Access enforced on our servers
Access rules are checked by the database on every request, not just hidden in the app's screens. A parent can reach only their own child's records, and a staff member only their own center's.
Security & Privacy
How WeBlossom protects your center's data
Child care records are some of the most sensitive information a family ever shares. Here is how we handle them, in plain language.
The most sensitive values are encrypted
Social Security numbers and the access tokens for connected accounts such as QuickBooks or cloud backup are encrypted at rest. Showing a Social Security number on screen requires re-entering your password.
Card payments handled by Stripe
Families enter card details directly into Stripe, our payment processor. WeBlossom never receives or stores a full card number.
Photo privacy built in
Before a photo is shared, staff can blur other children's faces; detection runs on the device and finds faces without recognizing whose they are. Location data is stripped from every uploaded photo.
Records that can't be quietly changed
A medication dose, immunization or drill logged in error is voided with a reason instead of deleted, and a corrected activity entry keeps the fact that it was corrected. The history a director or inspector sees is complete.
Voice features ask first
Nothing is sent for cloud transcription until the staff member allows it, and a center can turn it off for everyone. Every voice feature has a typed equivalent.
Hosted in the United States
WeBlossom's database and files are hosted in the United States. The providers we rely on, and exactly what each one receives, are listed in our Privacy Policy.
Children never have accounts
WeBlossom is used by a center's staff and by each child's own guardians. Children don't sign in or use the app, and we don't collect information directly from a child.
What We Never Do
Your families' data is not our product
These are commitments in our Privacy Policy, not marketing lines.
- We never sell personal information, and we don't share it with data brokers or advertisers.
- We never use children's information for advertising.
- We don't use your data to train our own machine-learning models.
- The app has no third-party analytics, advertising or tracking software.
Your Center Stays in Control
Export, delete and close on your terms
Your center owns its records. WeBlossom stores them on your behalf.
Export at any timeAdmins can export the center's own data, and billing data as a spreadsheet, whenever they like.
Delete your own account in the appAnyone can deactivate or permanently delete their own account from Settings.
Closing a center's accountWe complete verified deletion requests within 30 days, except records New York requires a center to keep, and we tell you what's kept and why.
Found a Problem?
Report a security issue
We welcome reports from security researchers and publish a vulnerability disclosure policy explaining what's in scope and how we respond.
Something seems wrong with a child's safety?
If an allergy alert looks incorrect or a check-in didn't register, contact your center first, since they can act immediately. Then let us know at support@weblossom.today so we can investigate.
Questions from your board or your families?
We're happy to walk through how WeBlossom handles data in more detail, on a call or in writing.