Security and privacy

Who can get in

There are no passwords to reuse or leak. Staff and owners sign in with a one-time code sent to their email. Park staff can add a second step with an authenticator app, so a lost inbox is not a lost back office. Setting up a park needs a code sent to your email, and a check that you are a person, and sign-in and sign-up attempts are limited per person and per address.

Every park is kept apart by the database

Each park's information is separated by row-level security in the database itself, not just by the application. The app connects with an account that cannot see another park's rows even if a bug asked it to, and each of these rules has tests that try to break it.

Who sees what inside a park

A park decides who is on its team and what each person can do. Staff see only their own park. A park can switch parts of the app off, and owners are only shown what the park uses.

Where it runs, and backups

Owner App runs on a server we manage ourselves, behind a network service that filters bad traffic. The database is backed up every day, and each backup is encrypted before it is copied offsite. The key to open a backup is not kept on the server. Updates are deployed automatically, and a release that fails its health check does not go live.

What we do with your information

We do not sell it, show adverts with it or use it for marketing. It belongs to the park, and we handle it only on the park's behalf. The privacy policy says exactly what is held.

This website

It sets no cookies and loads no third-party scripts. It counts visits with our own analytics (Umami, running on the same servers as everything else), which sets no cookies, stores nothing that identifies you, and honours Do Not Track.

If your insurer, auditor or data protection officer has questions, ask us and we will answer them in writing.