Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Athletic Connect (“Athletic Connect,” “we,” “us,” or “our”) collects, uses, discloses and retains Personal Information in connection with our software platform for running sports programs (the “Platform”), our mobile application (the “Mobile App”), the website at athleticconnectapp.com (the “Website”), and related support (together, the “Services”). This Privacy Policy is effective as of the “Last updated” date shown above.

In this Privacy Policy:

• “Customer” means an organization or individual that subscribes to the Services, such as a club, school program, league or tournament organizer, or an independent coach or trainer.
• “Authorized User” means an individual who uses the Services with an account associated with a Customer, such as the Customer’s owner, administrators, staff and coaches, and the parents, guardians and adult athletes the Customer serves.
• “Personal Information” means information that identifies, relates to or could reasonably be linked to an individual.
• “Customer Data” means Personal Information that a Customer or its Authorized Users submit to the Services, or that the Services collect on a Customer’s behalf.

2. Our Role

Service provider to our Customers. Our Customers determine what Customer Data to collect, which Authorized Users may access it, and how it is used within the Services. With respect to Customer Data, we act as a service provider (sometimes called a “processor”) on behalf of and at the direction of our Customers. We process Customer Data to provide the Services to the Customer and for no purpose of our own. If you are a parent, guardian, athlete or coach, the Customer you deal with, such as your club, is responsible for the Customer Data it maintains about you and your children.

Business with respect to limited information. We determine the purposes and means of processing for a limited set of Personal Information: information submitted to us through the Website, such as a demo request; information you provide when you contact us; and the records we maintain to operate and secure the Services. For that information, we act as a business (sometimes called a “controller”).

3. Personal Information We Collect

3.1 Customer Data

The categories of Customer Data we process depend on the features a Customer uses. A Customer that uses only our coaching tools may store little more than its own users’ accounts, drills, practice plans and playbooks. The Services can hold the following categories.

Account and contact information. Names, email addresses and telephone numbers of Authorized Users, and passwords, which we store only in a hashed form that cannot be read back. If an Authorized User enables two-factor authentication, we store the information it requires. When an Authorized User accepts our Terms of Service and this Privacy Policy, we record the version of the Terms of Service accepted, the version of this Privacy Policy then in effect, the time of acceptance, the internet protocol (IP) address from which it was accepted, and whether it was accepted on the Website or in the Mobile App on iOS or Android.

Athlete profiles, including those of children. A parent, a guardian or the Customer enters an athlete’s profile, which may include name, date of birth, gender, grade, home address, height and weight, position, uniform size and jersey number, emergency contacts, consent to public use of the athlete’s photograph, and the adults responsible for the athlete.

Registrations and Customer forms. The programs for which an athlete is registered, and answers to questions the Customer writes on its own forms. Because the Customer writes those questions, the answers may concern any subject the Customer chooses to ask about.

Waivers. When an Authorized User agrees to a Customer’s waiver, we record the waiver and version agreed to, the name typed, the time of agreement, who agreed on whose behalf, and the IP address and browser from which the agreement was made.

Payment records. Invoices, amounts, payments, refunds, credits, payment plans and store orders, including the athlete name, size and name printed on gear ordered, and the pay records a Customer maintains for its coaches and staff. Payment card details are entered on a payment page hosted by our payment processor, Stripe, and are retained by Stripe. We retain only the card’s brand and last four digits.

Financial aid applications. Where a Customer offers financial aid, the answers given on its application and any documents attached to it, such as a pay stub or a tax return. The Customer determines what its application asks.

Incident reports. Reports filed by a Customer’s coaches or staff when an athlete is injured or another incident occurs at a practice, game or session, and each household’s and adult athlete’s answer to whether a description of an injury may be recorded in them, with who answered and when. Section 4 describes what a report contains and how reports are handled.

Evaluations and tryouts. Coaches’ ratings, scores and comments, tryout attendance, and team placements. A family can view an evaluation only after the Customer releases it.

Attendance and scheduling. Attendance records, any short note a coach adds to them, and responses to event invitations.

Coaching materials. Practice plans, drills and playbooks, including their diagrams and any video links. Where a Customer uses scouting reports, they may contain notes about an opposing team, including the names, jersey numbers, positions and heights of opposing players and the coach’s notes about them.

Video and photographs. Game film and other video are added to the Services as links to third-party services such as YouTube, Vimeo or Hudl; we do not host the video itself. Photographs and files that Authorized Users upload, such as a Customer’s images, a coach’s receipt or a document attached to an application, are retained in our file storage.

Communications. Messages sent in Team Chat, in team channels and in private conversations between adults, and any report or block made there; a copy of each email we send on a Customer’s behalf; and the notifications displayed in the Services.

Information about individuals who are not Authorized Users. Some records identify individuals who do not hold an account, such as a visiting team’s contact for a tournament or an opposing player named in a scouting report.

3.2 Information We Collect for Our Own Purposes

Usage and log information. Our servers log each request to the Platform, including the page or action requested, the time, whether it succeeded, and the account and Customer that made it. The Platform also maintains a record of changes made within each Customer’s account, a record of each time a Customer’s staff open an individual’s record, and a record of each time our personnel access a Customer’s account to provide support.

Website information. If you request a demo through the Website, we receive your email address and the time of the request.

Support communications. The content of any message you send us.

3.3 Information We Do Not Request

We do not request government identification numbers or health records, and we do not collect the location of your phone or computer. A document a user elects to attach, such as a tax return, may contain an identification number. Section 4 addresses health-related information that the Services may contain.

4. Health-Related Information and Incident Reports

We do not request health records, and no feature of the Services requires them. The Services may nonetheless contain health-related information in the two ways described below. We process that information on behalf of the Customer and do not use it for any purpose of our own.

4.1 Incident Reports

A Customer’s coaches and staff may file an incident report when an athlete is injured or another incident occurs at a practice, game or session. A report identifies the athlete by selecting the athlete from the Customer’s roster. A coach may select only athletes on the teams the coach coaches, or in the classes, camps and clinics the coach runs. A report about an individual who is not on the Customer’s roster identifies that individual by a name entered as text.

Consent to injury descriptions. The account holder for each household, and each adult athlete for themselves, is asked whether they consent to the Customer’s staff recording a description of any injury in the Customer’s incident reports. An answer is required when an account is created through the sign-up form or through a registration, tryout or financial aid link, and at a program registration if the question has not yet been answered. The answer may be changed at any time on the Profile tab of My Account. We record who answered and when. If no answer has been given, we treat the answer as a refusal of consent. A change applies only to reports filed after it is made; reports already filed are not changed.

Content of a report. What a report records depends on that consent:

• Where consent has been given, a report may record the date, location and activity, the type of incident, a written description, and whether a guardian attended to the athlete, whether the athlete returned to competition, and whether staff followed up.
• Where consent has not been given, and for an individual who is not on the Customer’s roster, a report records only the date, location and activity, and, optionally, whether a guardian attended to the athlete, whether the athlete returned to competition, and whether staff followed up. It contains no description and no type of incident.

Access. A Customer’s administrators can view all of that Customer’s incident reports. Any other person can view only the reports they filed. Families cannot view incident reports. A report cannot be edited or deleted after it is filed.

Copies and deletion. A report that identifies an athlete from the Customer’s roster is included when a Customer provides a parent with a copy of the child’s records. When a Customer deletes an individual’s records, a report about that individual is retained, but its link to the individual is removed and the individual’s name is cleared. The written description in a report filed with consent may still describe the individual. A report that identifies an individual only by a name entered as text, such as a report about an individual who is not on the Customer’s roster or a report filed before athletes were selected from the roster, is not included in a copy and is not affected by a deletion.

4.2 Customer Forms

A Customer writes its own registration and financial aid questions and may ask about health, such as allergies, medications or medical conditions. Those questions, and the answers to them, are separate from the incident report consent described in Section 4.1.

5. Children’s Privacy

The Services are used to manage youth sports programs, and Customer Data often concerns children.

• Accounts are held only by adults. A child’s profile is created by a parent, a guardian or the Customer. Children do not sign in to the Services.
• Parental consent. We rely on each Customer to obtain any parental consent required by applicable law before entering a child’s information into the Services.
• Access by role. A coach can view the athletes on the coach’s own teams and in the programs the coach works with, not the Customer’s full membership. A Customer’s administrators and office staff can view the Customer’s members. A family can view only its own household.
• Injury descriptions. A description of a child’s injury is recorded in an incident report only where the child’s household has consented, as Section 4 describes.
• No advertising. We do not direct advertising to children, and we do not use children’s Personal Information for advertising or profiling.

6. How We Use Personal Information

We use Personal Information to:

• provide the Services and the features a Customer has enabled;
• process registrations, invoices, payments, refunds and coach pay;
• send the emails and notifications that accompany use of the Services, such as receipts, schedule changes and sign-in messages;
• respond to support requests and resolve problems;
• secure the Services and detect, prevent and investigate fraud and misuse; and
• comply with our legal, tax and accounting obligations.

7. Communications

Most messages we send concern activity within a Customer’s account, such as a registration, a bill, a schedule change or a message. In your notification settings, you can choose whether each message reaches you by email, within the Services, or as a push notification on your phone. So that no family misses a message about a child, you cannot disable every means of delivery for these messages. Messages about your sign-in, such as a password reset, are always sent by email.

A Customer may also send its own news or promotional messages to its families by email. Each such email includes an unsubscribe link. Athletic Connect does not send its own marketing email to Authorized Users.

8. How We Disclose Personal Information

We disclose Personal Information only as described below.

Within the Customer. Customer Data is available to the Customer’s Authorized Users according to their roles, as Section 5 describes. A Customer’s administrators can read every conversation in that Customer’s Team Chat, and private conversations display a notice saying so. Information a Customer elects to publish, such as its public staff list, its sponsors or a tournament’s contact, is available to the public.

Service providers. We engage service providers to perform functions on our behalf:

• hosting for the Platform and its database;
• network and security services, which carry traffic to and from the Platform, store uploaded files, and verify that forms are completed by a person rather than an automated program;
• email delivery;
• payment processing;
• error reporting and server logging;
• a password safety check, which receives only a short fragment of a hashed form of a new password, and never the password itself or the identity of the person who chose it;
• mapping, which receives a facility’s street address in order to locate it, and displays the map shown to staff on a facility’s page; and
• a push notification service, which delivers notifications to phones through Apple and Google.

We disclose to each service provider only the information its function requires.

Third-party video players. On the Platform’s web pages, game film hosted on YouTube or Vimeo plays in that service’s own player, which loads only when you press play. From that point, the service receives the information any website receives from your browser, under its own terms.

Legal requirements. We may disclose Personal Information where required by law or in response to valid legal process.

Corporate transactions. If Athletic Connect is involved in a merger, acquisition or sale of assets, Personal Information may be transferred as part of that transaction.

No sale. We do not sell Personal Information. We do not disclose it for advertising, and we do not use it to train artificial intelligence models. The Services do not display advertising.

9. The Mobile App

The Mobile App displays the same Customer Data as the Platform. In addition:

• Push token. If you allow notifications, the Mobile App provides us with a push token for your device, which we store so that notifications can be delivered to it. We delete the token when you sign out. Each push notification passes through Expo’s push notification service and then through Apple’s or Google’s service to reach your device. A push notification states only which Customer it is from and that there is an update to read; its content is shown only within the Services.
• App version and platform. The Mobile App sends its version number and your device’s operating system with each request.
• Error reports. When the Mobile App encounters an error, it may send us an error report. Before a report is sent, we remove the account information attached to it (such as your name and email address), any email address in the report, anything typed into a form, request bodies and query strings. A report may still contain the address of the screen in use, which can include an internal identifier.

The Mobile App does not collect your location, your contacts or your device’s advertising identifier, and it contains no analytics or tracking. It accesses a photograph or file only when you select one. Card payments open in your device’s browser, on Stripe’s payment page.

10. Cookies and Similar Technologies

The Platform does not set cookies of its own. When you sign in, your browser stores your sign-in on your device, and signing out removes it. The Mobile App stores your sign-in in your device’s secure storage and stores some Customer Data on the device so that it can be displayed without a connection.

The Website does not set cookies of its own and does not use analytics or advertising technologies. On the Website and on the Platform’s sign-up forms, the check that a form is completed by a person rather than an automated program is performed by Cloudflare, which may store information on your device for that purpose. Stripe’s payment page is operated by Stripe under its own terms.

11. Location of Processing

Our database is hosted in the United States. Some of our service providers operate globally, and Personal Information may be transmitted through or processed in other countries in the course of providing the Services.

12. Security

We maintain the following safeguards:

• Personal Information is encrypted in transit to and from the Platform.
• Each Customer’s data is logically separated from every other Customer’s data within the database.
• Access within a Customer’s account is limited according to each Authorized User’s role.
• Two-factor authentication is available to Authorized Users and is required for a Customer’s administrators.
• Payment card details are not transmitted to our systems.
• Access by our personnel to a Customer’s account is recorded and appears in that Customer’s activity log.

No method of transmission or storage is completely secure. If a security breach affects a Customer’s data, we will notify that Customer so that it can notify the individuals concerned.

13. Retention and Deletion

We retain Customer Data for as long as the Customer uses the Services. Customer Data is not deleted on a schedule, except for certain short-lived records, such as unfinished sign-up forms, unpaid store orders, older in-app notifications and spreadsheets uploaded for an import.

If a Customer’s account is deactivated, the account becomes read-only and no Customer Data is deleted. The Customer’s owner may download a copy of the Customer’s records, as spreadsheet files, at any time, including after deactivation.

When a Customer deletes an individual’s records, most of those records are removed. Records the Customer needs to retain, such as payments, invoices and released evaluations, are retained with the individual’s name and identifying details removed. Incident reports are retained as Section 4 describes. Signed waivers are retained as signed, and a waiver signed on behalf of a child is retained at least until the child reaches 21 years of age. A Customer may suspend deletion of an individual’s records while a legal reason requires them to be preserved.

Deleted information may remain in our backups, and in the copy of the Platform we use for testing, until those copies are next replaced.

14. Your Rights and Choices

Requests to a Customer. Because the Customer controls Customer Data, requests about it should be made to the Customer first. A Customer’s administrators can view what the Services hold about you or your child, provide a copy, correct it, or delete it, subject to the treatment of incident reports described in Section 4.

Your account. You can correct your own information and your children’s information, change your notification settings, and change your answer about injury descriptions in incident reports, in your account. The account holder can also deactivate the account, which signs every member of the household out and hides them from the Customer until the Customer restores the account.

Deleting your account. The account holder can delete the account in the Mobile App (More, then Delete my account) or on the website (My Account). If no payment, store order, signed waiver, incident report or safeguarding report relates to the household, the account is deleted immediately, together with the profiles in it, their registrations and any open invoices, and the login is deleted unless it is also used for an account with another Customer. Otherwise, the request is sent to the Customer’s administrators, who delete the individual’s records as Section 13 describes, and the Customer retains the records it is required to retain, such as payments, invoices, store orders, signed waivers, safeguarding reports and incident reports, for as long as the Customer is required to retain them. An account cannot be deleted while a Customer has suspended deletion of the records concerned for a legal reason. An individual with accounts associated with more than one Customer deletes each account separately. Instructions are available at athleticconnectapp.com/delete-account.

Requests to us. If a Customer does not act on your request, or your request concerns information we process for our own purposes, contact us at [email protected], stating the name of the Customer and the nature of your request. We may need to verify that a request is yours before acting on it, and where the Customer holds the records concerned, we will raise the request with the Customer.

Depending on where you live, applicable law may give you rights regarding your Personal Information, such as the right to access, correct or delete it, to obtain a copy of it, or to object to its processing. We will not discriminate against you for making a request.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and revise the version number and “Last updated” date shown above.

16. Contact Us

Questions and requests about this Privacy Policy: [email protected]. Sales and demonstration inquiries: [email protected].