Privacy, in plain language
Last updated August 2026
Carpool Crew is a shared schedule for families who drive each other's kids. That means you trust it with something real, so this page says exactly what we store, where it lives, and what we will never do with it. No legal fog, no fine print that takes it all back.
The short version. We store what your crew types in and nothing else. It lives in one database. We run no analytics, show no ads, and never sell or share your data with anyone. Payments happen entirely on Stripe, so we never see a card number. Kid Mode collects nothing from your child. The one outside service the app talks to is Google Fonts, and this page tells you so plainly below.
What we store
Everything we hold is something a parent in your crew typed in on purpose:
- Your family's name (like "The Rousseaus") and the initials we derive from it.
- Optional kid details - a first name, a photo, and a phone number, each only if you choose to add them. They exist so the crew knows who they're picking up and how to reach them.
- Optional parent phone number, so another parent can call you about a ride.
- Optional pickup addresses - one for your family, and, if you set one, a different address for a particular crew.
- Schedule data - who is driving which day, which rides your kid doesn't need, and requests to cover a ride.
- Crew details - the crew's name, its icon, its time zone, its driving days, and, if an admin pastes one, a link to your crew's group chat outside the app.
Who in your crew can see the phone numbers is a crew setting. New crews start restricted: contact details are visible only to crew admins and to the family they belong to, unless an admin deliberately opens them to the whole crew.
We never ask for an email address or a password - the app has no field for either. If you email us, we see the address you wrote from, and that's all.
Where it lives
All of the above is stored in a single PostgreSQL database hosted by Neon, the service that runs our database. Neon processes it on our behalf to provide that hosting; it is not shared with them for any other purpose, and nobody else gets a copy.
Cookies
The app sets four cookies, all its own. There are no advertising or tracking cookies, because there is no advertising or tracking.
- Your sign-in (
carpool_family) - remembers which family this device belongs to. It lasts up to 400 days and renews itself while you use the app, so an active family is never silently signed out. It is signed and unreadable by page scripts. - Your active crew (
carpool_active) - remembers which crew you last had open. Same lifetime. - A security token (
csrf_token) - exists only to stop other websites from making changes as you. Same lifetime. - "Acting as" (
carpool_act_as) - set only when a crew admin temporarily acts as another family to help them. It expires by itself after at most 4 hours and is cleared the moment the admin signs out or switches crews. The family being helped gets a notification when it starts.
Links that carry access
Carpool Crew has no passwords. Access is carried by long random links, and each kind is deliberately narrow:
- Your family's key - the personal join link that signs a device in as your family. Treat it like a house key. An admin can re-issue it if it leaks, and every re-issue is recorded in an audit log.
- Your calendar link - lets your calendar app subscribe to the schedule. It is read-only and carries crew names and driving days only - never kid names, never phone numbers, never addresses. It exists because the link ends up stored on your calendar provider's servers. You can turn it off at any time, and a fresh one is minted if you turn it back on.
- A kid link - a read-only page for one child's device, scoped to one family in one crew. It cannot change anything, cannot reach the roster or anyone's contact details, and you can revoke it on its own without touching anything else.
Kid Mode
The kid page answers one question - "who is picking me up?" - and stops. There is no kid account, no login, no tracking, and nothing is collected from the child, ever. The page shows only what the parent already put in the schedule. Notifications to a child's device are not a thing we do.
Notifications
If you turn on push notifications, your browser gives us a delivery address for this device and we store it. It can send you messages and nothing else - it reads nothing. Turn notifications off and we delete it.
Payments
Crew Plus payments are handled start to finish by Stripe. Your card number is entered on Stripe's checkout page and goes to Stripe, not to us - our servers never see it. What we store is a Stripe customer reference and whether your plan is active. Joining a crew, and running your first one, never involves a card at all.
One honest disclosure: fonts
The app's pages load their typefaces from Google Fonts. That is a real request from your device to Google's servers, which - like any web request - shows Google your device's network address. It is the only third-party request the app makes. No analytics script, no tracking pixel, no ad network, nothing else.
What we never do
- We never sell your data. Not to anyone, not in aggregate, not "anonymized".
- We never share it, except with the two services named above that make the product work: Neon, which hosts the database, and Stripe, which handles payments.
- We run no third-party analytics of any kind, and we show no ads.
- We never track your location. An address in the app is text you typed, nothing more.
Deleting your data
Leaving a crew archives your place in it, and deleting a crew archives the crew and its schedule - archived records drop out of the app but remain in the database. If you want your family's records fully and permanently erased, email us at eranrou@gmail.com and we will do it.
When this page changes
If our data practices change, this page changes with them, and the date at the top moves. We won't quietly widen what we collect and leave the promise standing.
Questions
Write to eranrou@gmail.com. A person reads it.