What happens to the records you keep
This page explains in plain words what happens to the records you keep about children. The legal version is our privacy policy. Where the two differ, the policy applies.
Who is who
You, the educator or service, collect information about the children in your care and their families. You decide what to record. BowerBook is the software you keep it in. We hold it on your behalf, use it only to run the app for you, and never sell it or use it to advertise.
Where it's kept
Your records and photos are stored in Sydney, Australia. Backups are encrypted and also kept in Sydney, Australia. Each service's records are kept separate, and every release is tested by opening every page as a different service and checking that nothing crosses.
Pages travel through Cloudflare's network, which protects the site from attacks and keeps it fast.
What the AI sees, and what it never sees
Some features use an AI model to draft writing for you: summaries, the day's story, suggestions for your plan, questions about your reflections. The model is provided by Anthropic, in the United States.
| The AI is sent | The AI is never sent |
|---|---|
| The name the child goes by | Surnames |
| Their age, in years and months | Date of birth |
| The notes and entries you've written about them | Family names, addresses, phone numbers or emails |
| What the family hopes for, what you're working towards, interests and emerging skills, if you've filled them in | Photos |
| Your state, so it follows the right rules | Consent records, or the notes on a child's record |
Nothing about a child goes to the AI until their family says yes, and you record it. "Not asked yet" counts as no. A child without a yes is left out completely: not in the day's story, not in summaries, not in suggestions. You can switch the AI off for your whole service at any time, and nothing is sent at all.
The app warns you before saving a note that looks like it contains a medical detail or a family matter, so you can leave it out. That check runs on our server and sends nothing.
The AI drafts and you decide. Nothing it writes is saved or sent until you approve it.
Photos
Photos stay behind your login. When a photo is saved, the camera's details are removed: where it was taken, the phone it came from, the exact time. Photos are never sent to the AI. A family sees a photo only through their own private link, and only photos of their own child.
Families
Nothing sends itself. A family receives something only when you press send. Each person gets their own link, which expires and can be switched off. A link shows only what was sent to that person. Families don't need an account or a password.
If a family asks to see, correct or remove what you hold about their child, you can find it all on the child's page, and export it.
Your data is yours
Export everything, any time. One download holds every record, photo and poster in your service, in an open format. It's offered to the service owner, who is asked for their password again.
Leaving. If you stop paying, your service becomes read-only. It is never deleted, and you can still export. If you close your service, we keep it for the period the law requires, then delete it.
Security
- Passwords are stored only as a one-way hash. Phones you choose to keep signed in get a key of their own, and signing out anywhere stops it.
- Sign-in stops after repeated wrong passwords.
- Each person has a role. An educator can document but can't manage the team.
- Everything travels over an encrypted connection.
The Australian Privacy Principles, briefly
| Principle | How it applies here |
|---|---|
| APP 1: open and transparent | This page, and the privacy policy |
| APP 3 and 5: collecting, and telling people | You collect from families, usually on your enrolment form. The app records which consents they gave and how |
| APP 6: use and disclosure | Used only to run the app for you. Shared with a family only when you send it |
| APP 8: overseas | The AI provider (the United States), only for children whose families said yes. Cloudflare carries the pages |
| APP 11: security | The security section above |
| APP 12 and 13: access and correction | Everything about a child is on their page, and can be exported and corrected |