How we think about it
- Role-scoped access. Every record is visible only to the roles whose work requires it — directors, staff, and parents each see their own slice.
- Payments through Stripe. Card data is handled by Stripe, not stored by us.
- Least privilege by default. Access is granted by what someone does at the camp, not handed out broadly.
A full security and data-handling write-up is in progress. If you have specific questions before then, reach out and we'll answer directly.