Privacy

Last updated: October 29, 2026

Shortlist (shortlist.guide) is operated by Shortlist LLC, a Washington limited liability company. This page explains what data Shortlist collects, what it’s used for, and what is never shared. The shorter answer: Shortlist collects as little as possible to run the site, and never sells what it does collect.

What Shortlist collects

Email address — when you sign in on Your shortlist, to sign you in and keep your saved programs on any device (see Your shortlist). It is also collected when you give it for a program alert, a question for a program, a request to Diana, a provider request or email updates, each described below. You can use the site fully without giving it.
Program alerts — if you ask Shortlist to watch a program, the details below under Program alerts.
Provider requests — if you submit a provider for Shortlist to research, your request and email are stored so the team can reply when the listing is added.
Requests to Diana — if you use a program’s page to ask for a tour, an introduction, information from the program, or the state’s record for it, Shortlist stores your email address, the name you give, the program or programs, what you asked, any note, and the city. A tour request also stores the days you prefer. An introduction or information request also stores how many programs you opened in that visit and the site you came from; a state-record request stores the site you came from. Each request is emailed to Diana, who writes to the program, or files the records request with the state, herself; nothing is sent to the program or the state automatically.
Email updates — if you sign up for email updates, Shortlist stores your email address and, where the form asks, your city, which form you used, when you need care to start and your child’s age range. Diana is emailed each signup.
Contact list — each of the requests above, and an email-updates signup, also adds your email address to Shortlist’s contact list with the kind of request and, where you gave them, your name and city.
First-party analytics — page views, link clicks, and feature use are recorded so Shortlist can see which tools parents actually use. Each event is stored with how long the page stayed open, a random visit code kept in this browser, a second random code kept in this browser that lets Shortlist tell a returning visitor from a new one (it names no one and is never linked to an account), your browser’s user-agent string, and what Cloudflare reports about the request: country, region, city, ZIP code, time zone, and the name of the network’s organization (for example, your internet provider). These are used to tell real visitors apart from automated crawlers. When you press Enter in a program search, the name you searched for is kept with that event, so Shortlist can see which programs parents look for and cannot find; anything that looks like a street address, an email, a phone number or a child’s age or birth date is dropped before it is stored. These events do not include your email, do not link back to your account, and are not shared with third parties.

What Shortlist doesn’t do

Your email address and any data tied to it are never sold, rented, or disclosed to third parties.
No third-party ad networks. No tracking pixels from advertisers, brokers, or social platforms embedded in the site.
No analytics products that monetize visitor data. No Facebook Pixel, no ad-platform retargeting, no data-broker integrations.
Shortlist sets no cookies.

Services the site loads

The site is served through Cloudflare, which handles every request and sees your device’s IP address and browser details. Pages load their fonts from Google Fonts, so Google receives your IP address and browser details. The sign-in code is loaded from jsDelivr. The commute map loads its map code from unpkg and its map tiles from OpenStreetMap; it sends the addresses you type to OpenStreetMap’s Nominatim service to find them, and the points on the map to the OSRM routing service to work out drive times. The neighborhood finder sends the address you type to Nominatim. The search box and a provider list’s map work the same way: an address you choose to look up is sent to Nominatim, the list’s map loads its code from unpkg and its tiles from OpenStreetMap, and a drive-time limit sends the home and work points to OSRM. Shortlist does not keep those addresses or points: they are not put in the page’s address, saved in your browser or sent with any event. Each of these services receives your IP address with the request.

Provider data

Provider information shown on Shortlist comes from public sources — state licensing databases, provider websites, public job postings, and IRS filings for nonprofits — or from data the provider has submitted directly through the Shortlist provider dashboard. See the methodology page for source-by-source detail.

Program alerts

If you ask Shortlist to watch a program, Shortlist keeps:

your email address;
the program;
whether you are still looking or your child goes there;
your child’s birth month and year, if you give it (never a day);
when you asked, when you confirmed, and when you stopped.

To run the emails, it also keeps a random code that makes your confirm and stop links work, the list of state reports already on file for the program when you confirmed (so you hear only about new ones), how many confirmation emails and which alert emails have gone out, and which kinds of note you turned off. Each email Shortlist sends is logged with your address, its subject and the time it went, and a copy stays in Shortlist’s Gmail sent mail. The request’s IP address and browser details are not stored with it. Your address is used only for the emails you asked for. Sending the form is counted in the site analytics described above, with the program and whether it went through, not your address.

The first email is a confirmation. Alerts start only after you confirm the address, and an unconfirmed request stops working after a week. Diana reads each batch of alerts before it goes out. Emails go out through Google’s Gmail service from [email protected]. To check that an address can receive mail, Shortlist looks up its domain (the part after the @) with Cloudflare’s DNS service; the rest of the address is not sent.

Every email has a stop link, and alert emails also work with your mail app’s own Unsubscribe button, which does the same as the stop link in that email. Stopping a program also deletes the birth month kept with it, and “Stop all Shortlist email” stops every program you watch, every question you asked a program, and the newsletter. The age email has a link that deletes the birth month on its own. A stopped request keeps the email address and program, with the date you stopped, so nothing restarts without a new confirmation. To have it removed entirely, email [email protected].

Questions for a program

If you tap “I want to know” on a program’s page and leave your email, Shortlist keeps:

your email address, once per inbox (Gmail treats dots and anything after a plus as the same inbox, so Shortlist does too);
the program;
which questions you asked it;
when you asked, when you confirmed, and when you stopped.

To run the emails it also keeps random codes that make your confirm and stop links work, how many confirmation emails have gone out, and when the program’s monthly note and your answer email went. The program is told how many parents asked, never who: your email is not passed to it. Each email Shortlist sends is logged with your address, its subject and the time it went, and a copy stays in Shortlist’s Gmail sent mail. The request’s IP address and browser details are not stored with it. Your address is used only for the emails you asked for. Diana reads each month’s program notes and answer emails before they go out.

Your question counts only after you confirm the address from the one email Shortlist sends when you ask. An unconfirmed question stops working after a week. Confirming also confirms a watch of the same program you asked for from the same address, and confirming that watch confirms these questions: one address, one confirmation. Every email has a stop link: “this program” stops your questions and any watch of it, and “Stop all Shortlist email” stops everything, the same as the link in a watch email. A stopped question keeps the email address, program and question, with the date you stopped, so nothing restarts without a new confirmation. To have it removed entirely, email [email protected].

Tuition you share

On some Seattle program pages you can share the tuition a program sent you: paste the email or tuition sheet, or attach a PDF. A PDF’s text is read in your browser and put in the box before you send; the file itself is not sent. For each share Shortlist stores:

the program;
the text in the box when you pressed Send, exactly as it was;
your email address as you typed it, and a copy in lower case with anything after a plus (and dots in a Gmail address) removed, used only to limit shares to three a day per inbox;
when you sent it, and when Shortlist emailed Diana about it.

Shortlist emails each share to Diana ([email protected]) with the program, the text and your address, so she can read it and reply to you. That email stays in Diana’s inbox and in Shortlist’s Gmail sent mail. Shortlist may publish the tuition it finds on the program’s page; your words, your name and your address are never published, and the program is not told who shared it. The request’s IP address and browser details are not stored with the share. Opening the box, attaching a file and sending are counted in the site analytics described above, with the program but nothing you entered and not your address.

A share is deleted from Shortlist’s database 180 days after you sent it. To have it deleted sooner, along with the email to Diana, email [email protected].

Tuition reports sent before November 2, 2026

Before November 2, 2026, the box sent a tuition report instead, confirmed by email. Those reports are kept and handled as below until they are deleted. For each report Shortlist stores:

the program;
what you entered: the amount and how often it is charged, the age group, full or part time, days a week if you chose them, the month you heard it, and a program name if you gave one;
the version of the wording you agreed to;
when you sent it, when you confirmed it, and the review’s outcome and reason.

Your email address is not stored with the report. To limit repeat reports, Shortlist keeps a one-way code made from it (anything after a plus, and dots in a Gmail address, count as the same inbox) and deletes that code two days after the report. Your confirm and manage links are random codes; Shortlist keeps only a one-way code made from each, so the links in your email are the only way back to your report, and anyone who has them can open it. A mail service that rewrites or scans links in email (as Outlook and many workplace filters do) receives them too. The confirmation email itself, which carries your address, both links and a summary of the tuition you reported, stays in Shortlist’s Gmail sent mail, as every email Shortlist sends does; its send log records the subject and time, not your address. The request’s IP address and browser details are not stored with the report. Opening the form, sending a report and confirming one are counted in the site analytics described above, with the program but nothing you entered and not your address.

A report counts only after you confirm it from that email. Confirming shows only that you can read that inbox: it does not show who you are or that the price is right. Shortlist reviews every report and publishes nothing during this test; the program is not told who reported. With the manage link you can see exactly what is stored, correct it (the correction replaces the report) or remove it at any time.

How long it is kept: an unconfirmed report is deleted after 7 days. When you remove a report, replace it with a correction, or it is not accepted in review, what you entered (the amount, how often, age group, schedule, days, the month you heard it and any program name) is deleted at once. For 30 days Shortlist then keeps only that a report was made for that program and when, the review’s reason if it was not accepted, and, for a report you removed, the one-way code of your manage link so the link can say it was removed. Then the record is deleted. Any other report is deleted 12 months after you sent it.

Separately from that 30-day record, when you remove or correct a report Shortlist keeps a second, smaller record for 13 months: the report’s random ID, whether it was removed or corrected, and the date. It names neither the program nor you, and holds nothing you entered. It exists so that restoring Shortlist’s database from a backup cannot bring a removed or replaced report back into use. A report that is not accepted in review has no such record.

Every deletion above is of Shortlist’s database. None of them deletes the confirmation email: its copy in Shortlist’s Gmail sent mail, with your address and the tuition summary, stays there, as does the copy in your own inbox.

Your shortlist

Tapping Save keeps the program in this browser’s local storage. Nothing is sent to Shortlist until you sign in, which you need only to share your list, turn on its alerts or keep it on another device. If you sign in, Shortlist keeps:

your email address, which is your account;
the programs you save, and when you saved each one;
if you make a link for your partner, a random code that makes the link work, when you made it, and when you turned it off;
if you tick “Email me when the state files a new report on a program I save,” when you ticked or unticked it, and for each program on your list what the program alerts below keep: a random code for the stop links, the state reports already on file when you ticked it (so you hear only about new ones), and which alert emails have gone out.

Signing in is run by Supabase, the database service Shortlist uses. To sign you in and keep you signed in, Supabase also keeps when your account was made, when you last signed in, and for each sign-in its time and the device’s IP address and browser details. If you use Continue with Google, it also keeps what Google sends with the sign-in: your name, email address and profile picture link. The Continue with Google button is loaded from Google when the sign-in box opens, so Google receives your device’s IP address and browser details then, along with Google’s own cookies if you are signed in to Google in this browser. The sign-in email goes out through Google’s Gmail service from [email protected], is logged with your address, its subject and the time it went, and a copy stays in Shortlist’s Gmail sent mail. Its link names the programs saved in this browser, so they reach your list even if the link opens in another browser. Signing in does not add you to any newsletter or email list. If you tick the alert box, Shortlist emails you when the state posts a new report on a program on your list, and on any program you save later. Every one of those emails has a stop link, “Stop all Shortlist email” also unticks the box, and you can untick it on Your shortlist at any time. Removing a program from your list stops its alerts.

Anyone with the link for your partner sees the names of the programs on your list and what each program’s page shows. The list is headed “Shortlist”, without your name or email. They can’t change the list. You can turn the link off from Your shortlist at any time, and anyone who opens it afterwards is told it was turned off. Open in ChatGPT, Claude or Gemini uses the same link: it opens your assistant with a question pointing at a plain-text copy of your list, which carries the same things (the programs and what each program’s page shows) and nothing about you. The assistant’s company receives the question and what it reads, under its own privacy terms. For Gemini, the question is put on your clipboard for you to paste. Turning the link off stops the plain-text copy too. To have your account and list deleted, email [email protected].

Cookies and local storage

Shortlist uses local storage to remember which programs you’ve saved (with or without an account), your last-viewed neighborhood, which questions you asked a program from this browser (so its page does not offer them again), and similar preferences. It also keeps the two random codes the analytics above are stored with. Signing in keeps a sign-in token in this browser’s local storage until you sign out; Shortlist sets no cookies. There are no advertising cookies and no cross-site trackers.

Data retention

If you sign in and later want your account and saved data removed, email [email protected]. Account data and saved-shortlist data are deleted on request. Analytics events, which are never linked to your account, are retained as long as they’re useful for product decisions.

Children

Shortlist is built for parents researching childcare; it is not directed at children. Shortlist does not knowingly collect personal information from children under 13.

Changes

If this policy changes, the “Last updated” date at the top of the page changes with it. Material changes will be flagged on the homepage.

Questions

If anything here is unclear, or if you want a copy of any data Shortlist holds about you, email [email protected].

See also: Terms & Disclaimer and Methodology.