Security & fraud protection

How gift money stays safe.

In plain English: what we do, what we don't do, and what happens if something looks wrong.

Money never touches KindNest

›Givers transfer directly from their own bank to the parent's bank — we are not a payment processor.
›We never see card numbers, CVVs, or banking passwords. There is nothing for an attacker to steal from us.
›We don't hold balances. There are no KindNest wallets, top-ups, or pending balances.
›Each gift uses a unique payment reference so parents can match incoming funds to the right child and occasion.

›Public milestone pages show a first name and an occasion — nothing more.
›Pages are not indexed by Google and require the share link.
›We don't sell data, we don't run ads, and we don't share info with third parties for marketing.

›Givers must enter their name and (optionally) email — anonymous submissions are blocked.
›Any sender email a parent or admin flags is added to a blocklist and future gifts from that email are hidden automatically.
›Parents can hide any gift entry from their own dashboard with one click.
›We rate-limit gift submissions per page to stop spam and scraping.
›An admin reviews flagged activity and can permanently hide entries or block senders.

›KindNest is invite-only — accounts can only be created with a valid invite code.
›Passwords are checked against the Have I Been Pwned database, so known-leaked passwords are rejected.
›Sessions are encrypted and isolated per-user; one parent can never see another parent's data.
›Admin access is least-privilege: only accounts we explicitly grant the admin role can see the full data.

›If a gift looks suspicious (wrong name, duplicate, unsolicited), the parent can hide it instantly and block the sender.
›If a parent suspects a payment didn't arrive, they keep their normal bank dispute rights — the transfer is bank-to-bank, so their bank can investigate directly.
›If we detect unusual activity on an account, we'll email the parent and require a password reset before any further use.
›Email us anytime — a human responds, usually within a day.

›We do not take card payments — there is no card data to leak.
›We do not hold gift money — we cannot lose or freeze your funds.
›We do not auto-charge anyone — every gift is a one-off bank transfer the giver approves themselves.

Email hello@kindnest.me with the milestone link and what you saw. A human will look at it the same day.