Privacy

This page describes what YouthBy actually does today. It is written from the site's own behavior rather than from a template, so where a feature is not switched on, this page says so instead of describing it as if it were.

Who to ask

YouthBy is a Massachusetts program directory run by the team behind NewtonYouthSports. Questions about privacy, or a request about anything you have sent us, can go through the contact form.

What stays in your browser

Eight things are stored in your own browser's local storage. They are readable only by this site. One of them — the review edit token below — is sent back to us only when you edit or delete a review you wrote. The rest stay in the browser, apart from the measurement cookie described separately under What is measured:

• Your place. The town or ZIP you last searched from, under yb-place, so the next visit opens where you left off rather than guessing again from your connection. Only the town name or the ZIP is written down — never a coordinate — and it is never sent anywhere. Choosing Anywhere clears it.
• Your last search. The words you last searched for, under yb-last-search, so the box is filled in when you come back. It is read only by this page and is never sent anywhere; the measurement described below receives categories, never the words themselves.
• Your saved programs. The shortlist you build by bookmarking listings. The key is youthby:saved.
• Your child profiles. Whatever you type into the child profile panel — a first name, an age or grade, and any interests. The key is nys-kids. These are used to filter the page you are looking at and for nothing else. They are never measured and never sent anywhere.
• Your calendar. The sessions and registration dates you add to My calendar, and the programs you mark as registered, under youthby:calendar and youthby:registered. Marking something registered is your own note; it does not enroll a child in anything.
• Your review edit token. When you write a review, this browser is given a random token so you can edit or delete that review later. It is stored under youthby:review-tokens and is sent back only when you use Edit or Delete. It is not an account and it does not identify you; the server keeps only a hash of it.
• Your measurement answer, under yb-consent, so the prompt is not repeated on every page. What that answer leads to is described under What is measured.
• Your newsletter answer, under youthby:newsletter, so the newsletter notice is not shown again after you subscribe, decline it or close it. The email address you submit is handled as described under What the forms send.

Clearing your browser's site data removes all eight, and if you had agreed to be measured it also ends that: the next visit asks again rather than reconstructing anything. You can also withdraw without clearing anything — see What is measured.

A schedule built in the older version of this site was stored under nys-plan. That key is no longer used; the next visit to any page moves whatever it held into your calendar and removes it, rather than deleting a plan you had made.

What the forms send

The contact form sends your message to us by email through this site's own server — no outside form service sees it. What you type in it is what is sent: an email address, a message, and whatever details you chose to include. It asks for no child's name, birth date, medical information or household financial records, and none of it is needed to answer a question about a listing.

The correction, suggestion, listing-update, program-submission and provider-pilot forms are different: they are written to YouthBy's own database rather than emailed, and they appear in the owner's private dashboard. A row holds what you typed, when it arrived, and the email address you gave so we can reply. The dashboard is not public, is not indexed, and is reachable only by the site owner. It is also where suggested edits and new accounts appear, so the owner can act on them without an inbox.

Provider accounts are the one part of the site that asks for a business contact. Claiming an organization asks for the organization’s name, the company email address it publishes, your name, your role, a website and a town. A six-digit code is sent to the company address to show it is yours, and the organization then waits for YouthBy to verify it by hand. No information about children is asked for anywhere in that flow, and claiming an organization does not create a subscription or a charge.

The newsletter notice, when it appears on the homepage or a town guide, asks for an email address and which of four lists you want: new programs, registration deadlines, camps, and free or low-cost programs. That address and your choices are stored in YouthBy’s own database, so the list can be run from the owner’s dashboard without handing the address to anyone else. It appears only after you have spent some time on a guide or read a good part of one, and it can be closed without answering. Closing it keeps it away for a week; choosing not to receive the email keeps it away for three months. Every email sent from the list carries a way to leave it, and leaving is recorded against that address so it is not written to again.

Each email is assembled when it is sent, from things you chose: your town, the programs you saved to your account, and the lists you asked for. If you accepted measurement, two more things can be used to put the most useful part first: the last town you looked at, when a signup did not name one, and the program pages you opened in this browser, so that a registration date on something you were already reading can lead the email. Someone who declined measurement has no identifier for us to look at, so their email is written from their town and their saved programs only. Nothing else about you is used, and nothing is inferred.

What is measured

The map on the search results and the town guides

The map beside a set of search results, and the map a town guide opens when you press Map, is drawn from map tiles served by OpenFreeMap, whose data comes from OpenStreetMap. It is a third party, so it is worth saying plainly what it sees.

Nothing is loaded until a map is going to be drawn — a search that comes back with results, or a town guide where you have pressed Map — and if you never search and never press it, no request is ever made. The town guide's map starts closed. When the map does appear, your browser asks OpenFreeMap for the tiles covering the part of Massachusetts it is showing. That request carries your IP address, as any request to any server does, and it carries the area being looked at — which is the area your search is about, and is a rough indication of where you are. No cookie is set, nothing about you is stored by us as a result, and the text you typed is not sent: the map is told the towns that came back, not the question that found them.

There is no way to draw a street map without asking somebody for the tiles. If you would rather not, leave the map closed and use the lists, which carry everything the map does.

Email you send us

Messages to hello@youthby.com, contact@youthby.com and providers@youthby.com are kept in our database so the owner can read and answer them: the address you wrote from, the subject and the words you wrote. They are not used for marketing, not shared, and not measured. A reply comes from the address you wrote to, so replying to it brings the conversation back to the same place.

Analytics

Cloudflare Web Analytics runs on every page. It is cookieless — it sets nothing on your device, does not fingerprint you, and does not follow you to other sites. It reports aggregate page views and referrers to us. It is how we can tell, at all, how many people chose not to be measured.

Alongside it, YouthBy keeps its own record of what people look at, so that a provider can eventually be shown what interest their listing produced rather than being asked to take our word for it. That record is only kept for visitors who agreed to it. If you say no, no identifier is created, nothing is stored under your visit, and the rest of the site works exactly the same.

Everyone is asked, wherever they are. The prompt does not depend on which country you are in, and nobody is measured quietly because they happen to live somewhere that does not require asking. Until 13 October 2026 the site only asked visitors in Europe, which meant most people were measured without being told; that is not the case now, and anyone who was measured under the old arrangement is asked the next time they visit.

The identifier

If you agree, the server gives your browser two random strings. They are generated at random and are not derived from your IP address, your device, your browser, your email address or anything else about you — they are simply two long random numbers, and nothing else about you is stored with them.

• A visitor identifier, in a cookie named yb_v, lasting 395 days. It exists so that a family who uses this site all year is counted once rather than as a hundred visits.
• A session identifier, in a cookie named yb_s, which expires after thirty idle minutes. It exists so that several things looked at in one sitting can be understood as one sitting.

Both cookies are first-party, are marked HttpOnly (so the page's own scripts cannot read them), Secure, and SameSite=Lax. They are set only after you agree, and they are set by our server rather than by the page.

What is recorded

What a listing looks like, how many times it was actually seen, and what happened next. Concretely: which town and category a listing belongs to, the name and provider as the page displayed them, the price as it was displayed at that moment, and whether you scrolled far enough down for a listing to count as seen — which is at least half of it on screen for a full second.

Each page also records how long it stayed open, sent once as you leave it, so a provider can be told that people spend a minute reading their listing rather than only that they opened it. A page open for less than two seconds is not timed at all.

Opening a program's own page is recorded once, as a listing being opened rather than only a card being seen. That is the record the newsletter uses, and only for readers who agreed to measurement and then asked for the email.

Clicks on a link to a provider's own site are recorded as clicks. They are not recorded as registrations, because we do not know whether you registered, and this page will not imply otherwise. Only two things could count as a registration: a note you make yourself on your calendar saying you signed up, which is stored as your own statement rather than as a fact, or a confirmation sent to us directly by a provider's booking system, which nothing does today.

Your IP address. Each page view stores the address the request came from, alongside the country Cloudflare already reports. It is used for two things: to work out which town you are nearest to, so the guides and the “Around …” box open in the right place, and to let the owner follow a single visitor’s path through the site when something needs explaining. It is kept with the page view rather than in a separate log, it is not sold or shared, and a request to have it deleted is answered like any other.

What is never recorded

• Anything that identifies your device. No browser fingerprint, no screen size, no language, no installed fonts, and no user-agent string stored. Your browser does send a user-agent, and it is read for two purposes: to tell a person from a crawler, and to label the visit with a coarse browser family and platform — “Safari”, “iPhone” — so a report can say which devices the site works for. Those two words are all that is kept; the string itself is discarded in the same request, and it is never hashed or combined with anything else.
• Your email address in the measurement store, or a scrambled version of it. If you sign in or ask us to email you, the address you give us is kept for that purpose, as described under Accounts; it is not copied into the measurement tables.
• Anything from your child profiles. Names, ages and notes you keep about your children stay in this browser. Nothing in a child profile is sent anywhere, and it is not part of an account.
• A recording of your session. Nothing is replayed, and no page is filmed.

How long it is kept, and how to remove it

The detailed record is deleted automatically 395 days after it is made. Daily summaries that contain no identifier are kept for up to three years, which is what makes it possible to answer “how did last autumn compare” a year later.

You can delete what has been kept about your browser at any time, without clearing anything else. In your account, under Privacy, Delete my analytics data stops the measuring, deletes the events stored under your identifiers, and clears the cookies; Cookie settings puts the question back so you can answer it again. Deleting cannot be undone, and neither control touches your saved programs, your calendar or anything else stored in your browser.

Crawlers and robots

YouthBy is a directory, so it is crawled constantly, and a crawler counted as a family would corrupt every figure on this page. Search engines, AI crawlers, SEO tools, monitoring services and link-preview fetchers are all refused before an identifier is issued — they are not asked, they are not counted, and nothing about their visit is kept except a tally of how many were turned away. They are still served the site in full; they are only left out of the measuring.

What the numbers mean, and what they do not

These are counts of browsers, not of people. One parent using a phone and a laptop is two; two parents sharing a tablet are one; someone who clears their cookies becomes a new one. A search for a town means someone was interested in that town's programs, which is not the same as living there. Aggregate figures are only reported where at least twenty different browsers and five different providers are involved, so that a summary cannot describe a handful of identifiable families.

Google Analytics and Microsoft Clarity

Both are described in the site's code and are not active: their identifiers are empty, so neither script is ever fetched and no data goes to either company. If they are switched on, the site asks first, and declining means the tags are never loaded at all rather than loaded in a restricted mode. Everything described above belongs to YouthBy's own store on YouthBy's own infrastructure — it is not sent to Google, Microsoft or anyone else.

Reviews

Reviews are public. If you write one, the rating, the headline, the review itself, the kind of reviewer you say you are (parent, participant, coach or community member), and the season you attended are shown to anyone who opens that program. A display name is optional; if you leave it blank the review is shown as “Anonymous”. If you are signed in you can also tick Post anonymously: your name is not shown, and the review carries no verified mark, but the account link is kept privately so you can still edit or delete it. Please do not put a child's full name, school or contact details in a review.

Replies are public too. A reply can be written by another parent, by the program's provider, or by anyone with something useful to add. Replies are one level deep and carry the same rules as reviews: no links, no contact details, and no child's full name.

A review can be edited or deleted from the browser that wrote it, using the Edit and Delete links beneath it. Editing keeps the original date and marks the review as edited. Deleting removes the review, its replies, its helpful votes and any reports about it. That right is carried by the edit token described above, not by an account; if the token is gone (cleared site data, a different device), write to hello@youthby.com and say which review.

To stop the same browser posting the same review repeatedly, the server keeps a salted hash of the request address alongside the review. It is used only for that rate limit. The address itself is not stored, and the hash is not used for analytics or combined with the analytics identifiers described above. Reviews do not require analytics consent, because they are content you deliberately publish rather than measurement of your visit.

Reviews are published immediately and are not edited. If you need one removed, write to hello@youthby.com from the address you would like us to reply to, and say which program and review.

You can also report a review or a reply with the Report link beneath it. A report can include a reason and an optional note, and is sent to the person who runs YouthBy so it can be looked at. Reporting does not hide anything automatically. The report, its reason and its note are kept privately and are not shown on the site.

Accounts

You can sign in with Google, or create an account with an email address and a password. With Google, Google tells us your name, email address and profile picture; with an email account, you choose the name to show and give a ZIP code, which is turned into your town and kept with the account. Either way we store the name, email address, a password hash if you set one, the programs you save, your town, your reviews and suggested edits, and the lists you asked to hear about, so your calendar and contributions follow you from one device to another. We never receive your Google password, and we never store an email password in readable form. Your children's profiles stay in this browser and are not part of an account. The IP address and the postal code Cloudflare resolves are kept on the account — the pair at signup, and the latest pair each time you visit while signed in — so the owner can see where accounts come from.

An email account is confirmed before it is used: we send a link to the address you gave, and the account stays inactive until it is opened. The link is a random token, stored only as a hash, and it expires after a day. If you ask for another, the previous one stops working.

If you claim an organization, the account also stores the organization’s name, your role, the company email address you verified, a phone number if you give one, a logo if you upload one, and the programs you post. A program you post is a listing: its name, town, ages, cost, venue, dates, registration link and description, and the photograph you choose, are stored and shown publicly once the owner publishes it. Until then only you and the owner can see it. Your organization’s name, logo and about text appear on your public provider page and beside the green verified check on anything you post.

Every search is recorded as a question the site was asked. The row holds the words as you typed them, the filters you chose, the town you searched near and how many programs came back — with no cookie, no visitor identifier and no IP address attached, and not linked to an account or to the measurement store above. The owner reads these to see what parents look for that the guides do not yet cover, and to decide what to research next. Because the words are kept, please do not type a child’s name into the search box; nothing in a child profile is ever sent, but the search box is a search box.

Page views are counted the same way: which page was opened, the site that sent the reader there (if any), any campaign tags in the link (utm_source, utm_medium, utm_campaign and their companions), whether the device is a phone, a tablet or a computer, and the country Cloudflare already sees. A random session id is kept in the browser's session storage and forgotten when the tab closes, so pages can be counted as one visit without a cookie that survives the visit. If the link that brought a reader carries an advertising click identifier from Google, Meta, Microsoft, TikTok or X, that identifier is stored with the view so the click can be credited to the ad that produced it. A separate random visitor id is kept in local storage, so the same browser is counted once across visits rather than once per visit; it is not linked to an account, an address or a device fingerprint, and clearing site data replaces it. A single yes/no flag in local storage records that this browser has been here before. Requests from crawlers and automated clients are not counted at all.

Actions on a listing are counted per program and per provider: opening a listing, saving it, clicking through to the provider's own website, writing a review, suggesting an edit, sharing a listing, or adding a session to the calendar. These counts are what a provider is shown when we talk to them. They carry the same tab-scoped session id and no other identifier.

Some campaign links are shortened, like youthby.com/s/abc123, so they can be read out loud or pasted into a message. Following one records only that it was followed: the time, the page it was followed from, and the country Cloudflare already sees. It does not store your IP address, a cookie or a visitor identifier, and it is counted separately from the measurement described above.

Signing in is separate from measurement. It does not turn measurement on, and declining measurement does not sign you out. You can log out at any time from the account panel. To delete an account and everything stored with it, write to hello@youthby.com from the address on the account and ask us to remove it.

Where the listings point

Every listing links to the provider's own website, and following one takes you to a site we do not run. What those sites do with your visit is governed by their policies, not this one.

Last reviewed 20 October 2026, against the site as built.