Privacy Policy
Effective August 18, 2026
The short version
Child Evidence is a research library, not a data business. We collect the minimum needed to run a saved-work feature for signed-in users. We do not sell data, we do not run third-party analytics or advertising trackers, and we never use your searches or saved work to train any AI model. The platform is designed so that it never needs privileged case facts to be useful.
What we collect
- Account data. If you sign in: your email address and authentication credentials, managed by Supabase Auth. Sessions are kept in HTTP-only cookies. We set no advertising or analytics cookies.
- Saved work. If you use the workspace: your matters, saved citations, tags, notes, and recently-viewed claims. Each row is scoped to your account by database-level row security — it is visible only to you, including from our own application code paths.
- Searches. Search queries are processed to return results (see OpenAI below). Signed-out searches are not linked to any account.
- Server logs. Ordinary web-server logs (IP address, user agent, pages requested) generated by our hosting provider.
What we never do
- Sell or rent your data, to anyone, for any purpose.
- Use your searches, matters, notes, or any other input to train AI models — ours or anyone else’s. The only AI providers that touch user input at all do so under commercial API terms that prohibit training on that input.
- Run third-party analytics, advertising pixels, or cross-site tracking.
- Send your saved work to any AI model. Model use in this product is confined to search-query embeddings and to offline editorial processing of published scientific papers.
Sub-processors
We use a small number of infrastructure providers. Each receives only what its function requires:
| Provider | Role | What it receives |
|---|---|---|
| Supabase | Database, authentication, and session management | Your email address, authentication credentials, and your saved work (matters, saved citations, tags, notes). Data is encrypted in transit (TLS) and at rest. |
| Vercel | Application hosting and content delivery | Standard request logs (IP address, user agent, requested pages) generated by serving the site. |
| OpenAI | Search relevance (text embeddings) | The text of a search query, sent to the OpenAI API to compute a numerical embedding used for ranking. Under OpenAI's API terms, API inputs are not used to train OpenAI's models. Your saved work is never sent. |
| Google Cloud (Vertex AI, Document AI) | Offline research-corpus processing | Published scientific papers during editorial ingestion. This pipeline runs offline on the research corpus only — it never receives user accounts, searches, or saved work. |
| Resend | Email delivery for the share feature | The recipient address and optional message you provide when you share a claim by email, and your account email as the sender identity. |
Confidentiality and your professional obligations
Child Evidence is built so that using it well does not require disclosing client confidences: the claims are about the science, not your client. Do not enter client-identifying information, privileged case facts, or protected health information into searches, matter names, tags, or notes. Child Evidence is not a HIPAA covered entity or business associate and does not offer a Business Associate Agreement. See the Terms of Use for the full clause.
Retention and deletion
- Saved work is kept until you delete it. You can remove any saved citation, note, or matter at any time from the workspace.
- Your account and all data associated with it can be deleted from your Account page. Deletion is immediate and permanent in the production database.
- Export. You can export your saved work from your Account page at any time.
- Server logsare retained per our hosting provider’s standard rotation and are not used for profiling.
Security
Data is encrypted in transit (TLS) and at rest. Application access to user data is governed by database row-level security scoped to your account. Administrative credentials are never present in the browser or in client-delivered code.
Changes and contact
If this policy changes materially, the effective date above will change and the update will be noted in the public ledger. Questions or requests: privacy@childevidence.com.