Privacy policy

When a parent signs a permission and medical release, their own device locks the form with the leader's public key before anything is sent. What we store is a locked blob: scrambled data that cannot be read in storage, in backups, or in transit.

Only the leader's forms passcode can unlock it. That passcode is never sent to us and never stored anywhere. Not even ActivitySlips can read a signed form.

We can see the things needed to run the app: event details a leader types in, RSVP names and answers, checklist progress, and when forms were signed.

We cannot see the contents of a signed form, including health conditions, medications, allergies, insurance details, or signatures. Those exist as readable information only on the parent's device and, after unlocking, on the leader's device.

Families respond through a private link that is long and unguessable. Anyone with the link can view that event's family page, so leaders should share it only with the families involved.

A family that wants to return later uses a second private link, created just for their RSVP. It works like a saved key on their own device, so there is no password to forget and no account to breach.

Outside the locked form, we store only what an event needs: the youth's name, the parent's name, a contact for reminders, the RSVP answer, and which checklist items are done.

Health and emergency details live only inside the locked form. They never appear in lists, reminders, search results, or any page.

Data is stored on Lovable Cloud, hosted on managed, encrypted infrastructure. Each leader's events, RSVPs, and forms are isolated so one leader's account can never read another's.

Leader accounts are protected by their sign-in. Signed forms add a second layer on top: even someone with full access to the stored data cannot open them without the leader's forms passcode.

Signed forms are kept until the leader deletes them, so a slip can be found months later if something happens. Leaders can delete a single form, download forms for their own records, or delete an entire event and everything attached to it.

If a leader loses their forms passcode, the saved forms can never be recovered. That's by design. The only option is to reset the locked box, which permanently deletes the unreadable forms.