Consent & privacy -- the honest version, repeated faithfully
What the family does with a camper's data, restated plainly
Camp Manager's Minor Consent Graph is the spine of the operations side: a machine-readable, revocable consent record per camper that governs forms, rosters, pickup, medical visibility, communications, and photography from one source of truth. Camp Photos matches a parent to their own camper by a permission-checked roster lookup, never a face scan switched on without a parent's say-so, and a camper's photo becomes sellable only when a released consent allows it. Underneath that posture, access is role-scoped and fail-closed: a staff member on shift reaches only what their assigned role is granted, directory listings can be suppressed, and no raw camper PII is surfaced beyond the role-scoped staff who genuinely need it -- privacy carried by how access is structured, not by a policy asterisk.
Facial recognition is off by default by design, not by omission -- the deliberate, safer choice for a roster made up of minors, not a convenience feature we simply have not gotten to yet. When a parent does opt in, the face template stays inside our own private system with no outside recognition service connected to it, it matches only that family's own photos, and withdrawing the opt-in stops the matching at the gate. The retention window -- about a year -- is what marks that template due for destruction; the step that destroys it is not finished, and this page will not claim a deletion the platform cannot yet show you. This page does not itself hold a camper record, a roster, or a photo -- it restates the same posture the two built engines already document on their own sites, and never claims more than they do.