Privacy Policy

COMMUNITY ACTIVITIES — PRIVACY POLICY Last Updated: March 22, 2026 IMPORTANT: THIS IS A TEMPLATE FOR DEVELOPMENT PURPOSES. It must be reviewed and customized by a licensed attorney before use in production. This Privacy Policy describes how Community Activities ("we," "us," or "our") collects, uses, shares, and protects your personal information when you use our platform ("Platform"). We are operated in the Commonwealth of Virginia. We take your privacy seriously, especially because our Platform involves information about children. Please read this policy carefully. --- 1. INFORMATION WE COLLECT We collect the following types of information: Information You Provide Directly: - Account information: your name, email address, and password. - Profile information: your location (city, state, neighborhood), profile photo, and bio. - Children's information: your children's first names, ages, and gender, as provided by you as the parent or guardian. This information is used to match your family with age-appropriate activities. - Activity information: if you are a Host, details about activities you create (descriptions, location, schedule, age ranges, pricing). - Booking information: records of activities you book for your children. - Communications: messages you send through the Platform to other users or to us. - Payment information: when payments are enabled, payment details are collected and processed by Stripe. We do not store your full credit card number on our servers. Information Collected Automatically: - Device and browser information (browser type, operating system, device type). - IP address and approximate location. - Usage data (pages visited, features used, timestamps). - Cookies and similar tracking technologies (see Section 8 below). 2. CHILDREN'S PRIVACY AND COPPA Community Activities is designed for use by parents and legal guardians who are 18 years of age or older. Children do not create accounts or use the Platform directly. However, we do collect limited information about children (first names, ages, gender) as provided by their parents or guardians. This information is necessary to match families with age-appropriate activities and to help Hosts prepare for their sessions. We handle children's information with extra care: - Children's information is only collected from and with the consent of their parent or guardian. - Children's information is only shared with Hosts when a booking is confirmed, and only to the extent necessary to conduct the activity. - We do not sell children's information to third parties. - We do not use children's information for advertising or marketing purposes. - Parents can review, update, or delete their children's information at any time through their account settings. If you believe we have inadvertently collected information directly from a child under 13, please contact us immediately and we will delete it. 3. HOW WE USE YOUR INFORMATION We use your information to: - Operate and maintain the Platform. - Match families with activities in their community. - Facilitate bookings and communications between Hosts and Bookers. - Process payments (when enabled). - Send you important updates about your account, bookings, and activities. - Send you notifications and reminders about upcoming activities. - Improve and develop the Platform based on usage patterns. - Ensure safety and enforce our Terms of Service. - Respond to your questions and support requests. - Comply with legal obligations. We will not use your information for purposes unrelated to the Platform without your consent. 4. THIRD-PARTY SERVICES We use the following third-party services to operate the Platform. Each of these services has its own privacy policy governing how they handle your data: - Supabase: Database hosting and user authentication. Stores account data, profiles, and activity information. - Stripe: Payment processing (when payments are enabled). Handles payment card information securely. - Vercel: Web hosting and content delivery. Processes web requests and serves the Platform. - Resend: Transactional email delivery. Used to send booking confirmations, notifications, and account-related emails. - Sentry: Error monitoring and performance tracking. Helps us identify and fix technical issues. May receive anonymized usage data. - Inngest: Background job processing. Handles scheduled tasks such as booking reminders and notifications. We select third-party services that maintain strong security and privacy practices. We do not sell your personal information to any third party. 5. HOW WE SHARE YOUR INFORMATION We share your information only in the following limited circumstances: With Other Community Members: - When you book an activity, the Host will see your name, your children's first names and ages, and any information you include in booking messages. - When you host an activity, Bookers will see your name, profile information, and activity details. - Community members may see limited profile information (name, neighborhood) within the community directory. With Service Providers: - We share information with the third-party services listed in Section 4, solely for the purpose of operating the Platform. For Legal Reasons: - We may disclose information if required by law, court order, or legal process. - We may disclose information to protect the rights, safety, or property of Community Activities, our users, or the public. In a Business Transfer: - If Community Activities is acquired, merged, or sells substantially all of its assets, your information may be transferred as part of that transaction. We will notify you of any such change. 6. DATA RETENTION We retain your information for as long as your account is active or as needed to provide you with the Platform. If you delete your account: - Your profile information and children's information will be deleted within 30 days. - Booking records may be retained in anonymized form for legal and operational purposes. - Communications with other users may remain visible to those users. - Payment records may be retained as required by financial regulations. We may also retain certain information as required by law or for legitimate business purposes (such as resolving disputes or enforcing our Terms). 7. SECURITY We take reasonable measures to protect your information, including: - Encryption of data in transit (HTTPS/TLS). - Encryption of sensitive data at rest. - Secure authentication through Supabase Auth. - Access controls limiting who can access your data internally. - Regular review of our security practices. However, no system is perfectly secure. We cannot guarantee the absolute security of your information. If we become aware of a security breach that affects your personal data, we will notify you as required by applicable law. 8. COOKIES AND TRACKING We use cookies and similar technologies to: - Keep you logged in to your account. - Remember your preferences. - Understand how you use the Platform so we can improve it. - Ensure the Platform functions correctly. Types of cookies we use: - Essential cookies: Required for the Platform to function (authentication, security). These cannot be disabled. - Analytics cookies: Help us understand usage patterns and improve the Platform. You can opt out of these through your browser settings. We do not use cookies for third-party advertising. We do not track you across other websites. Most browsers allow you to control cookies through their settings. Disabling essential cookies may prevent you from using parts of the Platform. 9. YOUR RIGHTS You have the following rights regarding your personal information: - Access: You can view your personal information at any time through your account settings. - Correction: You can update or correct your information through your account settings. - Deletion: You can request deletion of your account and personal information by contacting us or through your account settings. We will process deletion requests within 30 days. - Data Portability: You can request a copy of your personal data in a portable format. - Opt-Out: You can opt out of non-essential communications through your notification settings. To exercise any of these rights, contact us at the address listed below or use the relevant features in your account settings. 10. VIRGINIA AND US PRIVACY LAW COMPLIANCE We operate in the Commonwealth of Virginia and comply with applicable US privacy laws, including: - The Virginia Consumer Data Protection Act (VCDPA), which provides Virginia residents with rights to access, correct, delete, and opt out of certain data processing. - The Children's Online Privacy Protection Act (COPPA), as described in Section 2 above. If you are a Virginia resident, you have additional rights under the VCDPA, including the right to opt out of the processing of personal data for targeted advertising, sale of personal data, and profiling. We do not currently engage in any of these activities. If you believe we have not adequately addressed your privacy concerns, you may contact the Virginia Attorney General's office. 11. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top and notify you through the Platform or via email. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should stop using the Platform and delete your account. 12. CONTACT US If you have questions about this Privacy Policy or our data practices, please contact us at: [Contact Email Address] [Mailing Address] Community Activities Commonwealth of Virginia --- REMINDER: THIS IS A TEMPLATE FOR DEVELOPMENT PURPOSES. It must be reviewed and customized by a licensed attorney before use in production.