Legal · Wardline Co-Parent
How Wardline handles your family's information
This notice covers Wardline Co-Parent, the app separated parents and the people caring for their children use to run shared parenting. It is the same notice shown in the app. For the getwardline.com website, see the Privacy Policy.
Who we are
Wardline LLC, 522 W Riverside Ave Ste N, Spokane, WA 99201-0581, USA. Questions about this notice or your information: privacy@getwardline.com.
What we hold
- Your account: your name and email address, and a password, which Clerk stores (we never see it). Or, if you choose, the Apple or Google account you sign in with. When you sign in with a password from a new device, we email you a code to confirm it's you.
- Your household's record: what members enter: names and dates of birth of members and children; schedules, day swaps, handovers and their check-in results; messages and the files and photos attached to them; expenses; items that move between homes; trips; medical appointment logistics (when, where and who: see below); children's activities; and every vote and decision, with who made it and when.
- Location: when you check in at a handover, the app reads your phone's location once and keeps only whether you were at the agreed place, and how accurate the phone said its reading was. Where you were is never stored. Location data is removed from photos when they're uploaded.
- Your device: a push-notification token, if you allow notifications, and your IP address and browser or app details when you sign in.
Not for medical records
Wardline Co-Parent is not a place for medical records, and is not designed or protected as one. It helps a household coordinate appointments: when and where, and who is taking the children. Don't enter diagnoses, conditions, treatment, test results, medication or other health information, in appointments, messages, attachments or anywhere else in the app. By using Co-Parent you agree not to; the Co-Parent Terms set this out. If health information is entered anyway, it is protected like everything else in your household's record (below), but Wardline doesn't treat it as a medical record or offer the protections that health-record systems do.
Why
To run the app for your household; to keep a record every member can rely on and export; to check each message for threats and controlling language before it's sent; to offer optional help (a tone check, and drafting a schedule from your words); to send invitations and notifications; and to keep the service secure. We rely on providing the service you signed up for, and on our legitimate interest in keeping a reliable, tamper-evident record and keeping members safe.
Who else handles it
- Amazon Web Services (in the United States) runs our systems and sends our email. Inside AWS:
- AI (Amazon Bedrock): the text of each message, for the safety check (Mistral Ministral, Amazon Nova Micro and Anthropic Claude); a draft you ask to have tone-checked, or every draft you send if you turn on "Check tone before sending" (OpenAI gpt-oss); a message you choose to turn into a swap request (Meta Llama); and plan text or files you ask us to turn into a schedule (Amazon Nova, Meta Llama and Anthropic Claude). These models run on Amazon Bedrock in Wardline's AWS account. AWS doesn't store this or use it to train models, and the companies behind the models don't receive it. Your information is never used to train AI models.
- Maps (Amazon Location): the words you type when searching for a handover place, and the point you pick on the map, with nothing about you or your household.
- Clerk handles sign-in: your name, email address and sign-in details, including your password (stored hashed by Clerk) and, if you use them, the Apple or Google account you sign in with. It holds nothing from your household's record.
- Apple and Google, only if you choose to sign in with them, confirm who you are and share your name and email address with us. They see nothing you do in Wardline.
- Apple and Google sell subscriptions, through the App Store and Google Play, and hold the purchase. When a parent subscribes, we check that purchase with them, and Google may also tell us when it renews or ends. We send them nothing from your household. A household can also be free, with a waiver code that Wardline or a partner organisation (for example a shelter or a legal-aid service) gives out. Using one records in the household's own encrypted record that a waiver was used, and which kind (hardship, domestic violence, military, court-ordered). The code isn't linked to your household, and we ask for no proof.
- Expo, Apple and Google deliver notifications to your phone. Notifications say only what kind of thing happened (for example "New message"), never its contents.
- DigiCert and Sectigo, two independent timestamp services, receive only a fingerprint (a hash) of our hourly record checkpoint, never your information.
We don't sell, rent or trade your information, show advertising, or share it with anyone else, unless the law requires it.
How long we keep it
Your household's record is kept while the household is open. Closing it needs every parent's agreement, then there are 30 days to download a copy. A household closes straight away, without the 30 days, when its last member deletes their account, or when its last parent does; anyone still in it is told. The app asks the person deleting their account to download the record first. After that, the household's encryption key is destroyed and its record becomes permanently unreadable, to everyone including us. When a household closes, each member still in it gets their own copy of its record. It's encrypted under a key tied to that member, and the app opens it only for them, from their own signed-in account. They can download it from the app for 90 days; after that it is deleted. No one else, the other parents included, can open another member's copy. What remains are encrypted copies no one can open, and fingerprints that let a record exported earlier still be checked. A write-once copy of those encrypted entries is kept for seven years so the record can't be quietly altered.
Households no one uses close on their own. If no one in a household signs in or uses it for six months, we tell every member, by email, by notification and in the app, that it will close in 30 days, and again 7 days before. Signing in at any point keeps it open. A household with an active App Store subscription is never closed this way. If a household no one has used for six months pays through Google Play, we cancel the renewal instead, so it runs to the end of the time already paid for. When a household's subscription ends, it closes 30 days later unless someone subscribes again. Every member is told then, by email, by notification and in the app, and reminded 14, 7 and 1 days before it closes. Either way there is time to download the record first, and the household then closes as described above.
Your account (your email address, sign-in details, notification token) is kept while you belong to a household. You can delete it at any time from inside the app, or without the app (see Delete your account); it's deleted straight away. If you leave your last household, or it closes, your account details are deleted 30 days later. We keep only an account number with no email attached, because the household's record refers to it and removing it would break the record's tamper-evident chain. What you entered in a household that is still open (the name you were known by there, your messages, your votes) stays part of that household's encrypted record until the household closes.
Security logs (sign-ins and administrative actions) are kept for 12 months. Backups are encrypted and expire on a rolling schedule; a closed household's backups can't be read once its key is destroyed.
You can ask us to delete your information sooner by writing to privacy@getwardline.com.
How it's protected
Everything your household records is encrypted with a key unique to your household, and only Wardline's own application can use it. Wardline staff can't read your record without every parent's approval, and any other access is recorded and alerted. Every action is written to a tamper-evident record: any later change is detectable, and anyone holding an exported record can check it.
Your choices
We ask for your permission to use AI separately from the terms, before you first send a message or use AI help. You can withdraw it at any time with the AI permission link, on your list of households or in the menu. Because every message must be safety-checked before it's sent, withdrawing means you can still read messages but can't send them, and the optional AI help turns off. You can give permission again whenever you like.
The tone check and AI drafting are optional; the safety check applies to every message. You can turn notifications off on your phone. Any member can download the household's record at any time, free. You can ask for a copy of the information we hold about you, ask us to correct it, or ask us to delete it where we're not required to keep it: write to privacy@getwardline.com. Information that belongs to the household's shared record (for example a vote you cast) stays part of that record until the household is closed.