Trust and security

Written for the person at a school who has to decide whether this is safe to let parents use. If you are a parent, the privacy page is the one you want. Last updated August 20, 2026.

We never receive a student roster

This is the most important thing on the page, so it is first. The school does not send us a list of students, and there is no way for it to. The only information we hold about a child is a first name, and optionally a teacher's name, typed by that child's own parent into their own account, and only for orders that go home with a student rather than out to a car.

That is enforced by the database rather than by policy: a student record cannot exist without a parent account attached to it. No surname, no date of birth, no student ID, no grades, no attendance, nothing from your SIS.

How long a child's name is kept

Thirteen months after an order is finished, the child's first name and teacher are removed from it automatically. The order itself stays, with its amounts, because the parent group has to be able to reconcile money that actually moved — but the child is no longer named on it.

Thirteen months is a school year plus one, so a "we never got the hoodie" conversation the following August can still be answered. An order that is still outstanding keeps its name for as long as it takes, however long that is: if a family is owed an item, the name is how a volunteer knows who to hand it to.

A parent who deletes their account has their child's name removed from their past orders at that moment, rather than waiting.

One school cannot see another

Every table that holds school data is protected at the database level, not by the app remembering to filter. A signed-in parent, a volunteer runner, and an administrator of a different school each see nothing belonging to a school they are not part of, and cannot change it either.

We test that by trying it — signing in as each kind of account and attempting to read and write another school's records — rather than by reading the rules and assuming. Where a test could not be run honestly, we record that instead of claiming a pass.

Card details

We never see or store a card number. Cards are entered into Stripe's own payment sheet, inside Stripe's software, and the money settles into the school's own Stripe account rather than ours. Because of how that is built, card data never reaches our servers at any point.

The school is the merchant. Its name is what a parent sees on their bank statement, and its account is where the money lands.

Who we rely on

Supabase (database and sign-in), Stripe (payments), Resend and Amazon SES (email), Railway and Vercel (hosting), Expo (notifications) and Sentry (crash reports). Crash reports are configured not to carry personal information. The full list, and what each is used for, is on the privacy page.

What we do not do

• No advertising, anywhere in the product.
• No selling, renting or sharing of anyone's data.
• No profiles built about students for any purpose.
• Your position reaches us only for an order in the pickup line — once when you place it, to tell the queue from the sofa at home, and then, while that order is on its way and the app is open, every so often so the school's runners can see roughly where your car is and carry nearby orders out together. It is only recorded near the school, and it is deleted when the order is handed over. The rest of the time the app reads the phone's location only to decide what it can offer, and that reading stays on the phone.
• Nothing runs in the background. The app asks for "while using the app" location only, so when it is closed it cannot see where anyone is, whatever it is asked to do.
• No child accounts. Children do not sign in and cannot use the app.

What we have not done

A page like this is more useful if it says where the edges are.

• No SOC 2 report. We do not hold one and do not claim one. It is the right ask for a district-wide rollout and we would expect to be asked for it at that point.
• No signed data privacy agreement yet. We can work through a district's DPA, including the SDPC National Data Privacy Agreement, and would expect to before serving a district rather than an individual parent group.
• Saved student names do not expire. The children a parent has saved in their own account stay until the parent removes them or deletes the account. The retention rule above applies to orders.

Reporting something

If you believe you have found a security problem, or you want a copy of what we hold, or you want data deleted, write to support@carlinemarket.com. Please include enough detail to reproduce a security issue. We would rather hear about it than not.