Privacy Policy

Last updated: July 20, 2026

This Privacy Policy explains how Kateri ("we", "us") collects, uses, and shares information when you use the Kateri camp management platform. It complements each camp's own privacy practices — the camp operating your account is the "data controller" for the family and camper information they collect from you, and Kateri acts as their "data processor".

1. What we collect

Account information

Your name, email address, and password (stored hashed).
Optional: phone number, mailing address, family relationships.

Camper and registration information

Names, dates of birth, gender, grade level, and school of your campers.
Emergency contact names and phone numbers.
Medical information you choose to provide (allergies, medications, doctor, insurance).
Photo, ID, or vaccination documents you upload for your camper.
Consent form signatures, custom question answers, and add-on selections.

Payment information

Payment card details are collected and stored by our payment processor (currently Stripe). Kateri stores only the identifiers we need to reconcile a charge (session id, payment intent id, amount, and status). We never see or store your full card number.

Usage information

We collect basic technical logs (IP address, browser, request path, timestamps) for security, abuse prevention, and debugging.

2. How we use it

To operate the platform: registrations, rosters, payments, medical logs, communications.
To secure the platform: rate-limiting, fraud prevention, audit logs.
To send you transactional messages (registration confirmation, waitlist, packets).
To provide customer support when you or your camp contact us.

We do not sell your personal information. We do not use camper data or minors' data for advertising, ever.

3. Who sees what

Your camp's staff — the camp operating your registration can see the information you submit to that camp (camper details, medical, contacts, documents). Access is scoped to their camp only.
Other camps — no. Each camp's data is isolated by row-level security in the database. Camp A cannot see Camp B's rows.
Kateri team — a small number of engineers may access data to investigate bugs or security incidents. Access is logged.
Service providers — subprocessors that host or transmit data on our behalf (see section 5).

4. Security

All traffic is served over HTTPS/TLS.
Row-level security (RLS) enforces per-camp and per-user data isolation in the database.
Sensitive files (insurance cards, camper documents, photos) live in private buckets and are served via short-lived signed URLs.
Passwords are checked against known-breached-password lists during signup and password reset.

No system is perfectly secure. If you believe you have found a vulnerability, please contact your camp administrator so we can investigate promptly.

5. Subprocessors

Kateri uses these third-party service providers:

Supabase — database, authentication, file storage.
Cloudflare — application hosting and edge network.
Stripe — payment processing.
Twilio — SMS delivery (when SMS features are enabled by your camp).
Email delivery provider — for transactional email.

6. Retention

We retain your data for as long as your account is active and for a reasonable period afterward for accounting, dispute resolution, and legal compliance. Camps may retain historical registration data for their own records. You may request deletion of your parent account at any time; camper medical documents you uploaded will also be deleted, subject to any legal retention obligations of the camp.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete personal information about you. To exercise these rights, first contact the camp that holds your registration (they are the data controller). If you need help reaching Kateri directly, contact your camp administrator.

8. Children's privacy

Kateri is not intended for children under 13 to create their own accounts. Parents and guardians register children as campers on the parent's account. See our COPPA notice for details on children's information.

9. Changes

We will post any changes to this Policy here and update the "Last updated" date above. Material changes will be announced by email or in-app notice.