Skip to main content
    // Trust Center

    Trust, Security & Privacy

    This page is maintained by the C3 Culture Code Camp team to answer common security and privacy questions about how we operate the camp's portals and handle family, staff, and student data. It is app-owned editable content, not an independent certification.

    Access & Authentication

    • Separate portals for Admin, Staff, Family, and Student — each with role-based access enforced server-side.
    • Roles live in a dedicated user_roles table (never on user profiles) and are checked through security-definer helpers to prevent privilege escalation.
    • Family members can only see their own children. Staff access is scoped by assigned age band.
    • Student logins are age-appropriate: 3-icon picture login for K–2, 4-digit PIN for grades 3–5, password for grades 6–8. Adult staff/family accounts use email + password with optional Google sign-in.
    • Staff accounts are restricted to @rebrandtech.org and @c3camp.com email domains.

    Platform & Hosting

    • Hosted on Lovable Cloud, which provisions a managed Postgres database (Supabase) and serverless edge functions.
    • All traffic to c3camp.com is served over HTTPS.
    • Row-Level Security is enabled on every database table; access policies are reviewed when schemas change.
    • Payments are processed by Stripe — we never store card numbers on our servers.
    • This page describes platform capabilities we have enabled; it is not an independent certification.

    Data We Collect

    • Enrollment & family records: child name, age, grade, allergies, emergency contacts, authorized-pickup list, and the parent contact info you provide.
    • Operational records: attendance, end-of-day updates from staff, incident reports, portfolio uploads, and leaderboard points.
    • Account data: email, hashed password, and (for staff) role assignments.
    • We do not sell family or student data. It is used only to operate the camp and communicate with you.

    Subprocessors & Integrations

    • Lovable Cloud / Supabase — database, authentication, file storage, and serverless functions.
    • Stripe — payment processing for enrollment and break-camp fees.
    • Resend — transactional email (enrollment confirmations, check-in notifications, weekly reports).
    • ElevenLabs — narrated onboarding audio for the family portal.
    • Google — optional single sign-on for staff and family accounts.

    Retention & Your Choices

    • Records are retained while a child is enrolled and for a reasonable period afterward for operational, financial, and safety follow-up.
    • Families can request a copy, correction, or deletion of their child's records by emailing the address below. Some records (e.g. payment receipts, safety incident logs) may be retained when required for legal or audit purposes.
    • Families can update most child information (allergies, emergency contacts, authorized pickup list) directly inside the Family Portal.

    Security & Privacy Contact

    • Report a security concern, request data access/deletion, or ask a privacy question:
    • center@rebrandtech.org
    • We aim to acknowledge security reports within 3 business days.

    Shared responsibility: Lovable Cloud provides the underlying database, auth, storage, and serverless platform. C3 Culture Code Camp is responsible for how we configure roles and policies on top of that platform, what data we collect, and how we respond to family and staff requests. Families are responsible for keeping their portal passwords private.