Privacy Policy

Last updated: September 13, 2026

Effective: September 13, 2026

Camp Catalyst is a software platform operated by Lead Pass LLC, a New Jersey limited liability company.

Lead Pass LLC

Pennington, New Jersey 08534

campcatalyst.app

Support and privacy requests: support@campcatalyst.app

1. The short version

Camp Catalyst helps Camp Operators publish camps, register participants, collect Camp Operator documents and signatures, process payments, manage rosters, and communicate with families.

• Children do not have Camp Catalyst accounts under the current product design. Information about children is provided by an adult account holder.
• We do not sell personal information.
• We do not use personal information for third-party targeted advertising.
• We share registration information with the Camp Operator because that is necessary to register for and operate the camp.
• Camp Operators may ask their own registration questions; we provide the form infrastructure and apply platform controls.
• Authorized Lead Pass LLC platform personnel may access information across organizations when needed to operate, secure, support, investigate, or administer Camp Catalyst.
• You can request access, correction, or deletion of family information, subject to lawful retention exceptions.

2. Roles

The Camp Operator is the person or legal entity identified on the camp page as responsible for operating the camp.

Lead Pass LLC operates Camp Catalyst, the software platform.

A Camp Operator may be an independent third party, or Lead Pass LLC may itself operate a camp under another program or brand. When Lead Pass LLC is the Camp Operator, the camp’s operator-specific forms will disclose that common ownership; the use of different product or program names does not create separate legal entities.

3. Information we collect about children

Depending on the Camp Operator’s registration configuration, we may collect:

Identity and contact

• first name, last name, and preferred name;
• date of birth;
• email, phone, street address, city, state, and postal code where supplied or needed; and
• registration and attendance history.

Health and safety

• allergies and structured allergy details;
• medical conditions;
• medications and health notes;
• dietary needs;
• tetanus date;
• physician name and phone number; and
• health-insurance company, phone number, policy number, group number, and policy holder when the Camp Operator requests those fields.

Education, recruiting, and athletic information

• school name;
• graduation year;
• GPA and scale;
• SAT and ACT scores where requested;
• height, weight, wingspan, standing reach, jersey number, playing position, experience, sizing, and other athletic information;
• links to highlight or game video supplied by the family; and
• answers to Camp Operator questions.

Camp-created records

• staff notes about a participant;
• waitlist, eligibility, capacity, scheduling, and attendance information;
• forms required by the Camp Operator; and
• photographs or video when a valid Media Authorization or other lawful permission covers the use.

4. Information we collect about adults and households

We may collect:

• guardian or account-holder name, email, phone, address, and relationship/authority information;
• login/account information;
• two emergency-contact names and phone numbers where supplied;
• communication preferences;
• Camp Operator, coach, and staff names, roles, biographies, headshots, business contact information, and organization information; and
• residential venue addresses where a coach uses a home or other private location as a venue.

An emergency contact generally has not created an account or separately consented to Camp Catalyst. We use emergency-contact information only for the emergency/safety purpose for which the registering adult supplied it and do not use it for marketing.

5. Signature and agreement evidence

When a person signs or accepts a document through Camp Catalyst, we may store:

• the signed or typed name;
• a drawn or typed signature image;
• the exact document/version or cryptographic hash of the wording shown;
• the timestamp;
• the signature/acceptance method;
• IP address;
• browser user-agent; and
• authenticated account/session evidence.

These records are used to preserve evidence of what was presented and accepted.

6. Payment information

Payments are processed through Stripe.

Stripe receives payment information such as payer name, email, card or wallet information, amount, and payment identifiers. Camp Catalyst does not store full card numbers.

Camp Catalyst stores transaction records such as the amount charged, Camp Operator proceeds, Camp Catalyst fees, processing amounts, refunds, disputes, and Stripe identifiers.

Child health information is not intentionally sent to Stripe.

7. Communications

We use Resend for transactional email. A transactional message may include a guardian’s name/email and limited camp content, including a child’s first name where needed for the message.

We may retain the recipient address, message subject, delivery metadata, and limited message content for support, security, and delivery troubleshooting.

If we later add SMS or another communication vendor, we will update this Policy before using that vendor for personal information.

8. Server, account, and device data

We may collect technical information needed to operate and secure the service, including:

• IP address;
• browser/device and user-agent information;
• authentication/session records;
• server logs;
• requested pages and timestamps; and
• security/audit events.

We use session/authentication cookies or similar technologies needed to keep a signed-in user authenticated and protect the service. We do not use third-party advertising cookies or session-replay tools on pages containing participant information.

9. Why we use information

We use personal information to:

• create and secure accounts;
• register a participant for a requested camp;
• determine age/grade eligibility and manage capacity/waitlists;
• provide the Camp Operator with information needed to prepare for and operate the camp;
• support participant health, safety, emergency, accommodation, and operational needs;
• present, sign, store, and preserve evidence of Camp Operator and Camp Catalyst documents;
• process payments, refunds, disputes, and accounting records;
• send transactional communications;
• provide returning-family convenience;
• prevent fraud, misuse, unauthorized access, and security incidents;
• provide customer support and troubleshoot the service;
• enforce our agreements and comply with law; and
• maintain aggregate business statistics where the data has been appropriately deidentified or aggregated.

10. Camp Operator-created questions

Camp Operators may create registration questions in their own words.

Camp Catalyst provides the form infrastructure and may classify, block, reclassify, or remove questions that create legal, privacy, security, or child-safety risk. Camp Operators are contractually prohibited from requesting certain high-risk categories such as Social Security numbers, passwords, payment credentials, government-account credentials, biometric templates, and genetic data through custom questions.

Because custom free text can contain unexpected sensitive information, Camp Catalyst applies a short retention approach to those responses and may move misclassified health or education information into the appropriate protected category.

11. Who can see family and participant information

The family

An authenticated family account can access its own household, participants, registrations, documents, and related records as allowed by the product.

The Camp Operator

The Camp Operator and authorized organization users may access registration information for camps operated by that organization. The Camp Operator is required to limit sensitive access to personnel who need it for legitimate camp functions.

Camp Catalyst uses organization-level database controls to prevent one independent organization from reading another organization’s data through ordinary product access.

Lead Pass LLC platform administrators

Authorized Lead Pass LLC personnel may access information across organizations when reasonably necessary to:

• operate and support the platform;
• investigate security, fraud, abuse, or technical incidents;
• respond to privacy or legal requests;
• administer payments, disputes, and account issues;
• maintain data integrity; or
• perform legitimate platform operations.

Platform administrative access should be restricted, strongly authenticated, and audited. Reads of sensitive identifiers are logged where the product is designed to do so.

12. Service providers

We use providers to operate Camp Catalyst. Current/in-use providers include:

Supabase

Database, authentication, and file storage. Supabase may process the personal information stored in Camp Catalyst, including health information and uploaded documents.

Amazon Web Services

Infrastructure supporting portions of Supabase’s services and storage environment.

Cloudflare

Application hosting, delivery, security, data in transit, and server/log processing as configured for Camp Catalyst.

Stripe

Payment processing and Stripe Connect services. Stripe processes adult payer/payment information and transaction details.

Resend

Transactional email delivery. Resend may process guardian contact information and message content needed to deliver Camp Catalyst communications.

GitHub

Source-code and development-documentation hosting. Production customer data is not intended to be stored in GitHub.

We require service providers to process information for the services they provide to us and subject to applicable contractual/privacy obligations.

13. Artificial intelligence

Camp Catalyst does not currently send child or family personal information to an AI model provider for the planned coach-insights feature.

If that feature is launched, the intended design is to expose only aggregate statistics through a restricted database role that cannot read identity or health tables, with small-group suppression and testing intended to reduce re-identification risk.

We will update this Policy before a model provider receives personal information or before the feature materially changes how personal information is processed.

14. Sale and advertising

We do not sell personal information.

We do not share personal information for third-party targeted advertising.

We do not use participant information to build advertising profiles for unrelated third parties.

15. Business transfers and legal disclosures

We may disclose information where required by law, subpoena, court order, legal process, or to protect rights, safety, security, or the integrity of the service.

If Lead Pass LLC or the Camp Catalyst business is involved in a merger, financing, reorganization, sale, or transfer, personal information may be transferred as part of that transaction subject to applicable law. If a transaction materially changes the purpose for which sensitive child information is used and new consent is legally required, we will request that consent before relying on the changed purpose.

16. Retention

We use category-specific retention rules based on operational need, legal/accounting obligations, evidence requirements, safety, privacy risk, and the status of the relationship.

Examples of the criteria we use include:

• current health information should be retained only for a short period after the camp/operational need ends because stale medical information can create both privacy and safety risk;
• participant media has its own retention period and is removed sooner when authorization is withdrawn where reasonably possible;
• signature images are retained for less time than the agreement/consent evidence they support;
• payment/accounting records and signed legal instruments may be retained longer where tax, dispute, insurance, or limitation-period considerations require it;
• access logs may outlive the underlying profile information they are intended to audit; and
• legal holds suspend ordinary deletion only for records reasonably relevant to a claim, investigation, subpoena, dispute, insurance matter, or legal duty.

Camp Catalyst maintains an internal Retention Schedule & Deletion Standard. Specific production retention periods are implemented by category and may vary by jurisdiction. We do not treat a hash of an email address as anonymous merely because the plain-text email was removed; it remains pseudonymous information where it can reasonably be linked back to a person.

17. Your privacy choices and requests

Subject to authentication and lawful exceptions, an account holder may request to:

• access information Camp Catalyst maintains about the account holder and children in the household;
• correct inaccurate information;
• delete information;
• withdraw a Media Authorization;
• stop future optional collection where applicable; and
• opt out of marketing communications while continuing to receive transactional camp/account messages.

Submit privacy requests through available account controls or email support@campcatalyst.app.

We may retain limited information when reasonably necessary for legal, tax, payment, fraud, security, dispute, insurance, signed-document, or legal-hold purposes.

18. Camp Operator exports

A Camp Operator may export a roster or other registration information. An exported file can then exist outside Camp Catalyst’s technical control.

Camp Catalyst may log exports and requires Camp Operators to protect exported information and comply with applicable deletion/security duties. If a privacy request affects an operator-held export, we may notify the Camp Operator, but we cannot directly erase a copy we do not possess or control.

19. Children’s privacy

Under the current product design, children do not create Camp Catalyst accounts or directly submit information. The adult registering the child provides the information.

Camp Catalyst does not use facial recognition or create face templates from participant photographs.

We do not intentionally condition a child’s participation on optional promotional-media authorization.

If the product later changes to collect personal information directly from children, we will reassess the applicable children’s-privacy requirements before enabling that feature.

20. Consumer health data

Some information collected through Camp Catalyst may qualify as consumer health data under state law.

Where a consumer-health-data law applies, Lead Pass LLC will provide any separate privacy notice and consent required by that law. Our jurisdiction-triggered Consumer Health Data Privacy Notice describes the additional framework used where applicable.

21. Security

Camp Catalyst uses administrative, technical, and organizational safeguards intended to protect personal information, including encryption in transit, provider-supported encryption at rest, database access controls, private file storage, authentication, logging, and audit controls.

No system can guarantee perfect security. If a breach occurs, Lead Pass LLC will provide notices required by applicable breach-notification law and will not promise a single nationwide deadline where state requirements differ.

22. International and cross-border processing

Our service providers may process information in locations determined by their infrastructure and our configuration. We do not make a blanket promise that all processing occurs only in the United States unless and until that commitment is technically verified and maintained.

Where applicable law imposes requirements on cross-border transfers or processor locations, we will address those requirements through provider configuration, contracts, notices, or other appropriate measures.

23. Changes to this Policy

We may update this Policy as the product, providers, law, or data practices change.

If applicable law requires new consent for a material change in how sensitive child or health information is used or shared, we will obtain that consent before relying on the changed processing.

The current Policy version and effective date will be posted on campcatalyst.app.

24. Contact

Lead Pass LLC

Pennington, New Jersey 08534

campcatalyst.app

Support and privacy requests: support@campcatalyst.app