Privacy Policy

Account information: name, email, phone number, authentication information, and information you provide.

Family information: family name, member names and photos, party size, contact information, and camp-related information.

Camp information: campsite/camp-night selections, meals, jobs, orders, shared items, costs, invoices, payment status, refund records, and communications.

Dietary information may be entered for meal coordination. Users should not enter unnecessary medical information.

Photos are stored in private storage and served through temporary signed links expiring after approximately one hour.

Organizers may import names and phone numbers from camp spreadsheets.

The app uses browser local storage for sign-in persistence and offline caching. Hosting infrastructure may generate standard analytics and runtime error reports. No advertising cookies or third-party behavioral tracking are used.

Additional notices are shown within the app at the point specific information is collected, such as when a family enters dietary information or uploads a photo, explaining why that information is requested and how it is used.

Wildwood does not collect or store campers' full payment-card numbers. Card payments use Stripe's hosted checkout.

Wildwood may receive limited Stripe information: masked/last-four representation of the organizer's key, live/test status, account label, amount, fee, reference code, transaction IDs, receipt link, and date.

The organizer's Stripe secret key is encrypted using AES-256-GCM and cannot be read back through the application.

We use information to operate accounts and camps, coordinate meals/nights/jobs/items, display appropriate camp information, calculate costs and invoices, facilitate Stripe reconciliation, send service communications, provide security and offline functionality, prevent abuse, and comply with law.

Wildwood does not sell personal information and does not use Camp Companion for advertising or cross-context behavioral advertising.

Other families in a camp may see family name, family members' names and photos, party size, meal and night sign-ups, job assignments, shared-item sign-ups, email address, and phone number.

The camp cost table may show what each family owes and has spent.

Other families do not see dietary notes, private Venmo/Zelle/PayPal details, individual invoices merely from camp participation, Stripe information, or account credentials.

Photos are stored in a private storage bucket and are not intentionally public. Only signed-in users with appropriate access to the applicable camp may view them. Temporary signed links expire after approximately one hour.

Invoice links work without sign-in and expire by default after 30 days. A camp administrator may configure a shorter or longer period.

Anyone with an active link may view that specific invoice. Sharing the link shares access to that invoice only; it does not provide access to the account, family account, camp roster, other invoices, Stripe information, or other features.

After expiration, the link cannot be used to access the invoice. The underlying invoice may remain available to the authorized user after signing in.

Information may be shared with appropriate camp participants and organizers, service providers needed to operate the Service, Stripe when an organizer enables card payments, email delivery providers, and parties when required by law or necessary to protect the Service.

Wildwood does not share personal information with third parties for their own advertising purposes.

Camp Companion accounts are intended for adults 18 or older. Children do not have independent accounts; parents or guardians may enter children's information in a family account.

If Wildwood becomes aware that it has collected personal information directly from a child under 13 in circumstances requiring parental consent, it will take steps required by applicable law.

There is no automatic deletion of camp data after a fixed period. Camp data generally remains until the organizer or authorized super administrator deletes the camp. Cancelled camps may retain data until deleted.

Family account information remains until the user removes it, subject to legal, security, backup, and operational requirements.

Expiration of an invoice link does not delete the underlying invoice.

When an organizer creates a camp and invites families to participate, the organizer generally determines what information is collected from participating families and how it is used within that camp, such as meal choices, job sign-ups, and cost allocations. In that role, the organizer acts as the data controller for that camp's participant information, and Wildwood acts as a service provider or processor that hosts and processes the information on the organizer's behalf, and for Wildwood's own permitted purposes described in this Policy, such as operating and securing the Service.

Organizers are responsible for having an appropriate basis to invite and collect information about the families and individuals who join their camp.

Depending on where you live and applicable law, you may have rights concerning your personal information, including rights to access, correct, or delete your information, and to object to or restrict certain processing. Section 12 describes rights specific to California residents. Section 13 describes rights specific to individuals in the European Economic Area, United Kingdom, and Switzerland.

California residents may have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to:

• Know and access the personal information we collect, use, disclose, and retain about you
• Delete personal information we have collected from you, subject to certain exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information, where applicable
• Limit the use and disclosure of sensitive personal information, where applicable
• Not be discriminated against for exercising any of these rights

The only sensitive personal information Camp Companion may collect is dietary information entered for meal coordination. Wildwood uses this information solely to coordinate meals and does not use or disclose it for any purpose that would require a right-to-limit request.

Wildwood does not currently respond differently to browser Do Not Track signals. Wildwood honors the Global Privacy Control (GPC) as a valid opt-out preference signal, consistent with applicable law, although Wildwood does not currently sell or share personal information.

To submit a CCPA request, contact malindawalters@wildwoodroots.com. We may ask you to verify your identity before fulfilling certain requests.

Wildwood does not currently sell personal information or share it for cross-context behavioral advertising, so there is no sale/share opt-out to exercise at this time.

If you are located in the European Economic Area, United Kingdom, or Switzerland, the following applies in addition to the rest of this Policy.

Legal bases for processing. We process personal information under one or more of the following legal bases: performance of a contract with you, such as to operate your account and coordinate a camp you join; our legitimate interests, such as to secure and improve the Service; your consent, such as where you choose to enter optional dietary information; and compliance with legal obligations.

Your rights. Subject to applicable law, you may have the right to access, correct, or erase your personal information, restrict or object to certain processing, receive a copy of your information in a portable format, and withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your local data protection supervisory authority.

International transfers. Wildwood's infrastructure providers, including Lovable Cloud (Supabase/AWS) and Stripe, may process information in the United States or other countries outside the EEA/UK. Where required, Wildwood relies on appropriate safeguards, such as Standard Contractual Clauses, for such transfers.

To exercise these rights, contact malindawalters@wildwoodroots.com.

Lovable Cloud supports hosting, database, authentication, and related infrastructure, including underlying Supabase/AWS infrastructure.

Stripe supports card payments when enabled by an organizer.

Lovable's email delivery service sends service emails.

Google Fonts provides website typefaces; Google may receive information such as a requesting device's IP address when fonts are requested.

Wildwood uses reasonable administrative, technical, and organizational measures designed to protect information. No method of electronic storage or transmission is completely secure.

Service-related communications may include account notices, invitations, trip reminders, invoice notices, payment-related notices, security alerts, support responses, and legal-policy updates. Service emails may be sent from noreply@notify.wildwoodroots.com.

We may update this Privacy Policy as practices or legal requirements change and will update the effective date.

Wildwood Roots · info@wildwoodroots.com · camp.wildwoodroots.com