Privacy Policy

The short version

We treat your family's information the way we'd want our own treated — carefully, respectfully, and only used to make the experience better for you. We never sell your data, and we never see or store your credit card details.

Payments & Stripe Checkout

All purchases and subscriptions on Birch & Light — including the LightMap app and our Story Experiences — are processed by Stripe, a PCI-DSS Level 1 certified payment provider trusted by millions of businesses worldwide.

When you check out, you're handed off to Stripe's secure, encrypted checkout page. Your card number, expiration date, and CVC are entered directly into Stripe's systems — they never pass through, and are never stored on, Birch & Light's servers. We literally cannot see them.

What we do receive from Stripe is limited to the information we need to fulfill your order and support your account: your email address, the product you bought, the amount, the country the payment came from, and a Stripe customer ID we use to look up your subscription status. If you start a free trial, Stripe holds your payment method on their side and only charges it when the trial ends — and you can cancel any time from Settings in one tap.

You can read more about Stripe's own security and privacy practices at stripe.com/privacy.

What we collect

• Account info: your email and password (passwords are hashed — we never see them in plain text).
• Purchases: which Story Experiences, ebooks, or subscriptions you've bought, so we can give you access in your library.
• LightMap entries: the moments and notes you log are stored privately under your account and are visible only to you (and any other adult caregiver, co-parent, or professional you explicitly invite through the platform's sharing features).
• Usage signals: basic, anonymized analytics (pages visited, audio playback completion) so we can improve the experience.

How we use it

To deliver the books, songs, podcasts, and tools you've signed up for; to send you transactional emails (order receipts, trial reminders, password resets); and, if you opt in, the occasional gentle email about new stories or features. We do not sell or rent your data to third parties.

Children's privacy

Birch & Light is designed for parents and caregivers. Children do not create or hold accounts, and we do not knowingly collect information directly from children. LightMap is a parent-only space — only the optional shareable report is ever intended to be shown to a child.

However, when you use LightMap as a parent or guardian, you may choose to store information about your child under your own account, including: a first name (or nickname), age, behavior and emotion notes, triggers and bright spots, life-context reflections, and the AI chat conversations you have about your child. This information is stored privately under your adult account, is visible only to you (and any other adult caregiver, co-parent, or professional you explicitly invite through the platform's sharing features), and is treated with the same care as your own personal data described above.

You are in control: you can edit, export, or delete a child profile and all associated moments, notes, and chat history at any time from inside LightMap. Deleting your account permanently removes all of it.

LightMap Care Profile (optional)

If you choose to use the Care Profile feature inside LightMap, you may also store more sensitive information about your child: date of birth, grade or school name, allergies and sensitivities, diagnoses (as recorded by your clinician), prescribed medications and doses, prescriber and provider contact information, and a log of medication changes.

Birch & Light is not a medical provider and is not a covered entity under HIPAA. The Care Profile is a personal, parent-maintained record only — it is not a medical record, and nothing you read or enter there is medical advice.

Before you can add anything to a Care Profile, you must read and accept a separate Care Profile Data Agreement, which limits Birch & Light's liability for any clinical decision made from this record and asks you to acknowledge that you are the child's parent or legal guardian. Your acceptance is logged with a timestamp.

Care Profile data is stored in our encrypted database, protected by row-level security so that only you (and any co-parent or professional you explicitly invite through LightMap's sharing features) can read it. Care Profile data may be used by the in-app AI thinking partner (Muse) to reason more accurately about your child's recent history — for example, to notice that a behavior shift coincides with a recent medication-change window. Muse never recommends starting, stopping, or changing medication; that always belongs to your clinician.

We never sell Care Profile data, share it with advertisers, or use it to train AI models outside of your own private Muse conversations. Birch & Light staff do not access individual Care Profile records except as required to fix a bug at your request.

You can delete every Care Profile field for a given child at any time using the red "Delete all care data" button at the bottom of the Profile tab. Deletion is immediate and permanent and includes the consent record. Your other LightMap moments and bright spots are preserved unless you also delete the child profile itself.

Cookies, Analytics & Advertising Pixels

On our marketing pages we use three third-party tools to understand how the site is used and to measure our advertising: Google Analytics 4, the Meta (Facebook) Pixel, and the TikTok Pixel. These tools set cookies or similar identifiers in your browser and collect things like a device identifier, the pages you visit on our site, an approximate location derived from your IP address, referring URL, and — for the ad pixels — whether you interacted with one of our ads before arriving.

We use this information to understand which stories and pages people actually find helpful, and to measure whether the ads we run are reaching the right parents. This data is shared with Google, Meta, and TikTok as separate companies that process it under their own privacy policies: Google, Meta, and TikTok.

None of these tools load until you accept them. On your first visit we show a small cookie banner at the bottom of the screen with "Accept" and "Decline non-essential" buttons. If you decline, or simply haven't answered yet, no analytics or advertising script is loaded and no PageView is sent. You can change your mind at any time using the "Cookie preferences" link in the site footer.

Inside the LightMap app — every page under /lightmap — we do not load the Meta or TikTok advertising pixels at all, even for visitors who have accepted them on the marketing site. LightMap holds sensitive family information, and we do not want ad networks receiving any signal from that surface. Google Analytics may load on LightMap pages only if you have accepted our cookie banner, and is used solely to understand navigation.

Your choices

You can update your email, cancel a subscription, or request that we delete your account and associated data at any time. Just email us at [email protected] and we'll take care of it.

Questions

Anything unclear, or anything you'd like us to change? Reach out — a real human (usually Tara) reads every message.