Privacy policy

The short version

• Provider pages never show a street address or a provider's personal phone number.
• Provider pages use no cookies, no ads and no tracking by other companies.
• We do not sell personal information. We do not share it for advertising.
• A person at teddypage checks every photo before parents see it. We remove location data from every photo.
• We do not knowingly collect information from children.

Who this policy covers

teddypage makes free one-page websites for licensed home daycares (family child care homes) in California. This policy covers teddypage.com, every page at a name.teddypage.com link, and the shared teddypage phone number.

In this policy, “we” means teddypage. A “provider” is a person who runs a daycare and has a teddypage account. A “parent” is anyone who contacts a daycare through teddypage. A “visitor” is anyone who opens one of our pages.

Information from the state's public records

We start with the public list of licensed home daycares that the State of California publishes on the California Health and Human Services (CHHS) Open Data Portal. From that list we keep the license number, the daycare name, the licensee's name, the license status and dates, the phone number on the license record, and the city, ZIP code and county. The state list does not show street addresses for home daycares. We never store one.

We use this information to:

• make a private draft page for licensed homes in the areas where we work
• check that the person who claims a page is the licensee, by sending a code to the phone number on the license record
• show the Licensed badge, and check the state list every week to see if the license is still active
• contact licensed homes about their draft page, by phone, through a local child care agency, or through a community group. Before we call, we check the Do Not Call list.

A draft page is private. Only the licensee can see it, after signing in. Search engines cannot see it. If nobody claims a draft, we delete it 180 days after we make it. If you are a licensee and do not want a draft page, email hello@teddypage.com and we will delete it.

Information from providers

• Your account: your phone number or email, your language, and whether you want reminder texts.
• Checking your claim: if we cannot send a code to the phone on your license record, you can send a photo of your license and a photo of your ID. A person at teddypage looks at them to confirm who you are. We keep them in private storage. They never appear on your page.
• Your page: your daycare name, your intro, hours, ages, group size, languages, neighborhood, open spots, colors, logo, photos and captions.
• Where parent messages go: the phone number and email where we send calls, texts and messages from parents. Parents never see them.
• Signing in: see “Codes and passkeys” below. We also keep a record of each sign-in: the time, how you signed in, your browser type and a random device ID. We use it to warn you when a new device signs in.
• Help messages: texts and emails you send us, with an English translation so our team can read them.
• Changes to your page: we record which part changed and who changed it. If our team changes your page for you, we record what it said before and after, and we send you a text.

Codes and passkeys

You sign in with a 6-digit code that we send by text, by email, or in a short phone call. We store only a scrambled copy (a hash) of each code, never the code itself. A code works for 10 minutes. We delete old codes one day after they expire.

You can also sign in with a passkey. A passkey lets you unlock your account with your face or fingerprint, the same way you unlock your phone. Your face and fingerprint never leave your phone. We store only the passkey's public key, which cannot be used to sign in by itself.

Information from parents

• Contact form: your name, how to reply (phone or email), your child's age if you give it, and your message. We send it right away to the daycare's phone or email. We do not keep your message or your contact details in our database. We keep only a record that a message went to that page, and how you found the page (for example, Google or a QR code).
• Calls to the shared number: we connect your call to the daycare. We do not record calls. The daycare sees the teddypage number, not your number. We count that a call was connected.
• Texts to the shared number: you start your text with the daycare's 4-digit code. We send your message and your phone number to the daycare's phone. When the daycare replies within 7 days, the reply comes to you from the teddypage number. To make replies work, we keep your phone number linked to that daycare's page and in our log of texts we sent. We do not store the words of your texts in our database.
• Reports: if you report a page, we keep the page, the reason, your details, and your phone or email if you give them.

Our texting company (Twilio) and email company (Resend) handle messages to deliver them. The daycare decides what to do with your message. teddypage does not control how a daycare uses the information you send it.

Information from visitors

Provider pages set no cookies and load no ads or scripts from other companies. When a page opens, it sends us a small note: which page, and how the visitor came (Google, a shared link, a QR code, or directly). Taps on Call or Text are counted the same way. We do not store your IP address or any ID with these counts. We use them to show providers how many families found them.

Like every website, the servers that deliver our pages receive your IP address and browser information, and our hosting companies may keep them in short-term logs. We use your IP address for a short time, in memory, to stop abuse, such as too many messages from one place. We do not store it in our database. Photos on provider pages come from our photo storage service, which also receives your IP address. Our fonts come from teddypage itself, not from another company.

If something breaks, we record the page address and the error message. We never record what you typed.

Cookies

We use cookies only to sign people in. Parents and visitors who do not sign in get no cookies from teddypage. We do not use cookies for ads or analytics.

• tp_s: keeps a provider signed in. Lasts 90 days.
• tp_d: a random device ID, so we can warn you when a new device signs in to your account. Lasts 5 years.
• tp_vc: remembers the phone or email you just confirmed with a code. Lasts 1 hour.
• tp_claim: remembers which license you are claiming. Lasts 1 hour.
• tp_wa: used while you sign in with a passkey. Lasts 5 minutes.
• tp_admin and tp_enroll: for teddypage staff only.

tp_s and tp_d work on teddypage.com and on every name.teddypage.com page, so you stay signed in on your own page.

Photos

• We make a new copy of every photo you upload. The new copy has no location (GPS) data, camera details or other hidden data.
• New photos are private. A person at teddypage checks every photo before parents can see it. We do not approve a photo that shows a child's face without blur, a house number, a street sign or the outside of the home.
• You can blur a face by tapping it. The blur is permanent. We do not keep an unblurred copy. We do not use face recognition or automatic face detection.
• You may upload a photo that shows a child only if you have written permission from that child's parents.
• If a photo may show child sexual abuse, we do not delete it. We move it to locked storage that is never shown, disable the account that uploaded it, hide the page, and report it to the National Center for Missing & Exploited Children (NCMEC), as US law requires. We may share it with law enforcement.

How we write the English

When you write your intro, we send that text to Anthropic, an AI company, to write it in English and to translate it back into your language so you can check the meaning. It also looks for things that should not be on a page, like a street address or a child's name. The English goes live only after you approve it.

We also use Anthropic to translate help messages you send us into English, and to write our replies in your language. We do not send your photos, your license photos or your ID to Anthropic.

Who we share information with

We do not sell personal information. We do not share it for cross-context behavioral advertising. We use these companies to run teddypage. They may use the information only to provide their service to us:

• Railway: hosts our website, database and background jobs.
• Twilio: sends and receives texts and calls.
• Resend: sends email.
• A cloud storage service that works like Amazon S3: stores photos and delivers approved photos to visitors.
• Anthropic: writes and checks the English, and translates help messages.

We also share information when the law requires it, to protect a child or another person from harm, or to report possible abuse to NCMEC, law enforcement or Community Care Licensing (the state agency that licenses daycares). If teddypage is sold or joins another company, this information may move to the new owner, and this policy still applies to it.

Anything on a live page is public, including the daycare name, neighborhood, hours, photos and license number.

How long we keep information

• Unclaimed draft pages: deleted 180 days after we make them.
• Sign-in codes: deleted one day after they expire.
• Sign-in records: deleted when they expire, after 90 days at most.
• Your page, photos and account: kept while you have an account. Closing your page hides it but does not delete it. Ask us, and we will delete it.
• If you move to your own website, your teddypage link sends visitors there for one year.
• Parent phone numbers for text replies: kept with the daycare's page until the page is deleted.
• Claim records (including license and ID photos), reports, help messages, our log of texts and emails we sent, visit counts, and our staff action log: we do not delete these on a schedule yet. We are setting time limits and will update this policy.
• Material we report to NCMEC: kept as the law requires.

Your choices

• See and change your page at any time, on your phone.
• Download your page text, settings and photos as one file. In your page's menu, choose “Download my content and photos”.
• Stop reminder texts by replying STOP. Reply START to get them again. You still get sign-in codes and important messages about your account.
• Close your page at any time.
• Ask us to delete your account, page and photos. Email hello@teddypage.com from the email on your account, or tell us the phone number on your account. We confirm it is you, and then a person deletes your data within 45 days.

When we delete your data, we keep a few records: the public state record for your license, the record of how your claim was checked, our log of texts and emails we sent, our staff action log, and anything the law requires us to keep.

Your California privacy rights

If you live in California, you have the right to:

• know what personal information we collect, use and share about you, and get a copy of it
• ask us to delete it
• ask us to correct it
• opt out of the sale or sharing of your personal information. We do not sell or share it.
• limit how we use sensitive personal information. We use your ID photo only to check who you are, and your sign-in details only to keep your account safe.
• be treated the same when you use these rights

The information we collect is listed above: identifiers (like name, phone number, email and device ID), records from the state license list, ID photos for claims, photos, and activity on our pages (visits and taps, without IP addresses). We get it from you, from the state's public records, and from parents who contact a daycare.

To use these rights, email hello@teddypage.com. We confirm who you are with a code sent to the phone or email on your account. Someone you choose can ask for you if they show us your written permission. We answer within 45 days. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out. Because we do not sell or share personal information, nothing else changes.

Children

teddypage is for adults: people who run daycares, and parents looking for care. We do not knowingly collect personal information from children under 13, and children should not use our forms. The contact form asks for a child's age, not a name. When we check your intro, we look for children's names so they do not appear on your page. Photos may show children only with written permission from their parents, and every child's face must be blurred before a photo goes live.

If you think we have information from a child, email hello@teddypage.com and we will delete it.

How we protect information

We store only scrambled copies of sign-in codes and sign-in tokens. Our staff sign in only with a passkey or a hardware security key. Photos waiting for review, license photos and ID photos stay in private storage that is never public. Every staff action goes into a log that cannot be changed. No system is perfect. If a breach affects your personal information, we will tell you as California law requires.

Changes to this policy

When we change this policy, we update the date at the top of this page. If a change is important, we tell providers by email or text before it takes effect.

Contact us

Questions or requests: hello@teddypage.com. teddypage, San Diego, California.

Languages

This policy is in English, Spanish and Japanese. If the versions say different things, the English version applies.