Privacy Policy
Status: draft for board and California-counsel review. Not approved for posting.
Effective date: (to be set when posted — do not post without a real date; CalOPPA requires one) Last updated: 29 July 2026
El Dorado Hills Swim Team is the legal organization name. In this policy, "Taz," "we," "us," and "our" mean El Dorado Hills Swim Team, including its Taz, Swimclusion, and El Dorado Hills Tasmanian Devils Swim Team names and programs.
This policy covers the Taz family and admin website and app. It does not cover what happens at the pool, at meets, or in any program run by another organization, and it does not cover other websites we link to.
A note on how this document is meant to be used. This is a policy we post, not an agreement you sign. Registration asks you to acknowledge that you have seen it, but acknowledging it does not waive anything and does not give us rights we would not otherwise have. Your participation agreements — the liability waiver, refund policy, code of conduct, photo and media release, and the rest — are separate documents in the registration packet.
1. Children do not have accounts
Only parents and legal guardians, and Taz staff and volunteers, can sign in. Swimmers do not get their own logins and cannot create an account, post content, or message anyone through this app.
That matters for how this policy works. Everything we hold about a swimmer reaches us in one of three ways: a parent or guardian enters it, Taz staff enter it in the course of running the team, or it is generated by participation (a time swum at a meet, a volunteer shift worked).
We still treat this as children's information subject to the federal Children's Online Privacy Protection Act, because a swim program for children is directed to children even when the parent is the one typing. Section 6 explains what that means in practice.
2. What we collect
About parents and guardians
- Name, email address, mobile and other phone numbers, mailing address
- Which household you belong to, and which swimmers you are responsible for
- Sign-in information: we use an email sign-in link or Google sign-in, so we see your email address and whether it has been verified
- Records of the agreements you assented to: which document and version, the name you typed, the time, and audit information that lets us prove later what you were shown
About swimmers
- Name and date of birth
- Sex or gender, and the resulting age group — swim meets are organized by age and sex, and league eligibility depends on age, so we cannot run entries without this
- Season registrations, group placement, and water-safety or placement assessment results
- Meet and event entries, the events swum, and the times and places achieved
- Whether a swimmer meets qualifying standards (Meet of Champions, Taz, and league standards)
Health and emergency information about swimmers
This is the most sensitive category we hold, and we hold it because a coach needs it at the side of a pool:
- Allergies and details
- Medications and details
- Health insurance information
- Treating physician's name and phone number
- Emergency contacts and their phone numbers
Volunteer information
- Volunteer jobs signed up for, shifts worked, and hours credited toward your household's obligation
Payments
- What you were charged, for what, and whether it succeeded
We use Stripe to take payment. Card numbers go to Stripe, not to us — we never see or store a full card number. If you authorize us to save a payment method for later (for example, waitlist acceptance or an unfulfilled volunteer balance), that authorization is a separate agreement and the stored method lives at Stripe.
Technical information
- Standard server and application logs: IP address, browser and device information, pages requested, timestamps, and errors
3. Why we collect it
| What we use it for | Which information |
|---|---|
| Registering swimmers and running the season | Household, swimmer, registration, agreement records |
| Entering swimmers in meets and reporting results | Swimmer name, birth date, sex, age group, entries, times |
| Certifying league eligibility | Swimmer age, roster status, outside-team information you give us |
| Keeping swimmers safe at practice and meets | Health, allergy, medication, insurance, physician, emergency contacts |
| Taking payment and issuing refunds | Payment records |
| Tracking volunteer obligations | Volunteer jobs, shifts, hours |
| Contacting you about the team | Name, email, phone |
| Keeping the app working and secure | Technical logs |
We do not sell personal information. We do not rent or trade it. We do not use it for behavioural advertising, and we do not allow anyone else to use it that way through our app.
4. Who we share it with, and what they get
This is the section worth reading closely, because running a competitive swim team necessarily means sending swimmer information outside Taz.
| Who | What they receive | Why |
|---|---|---|
| Suburban Swim League (SSL) | Swimmer name, age or birth date, sex, roster and eligibility status, meet entries and results | We are an SSL member club; the league sets eligibility and runs championships |
| Meet hosts and other clubs at a meet | Swimmer name, age group, sex, seed times, entries and results — exchanged as meet files (Hy-Tek Meet Manager / SD3) | A meet cannot be seeded or scored without them |
| USA Swimming | Confirmation of whether a swimmer is an active USA Swimming club member | SSL eligibility rules turn on this |
| Stripe | Your name, email, and payment details you enter | To take payment |
| Google (Firebase) | Everything stored in the app, as our hosting and database provider | This is where the app runs |
| Coaches, officials, and Taz volunteers | Only what their role requires — a coach on deck can see health and emergency information; most volunteers cannot | Running practices, meets, and jobs safely |
We may also disclose information if the law requires it, to protect someone's safety in an emergency, or to our own professional advisers (for example, counsel or an accountant) under a duty of confidentiality.
Results and times are public by nature. Meet results, including swimmer first and last names, ages or age groups, and times, are published by leagues, meet hosts, and results services. Once a result is published outside Taz we cannot retract it. If that concerns you, talk to us before your swimmer competes.
Photographs are handled separately. Whether we may photograph your swimmer and where we may use the image is governed by the Photo and Media Release in the registration packet, not by this policy.
5. How you review, correct, or remove information
You can see and edit most of your household's information yourself: sign in and go to My Family → Account, which holds family contacts, swimmers, and emergency information. Registrations and volunteer records are under their own sidebar entries.
For anything you cannot change in the app — or if you want a copy of what we hold, or want something deleted — email us at the address in Section 11 and tell us which swimmer or household you mean. We will verify that you are a parent or guardian of that household before we act.
Some things we cannot undo:
- Information already sent to the league, a meet host, or a results service, as described above
- Records we are required to keep, such as financial records and signed agreements
- Anything needed to resolve a dispute or a safety matter that is still open
If we cannot delete something you asked us to delete, we will tell you why.
6. Children's privacy (COPPA)
Because our program is for children, we follow the federal Children's Online Privacy Protection Rule as amended by the Federal Trade Commission — the amended Rule took effect on 23 June 2025, with compliance required from 22 April 2026.
How consent works here. When you register your swimmer, you are the parent or guardian, you are signed in to your own verified account, and you enter your swimmer's information yourself. Your registration and payment are how we obtain your consent to collect and use that information for the purposes in Section 3 and the disclosures in Section 4.
Your rights as a parent. At any time, you may:
- Review the personal information we hold about your child
- Correct it
- Ask us to delete it
- Refuse to allow further collection or use of it
To do the last of those, tell us in writing. Understand that some information is necessary to participate — we cannot enter a swimmer in a meet without a name, age, and sex, and we will not put a child on a pool deck without emergency contact information. If you withdraw consent for information that participation requires, the practical consequence is that your swimmer cannot participate, and we will say so plainly rather than quietly keep using the data.
We do not condition participation on giving us more than we need. Where a field is optional, the app says so.
Separate consent for non-essential disclosure. We will not disclose your child's information to anyone for a purpose that is not integral to running the team without asking you separately first. The disclosures in Section 4 are the ones we consider integral: without them there is no league eligibility, no meet entry, and no result.
Security and retention. We maintain a written information security program and a written data retention policy, as the amended Rule requires. Section 7 summarises the retention side.
7. How long we keep things
| Information | How long |
|---|---|
| Household and swimmer records, including health and emergency information | While the swimmer is registered, and then for the period counsel sets for claims and league purposes |
| Signed agreements and assent audit records | The period counsel sets, because their purpose is to be producible later |
| Meet entries, times, and results | Indefinitely — team and league record books are the point |
| Payment records | As long as tax and financial-record rules require |
| Technical logs | A short operational period |
We delete or de-identify children's personal information when it is no longer reasonably necessary for the purpose we collected it for. The full schedule lives in our written retention policy.
Reviewer note — not for the posted version. The specific periods in this table must be set by counsel and then actually implemented in the app before this policy is posted. A retention schedule we describe but do not perform is a misstatement, and under the amended COPPA Rule the written policy is itself mandatory. See docs/legal/README.md.
8. How we protect it
Access is controlled by role: staff see only what their role allows, and health and emergency information is restricted more tightly than the rest. Data is held in Google Firebase with server-side rules enforcing those roles, and we sign in with email links or Google rather than passwords we store ourselves.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your family's personal information, we will notify you as California law requires.
9. Tracking and Do Not Track
We do not use advertising or cross-site tracking cookies, and we do not allow third parties to collect personal information about your activity across other websites through our app. We use only the cookies and local storage needed to keep you signed in and to remember interface preferences such as whether the sidebar is collapsed.
Because we do not track you across sites, there is nothing for a browser "Do Not Track" signal to turn off. We disclose this to comply with California Business and Professions Code section 22575.
10. California privacy law, stated accurately
The California Consumer Privacy Act and the California Privacy Rights Act do not apply to us. Those laws govern for-profit "businesses" that meet revenue or volume thresholds. El Dorado Hills Swim Team is a nonprofit organization, and nonprofits are outside their scope. We say this rather than pasting in a list of CCPA rights that would misdescribe your legal position.
What does apply, and what we follow:
- The California Online Privacy Protection Act (Business and Professions Code sections 22575–22579), which requires this policy, its effective date, the categories in Sections 2 and 4, the review-and-correct process in Section 5, the change process in Section 12, and the Do Not Track disclosure in Section 9.
- COPPA, as described in Section 6.
- California's data breach notification law, as described in Section 8.
Separately from any legal obligation, if you ask us for a copy of your household's information or ask us to delete it, we will handle the request as described in Section 5. We would rather give you the substance of those rights voluntarily than argue about whether we owe them.
11. Contact us
El Dorado Hills Swim Team
Email: info@edhtaz.org
Mail: PO Box 5238, El Dorado Hills, CA 95762
If you are a parent or guardian with a question about your child's information, say so in the subject line and we will route it accordingly.
12. Changes to this policy
If we make a material change — a new category of information, a new recipient, or a new purpose — we will post the updated policy with a new effective date and notify account holders by email before the change takes effect. Minor clarifications will be posted with an updated "last updated" date. We keep prior versions so you can see what changed.