How Nanny Invoice handles household data.

Information the app handles

The current build can store names, contact details, addresses, country and currency, caregiver engagement mode, an optional business identifier, household member iCloud email addresses, Apple-provided iCloud account identifiers, the care-arrangement name, hourly and kilometre rates, planned and actual shifts, breaks, kilometres, timesheets, approvals, issued records, adjustments, an optional payment reference, payment status and audit timestamps.

Where it is stored

The app keeps a file-protected copy on iPhone. Sharing uses Apple CloudKit and the signed-in person's iCloud account. Records for an invited participant are routed to the arrangement owner's private shared zone. Nanny Invoice has no developer-run application backend.

The optional caregiver web portal uses Apple's CloudKit JS service. Apple may keep the CloudKit sign-in session in that browser when the person chooses to remain signed in. The portal does not deliberately retain the household snapshot in browser storage, and clears the rendered household when the person signs out, access is revoked or a refresh or save fails.

Who can see it

The arrangement owner can invite selected parent collaborators and caregivers through private iCloud sharing. Invited participants can read and write the shared arrangement. The owner controls membership and can revoke a participant's iCloud access. The app's parent and caregiver roles are trusted-household rules rather than tamper-proof server enforcement.

CloudKit gives an accepted household participant access to the shared arrangement record. The caregiver portal therefore downloads the complete shared household snapshot before showing the caregiver view. It is not data-level isolation between trusted household members. Only use household sharing with people you trust.

Caregiver web access

When caregiver web access is enabled, the portal will use a public CloudKit web token restricted to the approved Nanny Invoice website origin. It uses the caregiver's Apple Account to request the private shared record. The token identifies the website to Apple but does not grant household access by itself. The portal is excluded from search indexing and its pages are served without browser caching.

What the current app does not do

• No advertising or third-party analytics.
• No sale of household information.
• No bank transfers or payment-card handling.
• No payroll withholding, employer contributions, tax filing or legal compliance service.
• No automated email workflow.

Documents and exports

The app can create PDF invoices or pay records and a spreadsheet ledger on the device. Nanny Invoice does not upload those files to a developer-run service. A person chooses where to save or share an export through the standard iPhone share sheet.

Control and deletion

The owner can revoke a participant's access or delete the complete arrangement from the owner's private iCloud zone and local device. An invited participant can leave the shared arrangement and remove the local copy from that device. Deleting the app removes its local app container, subject to normal iPhone backup and device-management behaviour, but it does not delete an owner's shared iCloud arrangement.

Questions and changes

Material changes will be reflected by an updated effective date. For privacy or support questions, email [email protected]. Do not email household records or identity documents.