Privacy by design in childcare
Photos of children should never live in a nanny's personal gallery. Child data should never be extractable. This is how Gardspace was architected — by constraint, not by policy.
In most childcare arrangements today, photos of children live in the nanny's personal camera roll. They sit alongside her personal photos — her weekends, her friends, her own life. When she leaves the family, the photos leave with her. The family has no control over what happens to them.
This is not a policy failure. There is no policy. The infrastructure does not exist to separate professional and personal. So everything lives together — because there is nowhere else for it to go.
In-app capture only
When a nanny takes a photo in Gardspace, the image is captured directly within the application. It never touches her camera roll. It never reaches her iCloud or Google Photos. It is stored within the Care Space — which belongs to the family — from the moment it is taken.
This is not achieved by a setting. It is achieved by architecture. The camera access in Gardspace routes the capture directly to the Care Space. There is no path from the photo to the nanny's personal storage. The constraint is structural.
48-hour media TTL
Photos and videos in Gardspace are automatically deleted after 48 hours. Parents can download them during this period. After 48 hours, they are gone from our servers permanently — regardless of account status, regardless of any action by the user. This is not a setting. It is an automatic process.
This decision reduces our data footprint, limits our liability, and gives families a clear and simple expectation: if you want to keep a photo, download it within 48 hours. We will not hold it indefinitely on their behalf.
Separation by design
The Care Space belongs to the family. The nanny is invited into it. She has access during active sessions. Outside of sessions, her access is limited to the Handover Note — a continuity note for the adjacent period. She cannot browse historical sessions. She cannot access photos from sessions she did not personally document. She cannot extract any child data from the Care Space.
When she leaves, she leaves with her NTR and her G-TRID — her professional record. The Care Space stays with the family. The child's history stays with the family. This is not a setting. It is how the system works.
Your NTR builds from your first documented session. Every day counts.
Create my professional profile