Version: 1.0 (DRAFT — REQUIRES ATTORNEY REVIEW BEFORE PUBLICATION)
Last updated: [DATE]
Effective date: [DATE]
⚠️ READ THIS BEFORE PUBLISHING — DO NOT SKIP
>
This is a well-researched draft, not legal advice, and I am not a lawyer. It must be reviewed by a licensed attorney before you publish it or collect a single real user's data. Two reasons this is not optional for your specific app:
>
1. You collect children's personal information. The FTC's amended COPPA Rule became fully enforceable on April 22, 2026. Penalties run over $50,000 per violation, and the FTC has publicly stated children's privacy is an enforcement priority (Disney settled a COPPA-related matter for $10 million in September 2025). A template policy is not a defense.
2. A key legal question in this document is genuinely unresolved and needs a lawyer's judgment — see "The COPPA Question You Must Resolve" at the bottom of this file. Getting it wrong in either direction is costly: too loose and you're exposed; too strict and you build friction that kills adoption unnecessarily.
>
Budget for a few hours of a privacy attorney's time. Compared to the backend build cost, it is cheap insurance.
Jr Tee Time ("we," "us," "our") operates a directory that helps parents and guardians in Central Florida find, compare, and request enrollment in junior golf camps, clinics, and programs.
Contact:
Bradley Padilla
Email: thejrteetime@yahoo.com
Phone: 720-880-8061
Jr Tee Time is intended for use by parents and legal guardians who are 18 or older. It is not directed to children, and we do not knowingly permit children to create accounts, browse independently, or submit information to us directly.
Children do not use Jr Tee Time. Parents use Jr Tee Time on their child's behalf.
When a parent or guardian submits a request to enroll a child in a program, we collect:
| Information | Why we need it |
|---|---|
| Parent/guardian name | So the provider knows who is requesting enrollment |
| Parent/guardian email | To send you confirmation and status updates about your request |
| Parent/guardian phone (optional) | So the provider can reach you about scheduling or details |
| Child's first name | So the provider knows who the enrollment is for |
| Child's age | To confirm the child meets the program's age requirements |
We deliberately do not collect: the child's last name, date of birth, photograph, address, school, medical information, or any other information about the child beyond what a provider needs to determine eligibility and hold a place.
We do not collect payment or financial information. Payment for programs, where required, is handled directly between you and the provider.
We use the information you provide only to:
We do not:
Golf course and program providers. When you submit a booking request, we share your submitted information with the specific provider you selected — and only that provider. Providers can access only the requests submitted for their own programs; our system enforces this at the database level.
Once a provider receives your information, their own privacy practices apply to their handling of it. We are not responsible for how a provider stores or uses information after it is transmitted to them. We encourage you to review the provider's own privacy policy.
Service providers who operate our infrastructure:
| Service | Purpose | What they may process |
|---|---|---|
| [Supabase or chosen host] | Database and authentication | All submitted booking data |
| [Resend/SendGrid or chosen provider] | Sending notification emails | Names and email addresses |
| [Hosting provider] | Serving the application | Technical/connection data |
Legal disclosure. We may disclose information if required by law, subpoena, or court order, or where we believe disclosure is necessary to protect the safety of a child or any person.
Business transfer. If Jr Tee Time is acquired or merged, information may transfer as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.
The amended COPPA Rule requires a written retention policy stating why data is collected, the business need for keeping it, and a deletion timeframe. Indefinite retention of children's information is prohibited.
| Data | Retention period | Business reason |
|---|---|---|
| Booking requests (including child's first name and age) | [PROPOSED: 12 months from submission, or 90 days after the program's end date, whichever is sooner] | To allow the provider to process enrollment and resolve any disputes about the request |
| Parent contact information tied to a booking | [PROPOSED: same as above] | To communicate about the request |
| Notification logs (email delivery records) | [PROPOSED: 12 months] | To verify notices were delivered and troubleshoot failures |
| Provider account information | Duration of the provider relationship, plus [PROPOSED: 12 months] | To operate provider accounts |
We delete children's personal information when it is no longer reasonably necessary for the purpose it was collected. Deletion is permanent and secure.
As the parent or guardian who submitted information, you may at any time:
To exercise any of these rights, email thejrteetime@yahoo.com. We will verify your identity as the submitting parent before acting on the request, and will respond within [PROPOSED: 30 days].
Deleting information may mean a pending booking request can no longer be processed. We will tell you if that is the case before deleting.
No system is perfectly secure, and we cannot guarantee absolute security.
Florida law (Fla. Stat. §501.171) requires notification of security breaches involving personal information, and applies to businesses of every size. If a breach affecting your information occurs, we will notify affected individuals and the Florida Department of Legal Affairs as required by law, within the timeframes the statute requires.
Jr Tee Time is directed to parents and guardians, not to children. We do not knowingly collect personal information directly from children.
Information about a child is provided to us by that child's own parent or guardian, who is exercising their own judgment in sharing it for the specific purpose of requesting enrollment.
If we learn that a child has provided us information directly, we will delete it promptly. If you believe a child has submitted information to us, contact thejrteetime@yahoo.com and we will delete it.
Parents: you may review, delete, or refuse further collection of your child's information at any time using the contact above. See Section 7.
We may update this policy as the service develops. When we make changes:
Continued use after a non-material update constitutes acceptance of the updated policy.
| Version | Date | Change |
|---|---|---|
| 1.0 | [DATE] | Initial policy |
Questions, concerns, or requests:
Bradley Padilla — Jr Tee Time
Email: thejrteetime@yahoo.com
Phone: 720-880-8061
[MAILING ADDRESS]