Last updated: July 21, 2026
The short version: your children's information is encrypted on your device with a key only you hold — your passkey (Face ID / Touch ID), vault password, or printed recovery code. If you turn on sync, our servers store only that encrypted data — we cannot read a single field of it, ever. We have no ads, no trackers, and no analytics.
Cubby stores the information you enter or upload — child profiles, immunization records, health details, documents, household and emergency contacts, and signatures — encrypted on your device (AES-256-GCM). The encryption key is derived from your vault password, which is never stored or transmitted anywhere.
If you enable sync, your encrypted vault is stored on our servers so your other devices can download it. This data is ciphertext only: it can only be decrypted with your key — passkey, vault password, or recovery code — on your device. We cannot read it, restore it without your key, or hand it to anyone in readable form — a full copy of our database contains no readable health information. The unencrypted items stored with your account are limited to your display name and, if you use the programs feature below, the name of your organization and its programs.
A daycare, camp, or league can share a Cubby program link. If you open it and press Send, the finished forms you approved — and, only if you tick the box, a short records summary — are delivered to that program, exactly as if you handed them to the front desk. To make that delivery, these submissions pass through and are held on Cubby's servers, encrypted in transit and at rest, until the program downloads or deletes them. Unlike your vault, this is not beyond our technical reach — the server must be able to hand the forms to your program — so the promise here is honesty, encryption, and restraint, not impossibility. Your vault itself stays exactly as described above: readable by no one but you. Nothing is ever sent to a program without you pressing Send.
Sign in with Google or Apple is used only to identify which encrypted vault is yours. We receive a stable account identifier from the provider; we do not receive your contacts, files, or activity, and sign-in cannot decrypt your vault. Google's or Apple's sign-in service loads only when you choose to use it.
Cubby is a tool for parents and legal guardians. Accounts are created by adults; Cubby is not directed at children and does not knowingly collect information from children directly. You affirm during setup that you are the parent or legal guardian of the children whose records you store.
Deleting your account in Settings permanently erases your vault from your device and, if sync was on, deletes the encrypted cloud copy. There is no retained backup.
Because we cannot read or reset your vault, your unlock methods — passkey (Face ID / Touch ID), vault password if you set one, and printed recovery code — are the only ways in. If all are lost, your data cannot be recovered — by design.
Questions: hello@easycubby.com