Summit Kids

Summit Kids Privacy Policy

Last updated: October 29, 2026 · Applies to: Summit Kids at summitkids.app, each classroom's subdomain of summitkids.app, and the Summit Kids apps for iOS and Android (together, the “Application” or “Service”)

1. Who we are and about this policy

Summit Kids is a product of Kiwi Tech Lab, LLC (“Kiwi Tech Lab,” “we,” “us,” or “our”), the company legally responsible for the Application. Summit Kids is software that a classroom uses to coordinate parent volunteering: which events need help, who has signed up, and the volunteer hours and donated items each family has contributed.

Contact for privacy matters: support@kiwitechlab.net. Postal address: 10361 NW 41st Ct, Coral Springs, FL 33065.

This Privacy Policy explains how Kiwi Tech Lab handles personal data in connection with the Application. It is written to meet the requirements of applicable federal and state privacy laws as of the “Last updated” date above.

2. Our role

Parents and teachers create their own accounts in the Application. For everything they enter, Kiwi Tech Lab is the business (California) or controller (other states). A classroom is a shared space inside the Application, not a separate customer that owns your data, so the rights in Section 11 are exercised directly with us.

We process personal information only to provide the Service. We do not use it to train machine-learning models or to build advertising or marketing profiles. Section 4.6 describes the product analytics and error monitoring we do use.

3. Note on California

California's privacy law covers people acting in a commercial or employment context, which includes teachers using the Application for their work; other states' laws are consumer-only. We do not use this distinction to narrow what we offer: the rights in Section 11 are extended to everyone regardless of state and regardless of whether you use the Application as a parent or a teacher.

4. What we collect

4.1 Categories under the CCPA

4.2 Where it comes from

Directly from you when you register, add a child, log hours or items, upload a receipt, or sign up for an event; from Google if you choose to sign in with Google (your name, email address and profile picture, and nothing else); from Apple if you choose to sign in with Apple in the iOS or Android app (an Apple user ID, your email address or a private relay address that forwards to it, and your name, which Apple shares only the first time you sign in); and automatically from your device when you use the Application.

4.3 Sensitive personal information

We do not collect sensitive personal information as defined by the CCPA (§ 1798.140(ae)) or by the Virginia-model state laws: no government identifiers, precise geolocation, racial or ethnic origin, religious beliefs, health data, sexual orientation, union membership, or contents of private communications. We therefore do not use or disclose sensitive personal information for any purpose requiring a “Limit the Use of My Sensitive Personal Information” mechanism, and none is provided.

We also do not collect “consumer health data” within the meaning of Washington's My Health My Data Act, Nevada SB 370, or Connecticut's health data provisions.

4.4 Photographs and biometric identifiers

Summit Kids stores photographs of receipts uploaded by parents so a teacher can verify a donation. We do not run facial recognition, face geometry extraction, or any other biometric analysis on uploaded images, and we do not collect, capture, store, or disclose biometric identifiers or biometric information within the meaning of the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act, or Washington RCW 19.375. If a person appears incidentally in an uploaded photograph, that image is treated as an ordinary receipt and is not analyzed.

4.5 Cookies, local storage, and tokens

The Application is a progressive web app. It uses the following, all of which are strictly necessary for the Service to function:

• session and authentication cookies: keep you logged in and maintain your session
• security tokens: protect against cross-site request forgery and session hijacking
• local storage and the service worker cache: store interface preferences such as your theme and enable offline, app-like behavior on mobile devices
• an Apple refresh token, only if you sign in with Apple: stored encrypted, and used only to revoke Summit Kids' access to your Apple ID when you delete your account
• a calendar-feed token, only if you turn on the calendar feed in settings: lets your calendar app fetch your events and volunteer commitments without signing in. You can reset or turn it off at any time.

Each of these exists only to deliver the Service you have requested. None is used for advertising, cross-site tracking, or profiling, and none results in the sale or sharing of personal information. The Application sets no advertising, analytics, or cross-site tracking cookies and therefore presents no cookie consent banner. The iOS and Android apps contain no analytics or crash-reporting software; the server-side analytics in Section 4.6 still apply when you use them.

4.6 Product analytics and error monitoring

Analytics. Our servers send a small number of usage events to PostHog: when you register, sign in or out, claim a volunteer opportunity, or log volunteer hours or a donated item. Each event carries your account ID, name, email address, role, and account creation date, and, from the iOS or Android app, the app's platform and version. These events are sent from our servers, not from your browser or device, so PostHog sets no cookies. We use them only to understand how the Service is used and to improve it.

Error monitoring. When the web Application or our servers hit an error, we send a report to Sentry so we can fix it. A report contains the technical details of the error, the page or request involved (with query strings, cookies, form contents, passwords and tokens removed), your browser type, your account ID, and your classroom's subdomain. It does not contain your name, email address, or IP address.

5. Why we use it

• To operate Summit Kids: authenticate users, show the classroom calendar, record volunteer hours, items and sign-ups, and let teachers verify them
• To send service messages: password resets and volunteer reminders a teacher sends through the Application
• To provide support and respond to your requests
• To keep the Service secure: detect abuse and unauthorized access, and investigate incidents
• To diagnose errors and improve reliability (Section 4.6)
• To understand how the Service is used and improve it (Section 4.6)
• To comply with law and to establish, exercise, or defend legal claims

We do not use personal information for marketing, targeted advertising, cross-context behavioral advertising, or profiling that produces legal or similarly significant effects.

6. Disclosure

6.1 We do not sell or share your data

We have never sold personal information and do not sell it now. We do not share personal information for cross-context behavioral advertising. We have not sold or shared the personal information of any consumer, including any consumer we know to be under 16, in the preceding twelve months. There is accordingly no “Do Not Sell or Share My Personal Information” link, because there is nothing to opt out of. We nonetheless honor Global Privacy Control and other universal opt-out signals as an opt-out of sale and sharing should our practices ever change.

We never disclose one classroom's data to another classroom. Each classroom has its own separate database, and nothing in one is visible from another.

6.2 Within your classroom

The Application is a shared space. The teachers of your classroom can see the volunteer hours, donated items, receipts, and event sign-ups that parents in that classroom submit, together with the parent's and child's names, so they can verify them. A parent who shares a child with you can see the hours and items logged for that child. When adding a child to their own account, any signed-in member of the classroom can search children by name; the results show matching children's names and the names of the parents linked to them. Other than that search and your name on an event you have signed up for, other parents cannot see your children or your records.

6.3 Service providers we use

All of the following are located in, and store data in, the United States. Each is bound by a written agreement containing the service-provider terms required by Cal. Civ. Code § 1798.100(d) and § 1798.140(ag) and the equivalent processor terms under other state laws.

6.4 Business-purpose disclosures

In the preceding twelve months we disclosed the categories of personal information in Section 4.1 to the service providers in Section 6.3 for the business purposes in Section 5. We disclosed no categories of personal information to third parties for their own purposes.

6.5 Legal and corporate disclosures

We may disclose personal information where we are legally compelled to do so, where necessary to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of any person. Section 10 describes how we handle government demands. In a merger, acquisition, financing, or sale of assets, personal information may transfer to the acquiring entity, which will remain bound by this policy for information collected before the transfer. We will notify account holders before any such transfer becomes effective.

6.6 Calendar feed and third-party calendars

If you turn on the calendar feed, the calendar app you subscribe with (for example Google Calendar, Apple Calendar, or a Skylight display) fetches your events and volunteer commitments from us using your token. That app's own privacy practices apply to what it does with them. We do not share your data with any calendar provider ourselves.

7. Where your data is stored

Summit Kids is hosted entirely in the United States. Every provider in Section 6.3 stores data in U.S. facilities. We do not currently store or process Summit Kids data outside the United States, and we do not transfer it internationally except where a user chooses to access the Service from abroad.

Data stored in the United States is subject to U.S. federal and state law, including lawful access by U.S. government authorities. Section 10 sets out what we do when we receive such a demand. Should we change this and our data is then stored outside the U.S., we will update this policy to disclose that.

8. Payments

Summit Kids has no paid features. We do not collect or process card or payment details of any kind. The dollar value a parent records for a donated item is a figure they type in for the classroom's records, not a payment.

9. Email, text messages, and marketing

Service messages. Password resets and the volunteer reminders a teacher sends through the Application are transactional. They are necessary to the Service and cannot be unsubscribed from separately while your account is active.

Marketing. We do not send marketing email. We do not sell or rent our mailing list.

Text messages. We do not send SMS. If we introduce SMS notifications, we will send them only with prior express consent, and replying STOP will end them. We do not use autodialed or prerecorded marketing calls.

California “Shine the Light” (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for those parties' own direct marketing purposes. California residents may confirm this by writing to the address in Section 1.

10. Government and law enforcement requests

When we receive a subpoena, warrant, court order, or other demand for user data, we:

• review it for validity and scope, and object to demands that are overbroad, defective, or unlawful
• produce the narrowest set of data responsive to a valid demand, and
• notify the affected user before producing anything, unless a court order or statute prohibits notice, in which case we notify as soon as the prohibition lifts

We have received no national security demands that we are permitted to disclose.

11. Your rights

We extend the following rights to everyone, without regard to which state law technically applies.

11.1 What you can ask for

• Know / access the categories and specific pieces of personal information we hold about you, the sources, the purposes, and the categories of recipients
• Delete your personal information, subject to the exceptions below
• Correct inaccurate personal information
• Portability: a copy in a portable, machine-readable format
• Opt out of sale, sharing, targeted advertising, and profiling: we do none of these, so there is nothing to opt out of. The right is stated for completeness
• Limit use of sensitive personal information: we collect none, so no limitation mechanism is required
• Non-discrimination: we will not deny service or provide a lesser quality of service because you exercised a right. We offer no financial incentives for personal information.

11.2 How to exercise them

Email support@kiwitechlab.net with the subject line “Privacy Request,” or write to the postal address in Section 1. You can correct your name and email address, and add or remove children, directly in the Application's settings.

You can also delete your account yourself in the Application's settings, or request deletion without signing in. How to delete your account explains both. If you signed in with Apple, deleting your account also revokes Summit Kids' access to your Apple ID.

11.3 Verification and timing

We verify requests by matching the request to the account email on file, and, for higher-risk requests such as deletion of an entire account, by confirming through a message to that address. We do not require you to create an account to make a request, and we collect no new personal information for verification beyond what is necessary.

We acknowledge requests within 10 business days and respond substantively within 45 days. Where reasonably necessary we may extend once by a further 45 days and will tell you why within the first 45. Access and portability responses cover the 12 months preceding the request. California residents may request information beyond that period where it is available and not disproportionately burdensome to produce.

11.4 Authorized agents and appeals

You may use an authorized agent, who must provide written permission signed by you. We may ask you to verify your identity directly.

If we decline a request, we will tell you why and give you a way to appeal. Appeals go to support@kiwitechlab.net with the subject line “Privacy Appeal” and are decided within 45 days, or 60 days where state law allows (for example, Connecticut), by someone other than the person who made the original decision. If we deny the appeal, we will provide you with a method to contact your state Attorney General.

11.5 Records about your child

Your children's names and the volunteer records attached to them are entered by you. You can remove a child from your account yourself in the Application; this unlinks the child from your account, but the child's name and the volunteer records attached to it remain part of the classroom's records, and a co-parent who shares the child keeps it. To have a child's name and records deleted entirely, send a request as described in Section 11.2.

11.6 Exceptions

We may retain information we are required to keep by law, information necessary to detect security incidents or to defend legal claims, or where deletion would be impossible or involve disproportionate effort. Verified volunteer hours and items form part of the classroom's own record of its volunteering; where deleting them would destroy that record, we de-identify rather than delete.

12. Children

The Application is intended for use by parents and teachers. We do not create accounts for children, the Application is not directed to children, and we do not knowingly collect personal data directly from anyone under 16. A parent enters their children's first names so volunteer hours and items can be attached to the right child; those names are visible to that parent, a co-parent who shares the child, and the classroom's teachers, and appear in the child-name search available to signed-in members of the classroom, as described in Section 6.2.

California residents under 18 who are registered users may request removal of content they posted, under Cal. Bus. & Prof. Code § 22581, by writing to the address in Section 1.

13. Security

We maintain reasonable security procedures and practices appropriate to the nature of the information, as required by Cal. Civ. Code § 1798.81.5 and comparable state statutes. These include encryption in transit (TLS 1.2 or higher), hashed passwords, role-based access control, least-privilege administrative access, authentication for staff, logging and monitoring, access-controlled backup storage, and periodic review of access rights. No system is perfectly secure, and we do not claim otherwise.

Breach notification. If we become aware of a breach of the security of the system involving personal information, we will notify affected individuals and any required regulators in the most expedient time possible and without unreasonable delay, consistent with the breach-notification statute of each affected individual's state.

California residents should note that Cal. Civ. Code § 1798.150 provides a private right of action for certain breaches of nonencrypted and nonredacted personal information caused by a failure to maintain reasonable security.

14. Retention

We keep personal information only as long as needed for the purposes in Section 5.

15. Do Not Track

Browsers send Do Not Track signals inconsistently and there is no accepted standard for honoring them, so we do not respond to DNT. We do honor Global Privacy Control as described in Section 6.1. We do not permit third parties to collect personal information about your activity across other websites through the Application.

16. Not a data broker

Kiwi Tech Lab is not a data broker. We collect personal information only through direct relationships with the parents and teachers who use the Application, and we are not required to register under the California Delete Act, Texas Bus. & Com. Code § 509, Oregon HB 2052, or Vermont's data broker statute.

17. State-specific notes

18. Changes

We will post any change here and update the “Last updated” date. For a material change such as a new category of data, a new purpose, a new recipient, or anything affecting Section 6.1, we will notify account holders by email at least 30 days before it takes effect and will not apply it retroactively to information already collected without consent.

19. Contact

Questions, requests, or complaints about this policy or our privacy practices:

Email: support@kiwitechlab.net
Address: Kiwi Tech Lab, LLC, 10361 NW 41st Ct., Coral Springs, FL 33065, United States

To exercise a right, use the subject line “Privacy Request.” To appeal a decision, use “Privacy Appeal.” California residents may also contact the California Privacy Protection Agency or the California Attorney General. Residents of other states may contact their state Attorney General.