Site Security and Privacy Policy

In today’s highly interconnected environment, computer and internet security and privacy are critically important. This page informs you of our site security and privacy policies regarding the collection, use, and disclosure of personal information when you use YMCA Camp Coniston’s services. We will not use or share your information with anyone except as described in this policy. 

We use your personal information for providing and improving our communications with the Coniston Community. By using our services, you agree to the collection and use of information in accordance with this policy.

The Basics of Web Site Security

The role of a web site hosted on a web server is to return content to the user’s web browser according to how it is requested. In addition, web sites can provide various forms of interactivity (forms to fill in, dynamic content that changes based on input, user-specific content, etc.

Overall, the Coniston web site is VERY “static” which reduces exposure to security issues.

The Coniston web site does NOT have any user customization or user log-in features (with the exception of the CampMinder features – see that section)

The Coniston web site has very few forms that collect user information, and those few collect a minimum amount of date required to accomplish the goal.

Site Security / TLS & SSL

The Coniston web site, based at the domain and server level, utilized industry-standard TLS/SSL encryption. This means that all content returned to the users’ browser is encrypted (i.e. scrambled and not human-readable) while being transmitted to the browser. This means that browsing activity and any data passed back & forth is secured against interception. A user can confirm the secure nature of the site by verifying that the “lock” icon is displayed in their browser’s UI.

Users who request content from the site using an “unencrypted” request (eg: http://www.coniston.org/) will be redirected to the SECURE version of the site (https://www.coniston.org). This helps ensure that security and privacy are preserved.

Site Cookies

It would be nice, but untrue, to say our site does NOT use web cookies to store “state” information about the user. 

Cookies are used by browsers and web sites to allow sites to maintain some form of “state” and “persistence” between browsing sessions. Cookies allow sites to make the browsing experience better for the user and remove the requirement that users “start from scratch” every time they visit a site. Cookies are what allow us to visit site without having to log in again every time.

To be clear, the Coniston web site does NOT require or offer any “log in” feature (again, with the exception of the CampMinder pages). We have not employed cookies for any site “features” that we offer. Across the site, we do not maintain any “state” related to the user. All users have access to the same pages and features.

However, we are using WordPress. And WordPress DOES use cookies. Specifically, WordPress uses cookies to maintain the state of the USERS of our WordPress platform. This means that cookies are used ONLY for users who have accounts and that ONLY includes Sherman Horton and Lindsey Tompkins at this time. 

Our “normal” web site user should not have any cookies written by WordPress to their systems.

It should also be noted that when our site is visited by referrals from sites like Facebook and Google, cookies WILL be associated with our site. 

Data Collection

With only a few exceptions, noted below, we do not collect or store any user data from the web site. Again, we do not have a site “login” required to access the site. 

Here are the ways we do or have in the past collected user data:

CampMinder
Coniston uses CampMinder (https://campminder.com/) for the following:

• Camper registration (including payment processing and forms management)
• Alumni registration and database
• Photo gallery access for parents
• These capabilities are “embedded” in the primary web site by simply linking to web pages hosted by CampMinder. For example, when the user clicks on the “Apply” link on the www.coniston.org web site, they end up loading https://coniston.campintouch.com/ui/forms/application/camper/App. This resulting page is hosted by CampMinder (via the campintouch.com domain) and Coniston has their own “subdomain” as part of that domain.
• As regards the Coniston web site, we ONLY use this external links. At no time do we collect data and then “send” it to CampMinder. All the user data is collected “inside” the CampMinder system. This limits the camp’s exposure to data leaks and user privacy.

• CampMinder maintains their own Privacy Policy (https://campminder.pactsafe.io/#privacy-policy) and that is visible/accessible to our Coniston users when they are interacting with the CampMinder pages.

Event Registration
We use an Event Calendar plug-in (inside WordPress) to manage camp event and present a listing of events on various web pages on the site. As part of this event management, we currently offer event registration. For this we collect the following information:

• First name
• Last name
• Email address
• Number of people attending the event
• In addition, we “link” this data to a unique event id so we can track which event it is associated with. 

This data is then, when submitted by the user, immediately emailed to an email address at the camp (Lindsey’s at this point). Beyond that email being sent, the data is NOT stored (in a database or spreadsheet) on or by the web site. In other words, there is no data available to be “stolen” or breached related to this function.

NOTE: Having this kind of form on the site (to submit registration for an event) COULD be abused (i.e. we could get flooded with bogus emails) but we haven’t seen that happen and could quickly turn the feature off if needed.

Keep Coniston on the Map
During the summer of 2020 we ran the “Keep Coniston on the Map” fundraiser. As part of that, we had two web pages (one the “map” version, and one the same functionality but using a “list” of things people could donate to.

• For this, we used a form to collect donation information. NOTE: we did NOT actually COLLECT the donations using this form (i.e. no credit card or other payments). We only collected Name, email address, “target” of the donation (i.e. dining hall), and donation amount (a money or time donation).
• The data collected was then emailed to the camp (to the interns who were managing the fundraising) AND logged into a spreadsheet that we could all reference.
• When we finalized the Keep Coniston on the Map event, we “cleaned up” the data, removing the spreadsheet and turning off all the forms on the site.

Contingency to Hacking

Because the Coniston web site is publicly available on the internet, it is possible that it could be the target of a hacking event or denial of service attack. The exposure is low, however, and we have mitigation steps in place:

• Our site is hosted, at Tidal Media, on a shared server. This means that our site is “running” alongside other sites on the same physical hardware and networking. Shared hosting has been a standard way of hosting for a long time and it usually works well. It saves us money (“dedicated” hosting is multiple times as expensive) and we’ve never experienced any issue being on a shared server. However, the exposure is there: if something goes wrong with another site, it could impact our site. If bad actors decide to “attack” one of our “neighbor” sites, it could impact ours.
• The Tidal Media hosting account could be hacked but the security looks good on the Tidal Media side. They run current, robust Linux servers and have the proper security pieces in place.
• Our WordPress installation is vulnerable to compromise, but we do have a limited # of users set up (2 at this time) and we use strong passwords. We are also active in our WordPress dashboard and would notice if something changed. We keep WordPress up-to-date with security patches, etc.
• There really isn’t anything “valuable” to steal / or compromise. There’s no user data, etc. (again, see CampMinder below – if anything were to be a target, it would be the CampMinder data)

• Our best mitigation against any site attack, hack, or compromise is our site backup strategy:
  • a full backup weekly (configured via the Tidal Media control panel)
  • incremental backups daily (configured via the Tidal Media control panel)
  • all backups stored on the Tidal Media servers, independent of our site, so if the site “goes down” we should be able to restore it very quickly, rolling back to the previous day’s state.
  • as extra protection, every backup is also transmitted, via Secure FTP, to a server that Sherman runs in his home. This means we have “off-site” backups as well.
  • In addition, Sherman has all the original content, a real “backup”, in his web development environment and tools. From that we could quickly rebuild the site.

Privacy Topics

A large part of ensuring user privacy protections is to protect user data. And since we don’t really capture any data (again, outside of CampMinder), there isn’t any user data to protect as private.

However, there are a few things to note:

• Our site does make extensive use of media, images, videos, audio, documents, and video that often depict our community members (campers, staff, etc.). We do not do anything special to protect that content (i.e. we don’t watermark images or documents and don’t have any image “protection” schemes set up to prevent downloading. I think it is true that parents agree to “image use” when registering their campers.
• The primary web site, at this time, does not have a Privacy and Data Use policy defined and linked. See the Actions section below for recommendations.

CampMinder / Camp-In-Touch
CampMinder is a third-party service that Coniston uses for a number of things:

• Camper Registration
• Alumni management
• Photo galleries for parents
• Document management (health forms, etc.)
• Donations to camp (they handle the credit card processing, etc.)

The camp’s web site offers links “through” to the CampMinder pages that provide these capabilities. The CampMinder team uses our site formatting to “replicate” the look and feel of our pages, so it may not be obvious to our users that they “leave” our site for these purposes. But this also means the CampMinder is fully in control and responsible for the security and data collection used on those pages. 

See the Data Collection section above for more details.

Social Media

The camp has a presence on most of the major social media platforms. There is often cross-linking (eg: a Facebook “event” posting may link back the event page on our web site), but in general there is no “deep” integration with these platforms. For example, we do not query or make use of any users’ Facebook profile or “logged in” status.

The site offers navigation links to the camp’s pages on these social media platforms, but they are “pure” hyperlinks, we do not embed any custom parameters or security tokens with the links.