Privacy Policy

Last updated: October 25, 2026

1. Who we are

Campkey ("we," "us," "our") is a campsite cancellation alert service operated by Ian Richardson, a sole proprietor based in Southern California. This policy covers our website, our text message and email alerts, and the Campkey iOS app. You can reach us at [email protected].

This Privacy Policy explains what information we collect, why we collect it, and what we do with it. We aim to write this in plain English. If anything is unclear, email us and we'll explain in plain language and update this document.

2. Information we collect

We collect only what we need to deliver alerts to you.

You give us directly:

• Your name (so we can address you)
• Your email address (account login, billing receipts, occasional product updates)
• Your phone number (required for the SMS delivery path and for signing in to the Campkey iOS app, which uses a code we text you; the email-only path requires no phone number, same paid service, same alerts. The iOS app needs phone sign-in, so email-only members cannot use it)
• The California parks you want monitored and any date preferences you specify
• Payment method information you enter into Stripe (we never see or store your full payment method number; Stripe handles this directly)

Collected automatically when you use the service:

• Basic technical information (IP address, browser type, device type) for security and abuse prevention
• Records of which alerts we sent you and when, so we can debug and improve the service

That's it. We do not collect:

• Your location (we don't track where you are)
• Your contacts
• Your photos, files, or anything outside the alert preferences you set
• Any data from third-party services or social media

3. The Campkey iOS app

The Campkey iOS app is for people who are already Campkey members. It is offered in the United States. Campkey is independent. It is not affiliated with or endorsed by California State Parks, ReserveCalifornia, Recreation.gov or OC Parks.

What the app uses

• Sign in with a code, no passwords. You sign in to the app with your mobile phone number and a six digit code we text you, sent through Twilio Verify. The app has no passwords. Your sign-in token is stored in your iPhone's Keychain. Signing out, or deleting your account, removes it.
• Your account data. Your name, phone number, watch list (campgrounds, dates, minimum rating), the texts Campkey sent you about openings, and your membership status are kept in your Campkey account, the same one your text alerts come from. The app shows them to you.
• Copies on your phone. So Openings and Watch still show something when you are offline, the app keeps a copy of your latest alerts and watch list on your iPhone. Signing out or deleting your account clears it.
• "I booked it" and "It was gone" stay on your phone. If you tap one of these buttons under an opening, the app saves a note on your iPhone only. It is not sent to Campkey or anyone else, and it is cleared when you sign out or delete your account.
• The Watch map. When you open the map, your phone asks OpenFreeMap (openfreemap.org, run by Hyperknot Software Kft. in Hungary) for the map pictures it needs. Because this is an ordinary request over the internet, OpenFreeMap receives your phone's IP address and which part of the map you are looking at. OpenFreeMap says it does not store IP addresses in its normal access logs and does not use cookies, that error logs (which can include an IP address) are deleted after 7 days, and that it may turn on IP logging for up to 30 days if it detects an attack. It may deliver maps through Cloudflare. Campkey does not send OpenFreeMap your name, phone number or watch list. The app does not ask for or use your location. Map data comes from OpenStreetMap contributors. If the map can't load, Watch shows a list. See OpenFreeMap's Privacy Policy.
• Booking. Book buttons open ReserveCalifornia, Recreation.gov or OC Parks in Safari. Campkey does not make reservations. Those sites have their own privacy policies.
• Billing. Paying members can open Stripe's billing page in Safari to change a plan, update a payment method or cancel. Campkey does not see your payment details. The app has no in-app purchase.
• Taps. The app uses light haptics (small vibrations) when you save or change what you watch. They send no data.

What the app does not do

No ads, no analytics or tracking tools, no access to your location, contacts or photos, and no push notifications.

Deleting your account in the app

In the app, go to Account, then Delete account, and type DELETE. Campkey stops billing first, then erases your name, number, watch list, dates and alert copies from Campkey. If billing can't be stopped, nothing is deleted and the app says so. We keep billing records, the date you joined, a scrambled copy of your number to record the deletion, and sign-in security records (sign-in attempts are kept for 30 days). Stripe (payments) and Twilio (text messages) keep their own records under their own policies. OpenFreeMap map requests are not tied to your account, so there is nothing of yours to erase there. Deleting your account does not delete anything held by Apple. You can also ask us to delete your data by emailing [email protected].

4. How we use your information

We use your information for these purposes only:

• To send you cancellation alerts via SMS or email, depending on the delivery channel you chose at signup, for the parks you've actively requested to monitor
• To bill you through Stripe and provide receipts
• To support you: respond to questions, fix problems, take feedback
• To send occasional product updates via email only (e.g., "we now cover Yosemite"). We do not send promotional content via SMS; SMS is reserved for transactional cancellation alerts and account-related messages only
• To improve the service by analyzing aggregate usage patterns (which parks are most-watched, which alerts get clicked)

5. SMS messaging: what you're consenting to

When you provide your phone number and subscribe, you explicitly consent to receive:

• Alert messages when a campsite matching your preferences becomes available
• Service messages related to your subscription (e.g., trial-ending reminders, billing receipts)
• Sign-in codes when you ask to sign in to the Campkey iOS app
• An occasional opt-in confirmation message after you sign up

Message frequency depends on your selected parks and date ranges. A typical user receives 0–10 messages per week.

We send all SMS through Twilio, a third-party messaging provider that complies with US carrier 10DLC requirements.

6. Who we share your information with: the short version

The outside services that handle your data, and why:

• Stripe, processes your payment. They see your payment method and billing address. They follow PCI-DSS standards. Stripe's Privacy Policy.
• OpenFreeMap, supplies the map pictures in the iOS app's Watch map. They receive your phone's IP address and the map area you view, and nothing else from Campkey. OpenFreeMap's Privacy Policy.
• Twilio, sends your SMS alerts and sign-in codes. They see your phone number and message content. Twilio's Privacy Policy.
• Railway (hosting): runs our servers and stores our database, so the data we hold about you sits on its systems. Railway's Privacy Policy.
• Cloudflare: serves this website and runs its site functions, so it handles ordinary web request data such as your IP address. Cloudflare's Privacy Policy.
• Resend (email): sends our emails (receipts, account confirmations, alerts and digests). It sees your email address and the message. Resend's Privacy Policy.
• TikTok (website signups only, when we have this switched on): when you sign up on our website, we can send TikTok's server-side Events API a "sign up completed" event so we can tell whether our TikTok ads led to signups. The event can include a hashed (scrambled) copy of your email address, a hashed copy of your phone number if you gave one, your IP address, your browser's user agent, and a scrambled internal ID. TikTok may use this under its own policy. This does not happen when you sign in to the iOS app, and the app sends nothing to TikTok. To ask us to leave you out, email [email protected]. TikTok's Privacy Policy.

This is the list as of the date at the top. If we add another vendor that handles your data, we will update this document.

If we are legally compelled by a valid court order to disclose information, we will. We will notify you of such requests when legally permitted.

7. How long we keep your data

• While your account is active: we keep your account data and alert history.
• When you cancel: your alerts stop, and we keep your account details in case you come back, until you ask us to delete them (in the iOS app, or by emailing us). We may retain anonymized usage records for service improvement.
• Billing records: Stripe retains payment records per their terms. We retain receipts for tax and accounting purposes for 7 years.
• In the iOS app you can delete your account yourself (see section 3). What we erase and what we keep is listed there.
• You can request immediate deletion at any time by emailing [email protected]. We will confirm deletion within 7 days.

8. How we keep your data safe

• All data is transmitted over HTTPS.
• Passwords, where a website account has one, are stored hashed (we cannot see your password; even we don't know it). The iOS app has no passwords: you sign in with a code texted to your phone, and the app keeps its sign-in token in the iPhone Keychain.
• Database is hosted on a reputable cloud provider with industry-standard security.
• Access to production data is restricted to the founder (Ian).
• We have not had a data breach. If we ever do, we will notify affected users within 72 hours per California law.

9. Your rights, California residents (CCPA / CPRA)

If you live in California, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information we have about you
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of "sale" or "sharing" of your personal information. We do not sell it for money. The TikTok ad measurement for website signups described in section 6 may count as "sharing" under California law, so you can opt out of it by emailing us
• Right to non-discrimination if you exercise any of the above rights (we won't change your service or pricing if you ask for your data to be deleted)
• Right to limit use of sensitive personal information (we don't collect sensitive PI as defined by CPRA)

To exercise any of these rights, email [email protected] with the subject line "Privacy Request." We will respond within 45 days as required by California law.

10. Children

This service is not directed to anyone under 13. We do not knowingly collect data from anyone under 13. If you believe we have inadvertently collected data from a minor, email us and we will delete it.

11. Cookies and tracking

We use minimal cookies, only those required for the website to function (e.g., remembering you're logged in). Our website does not currently load any advertising script or third-party advertising cookie in your browser. The server-side signup measurement described in section 6 is separate from cookies.

The iOS app uses no cookies, no advertising identifiers and no analytics or tracking tools.

We may use a basic, privacy-respecting analytics tool (e.g., Plausible, Fathom, or similar) that does not use cookies and does not collect personal information. If we ever add a third-party tracker that does, we will update this document and require explicit consent.

12. Changes to this policy

If we change this policy in any meaningful way (anything beyond fixing typos), we will:

1. Update the "Last updated" date at the top.
2. Tell members about material changes by email or with a notice on this page.

If a change would let us use information you already gave us in a new way you would not expect, we will tell you before it applies to your information.

Your continued use of the service after the change takes effect counts as acceptance of the updated policy.

13. Contact

Questions about this policy? Concerns about your data? Want to delete your account?

Email: [email protected]

We respond to every privacy request personally, usually within 24 hours.