Privacy Policy

CareLookup is a free, public-records-based lookup site that aggregates childcare facility licensing and inspection data from state government agencies. No account is required to search or view facility records. This policy explains the limited data we do collect, how we use it, and your rights.

Plain-English summary: We don't require accounts, don't sell data, and don't track you across the web. The data we do collect is described below.

What we collect

Anonymous browsing analytics

We use Google Analytics (via Google Tag Manager) to understand aggregate usage of the site — which pages get traffic, what search terms parents use, which states have the most demand. This data is anonymized at the Google Analytics level (truncated IPs, no cross-site identifiers). It helps us decide where to invest connector work next. You can opt out using a browser-level signal like Global Privacy Control (GPC) or the Google Analytics opt-out browser add-on.

Account info (only if you sign in to comment)

You can read every page on the site without an account. If you choose to post a comment on a facility's discussion section, you'll be asked to sign in via Supabase Auth (which supports passwordless email and OAuth providers). When you sign in, we receive:

• your email address
• a display name you choose (or one derived from your auth provider, e.g., your first name)
• a Supabase-assigned user ID

We use this only to attribute comments to you, send you authentication emails (magic links / sign-in codes), and let you edit or delete your own comments. We do not send marketing email to authenticated users.

Public comments you post

Comments posted on facility discussion sections are stored with the comment body (up to 500 characters), your display name, an upvote count, and the date posted. Comments are publicly visible on the facility's page. Anyone can flag a comment for review. You can delete your own comments at any time from the comment's menu. If you delete your account, your comments are removed automatically.

Notification signup email (optional)

On state pages that aren't yet covered, you can opt in to be notified when we add that state. We store the email address you provide and the state code, and we use them only to send a one-time announcement when that state ships. You can unsubscribe by emailing us; we delete the row on request.

Server logs

Our hosting provider (Google Cloud Run) records standard request logs — IP address, user agent, request path, response code, timestamp — for security and debugging. These logs are retained for up to 30 days and are not joined to any of the other data described above.

What we don't collect

• We don't require an account to use the site.
• We don't collect any data from or about children. The site is intended for parents and caregivers (adults).
• We don't collect payment information — the site is free and has no transactions.
• We don't use third-party advertising networks, retargeting pixels, or cross-site tracking.
• We don't sell, rent, or trade personal data.

Third-party services we use

• Google Cloud Run — hosting. Standard HTTP request logs as described above.
• Supabase — database, authentication, and row-level security. Stores facility data (public records) plus the account and comment data described above.
• Google Analytics / Google Tag Manager — anonymous usage analytics.
• Google Fonts — typography. Served via Next.js's self-hosting integration so font requests don't leak your IP to Google.

Each of these services has its own privacy policy. We share with them only what's necessary to operate the site (e.g., we share your comment text and display name with Supabase because that's where comments are stored).

Cookies

We use a small set of cookies:

• Authentication cookies — only set if you sign in to comment. They keep you signed in.
• Analytics cookies — set by Google Analytics. These can be blocked at the browser level or via the opt-out tools mentioned above.

We do not use advertising or tracking cookies.

Facility data is public record

Every facility listing on CareLookup — name, address, license status, inspection history, violations, etc. — is sourced from state government licensing agencies and federal programs (HHS Office of Head Start). We don't add to or modify the underlying public records; we aggregate them so parents can find them in one place. See our Data Sources page for the authoritative source of each state's data.

If you operate a facility and believe a listing is inaccurate, the correction needs to come from the source agency — please contact your state licensing authority. Once they update their records, the next monthly refresh propagates the change to CareLookup.

Your rights

You can:

• Request a copy of your data — email us and we'll send everything we have associated with your account or email.
• Delete your comments — use the menu on any comment you've posted.
• Delete your account entirely — email us and we will remove your account and all associated comments and notification signups.
• Unsubscribe from notification signups — email us with the address you used.

These rights are available to all users regardless of where you live. We don't treat California or EU residents differently because the underlying practice is the same for everyone.

Children's privacy (COPPA)

CareLookup is directed exclusively to adults — parents, guardians, family members, and other caregivers researching childcare on behalf of a child. The service is not directed to children under the age of 13, and we do not knowingly collect, use, store, or disclose personal information from anyone we know to be a child under 13, in accordance with the Children's Online Privacy Protection Act (COPPA) and its implementing regulations at 16 CFR Part 312.

What this means in practice:

• We do not market the site to children, and our content, language, and visual design are oriented to adult decision-makers.
• Account creation (only required to post a comment) is gated to users 13 and older. If you are under 13, please do not create an account or submit any information to us.
• The facility data on this site is about facilities — names, addresses, license status, inspection findings — not about any individual child. We do not ingest, store, or display child-level data of any kind.
• We do not use behavioral advertising, do not allow third-party advertising networks on the site, and do not place targeting cookies.

If you believe we have collected information from a child under 13: please email us at privacy@carelookup.net and we will promptly delete it. Parents and guardians may also review, request deletion of, or refuse further use of any information collected from a child by contacting us at the same address.

We are not currently certified by an FTC-approved COPPA Safe Harbor program. The standards described above reflect our own practices and are not a representation of third-party certification.

Changes to this policy

If we materially change how we handle data, we'll update this page and bump the “last updated” date at the top. For substantive changes that affect already-collected data, we'll also notify anyone with a signed-in account by email.

Contact

Questions about this policy, requests to delete your data, or anything else privacy-related: privacy@carelookup.net.