userid could be anything, results will always be returned (this means anyone could track anyone else) . Childid is the id of the person to track. userid is 'encrypted' by caesar cipher + 7. currentdate is the day requested.
User ids could be easily brute forced. Also, the requests are only http, so traffic could be easily sniffed for aquiring user ids.
Use HTTPS, only allow authorized users to access other peoples data, real encryption.