Your information, explained

Privacy notice

Updated November 8, 2026

1. Information involved

Melissa Coston, operating as CareCircle Creations, offers a family and care organizer. This notice covers the Care in the Details sales website, organizer, and support communications.

• Sign-in information: Google Firebase Authentication sends your sign-in link and verifies your email address. The organizer stores the verified email, an account identifier, and session information. Existing organizer accounts can stay linked to their original records and memberships when they switch to email sign-in.
• Information you enter: family profiles, appointments, medication details and dose logs, contacts, routines and completion history, notes, and important information. Depending on what you enter, records may contain health information or details about other people.
• Shared care and access: if you create or join a care profile, we store its name, owner, member identifiers, invited email addresses, permissions, invitation expiry and acceptance, and shared entries. Invitation secrets are stored as hashes. We also record which account last updated each shared entry.
• Membership: the organizer checks account-specific subscription status, plan, and paid-through date to decide whether care information is accessible. Stripe processes checkout and subscription management. We store a customer identifier, subscription identifier, billing event identifiers, subscription status, plan, paid-through date, and payment-review holds. Card details are entered on Stripe-hosted pages; the organizer does not store full card numbers.
• Shopping lists: items, quantities, notes, purchase timestamps, and the account that checked off a purchase. Shared-list change events used for alerts are retained for up to one day.
• Documents and imports: files or photos you choose to upload, filenames, titles, notes, size, and file type. Uploading does not automatically extract or verify the contents. Shared-space uploads follow that space’s access permissions.
• Optional phone alerts: device push subscription addresses and encryption keys, reminder choices, timezones, alert times, and recent delivery records. Test receipt is recorded only when you confirm it. Refill alerts are based on saved dates, not calculated doses.
• Preferences: the organizer saves whether you completed or skipped initial setup.
• Support messages: if you email us, we receive your email address, message, and attachments you choose to send.
• Technical information: the hosting and sign-in providers may process IP addresses, browser and device information, request times, and service or security logs to deliver and protect the websites.

Stripe handles payment details when customer checkout is enabled; sandbox testing uses simulated payments. The Care in the Details application code does not include advertising pixels, third-party marketing analytics, location tracking, or automatic access to your phone contacts.

2. How information is used and who can access it

Information is used to sign you in, save and display your organizer, apply your setup preferences, provide downloads, respond to support requests, and operate and protect the service.

Personal records are scoped to the signed-in account. Shared care profiles are separate, optional spaces: all entries in a profile are visible to its invited members. An owner grants view-only or view-and-edit access and can remove a member or revoke an invitation. Each participant needs their own active membership. Creating a shared care profile does not copy personal entries into it. Private account access does not mean that data is accessible only to you: authorized service administration and infrastructure providers may access or process information as necessary to operate, maintain, secure, or support the service.

• OpenAI / ChatGPT Sites: website delivery and hosting controls.
• Google Firebase Authentication: sends sign-in emails and verifies access to the email address.
• Cloudflare: application hosting and database infrastructure used by Sites.
• Stripe: payment processing, recurring billing, cancellation management, and payment security. Care records, recipient names, and health notes are not sent to Stripe by the application.
• Browser push providers: Apple, Google, Mozilla, or Microsoft may process push subscriptions and encrypted messages to deliver optional phone alerts. Notification text is generic and keeps care and item details inside the organizer.
• Proton Mail: receipt and handling of support emails.

Shared-care invitations are bound to the email associated with the recipient’s organizer account and expire after seven days. Care in the Details does not automatically email an invitation; the profile owner copies and sends its link. The owner can see invited and joined caregivers’ email addresses. A forwarded link cannot grant access to a different email. View-and-edit members can add, change, and delete shared care entries; view-only members can read and download the information available to them. Removed access blocks new reads and changes but cannot recall previously viewed, downloaded, or printed information.

Care in the Details does not include a feature that sells organizer records or sends them to advertisers. We may disclose information when required by law or when reasonably necessary to address misuse, security incidents, or threats to safety. Third-party providers also have their own terms and privacy practices.

Useful provider information: OpenAI privacy policy, Cloudflare privacy policy, Firebase privacy and security information, Proton privacy policy, and Stripe privacy policy.

3. Sign-in, cookies, and links

The sales page has no Care in the Details newsletter form or advertising tracker. Membership checkout and billing management open on Stripe-hosted pages. Hosting and authentication services may use cookies or similar technical mechanisms for sign-in, sessions, and security. Blocking those mechanisms may prevent access to the private organizer.

Following an external link, opening an email link, or dialing a contact uses another service or application. That service handles the action under its own policies.

4. Your choices and requests

You can review and edit saved entries, delete individual entries, and download a readable JSON copy using Help & account. Backup import is not available. A downloaded backup is a separate copy on your device; deleting an entry from Care in the Details does not remove your downloads or paper copies.

For help with access, correction, deletion of all organizer records, or a privacy question, email Carecircle26@proton.me. We may need to verify your control of the relevant account before acting. Do not send passwords, identity documents, full medication lists, or detailed medical records in your initial email. Describe the request and use the email associated with your organizer when possible.

Privacy rights vary by location. Contact us to make a request; nothing in this notice limits rights provided by applicable law.

You can turn off alerts for an entry or shared list and disable notifications on a device under Help & my account. Permission is separate for each device. Delivery can be delayed or fail; alerts are not emergency monitoring. A device that becomes unreachable may have its push registration removed. Delivery records are cleared after 30 days, and failed unsent delivery claims after about one day, during scheduler checks.

5. Retention and deletion

The current organizer keeps entries until an authorized person deletes them or removal is requested. Deletion rights within shared care depend on the profile role. Leaving or being removed from a care profile does not delete other caregivers’ shared records. Contact support to request removal or discuss information you cannot delete directly. It does not automatically delete records when you stop visiting. Deleting an entry removes it from the active organizer database; provider backups, security records, and legally required records may have different retention periods.

We retain support correspondence while a request is open and for 12 months after it is resolved, then delete it, unless a longer period is required by law or needed for an ongoing dispute or security investigation. Organizer entries remain until you delete them or request removal; inactivity alone does not trigger deletion. Infrastructure backups and security logs are handled by the hosting providers under their applicable retention practices. Removal from the active organizer does not guarantee immediate erasure from provider backups or logs. Contact us with a deletion request if you need help understanding which records can be removed.

6. Health information and security

Enter only information you need and are authorized to manage. Avoid Social Security numbers, payment-card numbers, passwords, and unnecessary identifiers. If you organize information about another adult or a child, make sure you have the appropriate authority or permission.

The organizer uses authenticated access and server-side checks for personal ownership, shared-care permissions, and individual membership. It is hosted online; it is not an end-to-end encrypted personal vault. No online service can promise absolute security. Protect your sign-in account, shared devices, downloads, and printed pages. Care in the Details makes no claim of HIPAA certification or suitability as a clinical records system.

7. Adults and caregiving records

Care in the Details is intended for adults managing their own or authorized family and household information. It is not intended for children to create accounts or use independently. Contact us if a child has submitted information without appropriate authorization.

8. Changes to this notice

The date at the top will change when this notice is revised. Material changes affecting existing customers will be communicated before the changed practice begins where required. Payment and notification practices are included in this edition.

9. Contact

Business operator and privacy contact: Melissa Coston, operating as CareCircle Creations, Carecircle26@proton.me.