Privacy Policy

In short

Child profiles, medications, parent notes, graphs, saved papers, and the doctor PDF stay on your iPhone. Teacher check-ins travel as sealed blobs. A 4-digit PIN unlocks the form on the teacher’s phone or Chromebook. The people who run this site cannot read those ratings. Resources search talks to OpenAlex from the iPhone. This is not a claim of HIPAA or FERPA compliance.

1. What stays on your iPhone

The app’s on-device store (SwiftData) holds:

• The child profile you type: name, age, diagnoses, therapies, school and sleep notes, and the behavior list.
• Medications, dose changes, and parent check-ins with optional notes and context tags.
• Teacher responses after your iPhone pulls them in and decrypts them.
• Invite records: the teacher label you typed, the child’s first name used on the form, the mailbox id, the 4-digit PIN, and whether you hid the name.
• Resources papers you save: title, abstract, DOI, and any PDF you imported, captured from a public page, or that OpenAlex marked open access.

That store file uses complete file protection. While the iPhone is locked, the file is inaccessible. Optional App Lock (Face ID or the device passcode) can lock the app when it goes to the background.

Mailbox keys live in the on-device Keychain: the private decryption key and the mailbox password. They become available after first unlock. They are not marked to sync with iCloud. You do not need to be signed into iCloud to use teacher links.

CloudKit is off. Older unused iCloud fields may still sit on a local invite record so the app does not need a destructive database migration. The app no longer publishes or accepts iCloud share links.

First-run tips, App Lock on/off, and “don’t show demo data” are ordinary iPhone settings (UserDefaults). Showcase data (Jordan) is local demo content you can replace.

2. The PIN and the blobs

A teacher link is not a folder of readable notes. It is a sealed mailbox with a PIN and two kinds of blobs.

The link is only a mailbox id, for example a path under /t/. It does not contain the child’s name, the teacher name, the behavior list, or the PIN.

The PIN is a 4-digit unlock code. It stays on your iPhone and you send it in a second message. Cloudflare stores only a SHA-256 hash of that PIN, not the PIN itself. The teacher types the PIN. The site checks the hash and, if it matches, returns the wrapped form. After a handful of wrong tries, unlocks are rate-limited for a short window.

The form wrap is a sealed blob (bp-formwrap-aesgcm-v1). After the PIN is entered, the teacher’s browser unwraps it locally. Inside are the child’s first name (or “this student”), the name you typed for the teacher, the behavior labels (or “Item 1”), and your public encryption key. The Worker stores that wrap as a string. It does not open it. Opening GET /form on a wrapped mailbox returns locked: true until the PIN succeeds.

The check-in blob is a second sealed blob (bp-p256-aesgcm-v1). The teacher’s browser encrypts the face ratings (still 1 to 5) and optional note to your public key before the rating leaves their device. Cloudflare stores ciphertext, a received time, and an id. Your iPhone decrypts the blob into the on-device store, then deletes it. Leftover blobs expire after 7 days.

If you turn on the hide-name switch, the wrap holds “this student” and “Item 1” instead of the real labels. Ratings still use the real behavior ids so they land on the right rows on your phone.

The current app uploads a wrapped blob. The Worker can still hold an older unwrapped encoded pack if one is uploaded. In either case it stores the string and does not parse it.

Knowing the link lets someone try to submit. It does not let them read ratings. Reading a check-in blob needs the private key on your iPhone. Seeing form names needs the PIN.

3. What Cloudflare holds for a live mailbox

• Mailbox metadata: a hash of the mailbox password, expiry, a revoked flag, and created time.
• The form wrap blob and the PIN hash, or an older unwrapped encoded pack.
• Inbox blobs: ciphertext plus received time. Up to 40 waiting blobs. At most 24 submits per mailbox per day.
• Short-lived abuse counters. Create-link limits hash the caller IP (first 16 hex characters of SHA-256) for about 48 hours. Unlock attempts use a short window.
• App Attest challenges for about 5 minutes when you create a link, and a device attestation public key plus counter with no child names.

There is no child roster, no SQL database of kids, and no CloudKit path for teacher ratings. Stop sharing clears the wrap, the pack, and the waiting blobs. The mailbox then expires on the date you set (between 1 and 180 days; the app default is 90 days).

4. Apple, Turnstile, and payments

Creating a production mailbox uses Apple App Attest so the request has to come from the real app. Teacher submit uses Cloudflare Turnstile. Turnstile receives a token and the teacher’s IP. BehaviorPulse Premium is an App Store subscription. Apple processes the payment. BehaviorPulse does not receive card numbers.

5. Logs

The Worker has Cloudflare observability turned on. Those traces can include request paths (a mailbox id can appear in a URL) and IP addresses. Web Analytics is not used on this hostname. Submit bodies, form wraps, Authorization headers, and PINs are not written to application logs by this Worker.

6. What the operator does not keep

The operator does not host your child’s profile, medications, parent notes, doctor PDF, or Resources papers. The operator cannot read check-in blobs. The operator cannot unwrap a form wrap without the PIN. A dump of the mailbox store is hashes, ciphertext, and mailbox ids — not a readable chart.

7. Support messages

The support form sends the name, email, and message you type to the operator’s inbox. That is the only family-written content the operator receives on purpose. It is not stored in the mailbox. Do not put medical record numbers in a support message.

8. How long things last

• On-device data lasts until you delete it or remove the app.
• Check-in blobs last until your iPhone deletes them, or 7 days.
• The form wrap lasts until you stop sharing or the mailbox expires.
• Rate-limit counters last about 48 hours (unlock counters about 30 minutes).
• App Attest challenges last 5 minutes.
• A support message lasts in the operator’s email inbox.

9. Children

Parents use the app for a child in their care. Teachers do not create accounts. BehaviorPulse does not market to children and does not host a child roster.

10. Contact

Privacy questions go through the support form. This page does not publish an email address.

11. Resources and OpenAlex

More → Resources can search scholarly works through the public OpenAlex API (api.openalex.org) from your iPhone. BehaviorPulse does not send the child’s name or parent notes. If you tap topic chips, the query can include diagnoses, current medicine names, and behavior labels from the on-device profile. Tapping another chip adds it after a comma. You can also type your own search words. A search does not run until you tap Search, press Search on the keyboard, or tap a topic chip.

OpenAlex may return an abstract and links. A PDF chip means OpenAlex marked the work open access and the URL looks like a PDF over HTTPS. If you save from a link or open a result without a PDF, BehaviorPulse can fetch that HTTPS address. If the response is a PDF, it stores the file. If the response is a public web page with readable text, it saves a text capture as a PDF on the iPhone. It does not sign in, run page scripts, or bypass a paywall. Login walls stay in Safari. PDFs you import or paste stay on the iPhone with complete file protection and are excluded from iCloud backup. You can open or remove those files under Resources. Summaries are written on the iPhone by Apple Intelligence when the device supports it, and labeled “Summary from Apple Intelligence.” If a PDF is too long for one on-device pass, the summary uses the opening pages plus the abstract, or the abstract alone. They are not medical advice and not proof of causation. The operator does not host these PDFs.