Privacy Policy

This policy explains what personal information the Montgomery County Business Association (“MCBA,” “we,” “us”) collects through mc-ba.com, why we collect it, who can see it, how long we keep it, and how to have it removed. It sits alongside our Terms of Service, which govern participation more broadly.

MCBA is a student-led organization. Most of our members are high school students, and many are minors, so this policy is written to be read by students and parents rather than lawyers.

We collect only what the platform needs to work. There is no advertising network, no analytics product, and no third-party tracker anywhere on this site.

• Member accounts: your name, email address, and a hashed password. Passwords are stored only as hashes and can never be read back, by us or anyone else.
• Chapter students: the full name and username your chapter creates for you, and optionally a personal email address so MCBA can send you your own login details.
• Starting a chapter: the name, email, school, and grade of the student applying, so we can respond to the request.
• Learning progress: which resources you have completed, quiz and practice results, points, streaks, and the competitions you declare you are entering.
• Portfolio Simulator: the runs you start, the orders you place, and the scores you earn.
• Sign-in records: the account and role that signed in and when. We do not store IP addresses.
• Devices: a device identifier, your browser's user-agent string, and a readable label such as “iPhone, Safari,” so you can see where you are signed in and stay within the device limit.
• Messages you send us: anything you type into the contact, feedback, or leadership application forms.

Because many of our members are minors, every account created on mc-ba.com must confirm at signup either that the member is 18 or older, or that a parent or legal guardian has read and agreed to our Terms on their behalf.

We record the moment that confirmation is given. We deliberately do not ask for a date of birth: asking every member to prove their age would mean holding more personal information about minors, not less, and a single confirmation covers both cases.

A parent or guardian may withdraw consent at any time by contacting us. Withdrawing consent means the account is closed and the associated data deleted, as described below.

• To run your account and keep you signed in.
• To run the Competition Academy and record your progress through it.
• To let your chapter advisor see how their own students are doing.
• To send you account email: verification links, password resets, and replies to messages you send us.
• To understand which parts of the platform are used, so we can improve them.

We do not use your information to build a profile of you for advertising, and we do not use automated decision-making that produces legal or similarly significant effects.

• You can see everything on your own account.
• A chapter account can see only the students belonging to that chapter, and nothing about students at any other chapter.
• MCBA administrators can see member and student records in order to run the organization.
• Nobody else. Student names and progress are never shown on any public page of this site.

• We never sell personal information, and we never rent or trade it.
• We never share student information with advertisers.
• We never run third-party advertising or tracking scripts on this site.
• We never publish a student's name, email, school, or progress publicly.

Running the site means some data is stored or transmitted by other companies. We use as few as we can, and each one only does the job named here.

• Vercel hosts the website and runs its server code.
• Neon stores the database.
• Microsoft Graph, or Resend where Graph is unavailable, delivers account email such as verification links and password resets.
• Stripe would process payments if paid membership is switched on. It is currently dormant and processes nothing.
• OpenStreetMap serves the background map tiles on the chapters page. Your browser requests those tiles directly, and we send no personal information with the request.

• Account and progress data: kept while your account is open.
• Sign-in and device records: kept for 12 months, then deleted.
• Messages sent through our forms: kept for 12 months, then deleted.
• Accounts inactive for two years: reviewed and closed, and the data deleted.
• Deletion requests: acted on within 30 days of a verified request.

Backups may hold a copy for a short period after deletion, and are overwritten on a rolling basis.

You, or your parent or guardian, may ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email us and say which of the three you want.

We will verify the request comes from the account holder or their guardian before acting on it, and we will complete it within 30 days. There is no charge.

If you are a student at a chapter, your chapter advisor can also close your account for you.

• Passwords are stored as hashes, never as text.
• The whole site is served over HTTPS.
• Every part of the member portal and the admin area checks who you are on the server, on every request, not just in the browser.
• Chapter accounts are isolated from one another at the database query level, so one chapter cannot read another's students.
• Signing in is limited to a small number of devices per account.

No system is perfectly secure. If a breach ever affects your information, we will tell affected members and, where the law requires it, the relevant authorities.

Where MCBA operates a chapter in partnership with a school or district, that partnership may be governed by a separate written agreement covering student data. Where such an agreement exists and its terms differ from this policy, the agreement governs.

Schools and districts may contact us at the address below with questions about student data, and we will answer them.

If we change this policy in a way that meaningfully affects what we collect or who can see it, we will update the effective date above and notify members by email.