Built to keep club and family data safe

Nippers runs on trust. Here's how NipperHub earns it — plainly, without the fine print doing the heavy lifting. Last updated: 10 September 2026.

Australian by default

Family and child information lives in Google Cloud's Sydney region (australia-southeast1), and that's where it stays. Three narrow, disclosed exceptions exist because the services are the best at what they do: email is delivered by Resend (US), payments are processed by Stripe (US) and carry adult and payment details plus one child-derived detail — a child's given name alone, on the program line of the payment, so the charge is recognisable on your receipt — and optional Telegram announcements are broadcast-only and never contain personal information. That's the whole list.

Two further services receive data without leaving that picture, and the privacy policy names all five together: our text messages go through MobileMessage, an Australian provider, so they are a disclosure and not an overseas one; and a password you choose is checked against known breaches by sending the first five characters of its scrambled form — never the password, and nothing that says whose it is. Signing in itself runs on Google's Identity Platform with reCAPTCHA Enterprise, which is where your email address and your sign-in events live and where an automated sign-in attempt is told apart from you.

We never store your child's date of birth

Your club verifies age through Surf Life Saving's own systems; NipperHub records the age group and nothing more. No birthday, no stored age. The most identifying fact about a child is one we simply don't hold.

Cleared adults only

Before anyone can open a child's record they need clearance — a current Working with Children Check, or another lawful basis your club has written down with evidence and an expiry. We check it afresh on every request, never from an old sign-in. And clearance is not a master key: a child's health and care notes are held more tightly than their everyday details — a club's list of applicants doesn't carry them at all — so each person sees what their job needs and no more.

Sign-in that fits the job

Everyone signs in with an email address — a password, or a sign-in link we email you. Club and program officials add a second factor as well, and the sensitive work — money, roles, safeguarding — demands an authenticator app. Every request is checked against the signed-in person's actual role.

Everything on the record

Every change carries who made it, stamped by the server — not self-reported. That audit trail is a first-class part of the product, not an afterthought.

Payments by Stripe

Clubs connect their own Stripe account, and money flows straight to the club — the platform never holds it. Card details never touch NipperHub. One child-derived detail goes the other way: a child's given name alone rides the program line of the payment, so a family and a treasurer can tell what a charge was for. It is sent only when the name a parent entered is a single word, never a surname, and the payment's internal record carries opaque reference codes and no child detail at all.

No trackers here

This website uses no analytics, no advertising technology and no third-party trackers. The product doesn't either.

Want the details?

Read the privacy policy and the privacy page for kids, or write to support@nipperhub.com — security questions welcome.