Privacy Policy

Last updated: April 18, 2026

1. Overview

Summer Camp Portal ("the Platform") is a self-hosted, multi-tenant software platform that helps camp organizations manage registrations, volunteer training, event scheduling, and related operations.

2. Information We Collect

Account information

When you create an account, we collect your name, email address, and password. If you sign in with Google, we receive your name and email from Google. We do not store your Google password.

Registration and participant information

When registering for a camp session or event, we collect participant names, dates of birth (for youth programs), household address, and emergency contact details. For general events (conferences, summits), we collect attendee names and optional email addresses.

Health and medical information

For youth camp programs that require health records, we collect medical conditions, allergies, dietary restrictions, medications, and emergency notes. This information is provided by parents or guardians and is used solely for the safety of participants. Health data is access-restricted to authorized medical and administrative staff.

Volunteer information

Volunteer profiles may include biographical information, skills, experience, occupation, emergency contacts, and background check status. Volunteers choose whether to make their profile visible in the volunteer directory.

Payment information

Payments are processed through Stripe. We do not store credit card numbers, bank account details, or other payment credentials on our servers. Stripe's privacy policy governs the handling of your payment data. We retain transaction records (amounts, dates, invoice references) for accounting and receipting purposes.

Training and activity data

We track training module progress (video completion, quiz scores, completion dates), event selections, check-in records, and feedback submissions to support training compliance and event management.

Technical data

We log IP addresses and timestamps for security auditing purposes (login attempts, administrative actions). We do not use tracking cookies or third-party analytics.

3. How We Use Your Information

We use collected information to:

  • Process registrations and payments for camp sessions and events
  • Ensure participant safety through health records and emergency contacts
  • Manage volunteer applications, training, and compliance
  • Facilitate event scheduling, badge generation, and check-in
  • Send transactional communications (registration confirmations, training notifications, board meeting invites)
  • Generate reports for organizational administration
  • Maintain security through audit logging and brute-force protection

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Data Access and Role-Based Controls

Access to your data is controlled through a role-based permission system. Different staff roles have access to different types of information:

  • Parents/guardians can view and edit their own household, camper, and registration information
  • Volunteers can manage their own profile and training records
  • Affiliate staff can access registrations, volunteer records, and session data for their specific affiliate only
  • Medical staff can access health records for their affiliate
  • Central administrators can access organization-wide data

Staff members from one affiliate cannot access data belonging to another affiliate. This isolation is enforced at the database query level.

5. Data Storage and Security

  • Data is stored in a managed PostgreSQL database with encrypted connections (SSL)
  • Uploaded files (photos, documents, training proofs) are stored in private cloud storage with time-limited, signed URLs — files are never publicly accessible
  • Sensitive API credentials are encrypted at rest using industry-standard encryption
  • All web traffic is encrypted via HTTPS with HSTS enforcement
  • Login protection includes rate limiting (account lockout after repeated failures) and optional two-factor authentication
  • Content Security Policy headers protect against cross-site scripting
  • All significant administrative actions are recorded in an append-only audit log

6. Third-Party Services

The Platform uses the following third-party services to operate:

Background check services, if used by the Organization, are governed by that service provider's own privacy policy and applicable law.

7. Children's Privacy

The Platform processes data about minors (campers) as provided by their parents or legal guardians. We do not knowingly collect personal information directly from children under 13 without parental consent. All camper data is entered and managed by parent/guardian accounts.

Health records, photos, and other sensitive information about minors are subject to strict access controls and are never made publicly accessible. Camper photos are stored with signed, time-limited URLs and excluded from public-facing pages.

8. Your Rights

You have the right to:

  • Access your personal data through your account dashboard
  • Correct inaccurate information by editing your profile or contacting staff
  • Request deletion of your data through the Platform's data deletion request feature or by contacting the Organization
  • Export your data by requesting it from the Organization's administrators
  • Opt out of the volunteer directory at any time by toggling your profile visibility

Deletion requests are processed by the Organization's administrators. Certain records (financial transactions, audit logs) may be retained as required by law or for legitimate compliance purposes.

9. Data Retention

Account and registration data is retained for as long as your account is active or as needed to fulfill the purposes described in this policy. The Organization determines specific retention periods based on their operational and legal requirements. Financial records are retained as required by applicable tax law.

10. Organization-Specific Policies

Each organization using this Platform may maintain additional privacy practices specific to their jurisdiction and operations.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the Platform. Continued use of the Platform after changes constitutes acceptance of the updated policy.

12. Contact

For privacy questions or concerns, contact the organization operating this instance of the Platform.