Run camp without spreadsheets, binders, or privacy risk

The Minor Consent Graph is the consent and restriction record for each child in the platform. It is machine-readable — the platform enforces it in code, not in policy. It governs forms (field visibility per role), rosters (directory suppression), pickup (authorised-pickup list), medical visibility (role-scoped health access), communications (family opt-in), photography (shot list inclusion, gallery release, no-photo flag), exports (district-report inclusion), and deletion timelines. When a family revokes an element of consent — say, photo permission — the effect is immediate: the child is removed from the shot list, their existing proofs are suppressed in the gallery queue, and any pending export is updated. The consent record is time-stamped and auditable. “Camp management that cannot accidentally violate a child’s consent boundary” is the design brief. The graph is built and production-ready.

Not yet. The registration and billing engine — session configuration, capacity rules, waitlists, custom intake forms, and the billing data layer (deposits, payment plans, sibling pricing, scholarships) — is built and production-ready. The live checkout interface that accepts payment from families is honest-off: it exists in the platform but is not enabled for live transactions today. There is no live billing, no subscription, and no pricing commitment on this site. When the payment rail is enabled (a founder-gated decision), organisations will be notified. The next step is a conversation, not a purchase form.

Authorised pickup is enforced at the engine layer, not by a reminder to a staff member at the door. When a person arrives to sign out a child, the check-in engine verifies their identity against the authorised-pickup list in the child’s record. A person not on that list cannot complete the sign-out — the engine refuses the action at the data layer, not by disabling a UI element that could be bypassed. Custody restrictions are stored as a field in the consent record and enforced the same way. The pickup rule is not a form families fill out once and hope staff remember — it is a constraint the system enforces every time. Check-in and authorised-pickup enforcement are built and production-ready on the BAS/check-in substrate.

Photo permission is a domain in the Minor Consent Graph, not a checkbox at registration. A family can grant or revoke photo permission for a child at any time. The platform generates a photographer shot list from the consent graph: children with a no-photo flag are excluded from the shot list at the photographer’s device, before a photo is taken. After a session, photos enter a parent-proofing queue — families see only their child’s photos and approve or decline before any order is placed or image is included in a gallery or yearbook package. The camp photo workflow does not use facial recognition — face-matching is off by default and is not part of the standard camp workflow. The shot list relies on the enrolled roster and the consent record, not on face detection or AI image analysis. Photo operations — shot lists, no-photo-flag enforcement, parent proofing, and yearbook/package handoff — are built and production-ready.

The health and safety data model stores allergy profiles, medication authorisations, incident logs, emergency contacts, and immunisation records per child, linked to the consent graph so that health information is visible only to staff with the appropriate role permission. A nurse-role view exposes the medication log and incident record for a session without granting access to billing or communication data. Offline emergency packets — a per-child printable summary for field trips or scenarios where the platform is inaccessible — are generated from the same data. The health and safety data substrate is built and production-ready. The full health center workflow surface and nurse-view permission tier are in active development: the data model is complete, the workflow surface and export UIs are being finished.

The parent communication engine handles transactional messages — registration confirmations, check-in alerts, incident notifications, and session updates — through email, SMS, and web-push channels. An emergency broadcast mode sends a time-stamped alert to all opted-in families in a session simultaneously. Delivery logs record the status of every outbound message. The channel infrastructure and message routing are built and production-ready. Live carrier delivery requires configured provider keys — the external SMS and email provider wires — which are honest-off: present in the platform, not yet enabled for live outbound delivery. Consent governs the list: a message reaches only families who have opted in to communications from the organisation. There is no open child-to-child messaging on this platform.

The platform is in active development. In a conversation we walk through the current state honestly: the session configuration and roster management engine including custom forms, capacity rules, and consent intake; the check-in, authorised-pickup, and attendance engine on the BAS substrate; the Minor Consent Graph in the consent record and what it enforces; the photo operations stack including shot lists, no-photo flags, and parent proofing; and the staff role-access and fail-closed enforcement layer. None of those involve live payments or live carrier message delivery today. A conversation is the honest next step: we show what is built, what the payment rail and carrier delivery timelines look like, and what early access means for a specific program.

Minor and family data is owned by the organisation, not the platform. No child or family data is sold to or shared with outside companies or advertisers. There is no behavioural tracking, no ad network, and no child-profile monetisation. The platform is not a child social product: there are no child-facing engagement profiles, no gamified feeds, and no open messaging between children. Data is encrypted in transit. Minor data is access-controlled: role permissions in the staff layer govern who sees what, scoped to their assigned session. Consent can be withdrawn by a family at any time; revocation is immediate and recorded. The platform is COPPA-conscious and FERPA-aware in its architecture: parental consent governs collection, access is role-scoped, and records are deletable on request. We do not claim a SOC 2 or FERPA certification we have not earned.

The staff management layer covers role-based access control, session assignments, certification tracking, and the fail-closed enforcement of consent and pickup rules against the staff role. Background-check integration — the external provider wire that performs actual screening — is honest-off: the integration point is in the platform but the provider connection is not yet live. A camp can record background-check completion status manually while the live wire is in development. Role-based access control, session assignments, and the fail-closed consent and pickup enforcement are built and production-ready. The live background-check provider wire is honest-off.

The platform is in active development. Built and production-ready today: the check-in, authorised-pickup, and attendance engines on the BAS substrate; the Minor Consent Graph and consent substrate; the photo operations stack; the registration and billing data layer; the health and safety data substrate; and the staff role-access layer with fail-closed enforcement. Honest-off today: the payment rail (live checkout for families), live carrier delivery for parent communications, the health center workflow surface, the background-check provider wire, and advanced reporting modules. Early access means a conversation where we show the current state honestly, discuss timelines, and agree on what the first season looks like for a specific program. There is no pricing commitment and no sign-up required.

One platform runs day camp and multi-week rotations, overnight and residential sessions, specialty programs (STEM, arts, music, sports clinics), school summer and intersession programs, after-school and extended-care programs, and faith, parks, and community youth programs. Every format runs on the same built session-configuration, roster, check-in, and consent engines — a two-day clinic and a six-week camp share one engine. The engines behind every format are built and production-ready; the family checkout that accepts payment is honest-off until the payment rail is enabled. School summer and intersession programs carry the same minor-privacy posture as the academic year: consent-gated intake, role-scoped health access, directory suppression, and no raw student PII surfaced.

A guardian gets a scoped view of only the children they are the verified guardian for — a minor camper row is never public. In the portal they see their child’s registration status and which required forms are still outstanding; they toggle per-domain consent for photo permission, directory listing, the authorised-pickup list, and communications opt-in, and each change writes directly to the Minor Consent Graph and takes effect immediately across the shot list, gallery queue, roster, and comms list; and they review only their own child’s photos in a proofing queue, approving or declining each before any gallery inclusion or order. The consent toggles and the proofing queue are built and production-ready. Live payment status in the portal and live carrier delivery of messages are honest-off. Access is consent-gated and FERPA-safe: no raw student PII is surfaced beyond the guardian and the role-scoped staff who need it. There is no open messaging between children and no child-facing social profile.

The roster is grouped by session and group, and every camper row shows required-form status at a glance, so a director sees who is fully enrolled and who is outstanding before the first morning. On the day, the attendance board reconciles expected against checked-in in real time; a staff-ratio meter warns a supervisor the moment a group drops below its configured ratio; and a missing-form flag fires at the gate when a child checks in whose required forms are incomplete — not at end-of-day reconciliation. The board is consent-gated and FERPA-safe: a camper row is never public, no raw student PII is surfaced beyond the role-scoped staff who need it, and directory suppression removes a child from any shared listing. Roster management, real-time attendance, staff-ratio tracking, and authorised-pickup enforcement are built and production-ready on the BAS/check-in substrate.