Yup, one password that they need to use to login, along with the email address that you've whitelisted for them. So its possible that someone could guess the password and their email address to get unauthorized access. I've debated a lot on this one and from the many parents I spoke to, this seemed to be a good middle ground between having some security and keeping it simple for family members to use.

The links in the emails have a special link that unique to each subscribers. These links at the moment do not expire but thats something I'm changing soon. All the images in the emails expire after a week.

I wrote a blog post on how I handle security on the app: http://blog.getbabydigest.com/post/88405261016/privacy-and-s...