Reference
Data, exports, and deletion
What the JSON and CSV exports contain, the PDF kinds and sizes, download link lifetimes, and exactly what deletion removes and in what order.
Export kinds#
| Kind | Format | Contents |
|---|---|---|
| JSON (all data) | JSON | Every row of the family's tables plus the shared catalogue, filtered to the family. Secrets removed: password hashes, tokens, calendar grants, push keys, chat ids. Large numbers as strings. |
| CSV (logs) | CSV | The diary only: 20 fixed columns, oldest first. |
| Portfolio PDF | PDF, A4 | One month page with bilingual captions. |
| Yearbook PDF | PDF, A4 or A5 | Cover plus twelve month pages for a year. |
| Playbook item PDF | PDF, A4 | One protocol in a chosen language. |
| Printable PDF | PDF, A4 | One of the twenty sheets, with the child's name and, where supported, the on-duty adult's language. |
| Book prompts PDF | PDF, A4 | Eight prompts for a book. |
| Evidence PDF | PDF, A4 | One calm page for one monthly check, for a paediatrician. |
| Shopping list | CSV or clipboard | Wishlist grouped by tier. |
PDFs are rendered by a headless browser in the background with a single-use render token that expires in ten minutes. Each adult may have up to 20 exports in flight. Downloads are signed links valid for five minutes.
Day-to-day adults may export playbook items and printables only.
Media#
Uploads: JPEG, PNG, or WebP up to 15 MB; audio MPEG, MP4, OGG, WAV, or WebM up to 20 MB. On completion the size, file type, and checksum are verified, a 1600 px version and a 320 px thumbnail are written, EXIF, IPTC, and XMP metadata are removed, and the original is deleted. Media is served only through the app or a scoped share link, via short-lived signed URLs.
Deletion#
Owner only. Requires typing the family name. Grace period 7 days by default (1 to 90). All non-viewer adults are notified in-app and by email; a banner shows on every screen until it runs or is cancelled.
When it runs, in order: pending exports are cancelled, calendar events pushed to Google are deleted, media and export files are deleted including the whole family prefix, queued jobs for the family are removed, every table with a family id is emptied and the family row removed, user accounts that belonged only to this family are removed, and a tombstone with counts is written. A stale device receives "This family's data was deleted" and erases its local copy.