Built to keep club and family data safe

Nippers runs on trust. Here's how NipperHub earns it — plainly, without the fine print doing the heavy lifting. Last updated: 23 September 2026.

Australian by default

Family and child information lives in Google Cloud's Sydney region (australia-southeast1). Three narrow exceptions exist, each of them disclosed, because those services are the best at what they do. Email is delivered by Resend (US). Payments are processed by Stripe (US), and carry adult and payment details plus one detail about a child: a given name alone, on the program line, so you can tell what a charge was for on your receipt. Optional Telegram announcements are broadcast-only and never contain personal information. That's the whole list.

Two further services receive data without leaving that picture, and the privacy policy names all five together. Our text messages go through MobileMessage, an Australian provider, so they are a disclosure and not an overseas one. And a password you choose is checked against known breaches: your browser sends the first five characters of its scrambled form — never the password, and nothing that says whose it is. Because your own browser makes that call, the breach service also sees your IP address. Signing in itself runs on Google's Identity Platform with reCAPTCHA Enterprise. That is where your email address and your sign-in events live, and where an automated sign-in attempt is told apart from you. Google does not promise to keep those sign-in records in one region.

We never store your child's date of birth

Your club verifies age through Surf Life Saving's own systems. NipperHub records the age group and nothing more. No birthday, no stored age. The most identifying fact about a child is one we simply don't hold.

Cleared adults only

Before anyone can open a child's record they need clearance. That means a current Working with Children Check, or another lawful basis your club has written down with evidence and an expiry. We check it afresh on every request, never from an old sign-in. And clearance is not a master key. A child's health and care notes are held more tightly than their everyday details, and a club's list of applicants doesn't carry them at all. Each person sees what their job needs and no more.

Sign-in that fits the job

Everyone signs in with an email address, using a password or a sign-in link we email you. If you take on a club or program role, you add a second check when you sign in. A role that handles money, other people's roles, safeguarding or the club's settings needs an authenticator app every time you sign in, and the app replaces any texted code. Other roles can use a code texted to your mobile. Every request is checked against the signed-in person's actual role.

Everything on the record

Every change carries who made it, stamped by the server — not self-reported. That audit trail is a first-class part of the product, not an afterthought.

Payments by Stripe

Clubs connect their own Stripe account, and money flows straight to the club. The platform never holds it. Card details never touch NipperHub. One detail about a child goes the other way: a given name alone, on the program line of the payment, so a family and a treasurer can tell what a charge was for. We send it only when the name a parent entered is a single word, and never a surname. The payment's internal record carries no child detail at all — only reference codes that mean nothing on their own.

No trackers here

This website uses no analytics, no advertising technology and no third-party trackers. The app uses no analytics or advertising either, but every page of it runs Google's reCAPTCHA Enterprise, which sees your IP address and how you use the page, to tell a person from a bot.

Want the details?

Read the privacy policy and the privacy page for kids, or write to support@nipperhub.com — security questions welcome.