Security

Minimal data by design

The safest data is data we never collect. We store kids' first names only, and we do not store bank or card details for recorded payments.

Access controls

• Every record is protected by database-level access rules, so a coach sees only their classes and a parent sees only their own kids.
• In group classes, parents can see only their own kid's row.
• Class chats are open only to the class's coach and the families enrolled in it; a family that leaves the class loses access. Other families' kids' names are never shown in a group chat.
• Co-parents get access only by accepting an invite from the primary parent, who can remove them at any time.
• Sign-in uses one-time email codes, so there are no passwords to reuse or leak.

In transit and at rest

• All traffic to Sesslynx uses HTTPS.
• Data is stored with a managed database provider that encrypts data at rest.

An audit trail

Attendance changes are recorded as events: who marked, who confirmed or disputed, and when. Balances are built from ledger entries that are reversed rather than silently edited.

Reporting a vulnerability

If you believe you have found a security issue, please contact us with details. Please do not access other people's data or disrupt the Service while testing. We will acknowledge your report and keep you updated.