Privacy policy

Mitlea stores what it needs to introduce a family to a caregiver, run a booking and pay for it. The most sensitive thing in the system is what a parent tells us about a child, and it is the most tightly held: it is never public, never in a web address, and reaches a caregiver only through a booking she has accepted.

Mitlea does not sell personal information, does not run advertising, and does not use anyone's data to train anything. There is no AI in this product.

• Your name, email address and, if you give it, a phone number.
• Your password, stored only as a scrypt hash. We cannot read your password.
• Your city, state and postal code, where you give them, so that search can work.
• Your role — family, caregiver or administrator — and whether your account is active, suspended or closed.
• Sign-in records: the time you last signed in, failed sign-in attempts, and whether the account is temporarily locked after too many.
• For each signed-in session: a hash of the session token, the expiry, and the IP address and browser user-agent the session was created from.

The session cookie is named mitlea_session. It holds a random token, it is HTTP-only, it lasts 30 days, and the database holds only its hash — so the cookie cannot be reconstructed from our data.

A published caregiver profile is public. Anyone on the internet can read it, and that is the point of it.

• Display name, headline, biography and photograph, with the photograph's alt text.
• City, state and how far she is willing to travel. Her street address is never on her profile.
• The experience numbers she typed herself: children raised, grandchildren, years babysitting, years working professionally, and anything else she wrote.
• The services she offers, the age groups she takes, and the languages she speaks.
• Her hourly rate, her minimum booking length and the days and hours she has marked as available.
• Her rating, her review count and how many bookings she has completed, all recomputed from real rows.
• Her verification badges, and the date each was verified.

Her postal code may be stored for search, and is not displayed. Her email address, phone number and street address are never shown on her profile.

This is the part of the policy that matters most. To book care, a parent creates a record for each child. That record can contain:

• The child's first name and birth year, and birth month where a parent gives it.
• Allergies.
• Dietary notes.
• Care instructions — routines, bedtimes, what helps, what to avoid.
• The child's interests.
• An emergency contact: a name, a phone number and their relationship to the child.

How that information is handled:

• It belongs to the parent's account, and only that account can read or change it.
• It is never public. It never appears in a search result, a listing, a caregiver's browsing view or a web address.
• When a family sends a request, the caregiver is shown each attached child's first name and age. She cannot judge whether she is the right person for the booking without them.
• Everything else — allergies, dietary notes, care instructions and emergency contacts — is shown to her only once she has accepted that booking. No accepted booking, no access to any of it.
• A parent can edit or delete a child's record at any time.

Children do not have accounts and cannot sign in. The information is provided by a parent or guardian, about their own child, for the purpose of that child being looked after. Whether any additional obligation applies to us under children's privacy law — including COPPA, whose actual scope we are not going to guess at — is one of the items on our pre-launch legal checklist.

• The date, start and end time, and the kind of care requested. Every booking is currently recorded in Eastern time, because Mitlea operates in one town; that changes before we open anywhere on a different clock.
• The address the session takes place at, and any instructions the family wrote.
• Which children were attached to it.
• A snapshot of the price — the rate, the hours, the subtotal, the service fee, the total and the caregiver's share — frozen when the request was made.
• Its status and the history of it: when it was answered, declined, cancelled or completed, and any reason given.

The address and the instructions are visible to the caregiver on that booking. They are not public.

Messages between a family and a caregiver are stored, and both of you can read the thread. Before a booking is confirmed, our system detects phone numbers, email addresses, social handles and payment handles and hides them from the recipient; we store the fact that a message was redacted.

A review is stored with its rating, its text, who wrote it, which booking it came from and any reply the caregiver wrote. Published reviews are public.

A safety report is stored with its category, what you wrote, who it is about, how serious it is and how it was resolved. Reports are read by Mitlea administrators. We do not show the person you reported the text of your report.

Mitlea keeps an append-only audit log of actions with money or safety consequences: who did it, what they did, which record it was about, the IP address, and the time.

For each credential a caregiver asks to have verified, we store: which credential it is, its status, which administrator attested to it, when they did, when the underlying document was issued and when it expires, and a note.

We do not collect, upload or retain identity documents or background-check reports. A caregiver shows the document to a person, live, and that person records what they saw. There is no library of licences, passports or criminal-record reports on Mitlea's servers, because the safest way to hold a database of other people's identity papers is not to have one.

Caregiver profile photographs are stored in Vercel Blob storage in production, or on the application server's own disk when Mitlea is run without blob storage configured. They are public by design — a profile photograph is the point of the page.

We do not store photographs of children, and none should be uploaded. A profile photograph should show the caregiver.

• Stripe processes payments and pays caregivers. Card numbers go to Stripe directly and never reach Mitlea; we store only Stripe's references, the amounts and the status. A caregiver being paid provides Stripe with her own identity and bank details, under Stripe's terms and privacy policy.
• Our hosting and database providers store the data on our behalf.
• Mitlea administrators, where a job requires it — verifying a credential, working a safety report, investigating a payment.
• Law enforcement or a court, where we are legally required to disclose something, and in an emergency involving a risk to someone's life.

We do not sell personal information and we do not share it with advertisers. Mitlea runs no advertising or analytics trackers.

• Passwords are hashed with scrypt at the OWASP baseline. They are never stored or logged in a readable form.
• Session tokens are stored as hashes; a stolen database row cannot be replayed as a login.
• The site sends a strict Content-Security-Policy, so an injected script cannot load code from, or send data to, a host we have not listed.
• Card details never touch a Mitlea server.

No system is perfect. If you find a security problem, write to us before you write about it anywhere else.

You can edit your account details, your profile and your children's records at any time, and you can close your account.

Records that a booking depends on — the booking itself, its payment and its audit trail — are kept after an account is closed, because a financial record that can be deleted by one of its parties is not a record. Personal records are marked deleted and stop being used by the application.

How long each kind of record must be kept, and what a deletion request must actually remove, depends on state law and on federal rules about financial records. Both are on our pre-launch legal checklist. We are not going to publish a retention schedule we have not confirmed.

Ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to us and a person will handle it.

Which statutory privacy rights apply to you depends on where you live. A growing number of US states — Virginia, California, Colorado, Connecticut, Texas and others — give residents rights to see, correct, delete or port their personal information, and the details differ between them. Exactly which apply to Mitlea and how we must respond is being confirmed with counsel before launch. In the meantime, write to us and we will do what you ask unless a financial or safety record legally has to be kept.

Privacy questions: hello@mitlea.com.