You're trusting us with a key to your child's school assignments. We treat that key as the most sensitive thing we hold. We designed the whole system so that even we can't casually get at it.
01No passwords to steal
There's no password to sign into ByBedtime. You use a short-lived emailed sign-in link. And we never ask for your school password. The only credential we hold is a read-only access key you generate in your own parent account. You can revoke it any time, independent of us. Fewer secrets means fewer things that can leak.
02Your access key, wrapped in layers
Your key is encrypted with AES-256-GCM using a unique data key per connection, itself held in a separate key-management system. It can be decrypted only by the process that runs your checks, every decryption is recorded, and the encryption is bound to your specific account. A stolen database row is useless anywhere else. Your key never appears in logs, error reports, or analytics, and that's enforced by automated checks that run on every code change, not by a promise on a page.
03One family can never see another
Every piece of data carries its family's identity. The application scopes to it, and the database enforces it a second time underneath. Isolation between families is tested automatically on every change we ship. Belt and suspenders, on purpose.
04Restricted connections
Everything travels over modern TLS with HSTS. Polling accepts only validated HTTPS Canvas hosts, and automated privacy and secret checks inspect every release. We do not retain raw school-platform responses.
05Careful with data at rest
The database is encrypted. Backups are encrypted, restore-checked daily, and retained no longer than 35 days. Raw school-platform responses and ad hoc diagnostic captures are not stored.
ByBedtime runs on dedicated hardware we control, located in the United States. Your family's data stays inside that boundary. We don't sell it, share it, or send it to any advertising or AI service.
06Run with discipline
Least-privilege service accounts, tightly restricted operator access, dependency and secret scanning on every release, restore checks on every encrypted backup cycle, and an incident-response plan with a 72-hour notification target if your data is ever affected.
What we keep, and for how long
- Normalized assignment state: while your account is active.
- Change history: 180 days.
- Sanitized notification logs: 90 days. No alert text. Ever.
- Raw responses from your school's system: not stored at all.
- A deleted account: removed from active systems immediately; encrypted backups expire automatically within 35 days.
Found something?
Responsible disclosure is welcome. Email security@bybedtime.com. We aim to acknowledge within 48 hours, and we won't pursue legal action for good-faith security research.