Privacy Policy

Last updated: [DATE TO BE FILLED ON PUBLISH]

sk8camp ("we", "us", "our") respects your privacy. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.

This Policy applies to the sk8camp website, mobile apps, and related services (the "Platform").

1. Quick Summary (Not a Substitute for the Full Policy)

• We collect the minimum information we need to run the Platform: account info, booking info, payment info (through Stripe), location for finding nearby parks, and basic device/usage data.
• We do not sell your personal information for money.
• We use a small set of vendors (Supabase, Stripe, Resend, Sentry, PostHog) to operate the service.
• California residents have specific rights under the CCPA/CPRA, summarized in Section 9.
• We do not knowingly collect personal information from children under 13. For users aged 13 to 17, we require parent/guardian involvement.

2. Information We Collect

2.1 Information you give us

• Account information: name, email, phone number, password (stored hashed), profile photo (optional).
• Parent/guardian information: for accounts that manage minors, the guardian's name, contact info, and waiver acknowledgements.
• Minor information: for booked minors, first name, age (or birthdate), skill level, any relevant medical or accessibility notes the parent chooses to share with the Coach.
• Booking information: lesson date/time, park location, Coach selected, communications with Coach, reviews, cancellations.
• Payment information: payment card details are collected and stored by Stripe, not by us. We store a token and the last four digits.
• Coach onboarding information: for Coaches, identity verification data, tax info, banking info via Stripe Connect, background-check results where applicable.
• Support communications: anything you send us when you contact support.

2.2 Information collected automatically

• Device and usage data: device type, OS, app version, IP address, crash logs, screens viewed, taps, time spent. Collected via Sentry (errors) and PostHog (product analytics).
• Location data: if you grant location permission, we use coarse or precise location to find skateparks near you. You can revoke this in device settings.
• Cookies and similar tech: the web app uses cookies and local storage for login, preferences, and analytics. Mobile apps use device identifiers in similar ways.

2.3 Information from third parties

• Stripe: payment confirmations, payout status, dispute notices.
• Background-check providers (Coaches only): results of screenings.
• Public sources: if a Coach links a public Instagram/TikTok profile, we may display that info.

3. How We Use Information

We use personal information to:

• create and operate your account;
• match skaters with Coaches and process bookings;
• process payments and payouts (Stripe);
• communicate with you (booking confirmations, reminders, support, product updates);
• handle refunds, disputes, safety reports, and abuse investigations;
• comply with legal obligations (taxes, subpoenas, mandatory reporting);
• improve the Platform and develop new features;
• prevent fraud, harm, and abuse;
• send marketing communications, where permitted (you can opt out at any time).

4. Legal Bases (for Users Outside the U.S., If Any)

The Platform is intended for users in the United States, currently California only. If you access the Platform from outside the U.S., you do so at your own risk and consent to the transfer of your data to the U.S.

5. How We Share Information

We share personal information only with:

5.1 Coaches and skaters

When you book a lesson, we share the necessary info with the Coach (skater name/first name, age, skill level, contact info if needed, location). Coaches see only what is necessary to teach the lesson.

5.2 Service providers (sub-processors)

• Supabase: primary database and authentication.
• Stripe / Stripe Connect Express: payment processing and Coach payouts.
• Resend: transactional email delivery.
• Sentry: error and crash monitoring.
• PostHog: product analytics.
• Cloud hosting: [HOST, e.g., AWS / Vercel / Cloudflare; confirm].
• Background-check provider (Coaches only): [VENDOR TBD].

We require service providers to handle personal information only for the purposes we direct.

5.3 Legal and safety

We may disclose information when required by law, court order, or subpoena, or when we believe in good faith that disclosure is necessary to (a) protect the safety of any person, especially a minor, (b) investigate fraud or abuse, or (c) defend legal claims.

5.4 Business transfers

If sk8camp is involved in a merger, acquisition, financing, or asset sale, personal information may be transferred. We will notify you of any change in ownership or use of your data.

5.5 With your consent

Any other sharing will be done only with your consent.

6. No Sale of Personal Information; Sharing for Behavioral Advertising

We do not sell personal information for money. We currently do not share personal information for cross-context behavioral advertising. If that changes, we will update this Policy and provide a "Do Not Sell or Share My Personal Information" link as required by California law.

7. Data Retention

We keep personal information for as long as needed to provide the Platform and as required by law. General guidelines:

• Account data: while the account is active, plus up to 24 months after deletion (for fraud, dispute, and tax purposes).
• Booking and transaction records: at least 7 years, to meet tax and accounting requirements.
• Payment records: per Stripe's retention policies.
• Support emails: up to 24 months.
• Crash and analytics data: up to 24 months.
• Background-check records (Coaches): per applicable law.

8. Children's Privacy

8.1 Under 13

The Platform is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us at [PRIVACY EMAIL] and we will delete it.

8.2 13 to 17

Users aged 13 to 17 may use the Platform only with verifiable parent or legal guardian involvement. The parent/guardian must agree to the Terms, sign the Liability Waiver, and oversee the minor's account and bookings.

8.3 Information about minor skaters

When a parent books a lesson for a minor, the parent provides limited information about the minor (first name, age, skill level, optional notes). The parent is responsible for the accuracy of that information and for the minor's safety on the Platform.

9. Your California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following rights regarding your personal information, subject to verification and exceptions:

9.1 Right to know

You can request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the categories of third parties with whom we shared it, for the prior 12 months (or longer where the CPRA's extended look-back applies).

9.2 Right to delete

You can request that we delete personal information we have collected from you, subject to legal and operational exceptions (e.g., completing a transaction, complying with legal obligations, security).

9.3 Right to correct

You can request that we correct inaccurate personal information.

9.4 Right to opt out of sale or sharing

You can opt out of the sale of personal information and of sharing for cross-context behavioral advertising. As stated in Section 6, we do not currently sell or share personal information in those senses.

9.5 Right to limit use of sensitive personal information

We do not currently use sensitive personal information beyond the limited purposes permitted by the CPRA without a "Limit Use" option.

9.6 Right to non-discrimination

We will not discriminate against you for exercising these rights.

9.7 How to exercise your rights

Email [PRIVACY EMAIL] or use the in-app privacy controls. We will verify your identity before fulfilling requests. You may designate an authorized agent under California law. We will respond within the timeframes required by the CCPA/CPRA (generally 45 days, with one possible 45-day extension).

9.8 Shine the Light

California residents may request once per year the categories of personal information disclosed to third parties for direct-marketing purposes. As we do not share for third-party direct marketing, our standard response will reflect that.

10. Security

We use technical and organizational measures to protect personal information, including encryption in transit, hashed passwords, access controls, and vendor due diligence. No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you as required by California law (Cal. Civ. Code § 1798.82).

11. Your Choices

• Account info: update via account settings.
• Marketing email: unsubscribe via the link in any marketing email.
• Push notifications: disable in device settings.
• Location: disable in device settings.
• Cookies: manage in browser settings.
• Delete account: in app settings or email [PRIVACY EMAIL].

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide reasonable notice (in-app banner or email). The "Last updated" date at the top reflects the latest version.

13. Contact

Privacy questions, requests, or complaints:

sk8camp, Attn: Privacy [MAILING ADDRESS] Los Angeles, California [PRIVACY EMAIL]