Security and privacy in practice

The app handles information about children. This page lists what has been done to protect it and what is planned. The privacy policy says what we store and why; this page says how it is secured.

In place

Login and access

  • Login is handled by Auth0 (EU). Passwords are never stored in the app. You can sign in with email and password, or with Google or Microsoft.
  • Everything about children – names, photos, attendance, parent contact – is behind login and shown only to members of the same group.
  • Access is controlled by roles per group: mentor, parent and tween. Group leaders can do more than mentors, and the main admins are a short, fixed list.
  • Opening a mentor page without being logged in sends you to the login and back afterwards. No content is shown before you are logged in.

Children and photos

  • Every uploaded photo is decoded and redrawn before it is stored. Hidden content and metadata such as GPS location and camera details are removed.
  • Information about children, photos of children, mentor photos and photos from gatherings are deleted automatically when the season ends. Parents can delete photos and the child themselves at any time.
  • Children's names are never sent to AI services. Birthday greetings are generated with a placeholder, and the app inserts the first name itself.
  • Messages to the Telegram groups never contain photos of children, and only one name: the first name in a birthday greeting when the parent has said yes.
  • Mentors cannot upload photos of children without confirming that the parents have consented.

Consents and the parent link

  • Consents (photo, photos from gatherings, Telegram, birthday greeting) are stored per child with who answered, when, and which version of the text they answered.
  • If a parent says no to photos, the child's photos are deleted immediately, including from the presentation.
  • The parent link is a random 128-bit code, applies to one child, expires after 30 days and cannot be indexed by search engines. The page does not pass its address on to other sites.
  • Consents given verbally can be registered by the group leader, but it is then clearly shown who registered it and how, and parents can override it with their own answer.

Logging and alerts

  • Changes to access and to information about children are logged: who did what, and when. Children appear in the log only as a number, never by name.
  • Unusual activity – such as many attempts to open groups you are not a member of – is flagged as an alert, shown to the main admin and sent to an admin chat in Telegram.
  • The log is deleted after one year. Quiz answers are deleted after one day, and Telegram poll answers at the latest one month after the gathering.

Expenses and finances

  • Bank account numbers are validated (MOD11 and IBAN) before they are stored, and shown only to you and the group leader.
  • Receipts and reimbursement forms can only be opened by the person who sent them and by the group leader, and are deleted automatically after 18 months (the group can choose 12–60).
  • Email to accounting is sent from the app's own address via Resend, with the mentor in copy, so everyone sees what was sent.

Technical safeguards

  • All traffic uses HTTPS. Pages send the security headers Content-Security-Policy, X-Frame-Options (no framing) and Referrer-Policy.
  • Automated jobs (deletion, sending) require a secret key known only to Vercel. Telegram messages to the app are verified with a secret token.
  • Secrets (API keys, database passwords) live only in Vercel's environment variables, never in the code or the logs.
  • Previews of new versions require logging in to Vercel. Only the finished domains are open.
  • The AI help (“Ask about the app”) is limited to 60 questions per user per day, and all images have size limits, so the service cannot be abused.

Where the data lives

  • The database is hosted by Neon in Frankfurt (EU). Photos are stored at Vercel. Login at Auth0 in the EU. Email is sent via Resend. AI services (Anthropic, OpenAI) never receive personal data about children.
  • The database is backed up continuously and can be restored to a point in time.

Going forward

Planned

  • Login with a BCC account (login.bcc.no), so nobody needs a separate password for the app, and access can follow membership.
  • Data processing agreements with all services collected in one place, and a record of processing activities (GDPR Article 30) that BCC can inspect.
  • “Delete everything about my child” and “Download everything about me” as buttons for parents, instead of having to ask the mentors.
  • When children can be in several groups (Tweens, hockey, Sunday school), consents and photos are kept per group, and a club never sees another club's data.

Under consideration

  • Two-factor login for group leaders and main admins.
  • An independent security review before more organisations are onboarded.
  • Access log: which mentors have opened photos of children, visible to the parents.

Privacy · Help

Last updated 29 October 2026