Privacy Policy

MLCops is the event operations system for the California YMCA Youth & Government Model Legislature & Court program (“Y&G”, “the program”). The organization behind the program is the YMCA of Metropolitan Los Angeles. Program staff decide what information the system holds and who may use it, following YMCA of Metropolitan Los Angeles policies and procedures.

The website and the Cal Y&G mobile app are built and run on the program’s behalf by Blargo LLC, which is also the publisher named on the App Store and Google Play. In this policy “we” means the YMCA of Metropolitan Los Angeles, as the organization behind the program, and Blargo LLC working on its behalf.

Four kinds of people have a place in the system: program staff, delegation advisors, volunteers, and delegates. Delegates are middle and high school students, so most of them are under 18 and some may be under 13.

There is no public sign-up. Your record comes from the program’s registration roster, which your delegation and its advisors fill in when you register for Youth & Government, or from program staff adding you by hand. Signing in only ever claims a record that already exists; an email address nobody added is turned away.

Whether delegates can sign in at all is a switch program staff control for each program year. A delegate who never signs in still has a roster record, because attendance and housing depend on it.

About delegates:

• First and last name, school grade, and gender (used for housing).
• Delegation and program area.
• Email address, if the roster has one. It is only used for signing in.
• Attendance: which sessions you were checked in to, when, and whether you checked yourself in or an advisor or staff member marked you.
• Housing: which room or building you are assigned to at an event.
• Notes that staff or advisors write on a roster record.

About staff, advisors and volunteers:

• Name, email address, role, the delegation or delegations you work with, and, if provided, a phone number and title.
• The work you do in the system: tasks assigned to or requested by you, checklist items you complete, equipment and help requests, approvals, and notes you write.

About anyone who signs in:

• A sign-in record: when you signed in, when that session expires, and the IP address and browser or device description (“user agent”) it came from.
• If you choose to set a password on the website, a scrambled (hashed) form of it. We never store the password itself. Most people sign in with an emailed link or code and have no password at all.
• Short-lived sign-in links and codes. An emailed link lasts 15 minutes and an emailed code 10 minutes. A one-time code an advisor issues for a delegate is stored only as a hash, works once, and expires.
• IP addresses, briefly, to limit how many sign-in attempts can come from one place.

A history of changes. Every time a record is added, changed or removed we keep who did it, when, and what the record said before and after. With two ways to edit the same data, this is how mistakes get found and undone. Only the system’s administrators can read it.

What we do not collect. No payment details, no government ID numbers, no health or medical information, no home addresses, no photos, and no precise or approximate location. We do not use advertising identifiers, and neither the website nor the app contains advertising, analytics or tracking software. The website’s only cookies keep you signed in and remember which program year and event you were looking at.

• To sign you in and show you only what your role allows.
• To run the events: schedules, room assignments, session check-in and attendance, housing, seating, tasks, checklists and equipment.
• To keep delegates safe and accounted for. Knowing who is where is the main reason attendance and housing are recorded.
• To send three kinds of email and no others: a sign-in link, a sign-in code, and a password reset. We do not send marketing email.
• To find and fix errors, using the history of changes described above.

Access follows your role, and the database itself enforces it:

• Delegates see their own schedule, check-ins and event information.
• Advisors see the roster, attendance and housing for their own delegation or delegations, not anyone else’s.
• Volunteers see the tasks they are working on.
• Program staff can see and edit all of it, because they run the event.

Who is given a staff, advisor or volunteer role, and how they are expected to handle information about participants, is governed by YMCA of Metropolitan Los Angeles policies and procedures.

We do not sell, rent or trade personal information, and we do not share it for advertising. It is handled by a small number of service providers, each only to do its job for us:

• Railway hosts the website, the database, and the spreadsheet-style editing tools staff use on that same database. Everything described on this page is stored there.
• Brevo delivers our sign-in and password-reset emails. It receives the recipient’s email address and the message.
• Airtable holds the program’s registration roster, which is where roster information is read from. MLCops reads from it and does not write back.
• OpenAI powers an optional planning assistant that only program staff can use. It is sent the staff member’s question along with housing figures, delegation names and headcounts. It is not sent the names or details of individual delegates.
• Apple and Google distribute the mobile app; what they collect when you download an app is covered by their own policies. If you allow notifications, they also deliver them: we send Apple (for an iPhone) or Google (for an Android phone) your phone’s push token and the title and text of the notification, and nothing else about you.

We will also disclose information if the law requires it, or if it is needed to protect someone’s safety at an event.

The app talks to the same system as the website and sends the same information to the same place. Event venues often have no dependable signal, so it also keeps some things on your phone:

• Your sign-in, kept in the phone’s secure storage (the iOS Keychain or Android Keystore).
• A copy of what you last saw: your schedule, the venue map, your check-ins and, for advisors, your delegation’s roster and attendance. Copies older than 14 days are discarded.
• Anything you did while offline — a check-in, an attendance mark, a help request — held until the phone is back online and it can be sent.

Signing out removes all of it from the phone, and so does deleting the app.

Notifications. The app asks whether it may send you notifications, and works without them if you say no. If you allow them, the phone gives the app a push token — an identifier Apple or Google issue so that a message can reach this phone — and we store it with your account, along with whether it is an iPhone or Android phone, the phone’s name and the app version. We use it only to deliver event notifications from program staff and notices about tasks assigned to you. It is removed from your account when you sign out, and when Apple or Google tell us it no longer works, and is not used again; like any other record, its removal is noted in the history of changes described above. Turning notifications off in the phone’s settings stops delivery. We also keep which notifications were sent to you and whether you have read them, so the app can show them in its inbox.

The app checks whether the phone is online. Beyond that and notifications it asks for no device permissions: no location, camera, microphone, contacts, photos or Bluetooth. It has no advertising, analytics or crash-reporting software in it and does not track you across other apps or websites.

The system also has a small number of demonstration accounts, used for testing and for app-store review. They belong to no real person and contain no real participant’s information. They are used in a separate demonstration copy of the system, which may be filled from program records only after every name and contact detail has been removed: a person appears there as a number, such as “Delegate 0417”, with their grade, gender, delegation and program area.

Youth & Government is a program for middle and high school students, so most delegates are minors and some may be under 13. We collect a delegate’s information from the program’s registration roster and from their advisors, not by asking the delegate for it, and we keep it to the few things listed above. A delegate who signs in can check in to sessions and ask for help; the app does not ask them for anything more about themselves.

Registration, parent and guardian permission, and the safeguarding of young people in the program are handled by the YMCA and each delegation under YMCA of Metropolitan Los Angeles policies and procedures. This system is not where that happens; it receives the roster that results.

Parents and guardians can ask to see what we hold about their child, have it corrected, or have it deleted, by emailing mlcops@blargo.net. Your delegation’s advisor can also help. Requests are handled as described under Your choices and rights.

• A sign-in lasts up to 14 days without use, then expires.
• Sign-in links and codes expire within minutes and work once.
• The copy on your phone is cleared when you sign out, and ages out after 14 days.
• Roster, attendance and housing records, and the history of changes to them, are retained and disposed of in accordance with YMCA of Metropolitan Los Angeles policies and procedures. The system does not delete them automatically on a schedule of its own.
• You can ask for your information to be deleted at any time; see Your choices and rights. Deletion requests are handled in line with those policies and applicable law, which may require some records to be kept.

• The website and the app only talk to our servers over encrypted connections (HTTPS).
• Access rules are enforced inside the database, not just on the screen, so a person cannot reach records outside their role.
• Passwords and advisor-issued sign-in codes are stored only as hashes.
• Sign-in attempts are rate-limited, and sign-up is closed to anyone not on the roster.
• Every change to a record is logged with who made it.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell the YMCA of Metropolitan Los Angeles and the people affected, in line with its policies and applicable law.

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it and close your sign-in. Email mlcops@blargo.net from the address on your record, or ask your advisor to. We will answer within 30 days. Requests are handled in line with YMCA of Metropolitan Los Angeles policies and procedures and applicable law, which may require some records, or a history of them, to be kept; if we cannot do all of what you ask, we will tell you what we did and why. Depending on where you live, including California, the law may give you these rights; we extend them to everyone. We will never treat you differently for asking.

Deleting the mobile app, or signing out of it, removes what it stored on your phone but does not delete your record from the program’s roster. Email us for that.

If what we collect or how we use it changes, we will update this page and the effective date at the top. If the change is significant we will tell advisors and staff directly.

Questions, or a request about your information: mlcops@blargo.net.