Your data, protected. Your payments, secured.

Yes. MyKidReports is built on Amazon Web Services (AWS) — the same infrastructure used by banks and hospitals. All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Payments are processed by Stripe and Deluxe, both PCI-DSS compliant. Access is role-based: directors set what teachers, admins, and parents can see. Passwords are hashed before reaching the database. We do not sell your data, share it with advertisers, or run ads inside the product or parent app.

Yes. MyKidReports is aligned with COPPA (Children’s Online Privacy Protection Act). We do not knowingly collect personal information directly from children under 13. All child data in MyKidReports is collected and managed by parents, guardians, and the daycare or preschool — the school acts as the verifiable consent point under COPPA. Data is used only to operate the service the school has signed up for; we do not sell or share child data with advertisers. Schools and parents can request data export or deletion at any time.

FERPA applies primarily to schools that receive federal funding from the U.S. Department of Education and is most relevant to K–12 and higher education; most private daycares and preschools fall under state-level privacy regulations rather than FERPA. MyKidReports’ data handling — encryption, access controls, no third-party data sale, school-controlled access — is built to support the privacy expectations of any state’s licensing requirements. HIPAA does not apply to typical daycare records, but wellness check data is encrypted and access-controlled the same way as all other data.

Yes. All messages between parents, teachers, and admins flow through encrypted channels (TLS 1.2+) and are stored encrypted at rest. Messaging is scoped — parents only see messages about their own children, teachers see their classroom, admins see what your director has authorized. There’s no public message wall and no cross-family visibility. We never use message content for advertising.

On Amazon Web Services (AWS) — the same enterprise cloud infrastructure used by banks, hospitals, and a large share of the modern internet. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

Payments go through Stripe (cards) and Deluxe (ACH/bank) — both PCI-DSS compliant payment partners. Card and bank details are tokenized at the moment they're entered and bypass MyKidReports entirely. We never see, store, or have access to full card numbers.

Each account uses role-based permissions. Directors and admins set what each role can see and do. Teachers see their classroom. Parents see only their own children. You can scope access as tightly as you need.

No. We don't sell your data, share it with advertisers, or run ads inside the product or the parent app. Your data is used to run your account — that's it.

Your data stays safe on our servers as long as your account is active. If you decide to cancel, our team will work with you to make sure you have what you need before your account is deactivated. No drama, no hostage-holding.

Reach our team through the in-product chat widget or the contact form on our Contact Us page. Reports are routed to engineering and acknowledged in writing.

Yes. Passwords are hashed before they ever reach our database — even our own engineers can't read them. If you forget a password, we send you a reset link rather than mailing the original (because we don't have it).

Logged-in sessions are tied to the device. A director can revoke access for any user from the admin panel. The parent re-authenticates on a new device — no one else gets in just because the old phone is found.