Privacy policy for the Firstep app

Last updated August 26, 2026

This policy covers the Firstep application — the mobile app and app.firstepapp.com — used by schools and by the families enrolled at them. The separate policy for this website covers firstepapp.com and the enquiries submitted through it.

Who holds this information

Your school decides what is recorded about your child, and why. Firstep provides the software and stores the information on the school's behalf, under an agreement signed with them. In data-protection terms the school is the controller and Firstep is the processor.

That distinction matters when you want something changed or removed: ask your school first. They can correct or delete records directly, and we act on their instructions. Firstep is operated by Bryan St. Clair, an independent software developer based in California, United States. Write to info@firstepapp.com with any privacy question.

What the app collects

Your account

• Your name, email address, and the password you set — stored as a hash, never in readable form
• Your role at the school, and which school you belong to
• If you turn on two-step sign-in, the secret your authenticator app uses — encrypted
• If you set a check-in PIN, a hash of it — never the digits themselves

Information about children, recorded by the school

Staff enter this; parents see what concerns their own children. Depending on what your school records, it can include:

• Name, date of birth, address, and the family a child belongs to
• Allergies, medical notes, medications, and immunization records
• Custody or collection arrangements, and who is approved to collect a child
• Arrivals and departures, including who dropped off or collected and at what time
• The day's record — meals, naps, diaper changes, mood, and learning notes
• Photographs taken by staff at the school
• Incident and injury reports
• Messages between families and staff
• Invoices, payments, and what is owed

Dates of birth, addresses, phone numbers, allergy and medical notes, custody notes, incident details, medication instructions, and the text of messages are encrypted where they are stored, so they are not readable from the database alone.

Notifications

If you allow notifications, the app registers a delivery token for your device so the school's messages can reach it. The token identifies the phone, not you, and it is deleted when you sign out. We record what was sent and whether it arrived, so that "I was never told" is a question with an answer.

Proving you were there

A check-in only counts if the person recording it is actually at the school, so the app asks for one of two things at that moment — whichever your school has turned on:

• The camera, to read the code posted at the door. The camera is used to recognize that one code and nothing else: no photograph is taken, and no image leaves your phone or is stored anywhere.
• Your location, checked once at the moment you tap check in or check out, to confirm you are within the boundary your school has set. It is never read in the background, never while the app is closed, and never used to follow where you go. What is kept is the reading from that one moment and how far it was from the school — a number staff can look at if an arrival is ever disputed.

Both are asked for the first time you use them, and you can refuse. Refusing means staff check your child in at the front desk instead — nothing else in the app changes.

What the app does not collect

• Your location in the background. Only at the moment you check a child in or out, and only if your school uses that method — see above.
• Photographs or video from your camera. The camera reads the school's check-in code and nothing else; no image is captured or kept.
• Your contacts, calendar, microphone, or camera roll. None are accessed.
• Payment card or bank details. Paying a bill opens Stripe's own secure page. Card numbers never pass through Firstep and are never stored by us.
• Advertising or tracking identifiers. There is no advertising in the app, no third-party analytics, and nothing that follows you to other apps or websites.

Why it is used

• To run the school day — recording who is present, what happened, and telling families about it.
• To keep children safe — allergies, medications, and who may collect a child are recorded so the people responsible can see them.
• To bill for care — invoices, payments, and balances.
• To keep the service secure — sign-in attempts, an audit trail of who changed what, and a record of who viewed a photograph.
• To prove an arrival or a collection happened — the scanned code or the distance from the school at the moment it was recorded.

Firstep does not sell this information, share it with data brokers, use it for advertising, or use children's data to train anything. It exists to run your school and for no other purpose.

Who it is shared with

Only the services needed to make the application work:

• Our hosting provider, which operates the servers and the database.
• Cloudflare R2, where photographs are stored. Photographs are served through short-lived links rather than public addresses.
• Stripe, which processes card and bank payments. Stripe receives the payment details you enter on their page; we receive only the result.
• Expo, which delivers push notifications to your device.
• Our email provider, which delivers messages and daily summaries.

Information is also shared inside your own school, as your school decides: staff see the children in their rooms, administrators see the school. Families see their own children and nobody else's. We may disclose information where the law requires it, or where it is necessary to protect someone's safety.

How long it is kept

Records about a child belong to the school and are kept while they are enrolled, and afterwards for as long as the school's own record-keeping obligations require. The school can ask us to delete them. Alongside that, the application removes routine records on a schedule:

• Sign-in and PIN attempt history: 90 days
• Expired verification, reset, and invitation links: 30 days
• Records of who viewed a photograph: 12 months
• Notification and daily-summary send records: 12 months
• Scheduled job history: 6 months
• Accounts registered but never confirmed: 30 days
• Deleted activity posts and their photographs: 30 days after deletion

Your choices

• Notifications. Every kind you can be sent has a switch in the app, for email and for your phone separately — except incident reports, emergencies, and messages about your own account, which are always sent because missing one matters more than the interruption.
• Your records. Ask your school to show you, correct, or delete what is held about your child. They can do all three.
• Your account. Ask your school to close it, or write to us.

If you are a California resident, the California Consumer Privacy Act gives you these rights formally, including the right not to be treated differently for exercising them. Firstep does not sell or share personal information as that Act defines those terms.

Security

• Everything travels over HTTPS.
• Sensitive fields are encrypted where they are stored, with keys held outside the database.
• Passwords and PINs are stored as hashes and cannot be read back.
• Staff accounts require two-step sign-in.
• Photographs are reachable only through short-lived links, and every link issued is logged.
• Changes to accounts and records are written to an audit trail.

No system is perfect. If you believe something here has gone wrong, write to us and we will tell you what we find.

Children

Children do not have Firstep accounts. The app is used by the adults responsible for them — parents, guardians, and school staff — and information about a child is entered by their school, not by the child. We do not knowingly allow anyone under 13 to create an account, and there is no advertising, no profiling, and no in-app purchasing anywhere in the application.

Changes

If this policy changes materially we will update the date at the top, and tell schools directly where the change affects the families they serve.