Privacy Policy
Version 2.0. Last updated: August 19, 2026
Our Bulletin is a small app for sharing children’s events and schedules with the family members you invite. It is built and run by one person, not by a company. That person is me, Corey Leichty, in Ohio. This policy explains what I collect, what I do with it, and what you can ask me to do about it.
What I collect
About you
- Your name and email address, used to identify you and let you sign in.
- Your timezone, when you last opened the app, and whether you have turned on notifications.
- If you enable push notifications: a device token, plus the browser and device description your browser sends with it, so notifications reach the right place.
- Anything you write in the in-app feedback form.
About your children
- The names and basic details you choose to enter: display name, date of birth if you provide it, and a color and initial for how they appear in the app.
- I do not ask for children’s last names, home addresses, school names, medical information, or government identifiers, and there are no fields for them. But the app has free-text fields (a child’s display name, an event title, a note), and whatever you type into one is stored. What ends up in there is your choice, so please put in only what you would be comfortable having stored.
About your events
- The title, date, time, location, and notes, and which children the event is about.
- Images you attach to events. These are meant for the practical stuff: a diagram of which field a game is on, where to park, a screenshot of the schedule the coach sent. Please don’t use them for photos of children or of other people; Our Bulletin is not a photo album, and there are better places for those. But I can’t inspect what gets uploaded, so whatever you attach is stored, on my behalf, by the providers listed below.
- Locations. When you type an address, Google Maps helps suggest it, which means the text you type is sent to Google. The address you save is stored with the event.
Please treat locations as the most sensitive thing in the app, because they are. An address plus a time plus a child’s name describes where a specific child will physically be. The app is built to show that only to the people you have invited and chosen to share that event with.
If you connect Google Calendar
- An authorization token that lets Our Bulletin add and update events on your behalf. I use it only to create and update the events you made in Our Bulletin. I do not read your other calendar entries, and I do not store or use them for anything. Depending on the permission Google asks you to grant, that token may technically allow more access than I use. The Limited Use commitment below is my binding promise about what I actually do with it.
Technical records
- I do not run analytics, ad trackers, or session recording, and I do not track your browsing.
- My hosting and database providers (Vercel and Supabase) keep ordinary server logs that include IP addresses and request times. That is standard infrastructure logging, it is retained under their policies, and I use it only to diagnose problems.
What I don’t collect
I do not collect your card number, your contacts, your photo library, your location in the background, or anything about what you do outside Our Bulletin. I do not buy data about you from anyone.
How I use it
I use your information only to operate Our Bulletin: to show you the right events, to deliver the notifications you have enabled, to sync events to your Google Calendar if you have connected it, to handle billing, and to respond to your feedback.
I do not sell your data. I do not share it with advertisers or data brokers. I do not use it to train AI models. I do not look at your family’s images or events except when you ask me to help with a specific problem, or in the rare case where I have to open something to fix a bug or comply with the law.
Who can see your data
Your family’s information is visible only to the people you have explicitly invited:
- Editors (typically parents) can see and edit everything in their own family.
- Followers(typically grandparents and close family) see events shared with them according to each event’s audience settings.
- Other familiesare not given access to your family’s data. Every request to the database is scoped to the family the signed-in person belongs to, and I test that separation as part of how I build the app. See the Security section below for what I can and can’t promise about it.
Remember that once you share an event with someone, they have seen it. If they have synced it to their own Google Calendar, it lives there too, and changing the sharing settings later does not reach into their calendar.
Google Calendar and Google’s rules
Our Bulletin’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Google Calendar at any time from within Our Bulletin, and you can revoke access directly from your Google Account’s security settings. Events already written to your calendar stay there until you delete them.
The services I rely on
To run Our Bulletin I use a small number of providers, and I share with each of them only what they need:
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Database, authentication, file storage | Your account, family data, events, and images |
| Vercel | Web hosting | Requests to the site, including IP addresses in logs |
| Resend | Email delivery | Your email address and the contents of sign-in and notification emails |
| Apple, Google, and Mozilla push services | Delivering push notifications to your device | Your device's notification address, and the notification itself, encrypted so they cannot read it |
| Google Calendar | Calendar sync, if you connect it | The events you create in Our Bulletin |
| Google Maps | Address suggestions | The address text you type into a location field |
| Stripe | Payment processing, if you subscribe | Your name, email, and payment details |
Each has its own privacy policy, and it is worth knowing that they do not all stand in the same relationship to your data. Supabase, Vercel, and Resend handle it on my behalf and under my instructions. Stripe and Google are different: they handle what they receive under their own terms and for their own purposes as well as mine. Stripe does so for payment processing, fraud prevention, and its own legal obligations; Google, for the calendar and mapping services you are choosing to use. I do not control what they do with it beyond what their policies say.
The push services are a narrower case. Your browser, not me, decides which one it uses, and a notification is encrypted before it leaves my server, so what they carry is a sealed envelope: they can see that a message went to your device and when, but not the event title or anyone’s name inside it.
Payments
If your family subscribes, Stripe handles the payment. Your card details go into a payment form provided and controlled by Stripe, so your card number goes directly to them and never reaches Our Bulletin’s servers. I could not see your card number if I wanted to.
What I store in my own database is small: your family’s billing status (for example trial, active, or lapsed), and two Stripe reference IDs (a customer ID and a subscription ID) that let the app know the payment went through. No card numbers and no billing address. The record of what you were actually charged and when lives in Stripe, and I can look at it there the way you can look at your own receipts.
Stripe receives your name, email address, and payment details when you subscribe, and uses them under its own privacy policy at stripe.com/privacy. Receipts and payment notices come from Stripe on my behalf.
If you cancel, I keep that same small record so your billing history stays consistent. Stripe keeps its own transaction records as the law requires, and canceling in the app cannot erase those. That part is theirs, not mine.
Children’s information
Our Bulletin is designed for adults. Children are not users: they do not create accounts, they do not sign in, and I do not knowingly collect any information directly from a child. Everything in the app about a child was entered by an adult in that child’s family.
If you add a child to your family, you are confirming that you are that child’s parent or legal guardian, or that you have their parent or guardian’s permission, and you are the one deciding what is appropriate to share and with whom. If you believe a child’s information has been added to Our Bulletin by someone without the right to do it, email me at coleichty@gmail.com and I will look into it and remove it if that is the right outcome.
Security
I want to be accurate here rather than reassuring.
What I do: your family’s data is separated at the database level, so a query made by someone in another family is not built to reach your records; everything travels over encrypted connections; sign-in uses one-time codes by email rather than passwords you might reuse; and I am the only person with administrative access to the app, aside from staff at the providers listed above who can reach their own systems under their own policies.
What I cannot promise: that any of this is perfect. Our Bulletin is in public beta and is built by one person. No app is immune to bugs or to a provider’s breach, and I would rather say so than pretend otherwise. Please do not store anything in Our Bulletin that would genuinely harm you if it got out.
If something goes wrong. If I discover a breach that affects your personal information, I will tell you by email without unreasonable delay, describe what happened and what data was involved, and tell you what I am doing about it. That is beyond whatever notice the law requires.
How long I keep things
- Your account and family data: as long as your family exists in the app, whether it is active or read-only.
- Archived families: 12 months after archiving, then permanently deleted from the database.
- Feedback you submit: up to 24 months, so I can trace a bug back to who reported it.
- Billing records: the small record described under Payments, kept while your family exists; Stripe keeps its own transaction records for as long as tax and accounting law requires, generally around seven years.
- Server logs: whatever Vercel and Supabase retain by default, typically days to weeks.
- Backups:deleted data can survive in my database provider’s daily backups for up to seven days after deletion, before it rolls off for good.
Your choices
You can, at any time:
- See what I have. Email me and I will tell you everything stored about you and your family.
- Correct it. Most of it you can edit directly in the app; email me for the rest.
- Get a copy.Email me and I will export your family’s events and images for you. (A self-serve export is on my list.)
- Delete it. See below.
- Turn off notifications, in the app or in your phone’s settings.
- Disconnect Google Calendar, in the app or from your Google Account.
I will not charge you for any of this and I will not make it difficult. You do not need to be in a particular state or country for these to apply. This is just how I want to run it.
Leaving Our Bulletin
If you want to stop using Our Bulletin, email me at coleichty@gmail.com. I will archive your family’s data immediately, and it is permanently deleted 12 months later. If you want it fully deleted right away instead, say so and I will do that, usually within 7 days.
Some things will remain outside my reach after deletion:
- Events synced to your or your followers’ Google Calendars stay in those calendars until each person removes them.
- Sign-in and notification emails may remain in Resend’s delivery logs under its retention policy.
- Stripe keeps its own payment records as the law requires.
- Backups roll off on the schedule above.
Cookies and local storage
Our Bulletin uses only what it needs to keep you signed in and remember basic preferences on your device, such as your timezone and which filter you last chose. There are no advertising cookies, no third-party trackers, and no analytics scripts.
For California residents
California law gives residents certain rights over personal information. Whether or not those laws formally apply to an operation this small, here is my position: I have never sold your personal information, I have never shared it for cross-context behavioral advertising, and I do not intend to. If either ever changes, I will tell you before it happens and give you a way to opt out. The rights listed under “Your choices” above are available to you regardless.
Beta status
Our Bulletin is currently in public beta, operated by an individual rather than a company. Things may occasionally break. If something goes wrong, please use the in-app feedback form or email me directly.
Changes to this policy
If I make a material change to this policy, I will tell you in the app and by email at least 30 days before it takes effect, and I will update the version and date at the top. I will not quietly edit this page. The terms of service carry the same version number, and this policy is part of that agreement.
Contact
For privacy questions, data requests, or anything else: coleichty@gmail.com. It reaches me directly.