Privacy Policy

Without an account. You can search, read provider records, compare providers and download resources without signing in. The ZIP code, address or provider name you type is used to run the search. We do not store what you type. Our analytics tools record only the first three digits of a searched ZIP code, and they link that activity to you only if you are signed in (see "Analytics and recordings" below).

If you create an account. We collect your email address and a password. Passwords are handled by our authentication provider and stored only in hashed form; we never see them in plain text.

Your watchlist. When you watch a provider, we store the provider's state license number, name and city, and whether you want email alerts about it.

Collected automatically. Like most websites, our hosting provider records standard technical data such as IP address, browser type, pages viewed and referring site, which we see only as aggregate visitor statistics. We also collect error reports (the page and error message) so we can fix problems.

Analytics and recordings. We use Google Analytics and PostHog to see which pages and features people use. They record the pages you view, buttons and links you click, searches (only the first three digits of a ZIP code, never the street address or text you typed), your device, browser and approximate location (country and region, derived from your IP address), and how you arrived at Canary. PostHog also makes recordings of visits that replay what appeared on screen: clicks, scrolling and page content. In recordings, everything typed into a form or search box is hidden, except a ZIP code typed into the search box. Street addresses, provider names you search for, email addresses and passwords are never recorded. If you are signed in, this activity is linked to an anonymous account number, not your email address. If your browser sends a Global Privacy Control signal, we turn off analytics and recordings completely.

Browser storage. If you sign in, a session token is kept in your browser's local storage so you stay signed in. Google Analytics and PostHog also store a random identifier in cookies or local storage to recognize a returning browser. We do not use advertising cookies, and we turn off Google's advertising features.

What we do not collect. We do not collect information about your children, your precise location, payment information or government ID numbers.

• To show licensed providers near the location you search and calculate their Canary grades.
• To keep your watchlist and, if you turn them on, email you when a watched provider's state record changes.
• To send account messages you need, such as email confirmation and password resets.
• To understand which features are used and where visitors get stuck, to fix errors and to prevent abuse.
• To comply with law and enforce our Terms of Use.

We do not send marketing email without your separate consent, and every alert email includes a way to stop alerts.

We share information only with providers that help us run Canary, and only what each needs:

• Supabase (database and sign-in, United States): account email, hashed password, watchlist. Privacy policy
• Google Maps Platform (maps, address search and provider details): the search text you type and standard request data from your browser. Privacy policy
• Hosting and error reporting (Lovable and its infrastructure providers): technical request data and error reports. Privacy policy
• Google Analytics (Google LLC, United States): page views, clicks and searches as described above, with Google's advertising features turned off. Privacy policy
• PostHog (PostHog, Inc., United States): product analytics, error reports and the masked session recordings described above. Privacy policy
• Email delivery provider: your email address and the alert or account message being sent.

We may also disclose information if the law requires it, to protect someone's safety, or as part of a merger or sale of the business, in which case this policy continues to apply to your information.

We do not sell your personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We honor Global Privacy Control signals as a request to opt out of any such sale or sharing.

Provider names, addresses, license details, inspection results and violation narratives come from public records published by the Texas Health and Human Services Commission. These are records about licensed businesses, not about you. If you believe a record shown on Canary is inaccurate, see our methodology and corrections process.

• Account and watchlist data: while your account is open.
• After you delete your account: removed from active systems within 30 days; backup copies expire within 90 days.
• Error reports and aggregate visitor statistics: kept only as long as useful for fixing and improving the site.
• Analytics events: no longer than 14 months. Session recordings: no longer than 30 days.

You can remove any provider from your watchlist or turn off alerts at any time. You may also ask us to:

• confirm whether we hold your personal information and give you a copy;
• correct inaccurate information;
• delete your account and personal information;
• opt out of any sale, sharing or targeted advertising (we do none of these).

Email info@journeyanalytic.com from the address on your account with the subject "Privacy request." We respond within 45 days, as Texas and California law require, and will not treat you differently for making a request. If we decline a request, you may appeal by replying to our decision; if you are a Texas resident and remain unsatisfied, you may contact the Texas Attorney General.

Data is encrypted in transit (HTTPS) and at rest. Database rules ensure each signed-in user can read and change only their own watchlist, and administrative access is limited. No system is perfectly secure; if a breach affects your personal information, we will notify you as the law requires.

Canary is for parents, guardians and other adults researching childcare. It is not directed to children under 13, accounts are for people 18 and older, and we do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

When we change this policy we update the date above. For material changes, we will also notify account holders by email before the change takes effect.

Journey Analytics, LLC · info@journeyanalytic.com