Privacy Policy

Last updated: April 27, 2026

1. Who we are

Campkey ("we," "us," "our") is a campsite cancellation alert service operated by Ian Richardson, a sole proprietor based in Southern California. You can reach us at ianxrichardson@gmail.com.

This Privacy Policy explains what information we collect, why we collect it, and what we do with it. We aim to write this in plain English. If anything is unclear, email us — we'll explain in plain language and update this document.

2. Information we collect

We collect only what we need to deliver alerts to you.

You give us directly:

• Your name (so we can address you)
• Your email address (account login, billing receipts, occasional product updates)
• Your phone number (the only way we can deliver SMS alerts — this is required)
• The California parks you want monitored and any date preferences you specify
• Payment method information you enter into Stripe (we never see or store your card number — Stripe handles this directly)

Collected automatically when you use the service:

• Basic technical information (IP address, browser type, device type) for security and abuse prevention
• Records of which alerts we sent you and when, so we can debug and improve the service

That's it. We do not collect:

• Your location (we don't track where you are)
• Your contacts
• Your photos, files, or anything outside the alert preferences you set
• Any data from third-party services or social media

3. How we use your information

We use your information for these purposes only:

• To send you cancellation alerts via SMS (the entire reason you signed up)
• To bill you through Stripe and provide receipts
• To support you — respond to questions, fix problems, take feedback
• To send occasional product updates (e.g., "we now cover Yosemite") — you can opt out of these
• To improve the service by analyzing aggregate usage patterns (which parks are most-watched, which alerts get clicked)

4. SMS messaging — what you're consenting to

When you provide your phone number and subscribe, you explicitly consent to receive:

• Alert messages when a campsite matching your preferences becomes available
• Service messages related to your subscription (e.g., trial-ending reminders, billing receipts)
• An occasional opt-in confirmation message after you sign up

Message frequency depends on your selected parks and date ranges. A typical user receives 0–10 messages per week.

We send all SMS through Twilio, a third-party messaging provider that complies with US carrier 10DLC requirements.

5. Who we share your information with — the short version

The only parties that ever touch your data, and why:

• Stripe — processes your payment. They see your card and billing address. They follow PCI-DSS standards. Stripe's Privacy Policy.
• Twilio — sends your SMS alerts. They see your phone number and message content. Twilio's Privacy Policy.
• Hosting provider — stores our database. They cannot read your data in any meaningful way.
• Email provider — sends transactional emails (receipts, account confirmations).

That's the entire list. If we ever add another vendor, we'll update this document.

If we are legally compelled by a valid court order to disclose information, we will. We will notify you of such requests when legally permitted.

6. How long we keep your data

• While your account is active: we keep your account data and alert history.
• When you cancel: we keep your account in a "deactivated" state for 30 days in case you want to reactivate, then we delete your phone number and personal information. We may retain anonymized usage records for service improvement.
• Billing records: Stripe retains payment records per their terms. We retain receipts for tax and accounting purposes for 7 years.
• You can request immediate deletion at any time by emailing ianxrichardson@gmail.com. We will confirm deletion within 7 days.

7. How we keep your data safe

• All data is transmitted over HTTPS.
• Passwords are stored hashed (we cannot see your password — even we don't know it).
• Database is hosted on a reputable cloud provider with industry-standard security.
• Access to production data is restricted to the founder (Ian).
• We have not had a data breach. If we ever do, we will notify affected users within 72 hours per California law.

8. Your rights — California residents (CCPA / CPRA)

If you live in California, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information we have about you
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of "sale" or "sharing" of your personal information (we don't sell or share, but you can confirm this)
• Right to non-discrimination if you exercise any of the above rights (we won't change your service or pricing if you ask for your data to be deleted)
• Right to limit use of sensitive personal information (we don't collect sensitive PI as defined by CPRA)

To exercise any of these rights, email ianxrichardson@gmail.com with the subject line "Privacy Request." We will respond within 45 days as required by California law.

9. Children

This service is not directed to anyone under 13. We do not knowingly collect data from anyone under 13. If you believe we have inadvertently collected data from a minor, email us and we will delete it.

10. Cookies and tracking

We use minimal cookies — only those required for the website to function (e.g., remembering you're logged in). We do not use third-party advertising cookies, retargeting pixels, or behavioral tracking.

We may use a basic, privacy-respecting analytics tool (e.g., Plausible, Fathom, or similar) that does not use cookies and does not collect personal information. If we ever add a third-party tracker that does, we will update this document and require explicit consent.

11. Changes to this policy

If we change this policy in any meaningful way (anything beyond fixing typos), we will:

1. Update the "Last updated" date at the top.
2. Email you about the change at least 14 days before it takes effect.
3. Post a notice on the website.

Your continued use of the service after the change takes effect counts as acceptance of the updated policy.

12. Contact

Questions about this policy? Concerns about your data? Want to delete your account?

Email: ianxrichardson@gmail.com

We respond to every privacy request personally, usually within 24 hours.