The short version: Kids under 13 can use Grouperly only through an account their parent creates and approves. We collect only what the account needs. We never show kids ads, never sell or share their information, and never use third-party analytics on their accounts. Parents can see, change, or delete their child’s information at any time.
This notice explains how Jamnaytac LLC, doing business as OrgStrong (“OrgStrong,” “we,” “us”), handles personal information about children under 13. It covers Grouperly and every app that uses a Grouperly account. We follow the Children’s Online Privacy Protection Act (COPPA). This notice adds to our Privacy Policy, which covers everyone else.
Who to contact
OrgStrong is the only company that collects or keeps children’s personal information through the Grouperly Services. Reach us at:
Jamnaytac LLC, doing business as OrgStrong
24A Trolley Square #1752
Wilmington, DE 19806
Phone: 929-262-1869
Email: privacy@grouperly.com
How children’s information gets into Grouperly
There are two ways:
- Roster profiles (the child doesn’t use Grouperly). Group leaders and parents can add a child to a group’s roster, for example a Cub Scout in a pack. A roster profile can include the child’s name; their age group (under 13, or 13 to 17) or birthdate; contact details and an address; tags such as “Den 3”; positions; notes from leaders; other details the group keeps, such as a member number or the date a health form expires (only the date, never the form); and links to the child’s parents or guardians. Adults in the group may also add documents about the child, such as a health form, photos that show the child, the child’s name when a parent RSVPs for them or a leader adds them to an event, and emails they forward to the group that mention the child. This information comes from adults, not from the child, and our Terms require leaders to have the parent’s permission. We never contact the child. Messages about the child go to their parents or guardians.
- Child accounts (the child uses Grouperly). A parent or legal guardian can create an account for their child so the child can see their group’s events, RSVP, and take part in group messages. We only create a child account after the parent gives us verifiable consent, and only in groups that have turned child accounts on. Child accounts work in the Grouperly app only. Leaders can’t consent for a child.
We protect roster profiles and child accounts the same way.
A parent or guardian can also register their child for an event that a group shares by link, without a Grouperly account. The registration holds the child’s name and ticket type, and only the group’s leaders, and those leading the event, see it. Children can’t register themselves, and a parent’s “Keep me posted” choice never covers their children.
An adult can also bring a guest to an event by name, such as a friend who comes along: a family lists them on their RSVP, or a leader running the event adds them to a family’s RSVP or to the event’s own list. We ask only for the guest’s name and a ticket, never their age or contact details, and we never contact them. A name on the event’s own list becomes “Guest” 2 years after the event.
Getting a parent’s consent
- If a child tries to sign up alone. When someone tells us they’re under 13 during sign-up, we stop: we delete the sign-in they just created, including its email address, and ask only for a parent’s email address. We use that address only to send the parent one email: what happened, what a child account collects, and how a parent sets one up and gives consent. If the parent doesn’t give consent within 14 days, we delete the address and our record of that email.
- When a parent sets up a child account, we first show the parent a notice describing what we’ll collect, how we’ll use it, and who can see it, and we email them a copy. We verify that the person consenting is an adult who can be the child’s parent, using a method approved by the Federal Trade Commission: a small card payment, which we refund at once. Prepaid cards can’t be used. A parent who has already been verified this way doesn’t do it again for another child. A leader of the child’s group also confirms that the person consenting is the child’s parent or legal guardian before the account is set up.
- What the parent agrees to includes letting the child share messages, RSVPs, and photos with the members of their own groups. Nothing a child posts is ever public. Adding the child to another group shows the parent this notice again and asks for their consent for that group, and a leader of that group confirms the parent first.
- If our practices change in a way that affects children’s information, we’ll ask parents for consent again before the change applies.
What we collect from child accounts
We collect only what a child account needs, and we never require a child to share more than an activity needs:
- Account details the parent provides: the child’s first name or a nickname, a username and password the parent chooses (a child doesn’t need an email address), the child’s birth month and year (so we know when they turn 13), and the links to the accounts of the parents and trusted adults on it.
- What the child does in their groups: messages they send, RSVPs, and photos they share, all visible only inside the group. Children can share photos but not videos. We remove the location from photos a child shares, and we don’t keep the original files.
- Technical information: the cookies that keep the child signed in, and sign-in security information such as IP address, approximate location (city and country), and device type. We use these only to keep the account secure. See Persistent identifiers.
We don’t collect a child’s precise location, contacts, phone number, email address, or audio recordings, and we don’t let children post anything publicly.
How we use children’s information
We use a child’s information only to:
- run the child’s account and their groups;
- keep the child and the account safe, including enforcing our youth-protection rules;
- send notices to the parent, such as consent requests, account updates, and safety alerts;
- comply with the law.
We never use children’s information for advertising, marketing, profiling, or training AI models, and we never send marketing to a child.
AI features. Nothing a child posts is ever used by our AI features. When a group’s assistant searches the group’s documents, every child on the roster appears only as a placeholder, such as “[Scout A]”, with their contact details and member numbers hidden. A document that adults upload can still mention a child, such as a scanned sign-in sheet. If an adult asks AI to read that document, Amazon Bedrock reads the page inside Amazon Web Services without keeping it or learning from it, except that an image appearing to show child sexual abuse may be kept and reported, as the law requires. Copies a group shares with other groups have children’s names and details removed, and health documents are never used.
Persistent identifiers
Child accounts use a few persistent identifiers: sign-in cookies, IP address, and device information. We use them only to support our internal operations:
- keeping the child signed in;
- detecting and blocking suspicious sign-ins;
- protecting against fraud and abuse;
- keeping the service running and fixing problems.
To make sure they’re used for nothing else:
- child accounts never load Google Analytics or any other third-party analytics, advertising, or social media code;
- these identifiers are never used to contact a child, build a profile, or show ads.
Who can see a child’s information
| Who | What they can see |
|---|---|
| Parents and legal guardians on the child’s account | Everything about their child: account details, roster profile, messages, RSVPs, and photos |
| Trusted adults a parent adds, such as a grandparent | What the parents see. They can help with the child’s sign-in and correct their name, but they can’t consent for the child, delete their information, or close the account |
| Other guardians listed on the group’s roster | The child’s roster profile, except details the group keeps for its leaders only, and that the child has a login. Not the account or its controls |
| The group’s leaders, including leaders of an organization that manages the group, such as a school over its classes | What they need to run the group: the child’s name, roster details, and the child’s activity in that group. A health form’s expiry date is seen only by the group’s own owners and admins |
| Circle leaders, such as a den or patrol leader | Their circle’s roster, as members see it. For their circle’s events: the RSVPs, whether the child is paid for, and, when they add the child, who answers for them |
| Someone leading an event, its organizer or lead, if they’re an adult member of the group | For that event only: its RSVPs, including the child’s, whether the child is paid for, and, when they add the child, who answers for them |
| Someone who handles the group’s money, an adult member an owner or admin chose | The child’s name on payments made for them, and whether the child is paid for |
| Other members of the child’s group | The child’s name and what the child shares in the group. Never the child’s birthdate, address, notes, or other details the group keeps about the child |
| Anyone else | Nothing from a child account or roster profile. Nothing a child posts is ever public. A photo that adults upload can show a child; leaders can put it on the group’s public page only after confirming that the child’s parent has given permission |
Third parties
We don’t sell or share children’s personal information, and we don’t disclose it to any third party except the service providers that help us run Grouperly. They act under contract, for our purposes only, and must protect the information:
| Service provider | What they do with children’s information | Why |
|---|---|---|
| Amazon Web Services | Hosting, database, photo and file storage, sign-in and security checks, delivering emails to parents, and running our AI features (Amazon Bedrock) | Integral to running Grouperly |
| Zoho | Hosts our privacy@ and support@ mailboxes, so it holds what parents email us about their child | Integral to answering parents |
Apps and tools. Apps from other companies, and tools a group’s owners connect to the group, never receive a child account’s information, a child’s roster profile, or anything a child posts. They see only how many young members a group has. If a group’s leaders let them read the group’s photos or documents, those can show or mention a child, as they can for any member of the group; our Terms require leaders to have parents’ permission for what they add about a child. Our own apps and add-ons show a child’s information only to the people who would see it in Grouperly.
COPPA requires a separate parental consent before a child’s information is disclosed to any third party for purposes that aren’t integral to the service, such as advertising. We don’t make any such disclosures. If that ever changes, we’ll ask for that separate consent first, and a parent can say no without affecting their child’s account.
We may disclose information when the law requires it, or to protect a child’s safety. For example, we report apparent child sexual abuse material to NCMEC.
How we protect kids in their accounts
- No private adult-to-child messaging. Any message between a child and an adult automatically includes the child’s parent or guardian, in the conversation or by an emailed copy. If we can’t include a parent, the message isn’t sent.
- Group-only. Children can only interact with members of groups they belong to.
- No public content and no ads. A child account can’t follow other groups, subscribe to their news, or ask to join them, and nothing a child posts appears on a group’s public page.
- Links stay with adults. Links a child writes aren’t clickable, so children can’t send each other off Grouperly. Links the group’s leaders and other adults share work as usual, and the child’s parent sees the same messages.
- Reporting and blocking. Anyone in a group, children included, can report a message, photo, or person to the group’s leaders. Reports about a child’s safety also come straight to us. Children can block people from messaging them directly.
- Leaders can remove inappropriate content and members.
Parents’ rights
As the parent or guardian, you can at any time:
- review the personal information we have about your child, and download a copy;
- correct it;
- delete it, item by item (a message, an RSVP, or a photo), or delete your child’s account entirely;
- set a new password, sign your child out everywhere, or pause the account;
- withdraw consent and stop us collecting more information from your child. Because an account can’t work without that information, withdrawing consent closes the account and deletes its information;
- agree to collection and use without agreeing to disclosure to third parties. Since we never make non-integral disclosures, your child’s account works fully either way.
How: use Profile → Your children in the Grouperly app, or email privacy@grouperly.com from the email address on your account. We’ll confirm you’re the parent before sharing or changing anything. For a roster profile that a leader created, you can also ask the group’s leaders to change or remove it.
Other adults. You can add your child’s other parents or legal guardians to their account, and they have nearly the same controls as you. They can’t remove you, and before they consent to something new for your child, such as another group or updated Terms, they make the same card check you did. You stay the parent who’s included in your child’s conversations with adults, and if you delete your own Grouperly account, your child’s account is deleted too. You can also add a trusted adult, such as a grandparent, who sees what you see and can help with things like a forgotten password. A trusted adult can’t consent for your child, delete their information, or close the account. Each adult uses their own Grouperly account, and every parent on the account is emailed when an adult joins or leaves.
How long we keep children’s information
This is our written retention policy for children’s personal information. We keep it only as long as reasonably needed for the purposes above, then delete it securely:
| Information | When we delete it |
|---|---|
| A parent’s email address collected before consent, and our record of the email we sent to it | 14 days after it’s given, if the parent doesn’t consent |
| A child account and everything in it | When a parent deletes it or withdraws consent, when the parent who set it up deletes their own Grouperly account, or after 12 months without use. We email its parents 30 days before deleting an inactive account. The child’s roster profile stays with the group (see below) |
| A parent’s consent records | 5 years after the child’s account is closed, as proof that the parent consented |
| An invitation to another adult to join a child’s account | 14 days after it’s sent, if they don’t accept it |
| Messages, RSVPs, and photos a child posted | When the child, a parent, or a group leader deletes them, or when the account is deleted |
| A roster profile | When a leader removes it, the group is deleted, or a parent asks us to delete it. If a leader just removes it, the child’s name on past RSVPs, and documents and photos about the child, stay until they’re deleted, the group is deleted, or a parent asks us. A health form’s expiry date is deleted when a leader removes the child from the group |
| Reports about a concern | 12 months after they’re resolved |
| Records of who opened a child’s health form, or which app read a child’s information | 12 months |
| A child’s name on an event registration made without an account | 2 years after the event, or sooner if the parent asks |
| A guest’s name someone adds to an event | With the family’s RSVP it’s on. On an event’s own list, 2 years after the event |
| Backups | Overwritten within 7 days |
| Server and security logs | 90 days |
| Sign-in security events | Up to 2 years, or until the account is deleted, whichever comes first |
We may keep information longer when the law requires it. For example, a photo we report to the National Center for Missing & Exploited Children is kept for at least a year, as federal law requires.
When a child turns 13
We email the parents in the month a child turns 13, going by the birth month and year on the account. Nothing changes on its own: the child account keeps every protection until a parent acts.
If you want your teen to have their own account, make a link on their page under Profile → Your children and give it to them. They sign up with their own email address, and you approve that account by name. Then we move their groups, messages, RSVPs, and photos to it, and delete the child login and its birth month and year. From then on, our Privacy Policy applies to them. We keep the record of your consent as proof, as described above.
Security
We keep a written information security program to protect children’s information. Under it we:
- name a person responsible for the program;
- assess risks at least once a year;
- limit who at OrgStrong can access children’s information;
- encrypt data in transit and at rest;
- require our service providers to protect the information too.
Schools and classrooms
Teachers and schools can add students to a class roster, as roster profiles. A student under 13 gets their own login only through their parent, as described above. We don’t accept a school’s consent in place of a parent’s.
Changes to this notice
If we make material changes to how we handle children’s information, we’ll email parents and ask for their consent again before the change applies to their child. Until a parent consents, their child can’t use the account. The version and effective date at the top of this page show when it last changed.
Questions?
Email privacy@grouperly.com, call 929-262-1869, or write to us at Jamnaytac LLC, 24A Trolley Square #1752, Wilmington, DE 19806.