Privacy Policy

Our promise about the information you share with us, in plain English.

This is our promise to you about the information we collect when you visit cmidaho.org, fill out a form, sign up for our newsletter, donate, become a member, book a field trip, book a birthday party, or otherwise interact with us through this website.

We wrote this in plain English on purpose. If anything is unclear, email us at privacy@cmidaho.org and we will explain it or change it.

We are the Children's Museum of Idaho, a 501(c)(3) nonprofit organization (federal tax ID 37-1899670) located at 790 S Progress Avenue, Meridian, Idaho 83642. You can reach us at 208.345.1920.

The short version

• We collect only what we need to answer your question, book your visit, send your newsletter, or process your donation.
• We do not sell, rent, or trade your personal information, and we have no plans to. The only situations in which information leaves the museum are described in Who else sees your information.
• We do not run Google Analytics, Meta Pixel, or any other marketing or advertising tracker on this site. The Visit and Contact pages embed a Google Map; Google may set its own cookies through that embed, and you can avoid them by using our written directions instead.
• We do not market to children. Every newsletter and fundraising message we send is directed at an adult.
• The information we have about specific children — a child's first name on a party booking, a child's age on an RSVP, the grade levels going on a field trip — was given to us by an adult on the child's behalf. Children do not fill out our forms.
• If you tell us your household uses SNAP/EBT benefits, or that you are a foster family, only our Development Director sees it. We delete what you wrote within 30 days of deciding your application.
• If you tell us about accessibility needs for a field trip, only the staff hosting your visit see it. We delete the notes 60 days after your visit.
• Ticket purchases and gift shop purchases happen on a separate website (sales.cmidaho.org), which is operated by Vermont Systems, Inc. and governed by their privacy policy.
• You can ask us to delete any information you have given us by emailing privacy@cmidaho.org.

What this policy covers

This policy covers cmidaho.org and any subdomain of cmidaho.org that we operate directly. It does not cover sales.cmidaho.org, our ticket and gift shop store, which is run by Vermont Systems, Inc. — see Buying tickets or shopping below. This policy also does not cover the websites we link to — Facebook, Instagram, Google Maps, or partner organizations. Each of those has its own privacy policy.

What we collect

What you tell us when you fill out a form

When you fill out a form on this website, you give us information so we can respond. Each form is different. Here is exactly what each one asks for. Required fields are marked with an asterisk.

Contact Us — /contact
Your name*, email address*, an inquiry type* (general question, visit info, parties, field trips, membership, sponsorship, volunteer, donation, scholarship, media or press, or other), a subject line if you choose, and your message*. Phone number is optional.

Facility Rental Inquiry
Your name*, email address*, the type of event you are planning, and a message* describing it. Phone number is optional.

Field Trip Inquiry
Your school's name*, your name*, your role at the school (teacher, counselor, etc.), email*, phone, preferred and alternate visit dates*, group size*, grade levels*, program interests, accessibility or accommodation needs for your group (see If you tell us about accessibility needs), and your funding source if any (such as Title 1 federal funding).

Birthday Party Inquiry
Your name*, email address*, phone number* (required so we can reach you on the day of the party), the child's first name* (we do not ask for the child's last name), the child's age*, preferred date and time*, which package you would like*, expected guest count*, and any notes. The child's name and age are entered by the parent — see Your child's information below.

Sponsorship Inquiry
Your name*, your role at the organization, the organization's name*, email*, phone, the kind of sponsorship you are interested in*, the event you would like to sponsor if any, and your message*.

Volunteer Application
Your name*, email*, phone, an age range — under 13 (we will route to a parent or guardian before doing anything else; see Volunteers under 18), 13–15, 16–17, 18–64, or 65 and over — your availability*, what role interests you*, whether you are applying as a group*, your prior experience, and a message*. Volunteers under 18 require a written parent or guardian consent, which we collect by email after you apply.

Museum on the Move Booking
Your organization's name*, your name*, your role, email*, phone, the kind of venue* (school, library, daycare, private event, etc.), the venue's address*, preferred and alternate dates*, expected audience size*, audience ages*, which program interests you, and any notes about the venue.

Event RSVP
For free events only, we collect your name*, email*, phone, number of adults attending*, number of children attending*, the children's ages as free-text you type in (for example, "3 and 7" or "two toddlers"), whether you are a member*, accommodation needs, and any notes. Because the ages field is free-text, please do not include children's names or other identifying details — a numeric age range is all we need. Paid events use the separate ticketing site at sales.cmidaho.org — see Buying tickets or shopping.

Membership Scholarship Request
The scholarship request uses our Contact Us form with the inquiry type preset to "Scholarship." There is no structured questionnaire — you tell us in your own words why your family qualifies. You decide how much detail to share. A sentence is enough. See If you apply for a scholarship membership for how we handle it.

Newsletter signup
Your email address*, your explicit consent* (a checkbox you click yourself), and the exact wording of the consent text you agreed to plus a version identifier for it (currently "v1"), so we have a verifiable record of what you said yes to at the moment you said it. We also record the User-Agent string your browser sent at signup (see What our website records on its own below), and a one-way fingerprint of your IP address for rate-limit purposes.

What our website records on its own

When you visit any page on cmidaho.org, our web server keeps a short record of it. That record includes the time of your visit, the page you asked for, and the response we sent back. For security and troubleshooting, it also includes your IP address (the unique number your home internet assigned your device) and what kind of browser you used. This is standard web-server logging. We use it to keep the site running, to investigate problems, and to detect abuse (spam, scraping, brute-force login attempts).

We do not run Google Analytics, Google Tag Manager, Meta Pixel, TikTok pixel, Hotjar, Mixpanel, PostHog, Plausible, Fathom, or any other web analytics, marketing, or advertising tracker on this site as of the effective date of this policy. If we adopt a privacy-respecting analytics tool in the future (such as a cookieless, IP-anonymizing tool), we will update this section and post a notice at the top of cmidaho.org for 30 days before the tool is enabled.

When you submit a form, we record two things to help us spot spam: the time the form first opened in your browser, and a scrambled version of your IP address. The scrambled version is a one-way code — we cannot turn it back into your IP. We only use it to tell if two submissions came from the same place. Rate-limit records (the IP fingerprint plus a timestamp) are also written to a small database table that we use to enforce per-visitor rate limits across our serverless functions. Entries older than the rate-limit window (60 seconds for forms, 10 minutes for newsletter signups) are purged automatically. The table never contains your raw IP address — only the irreversible fingerprint described above.

When you sign up for our newsletter, we additionally record the User-Agent string your browser sent (for example, "Mozilla/5.0 ... Chrome/126 Mac OS X"). This is a record of what kind of device and browser you used to subscribe. We keep this so that if someone later says they did not sign up, we can show that the sign-up came from an actual browser — not a script or a bot. We do not use it for analytics, demographics, or marketing.

What we do not ask for

We do not collect any of the following:

• Social Security number
• Driver's license number
• Government ID
• Bank account number
• Credit card number
• Health insurance information
• Medical records
• IEP or 504 plan
• Benefits case number
• EBT card number
• Foster-care licensing documentation

If a form on this website is asking you for any of these, something is wrong — please email privacy@cmidaho.org and we will fix it.

How we use what you give us

We use the information you give us to:

1. Answer your inquiry, return your call, or follow up on your booking request.
2. Schedule your field trip, party, outreach booking, event RSVP, or facility rental.
3. Send you the newsletter you signed up for.
4. Process and acknowledge your donation, including sending the receipt required for your tax records.
5. Renew your membership and let you know about member-only events.
6. Keep the website running, fix bugs, and prevent spam, fraud, and abuse.
7. Meet the law. For example, the IRS requires nonprofits like us to file a Form 990 every year — see If you donate.

We do not use your information for anything else. We do not build a profile of you. We do not score you, predict your behavior, share you with data brokers, train AI systems on you, or sell advertising against you. If we ever want to use your information for a new purpose, we will ask you first.

What submitting a form means

When you submit any of our forms, you are giving us your consent to use the information in the ways described above. You are not consenting to marketing or fundraising emails — those require a separate newsletter signup. If we email or call you about your inquiry, that contact is operational (we are responding to you, scheduling your visit, or sending you the tax receipt for your donation), not promotional. If at any point you would like us to stop contacting you, even about your own pending inquiry, reply to any email from us or call 208.345.1920 and we will stop.

Who else sees your information

We share information only with the service providers we need to operate the museum and the website. We name every one of them below so you can read their privacy policies too.

The companies that help us run the website

Supabase (Supabase, Inc.)
Our database and login system. All form submissions, member records, and staff accounts are stored in a Supabase PostgreSQL database hosted in the United States. Read Supabase's privacy policy.

Vercel (Vercel, Inc.)
Our website host. Every page you visit is served by Vercel's network. Vercel sees the page you asked for, your IP address, and what browser you are using. Vercel keeps that log for the window their service provides on our current plan — up to about 30 days for production runtime logs on our hosting tier as of this policy's effective date. If our plan changes and the retention window changes materially, we will update this policy. Read Vercel's privacy policy.

Mailchimp (The Rocket Science Group LLC, a subsidiary of Intuit Inc.)
Our newsletter platform. If you sign up for the newsletter, we send Mailchimp your email address and a tag identifying which version of the consent text you agreed to. Mailchimp records the time of the signup. Mailchimp's standard email-campaign tracking — which records that a particular subscriber opened a particular email and which links they clicked — is currently enabled on our account. You can opt out of that tracking inside any campaign by following the instructions at the bottom of the email. If you would like Mailchimp's open and click telemetry about you deleted independently of unsubscribing, email privacy@cmidaho.org and we will request the deletion from Mailchimp on your behalf. If you read our emails in a client that blocks remote images (Apple Mail's Privacy Protection, certain Outlook settings, or plain-text mode), opens are not recorded in the first place. Read Mailchimp's privacy policy.

Google Maps (Google LLC)
Two pages on this site embed an interactive Google Map: our Contact page (/contact) and our Visit page (/visit). When your browser loads one of those pages, it requests the embedded map from Google, which transmits your IP address, your browser type, and the URL of the page you are looking at to Google, and Google may set its own cookies inside the embed. Our Footer also links out to Google Maps but does not embed it — clicking the address opens Google Maps in a new tab. We do not have access to the data Google collects through these embeds. If you would prefer not to load the maps, our Visit page also has written directions you can use instead, and you can block the google.com and maps.googleapis.com domains in your browser. Read Google's privacy policy.

Buying tickets or shopping (a different website)

We do not currently sell admission tickets, memberships, gift-shop items, or paid event registrations through cmidaho.org. Those purchases happen on a separate website at sales.cmidaho.org, which is operated by Vermont Systems, Inc. using their Versai platform. When you click a "Buy Tickets" or "Shop" link from this site, you leave cmidaho.org. Anything you type on sales.cmidaho.org is collected by Vermont Systems under their own privacy policy. We receive back from Vermont Systems only the order summary information we need to fulfill your purchase (for example, that a membership was purchased, the membership level, and the contact information you provided). We do not see or store your credit card number.

When the law requires us to share

We share information when the law requires us to: a valid subpoena, court order, or law-enforcement request with proper legal basis; an investigation of suspected fraud or abuse; protecting the safety of a child or other person; and our IRS Form 990, which we file every year — see If you donate.

If the museum is reorganized

If the Children's Museum of Idaho merges with, transfers assets to, or is succeeded by another nonprofit or government entity, the information we hold may transfer to that successor, subject to this same policy. We will post notice of any such transfer at the top of cmidaho.org for at least 30 days before it takes effect.

What we never do

Outside the limited situations described in The companies that help us run the website, Buying tickets or shopping, When the law requires us to share, and If the museum is reorganized, we do not share your information. In particular, we do not:

• Sell your information.
• Rent your information.
• Trade your information.
• Share donor lists, member lists, newsletter lists, or any other lists with other nonprofits, for-profit companies, mailing-list cooperatives, or fundraising consortiums.
• Show your information to sponsors, board members, volunteers, or museum staff who do not need it to do their jobs.

Who reads each form

Every form is routed to the staff position responsible for that area. As of this policy's effective date, the routing is:

• Contact Us (general inquiries) — Executive Assistant
• Facility Rental — Visitor Services Manager
• Field Trip Inquiry — Program and Outreach Coordinator
• Birthday Party Inquiry — Visitor Services Manager
• Sponsorship Inquiry — Development Director
• Volunteer Application — Program and Outreach Coordinator
• Museum on the Move Booking — Program and Outreach Coordinator
• Event RSVP — Visitor Services Manager
• Membership Scholarship Request — Development Director
• Newsletter — Development Director (list owner)
• Media or press inquiries — Executive Director

If a staff member changes role, the routing on this list will change, and we will update the policy at the next routine revision. The actual recipient at the time you submitted your form is recorded with your submission, so we know exactly who saw what.

Your child's information

Children do not give us information directly on this website. Every form on cmidaho.org is designed to be filled out by an adult — a parent, guardian, teacher, school administrator, party-planning grown-up, or event organizer — on the child's behalf. The information we have about a specific child reached us because an adult typed it in.

This distinction matters legally. There is a federal law called the Children's Online Privacy Protection Act (COPPA) that regulates websites and online services that knowingly collect personal information from a child under 13. It does not regulate a parent giving us a child's first name to put on the birthday banner. We treat the information adults give us about specific children with care anyway, as described below — but we want to be clear about what we are and are not doing.

The information about children we receive from adults

• Birthday party booking. Your child's first name, your child's age, and how many guests will attend.
• Event RSVP (for free events). How many children will attend, the children's ages (free text), and any accommodation needs.
• Field trip booking. The grade levels of the students attending, the group size, and (from the school) any accessibility or accommodation needs for the group.
• Museum on the Move booking. The expected audience size and ages.

Who sees it. Only the staff working on your booking. We do not share children's names or ages outside the museum staff working on your booking, except where the law requires us to (see When the law requires us to share).

How long we keep it. See How long we keep things. In short: party records 60 days after the party; field trip records through the academic year plus 60 days; RSVP records 60 days after the event.

What we never do. We do not use children's information for marketing. We do not sell or rent it. We do not include it in donor reports, sponsor reports, or board reports — except for de-identified aggregate counts (such as "we hosted 240 birthday parties this year").

If a child fills out a form anyway

Our forms are designed for adults. If we discover that a person under 13 has filled out a form on this website themselves — for example, a child completes a volunteer application or RSVPs to an event using their own email address — we will:

1. Stop processing the submission until we have reached a parent or guardian.
2. Delete any information from the submission that we cannot justify keeping under a parent's authority.
3. Honor a parent or guardian's request to delete the entire record, with no questions asked, by emailing privacy@cmidaho.org.

Under COPPA, a parent or guardian has the right to review the personal information we have collected from or about their child, ask us to delete it, and refuse to allow further collection or use of the information. To exercise any of these rights, email privacy@cmidaho.org. We will verify your identity (typically by replying to the email address the original information was submitted from, or by asking a question only the parent who made the booking could answer), and then we will act on your request. We will not require legal documentation.

A parent or guardian can ask us to delete any specific booking, RSVP, or form submission that mentions a child in their care, at any time, for any reason or no reason at all. Email privacy@cmidaho.org with the date and the email address used and we will delete the record and reply to confirm. We will not ask why.

Volunteers under 18

Our Volunteer Application includes an "under 13" age option. We do not currently accept volunteers under 13, and we route any such application straight to a parent or guardian contact before any further processing.

For volunteers ages 13–15 and 16–17, we obtain a written parental or guardian consent before any volunteer work begins. The consent covers (1) the volunteer role itself, (2) photography of the minor volunteer for museum documentary, educational, and marketing use under the same standard described in Photos and video at the museum, (3) emergency-contact information, and (4) acknowledgment of the museum's volunteer expectations. We collect this consent by email reply with the museum's volunteer-consent form attached, signed (digitally or otherwise) by the parent or guardian. Until that signed consent is on file, we will not schedule, onboard, or place the minor volunteer in any role at the museum.

We do not market to children

We do not send marketing communications to children. Every newsletter, fundraising appeal, event reminder, member-renewal notice, and survey we send is directed at an adult — a parent, guardian, member, donor, sponsor, teacher, or supporter — at an email address an adult gave us.

We do not run advertising campaigns aimed at children. We do not buy advertising on platforms or in placements designed to reach children. We do not deliver our website's content with embedded advertising of any kind.

We do not encourage children to give us their email addresses, phone numbers, social-media handles, or any other contact information. If a form on this website ever appears to do so, that is a mistake and we want to hear about it at privacy@cmidaho.org.

We do not use children's information to deliver personalized content, recommendations, or advertising — to the child or to anyone else. We do not sell or share children's information for any marketing or advertising purpose.

Photos and video at the museum

The museum is a busy public space, and we sometimes take photos and video here. We use them on our website, on our social media, in our annual report, in fundraising materials, and inside the museum itself.

In-museum signage controls visitor consent. When you visit in person, signage at the admission desk explains our photography practices. Entry into the museum constitutes the visitor agreement described on that signage, not this website policy. This section describes our practices so you can read about them in advance.

You can opt out at any time. When you arrive, you can tell the staff member at the admission desk that you do not want to be photographed during your visit, and they will mark your group. If you change your mind mid-visit, tell any staff member or floor host and they will pass the request along. Our Visitor Services Manager oversees this process — you can reach her in advance at angelica@cmidaho.org or 208.345.1920.

If you would like to register a photography opt-out in advance of your visit, email angelica@cmidaho.org with the date(s) you will be visiting and we will note it. You will still be asked to confirm at the admission desk when you arrive.

Identifiable children require a separate written release. Before a recognizable photograph or video of a specific child appears in a marketing piece — a social-media post about that child, a website hero image, an annual-report profile, a sponsor-facing fundraising appeal, an email campaign, or printed promotional material — we obtain a separate written release from that child's parent or guardian. Wide shots of the museum where individual children are not the subject (and are not identifiable in close-up) do not require a release.

We do not tag children, families, or schools on social media. Even when we have a release to publish a photo, we do not tag the child, the family, the school, or any organization that would make a specific child more locatable by strangers. We may credit a sponsor for the program, but not a person under 18 or their school.

Our photographers and contractors get briefed on these rules. Anyone we hire or invite to photograph at the museum is told, in writing, about the opt-out and release rules before they begin.

Removal requests. If you find an identifiable image of yourself, your child, or someone in your care on cmidaho.org, our social media, or museum printed material and you want it taken down, email privacy@cmidaho.org. We will remove the image from material we control — typically within 7 days for website and social-media posts. Printed materials already distributed cannot be recalled, but we will not reuse them.

If you apply for a scholarship membership

The Membership Scholarship form lets you tell us why your family qualifies for a reduced-cost or free membership. There are two paths: SNAP/EBT participation and foster or kinship family status. Both flow through our Contact Us form with the inquiry type preset to "Scholarship," which means what you tell us lives in the free-text message field. You decide how much detail to share.

If you tell us your household uses SNAP/EBT benefits. This matches the Museums for All eligibility standard. We do not ask for your EBT card number, your benefit amount, your case number, or any financial documents. We do not check what you tell us with the State of Idaho or with any SNAP/EBT office. The statement you give us on the form is the statement we use to make the decision. Our staff procedure is for the Development Director to review the application within 30 days of receipt and remove the eligibility statement from your record after the decision. We are working toward automating this. Only the fact that you were approved for a scholarship membership stays on your member record, so we can renew you next year. If you re-apply at renewal time, we will ask you to re-confirm your eligibility from scratch.

If you tell us you are a foster or kinship family. Same handling: we do not ask for licensing paperwork, the names of the children in your care, your caseworker's contact information, or your placement agency. We do not check what you tell us with the Idaho Department of Health and Welfare or any foster-care agency. The statement you give us on the form is the statement we use to make the decision. Our staff procedure is for the Development Director to review the application within 30 days of receipt and remove the foster-status statement from your record after the decision.

What we do not do with this information. We do not identify specific members as scholarship recipients to sponsors, donors, the board, or museum staff outside the Development office, except where law requires (such as a subpoena). De-identified aggregate counts (such as the total number of scholarship memberships awarded in a year) may appear in grant reports and the annual report. We do not flag scholarship members in any database that front-desk staff, event hosts, or sponsors can see — when you visit, you are a member, full stop.

If you tell us about accessibility needs

Our Field Trip Inquiry, Museum on the Move Booking, and Event RSVP forms include an open field for you to tell us about accessibility or accommodation needs — sensory considerations, mobility support, hearing or vision support, communication aids, service animals, or anything else your group needs to have a good visit.

We treat this information as confidential. We use it only to prepare for your specific visit: routing to the gallery floor, planetarium, and education staff who will work directly with your group on the day of your visit.

What we do not ask for. We do not ask for diagnoses, individualized education plans (IEPs), 504 plans, or medical documentation. Please do not send those — a plain description of what your group needs is enough.

Who sees it. Accessibility notes for field trips and outreach bookings are reviewed by the Program and Outreach Coordinator and shared only with the day-of staff who need them to host your visit well. Accommodation notes on event RSVPs are seen by the staff who run that event.

How long we keep it. Our staff procedure is to remove these notes from the booking record within 60 days of your visit. We do not store them in any visitor-tracking, marketing, or donor system. We never share them with sponsors, funders, or school districts.

The next time you book, we start fresh. Because we delete these notes after each visit, the next time you book we will ask again. We know this means re-sharing — we would rather ask twice than store sensitive information about your group between visits. If keeping accommodation notes on file would be helpful to you, email bre@cmidaho.org and we will discuss what works for your group.

A note on funding source

Our Field Trip Inquiry asks whether your school's visit is supported by Title 1 federal funding or another funding source. We use this only to apply the correct pricing (Title 1 schools receive a free planetarium add-on) and to plan our school-outreach budget. We do not share which schools we serve under Title 1 with sponsors, donors, board members, or grant funders by name. Aggregated, anonymized totals (for example, "we served 22 Title 1 schools last year") may appear in our annual report and grant reporting.

If you donate

Will my name be public?

Your name does not become public because of an IRS filing. Your name may become public only if you choose to be publicly recognized — as a sponsor in a recognition program, an event sponsor, on a donor wall, in our annual report, or in similar materials. That is something you opt into when you make a gift, not something the IRS filing forces.

Anonymous giving. You can ask to be listed as "Anonymous" in any public recognition material we produce. We will record your anonymity preference and honor it. We still have to identify the gift to the IRS internally, but we will not publicly attribute it to you.

Removing yourself from public recognition. Our public sponsors page at cmidaho.org/support/sponsors lists organizations and individuals who have agreed to be recognized as current sponsors. If you appear on that page and would like to be removed — at any time, for any reason — email amy@cmidaho.org and we will take you down at our next site update (typically within 5 business days).

What about the IRS filing?

The Children's Museum of Idaho is a 501(c)(3) public charity. We file an IRS Form 990 (the annual financial form nonprofits file with the IRS) every year. IRS rules require us to attach a Schedule B (the donor list inside Form 990) that lists major donors. For public charities like CMI, Schedule B generally requires reporting donors whose total annual contributions equal or exceed the greater of $5,000 or 2% of our total contributions for the year. The IRS receives the unredacted Schedule B.

The version of our Form 990 made available to the public has Schedule B donor names and addresses redacted. Federal rules keep donor names and addresses off the public copy of our 990. (For the curious: Treasury Regulation 26 CFR § 301.6104(d)-1(b)(4)(ii).) So when our 990 is requested from us directly, or downloaded from Candid/GuideStar or ProPublica (public databases where anyone can look up a nonprofit's IRS filings), donor names and addresses for Schedule B donors are not visible — only the IRS sees them.

Donor lists are not shared, sold, traded, or rented

Not with other nonprofits, not with for-profit companies, not with mailing-list cooperatives, not with fundraising consortiums.

Removing yourself from donor mailings

Email amy@cmidaho.org or privacy@cmidaho.org and we will remove you from all fundraising mailings within 10 business days. This is a faster timeline than our general 30-day window for full data-deletion requests because unsubscribing from one mailing list does not require us to touch our IRS records. This does not affect our obligation to send you the tax receipt required for your gift.

Sponsor inquiries

When a business contacts us about sponsorship through our Sponsorship Inquiry form, we collect the organization's name, the contact person's name and role, and contact information. We treat this as business-to-business contact data — it stays in our Development office and is used to follow up on the sponsorship conversation. If a sponsorship is finalized and the sponsor agrees to be publicly recognized, the organization's name (not the individual contact's name) may appear on our sponsor wall, on this website's sponsors page, in event materials, and in our annual report. Public recognition is optional and we will ask before listing you.

Donations from minors

Our donation page is intended for adults. If a person under 18 makes a donation through our website or otherwise (for example, by mailing a check), we treat the gift as if it had come from an adult for IRS reporting purposes but apply the children's-information protections in Your child's information to any other personal information the gift includes.

If you sign up for the newsletter

When you sign up for our newsletter, you give us your email address and explicitly check a consent box. We send the newsletter through Mailchimp (see The companies that help us run the website). Every newsletter we send includes an unsubscribe link in the footer. You can also email privacy@cmidaho.org. We honor unsubscribe requests within 10 business days as required by the federal CAN-SPAM Act (15 U.S.C. § 7704), and in practice usually within one business day.

We currently send the newsletter approximately once a month, though the frequency may vary around major museum events. The newsletter may include museum news, upcoming events, fundraising appeals, and information about membership. We do not send marketing campaigns on behalf of other organizations through this list, and we do not sell or rent the list.

Cookies and tracking

We use very few cookies. They fall into two categories.

• Session cookies for staff login. A cookie is a small piece of data your browser stores so a website can recognize you between page loads. The only cookies this site sets are the ones that keep museum staff logged in to our admin tools. Those cookies appear only after a staff member signs in at /auth/login. They are flagged HTTP-only and Secure, expire when the session ends, and are not used for any analytics or marketing purpose.
• Google Maps cookies. On the two pages that embed an interactive Google Map (our Visit page and our Contact page), Google may set its own cookies through the iframe embed. We do not control or read those cookies. If you would like to avoid them, use our written directions on the Visit page and you will never load the embedded map.

No analytics, advertising, social-media tracking, or fingerprinting cookies. We do not run Google Analytics, Google Tag Manager, Meta Pixel, TikTok, Hotjar, Mixpanel, PostHog, or anything similar.

Do Not Track. Because we do not run analytics or tracking in the first place, we do not have anything to suppress when your browser sends a Do Not Track signal. We respect the signal by default, in the sense that we already behave as if every visitor sent it.

How we keep your information safe

Technical safeguards. All connections to cmidaho.org use HTTPS with modern TLS (the lock icon in your browser). Form submissions are validated, rate-limited per visitor, and protected against fake form submissions sent from other sites. Spam submissions are detected and silently rejected. Our database (Supabase) is set up so that public visitors can submit forms but cannot read anyone else's submission. Staff access to the admin tools requires email-and-password login plus a specific administrator role granted only by the Executive Director or Development Director.

Database-level limits on form data. Anonymous form submissions are additionally constrained at the database level: the structured metadata field on each submission is capped at 32 kilobytes and may only contain keys from a fixed allowlist of expected fields. This prevents a misbehaving form (or an attacker probing one) from inserting arbitrary structured data into our records.

Bot protection without CAPTCHA. Each form on our site embeds a hidden honeypot field with a randomized name and a cryptographically signed token that expires 30 minutes after the page loads. Automated submission bots fill the honeypot or submit with an expired or missing token; legitimate browsers do not. This lets us reject the overwhelming majority of spam without showing visitors a CAPTCHA.

Limits on staff access. Within the museum, access to form submissions is restricted to the staff who need it to respond. Scholarship applications are visible only to the Development Director. Field-trip accessibility notes are visible only to the Program and Outreach Coordinator and the day-of education staff. Newsletter subscribers are visible only to staff who manage the newsletter.

Vendor security. Supabase, Vercel, and Mailchimp each undergo independent security audits (SOC 2, ISO 27001, or equivalent — these are independent security audits that the major cloud providers go through every year). Their compliance documentation is linked from their public privacy pages above. If one of our service providers experiences a security incident that affects your information, their agreements with us require them to notify us promptly. We will then notify you on the same basis as if the incident occurred on our own systems.

A small subset of legitimate submissions are sometimes misidentified as spam. If you submit a form and do not hear back from us within our usual response window (3–5 business days for most inquiries; same-day for time-sensitive bookings), please email the staff member listed under Who reads each form directly — your submission may have been silently filtered.

What happens if there is a data breach

If something happens to information you trusted us with, we will tell you as soon as we have facts to share — what happened, what information was involved, what we are doing about it, and what (if anything) you should do.

Idaho law requires this kind of notice when a breach exposes sensitive ID information. Idaho's Identity Theft Protection Act (Idaho Code §§ 28-51-104 through 28-51-107) defines "personal information" as a person's name combined with their Social Security number, driver's license or state ID number, or financial-account, credit-card, or debit-card number paired with the security code or password that would allow access to the account. We do not currently collect those identifiers. If a security incident affects any information you trusted us with — whether or not it meets the statutory definition — we will tell you as soon as we have facts to share. If a breach is large enough to require notice to consumer reporting agencies under the statute, we will do that as well.

How long we keep things

We keep information only as long as we need it.

Form submissions and inquiries
We keep these until our staff has resolved the request and an administrator has deleted them. Our internal target is to delete resolved inquiries within one year, and we audit this manually. If you want yours deleted sooner — for example, immediately after we have answered you — email privacy@cmidaho.org. Submissions our spam filter rejected are kept for up to 30 days for filter tuning, then deleted.

Scholarship eligibility statements (EBT/foster)
Our staff procedure is to review these statements within 30 days of the scholarship decision and remove the eligibility detail from the inquiry record as part of that review. Only the approved-scholarship-member flag stays on the membership record.

Accessibility and accommodation notes
Our staff procedure is to remove these notes from the booking record within 60 days of the visit date.

Birthday party booking details (including child's first name and age)
Kept until the party happens, plus 60 days for follow-up and feedback, then deleted as part of regular records hygiene.

Field trip booking details
Kept through the academic year of the visit, plus 60 days, then deleted as part of regular records hygiene.

Newsletter subscribers
Kept until you unsubscribe or ask to be removed. Unsubscribed addresses are kept in a "do-not-add-back-by-accident" list at Mailchimp; you can ask us to delete the suppression-list entry too.

Member records
We keep these for the life of your membership, plus 7 years. The IRS can look back 7 years at charitable contributions, and we need to be able to answer if they do.

Donor records
Kept for at least 7 years after the most recent gift to support IRS audit. If you have an active multi-year pledge or recurring giving arrangement, we keep the gift record for the term of the arrangement plus 7 years after the final gift. If you ask us to delete a donor record, see What you can ask us to do; we will delete what we can while keeping the minimum information required by IRS rules (typically the gift amount, gift date, and a record that you were the donor — without contact information).

Staff accounts
Kept while the person is employed by the museum; deactivated and then deleted within 90 days after they leave.

Web-server and security logs
Vercel keeps page-request logs (URL, IP, response code, response time) for the limited window their service provides — currently up to about 30 days on our plan. The one-way IP fingerprints we use for spam-rate-limiting are kept in a rolling window and purged automatically.

If you would like your information deleted before these retention windows expire, see What you can ask us to do below.

What you can ask us to do

The single channel for any privacy request — to see what we have, correct it, delete it, or ask a question — is privacy@cmidaho.org. A real person reads that inbox; it is not an automated address. We will acknowledge your request within 5 business days and complete it within 30 days. If a request is unusually complex (for example, it spans multiple staff areas or requires us to consult our IRS recordkeeping obligations), we may take up to 45 days total and we will tell you why.

You can ask us to:

• Tell you what we have on file about you. We will send you a copy.
• Correct anything that is wrong. Send the correction by email and we will update it.
• Delete your information. For some records — IRS-required donor records, breach-notification logs — we cannot delete on request. If that applies to you, we will tell you exactly what we kept and why.
• Delete a specific booking, RSVP, or form submission. You do not have to ask us to delete everything. If you want one specific record gone — your daughter's birthday-party inquiry from last month, an event RSVP, a field-trip booking, a scholarship application — email privacy@cmidaho.org and tell us which one. Include the rough date and the email address used, and we will find it and delete it. We will confirm by reply when it is done. Deleting one record will not cancel your membership, end your newsletter subscription, or affect any other relationship with the museum.
• Stop sending you our newsletter. Click the unsubscribe link at the bottom of any newsletter email, or email us.
• Stop sending you fundraising appeals. Email us. We will remove you within 10 business days.

Residents of California, Colorado, and other states with consumer privacy laws

Some states — including California (with its CCPA/CPRA), Colorado (with its CPA), Connecticut, Virginia, and others — have passed broader privacy laws. Most of those laws do not legally apply to a nonprofit like ours. We honor the spirit of them anyway, no matter where you live. That means: you can ask what we have on you, ask us to correct or delete it, and tell us not to share or target ads at you. (We do not do targeted advertising in the first place.) Email privacy@cmidaho.org to use any of these rights.

One exception is California's "Shine the Light" law (California Civil Code § 1798.83), which can apply to nonprofits that share personal information with third parties for those third parties' direct marketing purposes. We do not share information with third parties for direct marketing. If you are a California resident and you want to make a Shine the Light request anyway, email privacy@cmidaho.org with "Shine the Light Request" in the subject line, and we will respond within 30 days.

Residents of Idaho

Idaho's general consumer privacy framework is centered on the Idaho Identity Theft Protection Act (described in What happens if there is a data breach). As of the effective date of this policy, Idaho has not enacted a comprehensive consumer privacy law equivalent to the California CCPA or the Colorado CPA. Regardless, Idaho residents have the same access, correction, deletion, and opt-out rights described above — we apply those rights to everyone, no matter where they live.

We will not penalize you for exercising any of these rights. Asking us to delete information will not affect your ability to visit the museum, hold a party, take a field trip, or RSVP to a free event. If you are asking us to delete information you previously gave us in support of a scholarship application that is still pending, we will tell you that we cannot evaluate the application without that information and ask whether you would like to withdraw the application or pause the deletion. If you have already been approved for a scholarship and ask us to delete your record, your scholarship status will remain on your active member record (so we can honor it through its term), but we will delete the underlying eligibility statement on request.

About the sign-up page on this site

Our website includes a sign-up page at /auth/sign-up that is currently publicly accessible. Any visitor can create an account by entering an email address and password. When you sign up, we store your email address and a one-way hash of your password (we never see or store the plaintext password) in our Supabase authentication system.

This page exists because the website will later include a member dashboard (planned for a future phase). Until that dashboard ships, creating an account does not give you any functionality — there is no member dashboard yet, and member benefits are not tied to website accounts.

Children should not create an account here. If a person under 13 creates an account on /auth/sign-up, we will delete it as soon as we become aware, and we will not require any verification from a parent before doing so — just an email to privacy@cmidaho.org with the address the child used.

If you sign up as a member of the public and do not want the record kept, email privacy@cmidaho.org and we will delete it. When the member dashboard launches, we will update this policy — including age-gating and parental-account rules — before the feature goes live.

When this policy changes

We will update this policy when our practices change, when we add a new service provider, when we add a new form, when we add online payments, or when a law changes that affects how we treat your information. The effective date at the top of this page and the change log below will always reflect when the current version was published. For changes that affect what we collect or how we use it, we will post a notice at the top of cmidaho.org for at least 30 days and (where we have your email address through an active relationship) email you.

We are planning to launch native online payments for donations, memberships, and event tickets on cmidaho.org in a future phase. When that happens, we will add Stripe (Stripe, Inc.) as a service provider and update this policy with the specific data Stripe will see (typically: your name, billing address, email, and your card details, which go directly to Stripe and are never stored on our servers). The update will be published before the payment feature goes live.

Prior versions. When we update this policy, we keep the prior version archived. If you submitted a form on this website before an update, your submission is governed by the version of this policy that was in effect at the time you submitted. To request a copy of the policy version in effect on a particular date, email privacy@cmidaho.org.

Change log

• October 27, 2026 — Version 1.0. First publication of this policy under the Children's Museum of Idaho's new website. Replaces the previous Drupal-based site's policy.

Contact us

Email: privacy@cmidaho.org (privacy questions and rights requests)

Email: info@cmidaho.org (general museum questions)

Phone: 208.345.1920

Mail:
Children's Museum of Idaho
790 S Progress Avenue
Meridian, Idaho 83642

For program-specific questions:

• Membership and scholarship — amy@cmidaho.org
• Field trips, outreach, and accessibility — bre@cmidaho.org
• Visitor services and photography opt-outs — angelica@cmidaho.org