What we are launching with

Accounts and signing in.

One grown-up owns the account. You sign in with your email and a password. Your child never gets one. Here is exactly how that works and what we store.

What this part does

It proves you are you. Every other part of the app leans on that. If the app cannot tell who is asking, it will not show anyone's money, anyone's child, or anyone's agreement.

We use a service called Supabase to handle sign-in. Supabase is a company that runs our database and our login system for us. We do not run our own login system, and we do not store your password. Supabase stores a scrambled version of it that cannot be turned back into your password.

How signing in works, step by step

1
You type your email and a password.
A new password must be at least twelve characters, and we check it against a public list of passwords that have appeared in known data breaches. We never send your password anywhere to do that: we send the first five characters of a fingerprint of it, get back a few hundred candidates, and do the matching here. Both checks run on our server before anything else, so neither can be skipped from a changed web page. An account made before this rule keeps working; the next password you set meets it.
2
Supabase checks the password.
We never see the password you typed after this point, and we never store it. The technical name for this call is signInWithPassword.
3
We confirm your email the first time.
We email you a link. The link only works if it points at one of our own web addresses. We keep a short list of allowed addresses and refuse anything else, so a fake link cannot be smuggled into that email.
4
You get a session cookie.
A cookie is a small file your browser keeps so you do not have to sign in on every page. Ours cannot be read by any code running in the page, it is only sent over an encrypted connection in production, and it is not sent when another website links to us. Those three settings are called HttpOnly, Secure, and SameSite=Lax.
5
Every page you load checks the cookie again.
If you are signed out, the app sends you back to the sign-in page. If you have not finished setting up, it sends you to setup. If the children's privacy notice has changed since you agreed to it, it sends you back to read the new one.

A correction to something we used to say

An older version of our own write-up said we use magic links, which are emailed links you click instead of typing a password. We checked the code. That is not what we do.

We use an email and a password. We email links for two other jobs: confirming a new email address, and resetting a forgotten password. We fixed the write-up rather than leaving a claim a reviewer would catch.

Adding a second parent

One parent owns the account. We call that parent the primary parent. The primary parent can invite one more adult, usually the other parent.

The second adult can look but cannot move money. Only the primary parent can approve a payment, turn one down, or delete a child's record. We built it that way after we found that a second parent could once start a deletion, which is not a thing a shared account should allow.

So is it really one account per family?

It is one account that owns the family, plus an optional look-only second adult. We say that instead of saying "one account per family," because the second adult is real and a reviewer would find it.

Why your child has no login

A login for a child means a password a child has to protect, a way to reset that password, a screen where a child types, and a way for a grown-up to reach that child. Every one of those is a risk, and every one of those is a question a school district will ask.

We removed the whole set by removing the login. Your child is described in your account. Your child is not a user of the app.

This is the decision a district or a league is really evaluating, so it is worth being exact about what it buys. There is no child password to be reused from another site, no child password to reset, no child session to steal, no screen where a child types, and no route through which an adult reaches a child. Those are not five features we hardened. They are five questions that have no subject.

What data this part touches

What
Your email
Where it lives
Supabase
Notes
Used to sign in and to email you. Also used to confirm it is really you when you ask to delete your account.
What
Your password
Where it lives
Supabase, scrambled
Notes
We never see it and it cannot be unscrambled. Our own rule for a new password is at least twelve characters plus a check against known breached passwords, both on our server. Supabase's own floor underneath us is six, so the twelve is ours and not something we inherited.
What
Your name, birthday, city and state
Where it lives
Our database
Notes
You type these during setup.
What
Your role
Where it lives
Our database
Notes
One word saying what kind of account this is. Yours says parent. Nobody can give themselves the staff role, and a role is never read from the browser.
What
The link between you and your child
Where it lives
Our database
Notes
A row saying you are linked to this child, and whether you are the primary parent. Table name parent_athletes.
What
Your session cookie
Where it lives
Your browser
Notes
Deleted when you sign out.

Data used by accounts and sign-in
What	Where it lives	Notes
Your email	Supabase	Used to sign in and to email you. Also used to confirm it is really you when you ask to delete your account.
Your password	Supabase, scrambled	We never see it and it cannot be unscrambled. Our own rule for a new password is at least twelve characters plus a check against known breached passwords, both on our server. Supabase's own floor underneath us is six, so the twelve is ours and not something we inherited.
Your name, birthday, city and state	Our database	You type these during setup.
Your role	Our database	One word saying what kind of account this is. Yours says parent. Nobody can give themselves the staff role, and a role is never read from the browser.
The link between you and your child	Our database	A row saying you are linked to this child, and whether you are the primary parent. Table name parent_athletes.
Your session cookie	Your browser	Deleted when you sign out.

What a parent sees

A sign-in screen with an email box, a password box, and a Forgot password link.
A setup flow the first time, which asks for your birthday, your city and state, whether anyone is under 13, the family agreement, your child's name, and your bank.
A settings screen where you can change your password, get a copy of your data, turn off data sharing, and delete your account.

If something goes wrong

You forget your password

You click Forgot password. We email you a reset link. Only the person reading that inbox can use it. We do not have a way to read your old password and tell it to you, because we never had it.

Someone tries to sign in as you

They need your password. Guessing is slowed down by Supabase. Nothing in the app will show them your family's data without a valid session, because every single database request is checked against who is asking. That check is described on the security page.

Our email service breaks

Confirmation and reset emails go out through a company called Resend. If our email service cannot prove the request really came from the right place, it refuses the request instead of guessing. A refused request is answered with a clear error, so the sender stops retrying rather than piling up.

You want to leave

You delete your account from settings. You have to type your own email address exactly to confirm. We explain the rest on the your data page.

Staff accounts

A few GuardNIL staff have admin accounts. Those sign in on a separate screen, and the app checks the role right after the password. If the account is not an admin, the app signs them straight back out instead of letting them in with a normal view.

An admin can look at the app as a family sees it, to help with a support question. Every time that happens, the app writes a permanent record of who did it and who they looked at. Those records cannot be edited or erased by anyone, including us.