Privacy policy

Play Pass LLC, a Minnesota limited liability company ("Play Pass," "we," "us," or "our")

This Privacy Policy explains what information Play Pass collects, why we collect it, who we share it with, and the choices and rights you have. It applies to our mobile application, our website, and all related services (the "Platform"). It is incorporated into our Terms of Service by reference.

1. Introduction

Play Pass is a membership platform that helps families find local children's entertainment and play venues, see member-only offers, and reserve or check in for a visit. Membership accounts are held by adults. Parents and legal guardians may add profiles for the children in their care so that a booking can be made and a venue can confirm that a child meets its age requirements.

Because our members are families and because a limited amount of information about children passes through our Platform, we have designed the Platform around a simple principle: collect as little as possible, use it only for the purpose it was given, and never sell it. This Policy describes those practices in plain language and, where the law gives you specific rights, explains how to use them.

Please read this Policy together with our Terms of Service. If anything in this Policy is unclear, contact us using the details in Section 2.

2. Who We Are and How to Contact Us

Play Pass is the controller of the personal information described in this Policy. You can reach us at:

Play Pass LLC

250 Morse Ave

Excelsior, MN 55331-1931

United States

Privacy requests and questions: support@playpasscommunity.com

General support: support@playpasscommunity.com

This Policy is published at: https://playpasscommunity.com/privacy

3. Scope of This Policy

This Policy applies to information we collect through the Play Pass mobile application, the Play Pass website, and our email, text, and customer-support communications with you.

This Policy does not apply to:

Information you give directly to a participating venue ("Partner Business") — for example, when you sign a waiver at the front desk, join that venue's own loyalty program, provide allergy or medical information to their staff, or pay them for admission. Partner Businesses are independent businesses with their own privacy practices and policies.
Information handled by Apple or Google when you purchase a membership through an app store, or by Stripe when you pay us directly. Those companies process your payment under their own privacy policies.
Third-party websites or services you reach through a link on our Platform.

Play Pass does not collect, hold, or process payment for admissions or activities at a venue. You pay the venue directly, at the venue.

4. Quick Summary

This summary is for convenience. The full sections below control.

We collect what we need to run your membership, book your visits, and check you in — and not much else.
About a child, we collect only the child's first and last name and date of birth.
We do not collect medical, allergy, dietary, or health information about anyone, including children.
We do not sell personal information, and we do not share it for targeted advertising or cross-context behavioral advertising.
We do not use third-party analytics tools, advertising pixels, advertising identifiers, attribution SDKs, or session-recording tools.
Children do not have accounts and cannot sign in to Play Pass.
We do not use your device's location. To show you venues near you, we use the town and state you give us, which you can change at any time.
You can delete your account, and any child profile on it, from inside the app.

5. Information We Collect

5.1 Information you provide about yourself

Account information: your first and last name, email address, and date of birth. We use your date of birth to confirm that you are at least 18, as our Terms of Service require.
Login credentials: a password you create, or an authentication token if you sign in with Google or Apple. We do not receive or store your Google or Apple password.
Phone number, if you choose to provide one, so that we can send you account or reservation text messages you have opted into and reach you about a support matter.
Membership and billing information: your plan, subscription status, start and renewal dates, billing history, and cancellations. See Section 11 for how card details are handled.
Booking, reservation, and check-in history: which venues you reserved, when, how many people the offer covered, whether you checked in, and whether you cancelled or did not attend.
Communications: the content of emails, support messages, and other correspondence you send us, and our replies.
Marketing preferences: whether you have opted into or out of promotional email, push notifications, or text messages.
Venues you follow or save in the app.
The town or city and state you enter during onboarding, used to show venues near you. We never ask for a street address (see Section 15).
Campaign details from the link you signed up through (the UTM source, medium, campaign, term and content), used only to measure our own marketing and never shared or sold.

5.2 Information you provide about a child

We collect only two pieces of information about a child: the child's first and last name, and the child's date of birth.

That information is entered by you, the adult account holder, when you add a child profile. Section 9 explains in full how we handle it.

Information about other people. You should not provide information to us about another person — including a child who is not in your care, or another adult who will accompany or collect your children — unless you have obtained all necessary and applicable permissions or consents from that person, or from that person's parent or legal guardian, for us to receive and use their information as described in this Policy. By entering information about another person, you confirm that you have done so.

5.3 Information collected automatically

Device and technical information: device type and model, operating system and version, app version, browser type, language settings, and mobile device identifiers used by the operating system.
IP address, which we use for security, fraud prevention, and to keep a record of parental consent.
App activity: pages and screens you view, features you use, offers you view or save, error and crash information, and timestamps. We use this internally to operate and improve the Platform.
Cookies and similar technologies on our website, as described in Section 12.
Location information, as described in Section 15: only the town or city and state you give us. We do not collect your device's location, and we do not work out your location from your IP address.

5.4 Information we receive from others

From Google or Apple, if you use their sign-in service: your name, email address, and a unique identifier that lets us recognize you at your next login. If you use Sign in with Apple and choose to hide your email, we receive only Apple's private relay address.
From Stripe: confirmation that a payment succeeded or failed, the subscription status, and limited identifiers needed to reconcile your account. We do not receive your full card number.
From Apple or Google: subscription status, if you purchased your membership through an app store.
From a Partner Business: confirmation that you checked in or did not arrive. Partner Businesses may also choose to submit feedback to us about a member's use of their facilities or services — for example, a report that a member did not satisfy a posted age or height requirement, did not follow venue rules, or was involved in an incident during a visit. We receive that feedback in order to respond to it, to administer our Terms of Service, and to maintain the safety and integrity of the Platform.

6. Information We Do Not Collect

We think it is as important to tell you what we do not do. As of the Last Updated date above, Play Pass does not:

Collect medical, health, allergy, dietary, medication, or disability information about members or children. If a venue needs to know about an allergy or medical condition for a particular activity, you give that information directly to the venue at your visit. It is not entered into, stored by, or transmitted through Play Pass.
Collect photographs of children, or allow photographs to be added to a child profile.
Collect government identification documents, Social Security numbers, or biometric information.
Store your full payment card number, expiration date, or security code.
Use third-party analytics services, advertising or retargeting pixels, mobile attribution SDKs, advertising identifiers (such as Apple's IDFA or the Google Advertising ID), or session-recording and heatmap tools.
Sell personal information, or share it for targeted or cross-context behavioral advertising.
Use automated decision-making, profiling, or artificial intelligence to make decisions that produce legal or similarly significant effects about you.
Record or transcribe customer support calls.

If any of this changes, we will update this Policy and give notice as described in Section 29 before the change takes effect.

7. How We Use Information

We use the information described above for the following purposes, and not for unrelated purposes:

To create and maintain your account and verify that the account holder is an adult.
To provide the Platform: showing venues and offers, taking reservations, holding capacity, and completing check-ins.
To confirm that a child meets a venue's stated age requirement for an activity, using the child's date of birth.
To bill and manage your membership, including renewals, cancellations, failed payments, and price-change notices.
To calculate and invoice the commissions that Partner Businesses owe us for member activity generated through Play Pass.
To communicate with you about your account, your reservations, and changes to our terms or this Policy.
To send you news, offers, and promotions about Play Pass, where you have not opted out (and, for text messages, where you have opted in).
To provide customer support and to investigate and resolve reports about a venue.
To keep the Platform secure: detecting, investigating, and preventing fraud, abuse, unauthorized access, and violations of our Terms.
To show you Partner Businesses near you, using the location information described in Section 15.
To fix problems, diagnose errors, and improve the Platform, using internal usage and error information.
To comply with law, respond to lawful requests, and establish, exercise, or defend legal claims.

We do not use a child's information for any purpose other than adding the child to your account, completing a booking or check-in, confirming an age requirement, and responding to a request you make about that profile. We do not market to children and do not build advertising or interest profiles of children.

9. Children's Privacy

This section is the most important part of this Policy, and we have written it in more detail than the rest.

9.1 Children do not have accounts

Play Pass is a service for adults. You must be at least 18 years old to create an account or buy a membership. Children cannot register for an account, cannot sign in, cannot use the app on their own, and have no login of any kind. The Platform contains no games, characters, or content designed to appeal to children, and we do not advertise to children or market Play Pass through channels directed to children.

9.2 How a child's information reaches us

Every piece of information we hold about a child is typed into the app by an adult account holder. We do not collect information from children directly, and there is no feature through which a child could give us information.

When you add a child to your account, you confirm — as required by Section 2.3 of our Terms of Service — that you are that child's parent or legal guardian, or that you have that parent or guardian's express authorization to provide the information and to make bookings on the child's behalf. We rely on that confirmation and do not independently verify it.

9.3 Exactly what we collect about a child

A child profile contains the child's first and last name and date of birth. That is all.

We collect the name so that a venue can identify who is attending under your reservation, and the date of birth so that we can confirm the child meets any age, height-band, or eligibility requirement the venue has set for an activity, and so that age-restricted offers are not shown for a child who does not qualify.

We do not collect any medical, health, allergy, dietary, medication, behavioral, or special-needs information about a child, and the app provides no field in which such information could be entered. If a venue needs to know about an allergy or a medical condition for a specific activity, you give that information directly to venue staff at your visit. It does not pass through Play Pass and we do not store it.

We do not collect a child's photograph, address, email address, phone number, school, or location. The only identifier tied to a child's profile is a random check-in code that Play Pass creates so a venue can check the child in. It is used only for check-in and is never used to recognize the child on other websites or services.

9.4 Who sees a child's information

A child's name and date of birth are visible to:

You, the account holder, in your account.
A Partner Business, through its partner dashboard, for a reservation or check-in at that venue that includes that child.
A small number of authorized Play Pass personnel with administrative access, where necessary to operate the Platform or respond to a support request.
Our hosting provider, which stores the data on our behalf under contract and may not use it for its own purposes.

A child's information is never shown publicly, never displayed to other members, never used for advertising, never sold, never shared for targeted advertising, and never disclosed to any third party for that third party's own purposes.

9.5 How you review, correct, or delete a child's information

As the account holder, you control every child profile on your account at all times. You can:

View the information on a child profile in the app at any time.
Correct or update a child's name or date of birth in the app at any time.
Delete a child profile in the app at any time.
Ask us to do any of the above, or to confirm what we hold about a child, by emailing support@playpasscommunity.com.

You may refuse to permit any further collection or use of a child's information by deleting the child's profile, and you may delete a child's profile without closing your own account or cancelling your membership.

What deletion means. When you delete a child profile, the profile is immediately removed from your account and from the Play Pass app, and the child can no longer be added to a booking. The underlying record is marked deleted and is then permanently erased from our live systems within 30 days. During that 30-day window the record is not visible to you or to any Partner Business, and it is retained only so that an accidental deletion can be reversed and so that we can complete any reservation already in progress. A child's name may remain in the historical record of a past booking or check-in until that record is deleted on the schedule described in Section 18, because that record is how a venue's commission is calculated and how a dispute about a past visit is resolved. Residual copies may persist in encrypted backups until those backups are overwritten in the ordinary course, after which they are permanently gone. If you want the historical booking records deleted as well, tell us and we will delete them except where we are required to keep them by law.

9.6 If a child gives us information directly

Because there is no way for a child to log in or submit information to Play Pass, we do not expect this to happen. If we nevertheless learn that we have received personal information directly from a child under 13 without a parent's or guardian's involvement, we will delete it promptly. If you believe a child has given us information, or that a child's information has been added to an account by someone who is not that child's parent or guardian, contact us at support@playpasscommunity.com and we will investigate, delete the information where appropriate, and where necessary suspend the account involved.

9.7 Children's Online Privacy Protection Act (COPPA)

COPPA and the FTC's COPPA Rule apply to operators of websites and online services that are directed to children under 13, or that have actual knowledge that they are collecting personal information from a child under 13. The Rule regulates information collected from a child. Its main obligations — direct notice to parents and verifiable parental consent before collection — attach to operators in one of those two positions.

Play Pass has been designed so that neither condition is met. The Platform is a general-audience service for adults, contains no child-directed content, and is not marketed to children. Children cannot create accounts or sign in, and there is no mechanism through which a child can submit information to us. The information we hold about a child is provided by the child's own parent or guardian, who chooses what to enter, can see it at any time, and can correct or delete it at any time.

On that basis, we do not believe Play Pass is an operator subject to the COPPA Rule for the information described in this Policy. We do not treat that as a reason to do less. As a matter of policy, and whether or not COPPA requires it, Play Pass:

Collects the minimum information about a child that the service actually needs — a name and a date of birth.
Uses that information only for the purposes described in Section 9.3.
Does not condition your membership, or a child's participation in an activity, on disclosing more information about the child than is reasonably necessary.
Does not disclose a child's information for any third party's own purposes, and never for advertising.
Gives you, the parent or guardian, the ability to review, correct, and delete a child's information and to refuse further use of it.
Retains a child's information only as long as needed for the purpose it was collected, and then deletes it.
Applies the security measures described in Section 19 to children's information.

If we ever change the Platform in a way that would make COPPA apply — for example, by giving children their own logins, adding child-directed features, or collecting information directly from children — we will not launch that change until we have implemented direct notice to parents and verifiable parental consent as the Rule requires, and we will update this Policy first.

9.8 Older minors

Some of the children on a Play Pass account may be teenagers. We treat every child profile the same way regardless of the child's age: name and date of birth only, no advertising use, no sale, no sharing for targeted advertising, and full parental control over the profile. A teenager still may not hold a Play Pass account or sign in.

10. Sensitive Information

Several state privacy laws define a category of "sensitive data" that receives extra protection, generally including health or medical information, precise geolocation, racial or ethnic origin, religious beliefs, sexual orientation, immigration status, biometric or genetic data, and personal data collected from a known child.

Play Pass has deliberately designed the Platform so that it collects almost nothing in those categories. We do not collect health, allergy, or medication information; we do not collect racial, ethnic, religious, or sexual-orientation information; we do not collect biometric or genetic data; and we do not collect immigration or citizenship status.

That includes precise geolocation, which is sensitive data under Minnesota, California, and most other state privacy laws: Play Pass does not collect it. The app never asks for your device's location (see Section 15).

A child's name and date of birth are entered by the child's parent or guardian rather than collected from the child. We nonetheless treat that information with the protections we would apply to sensitive data: minimal collection, purpose limitation, restricted access, no advertising use, no sale, and deletion on request. We would not sell a child's data or any sensitive data under any circumstances, and Minnesota law prohibits us from doing so without prior consent in any event.

Please do not send us sensitive information. We do not seek to collect sensitive personal information, and we ask that you not send or disclose it to us — including through a support email, a message to our team, or any free-text field on the Platform. In particular, please do not send us medical, health, allergy, dietary, medication, or disability information about yourself or about a child. Information of that kind should be given directly to venue staff at your visit, where it can actually be acted on. If you do send us sensitive information, we will not enter it into a member or child profile, we will use it only as necessary to respond to your message, and we will delete it from our records once your matter is resolved, except where we are required to retain it by law.

11. Payment Information

The only amount Play Pass charges you is your membership fee.

If you subscribe directly through Play Pass, your payment is processed by Stripe. You enter your card details into a payment form hosted by Stripe. Your full card number, expiration date, and security code go directly to Stripe and never touch Play Pass systems. We receive from Stripe only what we need to run your membership: confirmation that a charge succeeded or failed, your subscription status and renewal date, and identifiers that let us match the payment to your account. Stripe processes your payment information as an independent controller under its own privacy policy.

If you subscribe through the Apple App Store or Google Play, that purchase is billed and processed by Apple or Google under their own terms and privacy policies. We receive subscription status from them, not payment details.

You pay Partner Businesses directly, at the venue, using whatever method that venue accepts. Play Pass does not collect, process, hold, or refund those payments and does not receive information about them beyond the fact that a check-in occurred.

12. Cookies and Similar Technologies

Our website uses cookies and similar technologies that are strictly necessary to make the site work — for example, to keep you signed in, to remember your session, to balance load across our servers, and to protect against fraud and abuse. We also use local storage on your device for the same operational purposes.

We do not use advertising cookies, retargeting pixels, third-party analytics cookies, or any other non-essential tracking technology, and we have not enabled the optional analytics or performance-measurement features offered by our hosting provider. Because we use only strictly necessary technologies, we do not display a cookie consent banner. If we introduce any non-essential cookie or tracking technology in the future, we will update this Policy and implement an appropriate consent mechanism before doing so.

Most browsers let you block or delete cookies through their settings. Blocking strictly necessary cookies may prevent parts of the website from working.

13. Analytics

We do not use third-party analytics services. We look at internal usage and error information — for example, which screens are loading slowly and where errors are occurring — to keep the Platform working and to improve it. Error reports and performance timings are collected for us by Sentry, an error-monitoring service that processes them only on our instructions, as described in Section 8.2. That information is not shared with analytics or advertising vendors.

14. Advertising

Play Pass does not display third-party advertising in the app, does not use advertising or retargeting pixels, does not collect advertising identifiers, does not build advertising profiles, and does not engage in targeted or cross-context behavioral advertising. We do not track you across other companies' websites or apps.

We may send you our own promotional messages about Play Pass and about offers from Partner Businesses, as described in Section 16. You can opt out of those at any time.

15. Location Information

We do not collect your device's location. The Play Pass app never asks for location permission, and we do not use your internet protocol (IP) address to work out where you are.

To show you Partner Businesses near you, we use the town or city and state you enter during onboarding. We list venues in your town first, then the rest of your state. You can change your town at any time in your profile, and we never ask for a street address.

You can also find venues by searching for a venue's name or city. If we ever add a feature that uses your device's location, we will update this Policy first and ask your permission through your device's own location prompt.

16. Email, Push Notifications, and Text Messages

Email. We send transactional email that is necessary to run your membership — booking confirmations, billing and renewal notices, password resets, security alerts, and notices about changes to our terms or this Policy. You cannot opt out of transactional email while you hold an account, because it is how we give you legally required notices. We also send promotional email about Play Pass and Partner Business offers; you can opt out of promotional email at any time using the unsubscribe link in the message or through your account settings.

Push notifications. If you allow notifications, we may send push notifications about your reservations, your membership, and Play Pass offers. You can turn push notifications off at any time in your device settings or in the app.

Text messages (SMS/MMS). Play Pass does not currently send text messages to members, and no member telephone number is used for text messaging at this time. If we introduce text messaging in the future, participation will be entirely voluntary. We will request your separate, express written consent at the time the feature becomes available, we will disclose the purpose and expected frequency of the messages and that message and data rates may apply, and we will not condition your membership or any purchase on your agreement to receive them. You will be able to withdraw your consent at any time by replying STOP to any message or through your account settings, and you may reply HELP for assistance. Withdrawing consent to promotional text messages would not affect transactional or account-related notices delivered by email or in the application. We will update this Policy before any such feature is introduced.

17. User-Generated Content

The Platform does not currently show members' written reviews to other members, and it does not allow members to upload photographs or share content with other members; there are no social or friend features. If you rate a visit, your star rating counts toward that venue's average rating, which other members can see without your name, and your written review goes to that venue, with your first name, and to Play Pass. Members cannot see one another's names, accounts, children, or activity.

If we start showing written reviews to other members, or add photo uploads or social features, we will update this Policy first and explain what becomes visible to others. We would not permit photographs of children to be uploaded to the Platform.

18. Data Retention

We keep personal information only for as long as we reasonably need it for the purposes described in this Policy, and then delete it. In practice:

Account and profile information, including child profiles, is kept while your account is open. When you delete your account or a child profile, the record is marked deleted immediately and is permanently erased from our live systems within 30 days.
Booking, reservation, and check-in records are kept while they are needed to operate your membership, to calculate and invoice Partner Business commissions, and to resolve any dispute about a visit, and are then deleted.
Membership and transaction records are kept for as long as needed to administer your membership and to meet our tax, accounting, audit, and payment-dispute obligations. Some of these records must be kept for longer than 30 days by law, and Stripe retains its own transaction records under its own retention schedule.
Customer support communications are kept while your matter is open and for a limited period afterward, so that we can respond to any follow-up question and resolve any related dispute, and are then deleted.
Security, fraud-prevention, and system logs are kept for a limited period appropriate to their purpose, which is to detect and investigate security and reliability issues, and are then deleted or overwritten in the ordinary course.
Backups are encrypted and are overwritten on a routine cycle. Where we no longer have an ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible — for example, because your personal information has been stored in backup archives — we will securely store your personal information and isolate it from any further processing until deletion is possible. Restored backups are not used to reinstate records that have been deleted at your request.

In determining how long to retain any category of personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, whether we can achieve those purposes by other means, and the legal, tax, accounting, and regulatory requirements that apply to us. Our internal retention schedule reflects these criteria, and we review it periodically.

We may keep information for longer where we are required to by law, where it is needed to establish, exercise, or defend a legal claim, or where it is needed to investigate fraud, abuse, or a safety concern — and only for as long as that need lasts.

De-identified data. To the extent that we hold de-identified data, we commit to maintaining and using that data in de-identified form and will not attempt to re-identify it, except as permitted by applicable law to test whether our de-identification measures are effective.

19. Data Security

We take security seriously and use measures designed to protect personal information, including:

Encryption of data in transit and at rest.
Role-based access controls that limit administrative access to our production database to a small number of authorized personnel who need it to do their jobs.
Multi-factor authentication on administrative and cloud accounts.
A payment architecture in which full card details never reach our systems.
Reputable cloud infrastructure providers with their own security programs and certifications.
Contractual security and confidentiality obligations on our service providers and on Partner Businesses.

No method of transmission or storage is completely secure, and we cannot guarantee the security of your information. You also play a part: use a strong, unique password, keep it confidential, and tell us immediately at support@playpasscommunity.com if you believe your account has been accessed without your permission.

20. Security Incidents

If we become aware of a security incident that has compromised personal information, we will investigate promptly, take steps to contain and remediate it, and notify affected individuals and any regulator, attorney general, or other authority where and when applicable law requires. Minnesota law requires notice to affected Minnesota residents in the most expedient time possible and without unreasonable delay, consistent with the needs of law enforcement and any measures necessary to determine the scope of the breach and restore the system's integrity. Other states in which we operate impose their own requirements, and we will comply with each of them.

21. Where Your Information Is Stored

Play Pass operates in the United States. Personal information collected through the Platform is stored and processed on servers located in a United States region of our hosting provider's infrastructure. We do not transfer personal information outside the United States for storage or processing, and no personnel or contractor located outside the United States has access to our production systems or to the personal information they contain. Certain of our service providers, such as our payment processor, may operate internationally; where they do, they process information under their own privacy policies and under contractual terms that require appropriate safeguards.

22. Your Privacy Choices and Rights

22.1 Choices available to everyone

Access and review: see your account information and every child profile in the app at any time.
Correction: edit your own information and any child profile in the app at any time.
Deletion: delete a child profile, or your entire account, from within the app. See Section 23.
Marketing: opt out of promotional email using the unsubscribe link, turn off push notifications in your device settings, and reply STOP to any text message.
A copy of your information: ask us for a portable copy of the personal information associated with your account.

22.2 Rights we honor for all members

Several states give residents specific privacy rights. Rather than offering different rights depending on where you live, Play Pass honors the following for every member, regardless of your state and regardless of whether a particular law applies to us:

The right to confirm whether we are processing your personal information and to access it.
The right to correct inaccurate personal information.
The right to delete personal information we hold about you.
The right to obtain a copy of your personal information in a portable, readily usable format, where technically feasible.
The right to obtain a list of the specific third parties to which we have disclosed your personal data.
The right to opt out of the sale of personal information, targeted advertising, and profiling with legal or similarly significant effects. We do not engage in any of these, so there is nothing to opt out of; if that changes, we will provide a working opt-out before it does.
The right to appeal if we decline a request.
The right not to be discriminated against for exercising any of these rights.

22.3 How to submit a request

Email support@playpasscommunity.com with the words "Privacy Request" in the subject line. Tell us which right you are exercising, the email address on your Play Pass account, and — if your request concerns a child profile — which child profile it concerns. For deletion and correction of your own account or a child profile, the fastest route is usually to do it yourself in the app.

We will acknowledge your request and respond within 45 days. If we need more time because your request is complex or because you have made several, we may extend that period by a further 45 days and will tell you why before the first period ends. There is no charge for a request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline it, and will explain why.

22.4 How we verify a request

To protect your account and your children's information, we verify who is asking before we act. We will normally verify you by asking you to make the request from, or confirm it at, the email address on your account, and by asking you to confirm information we already hold. For a request to delete an account or to disclose a copy of information, we may ask for additional confirmation. We will not ask for more information than we need to verify you, and we will use anything you give us for verification only for that purpose and then delete it.

If we cannot verify you, we will tell you and explain why. We may decline a request we cannot verify.

22.5 Authorized agents

You may use an authorized agent to make a request on your behalf. We will ask the agent for written proof that you authorized them, and we may contact you directly to confirm the authorization and to verify your identity.

22.6 Appeals

If we decline your request, we will tell you in writing, explain why, and tell you how to appeal. To appeal, reply to our decision or email support@playpasscommunity.com with "Privacy Appeal" in the subject line. Play Pass leadership will review the appeal and respond in writing within 45 days, explaining the reasons for the decision. If we deny your appeal, we will give you a method to contact your state attorney general to submit a complaint.

22.7 Non-discrimination

We will not deny you service, charge you a different price, provide a different level or quality of service, or otherwise penalize you because you exercised a privacy right. We do not offer financial incentives in exchange for personal information.

23. Account Deletion and Child Profile Deletion

Deleting a child profile. Open the child profile in the app and choose to delete it. The profile is removed from your account immediately. See Section 9.5 for what happens next. Deleting a child profile does not cancel your membership or affect your account.

Deleting your account. You can delete your Play Pass account from within the app, in your account settings. Deleting your account deletes your profile, your child profiles, your saved venues, and your reservation history, subject to the retention exceptions in Section 18. You may also ask us to delete your account by emailing support@playpasscommunity.com.

Deletion and billing are separate. If you subscribed through the Apple App Store or Google Play, deleting your Play Pass account does not automatically cancel the subscription with that app store. You must cancel it through the app store's own subscription settings, or you may continue to be billed. If you subscribed directly through Play Pass, cancellation is handled as described in our Terms of Service.

Sign in with Apple. If you created your account using Sign in with Apple, we revoke the associated Apple token when your account is deleted.

24. Minnesota Residents

The Minnesota Consumer Data Privacy Act, Minn. Stat. ch. 325O, took effect on July 31, 2025. It applies to a business that, in a calendar year, controls or processes the personal data of at least 100,000 Minnesota consumers, or that derives more than 25 percent of its gross revenue from the sale of personal data and controls or processes the personal data of at least 25,000 Minnesota consumers. The Act also exempts small businesses as defined by the United States Small Business Administration, except that an exempt small business may not sell a consumer's sensitive data without the consumer's prior consent.

Play Pass does not currently meet the volume thresholds, does not derive any revenue from the sale of personal data, and qualifies as a small business. We therefore do not believe the Act's general obligations currently apply to us. We do not sell sensitive data, so the provision that applies to exempt small businesses is satisfied.

We nonetheless honor the rights the Act provides, as a matter of policy, for every Minnesota member and for every other member. Those rights are:

To confirm whether we are processing your personal data and to access that data.
To correct inaccurate personal data, taking into account the nature of the data and the purposes of processing.
To delete personal data concerning you.
To obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format.
To obtain a list of the specific third parties to which we have disclosed your personal data.
To opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. We do none of these.
Where profiling is used in decisions producing legal or similarly significant effects, to question the result, be informed of the reason, and be informed of actions you might take to secure a different outcome. We do not use profiling in this way.
To appeal a refusal to act on a request.

The Act treats precise geolocation as sensitive data and requires consent before it is processed. We do not collect precise geolocation (see Section 15), and we do not sell sensitive data of any kind, which is the one obligation the Act imposes on an exempt small business.

Submit a request as described in Section 22.3. We will respond within 45 days, with one 45-day extension where reasonably necessary. If we decline, you may appeal as described in Section 22.6; we will respond to an appeal within 45 days and, if we deny it, provide you with a method to contact the Minnesota Attorney General to submit a complaint. The Minnesota Attorney General has exclusive authority to enforce the Act; there is no private right of action.

Minnesota's breach notification statute, Minn. Stat. § 325E.61, also applies to us. See Section 20.

25. California Residents

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to a business that does business in California and meets one of three thresholds: annual gross revenue over $25 million; buying, selling, or sharing the personal information of 100,000 or more California consumers or households in a year; or deriving 50 percent or more of annual revenue from selling or sharing personal information.

Play Pass currently operates in Minnesota, does not meet any of those thresholds, and does not believe it is a "business" subject to the CCPA. We include this section because we expect to expand, and because we want California residents who use the Platform to know where they stand.

The disclosures below describe our actual practices. If and when the CCPA applies to us, these rights become legally enforceable; in the meantime we honor them as a matter of policy under Section 22.2.

Categories of personal information we collect

Identifiers: name, email address, IP address, device identifiers, account identifiers.
Customer records information: name, contact details, and billing information as defined in Cal. Civ. Code § 1798.80.
Characteristics of protected classifications: date of birth or age, for you and for a child on your account.
Commercial information: membership plan, subscription and billing history, reservations, check-ins, and offers viewed or saved.
Internet or other electronic network activity: app and site usage, error information.
Geolocation data: only the town or city and state you enter. We do not collect precise geolocation or work out your location from your IP address.
Inferences: none. We do not create profiles reflecting preferences, characteristics, or behavior.

Sensitive personal information: we do not collect precise geolocation, and we do not use or disclose personal information to infer characteristics about you.

Sources: you; your device and browser; Google or Apple if you use their sign-in; Stripe, Apple, or Google in connection with payments; and Partner Businesses in connection with your visits.

Business and commercial purposes: the purposes listed in Section 7.

Categories of recipients: Partner Businesses, as described in Section 8.1; and our service providers, in the categories listed in Section 8.2. We disclose personal information to these recipients only for the business purposes described in this Policy.

Sale and sharing: Play Pass has not sold personal information and has not shared personal information for cross-context behavioral advertising in the twelve months preceding the Last Updated date of this Policy, and does not do so now. We have no actual knowledge of selling or sharing the personal information of any consumer under 16 years of age, and we would not do so.

Retention: as described in Section 18.

Your rights: to know and access; to know the categories described above; to delete; to correct; to opt out of sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising a right. Exercise any of these as described in Section 22.3, including through an authorized agent under Section 22.5.

Shine the Light: California Civil Code § 1798.83 permits California residents to request information about disclosures of personal information to third parties for their own direct marketing purposes. We do not make such disclosures.

26. Residents of Other States

A growing number of states have comprehensive privacy laws that give residents rights similar to those described in Sections 22.2 and 24. Most apply only to businesses above a threshold volume of residents' data or above a revenue level tied to selling data. Play Pass is currently below those thresholds in every state.

We are not relying on that. Section 22.2 sets out the rights we honor for every member, wherever you live, and Section 22.3 explains how to use them. As we expand into new states, we will update this Policy to identify any additional state-specific rights, disclosures, or contacts that become applicable, including any state-specific rules for minors' data.

27. Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track" signal. There is no common industry standard for how to respond to it, and we do not currently respond to it.

The Global Privacy Control is an opt-out preference signal that a browser or extension can send to tell a website not to sell or share personal information for targeted advertising. Play Pass does not sell personal information and does not share it for targeted advertising, so there is no such processing for the signal to stop. If we ever begin any processing that a valid opt-out preference signal would apply to, we will honor the signal, and we will say so here before we do.

28. Third-Party Websites and Services

The Platform links to and integrates with services we do not control, including Partner Business websites, Stripe, Google, Apple, and app stores. This Policy does not cover their practices. When you leave the Platform or provide information directly to one of these companies, that company's own privacy policy governs. We encourage you to read it.

29. Changes to This Policy

We may update this Policy to reflect changes to the Platform, our practices, or the law. When we do, we will change the Last Updated date at the top and post the revised Policy on our website and in the app.

If a change is material — for example, if we begin collecting a new category of information, use information for a materially different purpose, share information with a new category of recipient, or change how children's information is handled — we will give you notice by email or in-app notice at least 30 days before the change takes effect, or such longer period as the law requires. Where the law requires your consent before a change applies to information already collected, we will obtain it. If you do not agree to a change, you may delete your account before it takes effect.

30. Contact Us

Questions, concerns, or complaints about privacy: