Privacy

1. What we collect

• Account information: email address, optional display name, optional avatar URL.
• Family profile (optional): your city, your children's first names or nicknames (no surnames), age bucket (not precise birthdate), interests, considerations.
• Contributions: ratings, structured tags, optional free-text story, the program you contributed to.
• Activity: programs you save, deadlines you subscribe to, Copilot queries (if you use it).
• Technical: standard server logs (IP, user agent, timestamps) retained for 30 days for security; product analytics events (anonymized).

2. Legal basis (GDPR / UK GDPR)

For users in the UK, EU, and EEA, our legal basis for processing is:

• Contract — to provide the service you signed up for (account, profile, contributions).
• Legitimate interests — limited security logging and abuse prevention.
• Consent — for marketing emails and any non-essential analytics. You can withdraw consent at any time from your settings.

3. Your rights

Wherever you live, you can ask us to:

• Show you a copy of your data (data portability)
• Correct anything that's wrong
• Delete your account and contributions ("right to be forgotten")
• Limit how we process your data
• Object to any specific processing

You can self-serve most of these from your settings. For anything else, email us at privacy@camplee.fun. We respond within 30 days.

4. Children's privacy (COPPA, GDPR-K)

Camplee is not directed to children under 13 (or 16 in some EU countries). We do not knowingly collect personal information from children. Children do not have their own accounts on Camplee — they are only mentioned as attributes of a parent account, and only with the parent's input.

If you believe a child has provided us with personal information, please email privacy@camplee.fun and we will delete it.

5. California (CCPA / CPRA)

California residents have the right to know what personal information we collect, to delete it, to correct it, and to opt-out of "sale" or "sharing." We do not sell or share your personal information for targeted advertising. To exercise these rights, email privacy@camplee.fun.

6. Subprocessors

We rely on the following service providers to operate Camplee:

• Supabase (database + auth + storage) — US-hosted by default; EU residency available on request.
• Vercel (hosting + serverless functions).
• Cloudflare R2 (image storage).
• Resend (transactional email).
• OpenAI / Anthropic (AI summarization; no personally identifiable contribution content is sent for training).
• Google Analytics (aggregate, anonymized usage analytics).

7. Data retention

We keep your account and contributions as long as you want them public. When you delete your account, contributions are anonymized (removed from your profile, retained for the public record under "by a Camplee parent"), unless you specifically request full deletion of your contributions too.

8. Cookies & analytics

We use first-party cookies for authentication. We use Google Analytics for aggregate usage analytics. If you're in the EU/EEA/UK, we ask consent before any non-essential analytics fire. If you're in California, you can opt out of any analytics at any time from your settings.

9. Contact

Questions or requests: privacy@camplee.fun. We aim to respond within 7 business days, and always within 30 days for formal data-subject requests.