Security, Privacy & Data Protection

30-Day Auto-Purge Policy (Starter Forms)

To minimize data liability and ensure strict compliance with data minimization principles, parent-submitted magic link starter forms are permanently purged from active storage 30 days after submission.

Strict Unit Isolation (PostgreSQL Row Level Security)

Every query to our cloud database is protected by database-enforced Row Level Security (RLS). Leaders can only view, create, or update records belonging to units where they are verified leaders or designated helpers.

• No shared member databases between units
• Helper roles have restricted access (read-only for registers, no financial or starter form exports)

AES-256 On-Device Encryption for Offline Storage

When using UnitSolutions offline (e.g. taking registers on camp or in community halls with zero mobile signal), cached data is protected by AES-GCM 256-bit encryption via the Web Crypto API.

Crypto keys are stored as non-exportable key objects directly in browser IndexedDB, preventing client-side script extraction or unauthorized inspection.

Data Controller vs Data Processor

Under UK GDPR guidelines, UnitSolutions operates as a Data Processor providing digital productivity tools. The individual Unit or charity organization remains the Data Controller.

We never monetize, sell, or advertise against young people's or parents' data.