What we collect, and what we refuse to.

Draft for lawyer review. Effective for the 2026-27 season. MOMentos Keepsakes LLC, San Jose, California.

The short version

We collect the minimum to print a card: your child’s first name, jersey number, team and age group, plus your email and, if you choose texts, your phone number.
No last name, no school for club athletes, no birth date, no address on the athlete. A shipping address lives on the order and is deleted with it.
Order photos are deleted 30 days after delivery unless you ask us to keep them for reorders; then they are deleted on August 31.
You can switch any permission off at any time, and the card’s web page goes dark immediately.
Children never create accounts. A parent or legal guardian signs up and affirms they are 18 or older.

Consent is a record

Every photo we print is linked to a signed, versioned consent: the exact form text you saw, the boxes you ticked, your typed name, the time, and your device’s IP address and browser identifier (kept as evidence that you signed, not for tracking). Switching a box off creates a new record; the old one is kept so we can show what was true when a photo was taken.

The six permissions

Products for my family (on by default): cards and keepsakes you order.
Cards that teammates can buy: your child’s card in team sets other families purchase.
Group photos: photos with other players, which those families may keep and share.
Instagram handle on products: 13s and older only; printed on the card and shown on the card page.
Marketing samples: we may show the card as a sample. We never tag a player’s account.
Texts: QR delivery and order-ready texts to your phone, never to your child.

The card’s QR page

Each card carries a QR to a page on our domain identified only by a random six-character code. The page shows the first name and team, and a Follow button only with the handle permission. We count how many times a page is opened per day and keep nothing else: no time, no location, no device. No third-party analytics or pixels run on any page that shows a child’s name.

Who can see what

You see only your own athletes, consents and orders. Our staff see the roster for the event they are working, and every lookup of a child’s record is written to an audit log with the staff member’s identity. Payments are processed by Square; we store Square’s order ids and never card numbers.

Deletion

Delete an athlete from your account and the photos go immediately. Consent and order records are kept with the name replaced by the code for the period our lawyer sets, as evidence of what was agreed. Every deletion writes an audit entry and sends you a confirmation email. Email hello@momentosbayarea.com with the subject “privacy” for anything this page does not cover.

What we will not build

Public search by name, team or number.
A gallery per team or event. You get your own athlete’s photos only.
Anything that shows one family another family’s child without both families’ group-photo consent.
Location, schedule or “where is this team playing” anywhere public.
AI editing of faces.