Privacy

Last updated 17 October 2026

E Squared is a private family application. Your family's data belongs to your family. We never sell it. We never share it with anyone for advertising or for their own purposes. We don't build profiles on you or your children.

This page explains what we collect, why, who touches it, and the rights you have. It is written to be read, not to cover us.

Who we are

E Squared is the data controller for the information described here. It is run by Sonia Grant in Ireland. You decide what to record about your family; we decide how the service handles it. For any question or request about your data, email sonia@esquared.app.

What we collect

Only what the app needs to work for your family:

• Account details: an email address for sign-in (or a Google account if you sign in with Google), display names, and the avatars and colours you choose.
• What you put in the app: learning logs, the profile notes and private notes you keep on each Being, wishlists, modules, calendar events, and the reports you generate.
• Photos you upload to log entries. We strip location and device metadata from every image before it is stored.
• Billing details are held by Stripe, not by us. We keep a reference to your Stripe customer and your plan.
• Basic technical data needed to run the service and keep it secure, such as sign-in sessions, device records for Being sign-in, and rate-limit records.
• If you join the waiting list or reserve a place: your email, the details you give on the form, and which page or campaign you came from.

We ask for a Being's date of birth only if you choose to add it. You decide how much detail to keep in a Being's profile.

Health and neurodevelopmental information

Profile notes and private notes can describe a Being's neurodivergence, regulation needs or eating difficulties. That is health information, which the law treats as special category data. We only process it if you choose to write it, and only on the basis of your explicit consent, given as the parent or guardian. Private notes are visible only to the Human who wrote them, not to other caregivers or the Being, and they appear in a report only if you tick them for that report. You can edit or delete any note at any time, and you can withdraw your consent by emailing sonia@esquared.app or by deleting the family. Nothing in the app requires you to enter it.

Why we can hold it

We process your account and billing data to provide the service you asked for, under our agreement with you. We process health information in profile notes and private notes on your explicit consent. We process waiting-list and marketing email on your consent, and you can unsubscribe from any email we send. Where you give us a Being's information, you do so as their parent or guardian.

Children's data

Most of what E Squared holds is about children. We treat it that way. A Being never signs up, never has an email address and never agrees to anything; every Being is created and controlled by a Human. Content about a Being is private to your family and visible only inside it. We do not profile Beings, we do not advertise to them, and we do not sell any of it.

How we protect it

Sensitive free-text fields are encrypted at rest with AES-256-GCM before they reach the database. That covers the profile notes you keep on each Being, the family's "what to expect" note, learning logs and their Educational value notes, private notes, fear notes, lists and drives, saved logins for a Being's links, wishlist and shopping items, and the optional disclosure on a reservation. Names, email addresses, calendar events and report settings are not encrypted at the field level; they are protected by access controls, encryption in transit and the encrypted storage of our database provider. Uploaded images have their metadata stripped and are served through short-lived private links, not public URLs.

Analytics and cookies

We use only the cookies and browser storage needed to keep you signed in and the app working. We do not use advertising or tracking cookies. The full list is on the cookie policy.

On our public pages we use Vercel Analytics, which sets no cookies and does not profile visitors. It does process page-view data such as the page visited, referrer, browser and country, and the request IP address is used transiently to produce those. It never loads inside the app, on the Human dashboard or on any page a Being uses. Three things are also counted as plain totals: a new family finishing setup, a family's first moment, and a report being made. These counts carry no names, ids, email addresses, page addresses or anything from your record.

Who else touches your data

We run E Squared with a small number of service providers. They process data on our instructions, under data processing terms, and not for their own purposes, except where we say otherwise:

• Vercel, for hosting and running the app.
• Neon, for the database. It is hosted in London (AWS eu-west-2).
• Cloudflare R2, for storing uploaded images and files.
• Loops, to send sign-in links and the emails you ask for, and to hold the waiting-list and marketing contacts you opt into.
• Stripe, to process your subscription and payments. For fraud prevention and its legal duties on payments, Stripe also acts on its own account under its own privacy policy.
• Anthropic, the company behind Claude, only if you turn on Educational value (see below).

Educational value is off unless you turn it on in your family settings. When it is on, the words of a moment are sent to Anthropic only when you press See educational value, so Claude can suggest a note and tags. Only the text of that moment is sent. No photos and no profile details are attached, though the text may include a name if you wrote one. Turning it off stops anything new being sent. Text already sent can't be recalled. Read how Educational value works.

If you choose to sign in with Google, Google handles your sign-in under its own privacy policy. It tells us your name and verified email address. It is not one of our service providers.

That is the whole list. We do not pass your data to advertisers, data brokers, or anyone else. We may disclose data if the law requires it.

Where your data is held

Our database is in London. The UK is covered by an adequacy decision from the European Commission, which is time-limited and which we keep under review. Some providers, including Vercel, Cloudflare, Loops, Stripe and Anthropic, may process limited data outside the UK and the European Economic Area, including in the United States. Where they do, the transfer is covered by standard contractual clauses or another mechanism the law recognises.

How long we keep it

We keep your family's data for as long as you have an account. Specific rules:

• When you delete your family, the database records, uploaded files, your Stripe customer record and your Loops contact are removed straight away. Stripe may keep transaction records it is legally required to hold.
• Learning log entries you delete are removed immediately. Finds and wishlists you delete are hidden, then permanently removed after 30 days.
• Private notes written by a caregiver you remove are deleted 30 days after the removal. Expired invites and revoked devices are removed after 30 days. Waiting-list signups that are never confirmed are removed after 7 days.
• Routine database backups are kept for 35 days and then expire. Deleted data can sit in a backup until then, and is not restored except to recover from a failure.

Ask us and we will confirm when your data has gone.

Your rights

Under data protection law you can:

• Ask for a copy of the data we hold about you and your family.
• Correct anything that is wrong.
• Delete your account and your data.
• Export your data so you can take it elsewhere.
• Object to or restrict processing, and withdraw any consent you gave.

Email sonia@esquared.app and we will answer within one month. If you are unhappy with how we have dealt with your data, you can complain to the Data Protection Commission in Ireland (dataprotection.ie), or to the supervisory authority where you live.

If something goes wrong

If a personal data breach puts your family's data at risk, we will tell the Data Protection Commission within 72 hours, and we will tell you directly without undue delay when the risk to you is high.

Changes to this policy

If we change how we handle your data, we will update this page and change the date at the top. If a change matters to you, we will tell you directly.