longer attached to a name. The same happens to a closed account: it is severed from the records it appears on, and the signature on any incident report you acknowledged is replaced.

The clock stops if the school has an audit, investigation, or legal action open. Nothing is disposed of while that is the case.

Alongside that, the application removes routine records on a schedule:

• Sign-in and PIN attempt history: 90 days
• Expired verification, reset, and invitation links: 30 days
• Records of who viewed a photograph: 12 months
• Notification and daily-summary send records: 12 months
• Push delivery receipts: 12 months
• Scheduled job history: 6 months
• Attachments on a support ticket: 90 days after the ticket is closed
• Deleted activity posts and their photographs: the post is removed 30 days after deletion. Its photographs are marked at the same point and leave storage about a week later, which is a deliberate grace period — a teacher who deletes the wrong post has that long to say so.

An account registered and never confirmed is not deleted. After seven days it is locked, and it stays on the school's list so they can follow up with the person directly. This page previously said such accounts were deleted after 30 days; they were not, and the behavior they described was removed deliberately — deleting the account also deleted the school's only record that a family had ever applied, along with anybody to contact about it. Ask the school to close the account and it is removed under the rules above.

Your choices

• Notifications. Every kind you can be sent has a switch in the app, for email and for your phone separately — except incident reports, emergencies, and messages about your own account, which are always sent because missing one matters more than the interruption.
• Your records. Ask your school to show you or correct what is held about your child. Deleting a licensing record on request is not something a school can do, and not something we can do for them — an incident report is the school's account of how something was handled, and it has to be able to produce it. It is disposed of on the schedule above instead.
• Your account. Close it yourself, at any time — in the app under Account, or on the website under Your account. Your password stops working immediately, your PIN and second factor are erased, every phone set up for notifications is removed, and your email address is released. It cannot be undone, and nobody at the school can reopen it. What your school keeps is described above.

If you are a California resident, the California Consumer Privacy Act gives you these rights formally, including the right not to be treated differently for exercising them. Firstep does not sell or share personal information as that Act defines those terms.

Security

• Everything travels over HTTPS.
• Sensitive fields are encrypted where they are stored, with keys held outside the database.
• Passwords and PINs are stored as hashes and cannot be read back.
• Staff accounts require two-step sign-in.
• Photographs are reachable only through short-lived links, and every link issued is logged. Inside the app a link lasts five minutes. The one exception is the end-of-day email, where a link lasts a week — an email read next weekend should still show the pictures, and that link sits in your inbox rather than behind a sign-in.
• Changes to accounts and records are written to an audit trail.

No system is perfect. If you believe something here has gone wrong, write to us and we will tell you what we find.

Children

Children do not have Firstep accounts. The app is used by the adults responsible for them — parents, guardians, and school staff — and information about a child is entered by their school, not by the child. We do not knowingly allow anyone under 13 to create an account, and there is no advertising, no profiling, and no in-app purchasing anywhere in the application.

Changes

If this policy changes materially we will update the date at the top, and tell schools directly where the change affects the families they serve.