Consent & privacy -- the honest version, repeated faithfully
What the family does with a camper's data, restated plainly
Camp Manager's Minor Consent Graph is the spine of the operations side: a machine-readable, revocable consent record per camper that governs forms, rosters, pickup, medical visibility, communications, and photography from one source of truth. Camp Photos matches a parent to their own camper by a permission-checked roster lookup, never a face scan switched on without a parent's say-so, and a camper's photo becomes sellable only when a released consent allows it. Underneath that posture, access is role-scoped and fail-closed: a staff member on shift reaches only what their assigned role is granted, directory listings can be suppressed, and no raw camper PII is surfaced beyond the role-scoped staff who genuinely need it -- privacy carried by how access is structured, not by a policy asterisk.
Facial recognition is a capability we are building and is not turned on today by design, not by omission -- the deliberate, safer choice for a roster made up of minors, not a convenience feature we simply have not gotten to yet. Face matching is a capability we are building and is not turned on today — the recognizer is not yet wired: it holds no face-recognition model weights, and no face template is computed from a photo. Photo finding uses a permission-checked roster lookup instead. This page does not itself hold a camper record, a roster, or a photo -- it restates the same posture the two built engines already document on their own sites, and never claims more than they do.