Privacy policy

Last updated October 22, 2026

ECYD (ecyd.app, "the app") is the web app of ECYD, a youth program of Regnum Christi ("we", "us"). Staff use it to organize ECYD retreats, clubs and teams for boys and girls, and families use it to see their zone's calendar, register their children for retreats and events, and keep their family's details up to date. This policy explains what information the app collects, how it is used and shared, how long it is kept, and the choices you have.

Information we collect

We collect only what is needed to run ECYD's activities:

• Staff accounts (directors and helpers of a section): name, email address, phone number, a password (stored only as a secure hash) or a one-time sign-in code sent by email, the sections they help run, and their role.
• Members and families, given by parents or staff: names, birthdays, gender, grade or graduation year, school, email addresses, phone numbers, home address, the parents and children linked to each other, club and team membership, retreats and events attended, awards and stage in the program, and staff notes.
• Registrations for retreats and events: who was registered and by whom, medical notes, allergies and emergency contacts given on the form, the signed release (kept as a PDF), coupons used and the amount paid. Card payments are made through Stripe; the app never sees or stores card numbers.
• Email preferences: whether an address unsubscribed from group emails, and when.
• Google account data, only for section directors who choose to connect a Google Calendar: their Google email address and Google's permission for the app to manage their calendars (see Google Calendar below).
• Technical information: your browser keeps your sign-in session on your device. We don't use advertising or tracking cookies, and we don't use analytics services.

How we use it

• Signing you in and showing each person what their role allows.
• Planning retreats, clubs and teams, and keeping track of who takes part.
• Registering participants, collecting signed releases and taking payment.
• Giving staff the medical and emergency information they need at events.
• Sending sign-in codes, registration confirmations and group emails from the section.
• Showing each zone's calendar of retreats, events and club meetings.

We do not sell information, and we do not use it for advertising or profiling.

Who can see it and who we share it with

• Staff see the members, families and activities of the sections they help run. Global administrators set the app up.
• Families see and edit their own details and their children's, and see their children's retreats, clubs and upcoming club meetings. Staff notes are never shown to families.
• Anyone can see the list of zones, each zone's public calendar and the events open for registration.
• Service providers that run the app for us, only as needed to provide their service and bound to protect it: Fly.io (servers and database), Google Firebase (website hosting and file storage), Stripe (payments), Resend (email delivery) and Google Calendar (zone calendars).
• Authorities, only if the law requires it or to protect someone's safety.

Google Calendar: how the app uses Google user data

A section's director can choose to connect their own Google Calendar, so that the section's retreats, events and club and team meetings appear in a calendar they own and on the zone's page. Connecting is optional, and only directors are asked. The app does not use Google sign-in for anyone else.

When a director connects, the app asks Google for permission to:

• See their email address (the email scope), only to show which Google account is connected.
• See, edit, share and delete their Google calendars (the Google Calendar scope), which the app uses only to:
  • list the calendars they own, so they can choose which one the section uses;
  • create a new calendar for the section, if they choose that;
  • make the chosen calendar public, so families can see it on the zone's page;
  • add, update and remove the section's ECYD events in that calendar;
  • read the events in that calendar to check that the app's own events are still in step (for example, if one was deleted in Google Calendar), so the director can fix them.

The app does not read, change, copy or store the director's other calendars or other events. The only Google data the app stores is the director's Google email address, the chosen calendar's id, and Google's permission (a refresh token). The token is kept on our server, where only the server can read it; it is never shown to other users or shared with anyone. When a director disconnects in the app, the app removes its events from their calendar, revokes the permission with Google and deletes the token. A director can also remove the app's access at any time at myaccount.google.com/permissions.

ECYD's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features described above. It is not sold, not transferred to others except as needed to provide these features or as the law requires, not used for advertising, not used to develop, improve or train AI or machine-learning models, and not read by people except with the director's permission, for security purposes, or as the law requires.

Children

ECYD is a program for young people, so the app holds information about children. It is given by their parents or guardians, or by the section's staff with the family's knowledge; children do not create accounts. Parents can see, correct and clear what we keep about their children in My family, and can ask us to delete it.

How long we keep it

We keep information for as long as the person takes part in ECYD, and afterwards only as long as needed for the program's records (for example, signed releases for past events). You can ask us to delete your information or your children's at any time, unless we must keep it by law.

Your choices and rights

• See and update your family's details in My family.
• Unsubscribe from group emails with the link in each one.
• Disconnect Google Calendar in the app, or remove its access in your Google account.
• Ask for a copy of your information, or for it to be corrected or deleted, by writing to us.

Security

Connections to the app are encrypted (HTTPS), passwords are stored only as secure hashes, Google permissions are readable only by our server, and each person sees only what their role allows. No system is perfectly secure, but we work to protect the information we keep and will tell affected people if it is ever compromised.

Changes

If this policy changes, the new version is posted here with its date. Important changes are announced in the app.

Contact

ECYD, Regnum Christi. Questions or requests about your information: support@ecyd.app.