Privacy Policy

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

Error monitoring: Sentry collects application error reports that may include technical context about the error (such as the page you were on and actions that led to the error). Before any report leaves the browser or server, our site applies a data-scrubbing step that removes volunteer names, email addresses, and phone numbers from error content.

When session replay is active (a small sample of sessions, plus any session in which an error occurs), all form inputs are masked and media playback is blocked before recording.

2.3 Information from Third Parties

We do not collect information about you from third parties.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To coordinate events and volunteers: Managing volunteer signups, assigning roles, and communicating event logistics to volunteers who have signed up.
• To send event-related communications: Sending confirmation emails when you sign up to volunteer and allowing PTO administrators to contact volunteers about their specific events. These messages are transactional and directly related to your signup.
• To deliver newsletters: If you subscribe to our newsletter, we use your email address to send PTO updates. You can unsubscribe at any time using the link in any newsletter email.
• To improve the Site: Reviewing error reports (from Sentry) and user feedback to identify and fix issues, improve site reliability, and enhance the user experience. We do not use traditional analytics or tracking tools for this purpose.
• To comply with legal obligations: Responding to lawful requests from authorities and enforcing our Terms of Service.

We do not use your information for:

• Selling your data to third parties
• Targeted advertising or behavioral profiling
• Automated decision-making about you
• Any purpose unrelated to PTO activities

4. How We Share Your Information

We share your information only in the following circumstances:

4.1 Service Providers

We use third-party services to operate the Site. These providers, as summarized below, may process your data according to their own terms and processes.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process (court order, subpoena, or government request).

4.3 With Your Consent

We may share your information for other purposes with your explicit consent.

We do not sell your personal information.

5. Data Retention

We keep your information only as long as necessary for the purposes described in this policy.

Backups: Deleted data may persist in encrypted database backup files for up to 30 days and in point-in-time recovery systems (Neon) for up to 7 days before automatic purge. Database backups are encrypted before they leave our backup process using modern public-key encryption; the decryption keys are held by the PTO and are not accessible to our backup storage provider. Backup files are automatically deleted after the 30-day retention window by a bucket lifecycle rule.

6. Your Rights

You have the following rights regarding your personal information:

• Access: You can request a copy of the personal information we hold about you.
• Correction: You can request that we correct inaccurate information.
• Deletion: You can request that we delete your personal information.
• Opt-out of newsletters: You can unsubscribe from our newsletter at any time using the unsubscribe link included in every email.

How to exercise these rights: Contact us using the information in Section 14 below. To protect your privacy, we may ask you to verify your identity before processing your request (for example, by confirming the email address associated with your volunteer signup). We will respond to your request by email within 30 days. If your request is unusually complex or voluminous, we may extend the response period by an additional 30 days and will notify you of the extension and the reason for it.

If your state provides additional privacy rights beyond those listed above, we will honor those rights upon request.

7. Cookies and Tracking Technologies

We use only essential cookies required for the Site to function. We do not use advertising or tracking cookies. The Site does not run an analytics product.

Essential cookies: Authentication session cookies are set for admin users only when they log in to the admin panel. These cookies are required for admin functionality and are not set for public visitors.

Newsletter signup: Our newsletter subscription is processed through a server-side API connection to MailerLite. No third-party cookies are set on public visitors through the newsletter signup form.

CAN-SPAM compliance: Our newsletter emails comply with any requirements under the CAN-SPAM Act. To the extent the CAN-SPAM Act applies to a PTO email, the email includes our physical mailing address, is clearly identified as coming from the PTO, and includes a functioning unsubscribe mechanism. Opt-out requests are honored within 10 business days.

8. Security

We implement reasonable security measures to protect your information, including:

• Encryption of all data in transit using TLS/HTTPS
• Encryption of data at rest (AES-256 encryption at our database provider)
• Admin access restricted to authorized users through Clerk authentication
• Security headers enforced on all pages (Content Security Policy, HTTP Strict Transport Security, X-Frame-Options)
• Rate limiting on API endpoints to prevent abuse
• Regular dependency monitoring and security updates via automated tools
• Input validation on all forms and API routes

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security.

9. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected individuals by email (using the email address associated with your volunteer signup or newsletter subscription) within a reasonable time after discovering the breach
• Provide a description of the incident, the types of information involved, and the steps we are taking to address it
• Offer guidance on steps you can take to protect yourself, if applicable

We will also comply with any applicable state data breach notification laws.

10. Children's Privacy

This Site is intended for use by adults — parents, guardians, school staff, and community members. We do not knowingly collect personal information from children under 13. Volunteer signup is for participants age 18 and older. The Site does not contain any content, games, or interactive features designed to appeal to children.

Although this Site may be exempt from the Children's Online Privacy Protection Act (COPPA) as a nonprofit organization, we voluntarily adopt child-protective practices as described in this section.

If we become aware that a child under 13 has provided us with personal information, we will delete that information promptly, document the incident, and notify the child's parent or guardian if their identity is reasonably ascertainable.

If you believe a child under 13 has submitted information to us, please contact us using the information in Section 14.

11. AI Disclosure

All Site code and content, including that which may have been developed with AI-assisted tools, has been reviewed and approved by human contributors. The Site does not use AI features that process your personal information. AI features are not used in the operation of the Site. For example, there are no user-facing AI elements such as a chatbot or AI-generated content.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will post the updated policy on this page with an updated date. Your continued use of the Site after changes are posted constitutes your acceptance of the revised policy.

13. Accessibility

We are committed to making this Site accessible to all users. We target compliance with Web Content Accessibility Guidelines (WCAG) 2.1 Level AA. If you encounter an accessibility barrier on our Site, please contact us and we will work to address it.

14. Contact

For privacy questions, concerns, or to exercise your rights under this policy, contact the PTO:

Email: westmontpto20@gmail.com
Mailing Address: 13210 Glenn St, Omaha, NE 68138