Privacy Policy

1. Who this policy covers

• Operators are the booth companies that use the Service, and the owners and staff they invite. Operators have accounts. They set up events and decide what to ask guests.
• Guests are the people who use an Operator's booth at an event. Many guests are children. When we talk about guests in this policy, we also mean their parents and guardians.

For guest information, the Operator decides what is collected and why. We store and process guest information on the Operator's behalf and only on the Operator's instructions. We also use it for a few limited purposes of our own: keeping the Service secure, preventing fraud and abuse, complying with the law and keeping the Service running.

If you were a guest at an event, the booth company that ran the booth is your main point of contact. Its own privacy notice applies too, and it is responsible for telling you what it collects and for getting any consent the law requires.

2. Information we collect

From Operators

• Account details: the email address of each owner and staff member, and whether they are an owner or staff. Accounts are by invitation only. There is no public sign-up.
• Company name.
• Events: the event name, date, sport, team name and any notes.
• Logos and card art you upload, and the card styles you design.
• Guest-question settings: which card questions are required and any extra questions you add.
• iPad settings for each event, such as the countdown, retakes, number of copies and printing.
• Anything you send us when you contact us, such as a support request, including your name or phone number if you include them.

From guests, at the booth

Guest information is collected at the event on the Operator's iPad. Depending on how the Operator sets up the event, it includes:

• Photos taken at the booth, including a cut-out version with the background removed. The cut-out is made on the iPad.
• The trading cards made from those photos: the front, the back and the print sheet.
• Answers to the Operator's questions. Card questions are typically first name, last name, jersey number and position; the team name on the card comes from the event. Operators can add their own questions, answered as short text, an email address, a phone number, a checkbox or a single choice. On the iPad, email and phone questions are labeled as a parent's or guardian's contact.
• Card details: the card number, the time the photo was taken, the number of copies printed and whether the card was shared from the iPad.

The Service does not offer a date-of-birth question.

From booth iPads

• The iPad's name, the booth app version, when it last checked in and which event it has open.

Automatically

• Sign-in cookies. When an Operator signs in to the website, we set cookies that keep them signed in. The Service does not use analytics, advertising or tracking cookies, and it does not include third-party tracking tools.
• Browser storage. The card designer can remember the sample player's name, number and position in your own browser so they are there next time. This stays on your device.
• Server logs. Our hosting providers keep standard server logs, such as IP address, browser type and the time of each request, for security and operations.

3. Face detection and photo processing

To frame each photo, the booth app finds where the largest face is in the picture so the card can be centered on it, and it separates the person from the background to make the cut-out. Both steps run on the iPad itself, using the iPad's built-in tools. The face position is used only to crop the photo and is not uploaded to our servers.

We do not create or store face templates, faceprints or any other biometric identifiers, and we do not use faces to recognize or identify anyone.

4. How we use information

We use information to:

• Provide the Service: designing cards, running events, making and printing cards, showing each Operator their own private gallery, letting Operators download their cards and sending event settings to linked iPads.
• Sign Operators in, including emailing one-time sign-in codes.
• Keep the Service secure, prevent fraud and abuse, and find and fix problems.
• Answer support requests.
• Comply with the law and enforce our Terms of Use.

Our commitments:

• We do not sell personal information.
• We do not use personal information for advertising, and we do not share it for targeted advertising.
• We never use guest photos, cards or answers to train or improve artificial intelligence or machine-learning models.
• We do not use guest information to market to guests or contact them.

5. How we share information

We share information only as described below.

• Service providers that run parts of the Service for us and may use the information only to do that: Supabase (database, sign-in and file storage, in the United States), Vercel (website hosting, in the United States) and an email delivery provider that sends sign-in codes.
• Google Fonts. Our server downloads the fonts used on cards from Google Fonts. No personal information is sent with those requests, and your browser does not contact Google for them.
• The Operator. Guest information belongs to the Operator's account and is shown to that Operator's owners and staff. Other Operators cannot see it.
• At the Operator's direction. For example, if an Operator allows sharing at an event, a guest can share their card from the iPad using the iPad's own sharing options. The person sharing chooses where it goes.
• Printing. Cards are printed on the Operator's own printer at the event. We do not send them to an outside print service.
• Legal reasons. When we believe in good faith that the law requires it, such as a subpoena or court order, or to protect the rights, safety or property of our users, guests, the public or us.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, information may be transferred as part of that deal, and it will stay protected by this policy or one at least as protective.

6. How long we keep information

• Guest photos, cards and answers on our servers are deleted automatically after 90 days from the event date, usually within a day or two after that. The 90 days are counted from the event date as it was when each card was uploaded, so changing the event date later does not extend them. A cleanup runs every day.
• Sooner, by the Operator. An Operator's owners can delete a single card, or all of an event's photos, at any time from their gallery.
• Leftover files. Files that reach our storage without a matching card, such as after an interrupted upload, are cleaned up within about 14 days.
• On the iPad. Copies stay on the Operator's iPad until the Operator starts a new event, and they can be reprinted until then. Starting a new event deletes the previous event's photos and cards from the iPad. Operators can also delete single cards on the iPad.
• When an Operator's account is closed, the guest photos, cards and answers in that account are deleted on the schedule above, or sooner if the Operator asks us.
• Backups. Our database provider's backups may hold copies for a limited period, typically no more than a few weeks, after which they are overwritten.
• Operator account information is kept while the account is active. If you ask us to delete it, we will do so within a reasonable time, unless the law requires us to keep some of it.

7. How we protect information

• Each company's data is kept separate at the database level, so one Operator cannot see another Operator's data.
• Guest photos are kept in private storage and are shown only through links that expire after 5 minutes.
• On the website, only an Operator's owners can delete guest cards and photos.
• Information is encrypted in transit using HTTPS.

No system is perfectly secure, and we cannot guarantee that information will never be accessed without permission. If we learn of a security incident that affects an Operator's data, we will notify the affected Operators without undue delay. Operators are responsible for any notices to their guests that the law requires, and we will give reasonable help.

8. Children's privacy

Many guests are children, including children under 13. The Service is used by Operators, not by children directly. Children do not create accounts or sign in.

• Before collecting a child's personal information, the Operator must give notice to the child's parent or guardian and obtain verifiable parental consent, as the Children's Online Privacy Protection Act (COPPA) requires for children under 13, along with any consent or notice that state law requires.
• We use children's information only to provide the Service to the Operator, as described in this policy. We never use it for advertising and never use it to train artificial intelligence or machine-learning models.
• Personal information about a known child under 13 may be "sensitive data" under state laws such as the Texas Data Privacy and Security Act. We process it only on the Operator's instructions, and our Terms of Use require the Operator to obtain verifiable parental consent before collecting it.
• Parents and guardians can ask the Operator, or us at larson_e@ymail.com, to review or delete their child's card and information. We will work with the Operator to do so. We may need to confirm that you are the child's parent or guardian first.

9. Your choices and rights

• Operators can see and change most of their information in the app, and can contact us to access, correct or delete the rest.
• Guests, parents and guardians can ask the Operator that ran the booth to access, correct or delete their information, or contact us.

Depending on where you live, state privacy laws, such as the Texas Data Privacy and Security Act, may give you rights over your personal information. These can include the right to confirm whether it is being processed, to access, correct or delete it, to get a copy of it, and to opt out of its sale, targeted advertising or certain profiling (we do none of those). Whether a particular law applies depends on the facts, but we will consider any request we receive. Where the law gives you a right to appeal our decision, you can appeal by replying to our response.

We will respond within the time the law requires. We may need to confirm your identity before acting on a request. Because Operators decide how guest information is used, we may refer requests about guest information to the Operator that collected it, and we will help them respond. We will not treat you differently for exercising your rights.

Do Not Track and Global Privacy Control. We do not track you across other websites or services, sell personal information or use it for targeted advertising, so these browser signals do not change how the Service handles your information.

10. Where information is stored

We store information in the United States, using the service providers listed above.

11. Changes to this policy

We may update this policy from time to time. When we do, we will post the new version on this page with a new "Last updated" date. If we make a material change, we will notify Operators (for example by email or a notice in the Service) before it takes effect.

12. Contact us

Questions or requests about this policy or your information: email larson_e@ymail.com.