Privacy Policy

1. Introduction

GameGrit ("we," "us," "our") is a youth-sports team and club management platform operated by GameGrit Tech LLC, a U.S. limited liability company. Coaches, club directors, parents, and athletes use GameGrit to run rosters, schedules, team communication, and team fees.

GameGrit is for users age 13 and older. Children under 13 are not permitted to use the service, and we do not knowingly collect their personal information (see § 5). Because GameGrit is used by minors aged 13–17, this policy is written to comply with:

• The Children's Online Privacy Protection Act (COPPA) (15 U.S.C. §§ 6501–6506)
• The California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)
• The California Age-Appropriate Design Code Act (CA AADC)
• Comparable state privacy laws (Colorado, Connecticut, Virginia, Utah, New York, and others)
• The Family Educational Rights and Privacy Act (FERPA), where GameGrit serves school-affiliated customers under a written agreement

Questions: privacy@gamegrit.ai.

---

2. Who This Policy Covers

GameGrit has four user types:

• Club Directors — adults who administer a club and its teams
• Coaches — adults who create and manage teams
• Parents / Guardians — adults who link to and oversee one or more athletes
• Athletes — team members who may be minors (age 13–17)

Different rules apply to adults and to minors 13–17. GameGrit requires all users — including athletes added to a roster by a parent, coach, or director — to be at least 13 years old (see § 5).

---

3. What We Collect

3.1 Account Information (all users with a login)

• Name, email address
• Password (stored hashed by our authentication provider; we never see it in plain text)
• Account role (coach, parent, or athlete), plus club roles (such as director) for club administrators
• Optional profile details (bio, city/region)
• For parents: optional phone number and mailing address (used for club and team administration)

3.2 Athlete Information

• Date of birth (used to enforce the 13+ minimum age and determine roster age class)
• Sport(s), position(s), team memberships and history
• Optional athletic measurements (height, weight) for roster and recruiting surfaces
• Availability and RSVPs (set by the athlete, or by a linked parent on their behalf); attendance (recorded by coaches)
• Stats (entered by coaches or the athlete's family), and evaluations and coaching notes (entered by coaches)
• Photos and videos voluntarily shared to the team (uploaded by coaches or parents) or to the athlete's own profile (managed by the athlete's family)
• Goals and notes entered by the athlete (13+) or parent
• Shareable stat cards: with parent approval (or at an adult athlete's own request), GameGrit can generate a snapshot stat card (name, age, sport, positions, measurements, featured achievements, season stats) as a file the family may share outside GameGrit — see § 6 for who can see it

3.3 Medical and Emergency Information (optional)

Parents — or an athlete 13+ for their own profile — may enter: emergency contacts, allergies, medications, conditions, blood type, insurance, physician information, and free-text notes. This is visible only to the athlete, their linked parents, and the coaches of the athlete's teams, is protected by row-level access controls, and is encrypted at rest.

3.4 Messaging Data

Team channel messages, direct messages, announcements, reactions, read receipts, and attachments (such as images) shared in chat. Communication involving minor athletes is intentionally transparent (a SafeSport-aligned design): linked parents are included in their child's team channels by default, and any direct or group thread that includes a minor and a non-family adult must include the minor's parent — enforced at the database layer. There is no unmonitored one-on-one messaging between a minor and a non-family adult. Coaches and directors can also create role-scoped channels (for example, coach-only or parent-only rooms).

3.5 Payment Information (when team-fee payments are enabled)

Team fees may be paid in the app through Stripe, our payment processor. Card details go directly to Stripe and never touch GameGrit's servers; we store only what we need to show payment status (amounts, dates, paid/unpaid state, and Stripe's opaque references). Stripe's handling of your payment data is governed by Stripe's own privacy policy.

3.6 Device & Technical Data

• Device push-notification token (to deliver notifications)
• App version, platform (iOS/Android/web), and error/crash reports for diagnostics — error reports pass through an automated scrubber that removes known personal-information fields (names, emails, dates of birth, tokens) before they leave the app
• IP address (logged by our authentication and hosting providers for security)
• In-app feedback you choose to send (message, optional screenshot, and app/platform details)

3.7 What We Do Not Collect or Do

GameGrit does not:

• Sell personal information — anyone's, ever
• Use advertising networks, behavioral-advertising SDKs, or tracking pixels
• Use third-party marketing analytics (no Google Analytics, Mixpanel, Segment, or similar)
• Collect precise geolocation (GPS)
• Use biometric identifiers
• Knowingly collect any information from or about children under 13 (see § 5)

---

4. How We Use Information

Only to:

• Operate the platform (authentication, rosters, schedules, messaging, notifications, fees)
• Provide optional calendar subscriptions: if you create a personal calendar-feed link, your teams' event schedule is served to the calendar service you subscribe with (such as Apple, Google, or Outlook), and anyone you give that link can read the schedule until you revoke it
• Let parents oversee their children's participation and approve certain actions
• Let coaches and directors manage teams and clubs
• Provide customer support
• Detect abuse, enforce our terms, and maintain security
• Comply with legal obligations

We do not use anyone's personal information for targeted advertising or sell it.

---

5. Children Under 13 — Not Permitted

GameGrit has a minimum age of 13. We enforce it everywhere an athlete can enter the platform:

• Self-signup is age-gated: a date of birth indicating the person is under 13 blocks registration.
• Roster and family invites are age-gated the same way: a parent, coach, or director cannot add an athlete whose date of birth indicates they are under 13.

We do not knowingly collect personal information from or about children under 13. If we learn that information about a child under 13 has been collected (for example, through an inaccurate date of birth), we will delete it promptly. If you believe a child under 13 has information on GameGrit, contact privacy@gamegrit.ai with the subject line "Under-13 Report" and we will investigate and delete as required.

If we decide to support under-13 athletes in the future, we will do so only with verifiable parental consent compliant with COPPA, and this policy will be updated (with the required notice, and fresh consent flows) before any such change takes effect.

---

6. Minors 13–17

Athletes 13–17 may have their own accounts (via team invite or approved join request; when a teen signs up we collect a parent's email to route the approval). For them:

• Profile age and location visibility on recruiting and discovery surfaces is controlled by the athlete and their parent in privacy settings
• In the app, sensitive privacy-setting changes by a linked minor are routed to the parent for approval
• Linked parents are included in their child's team channels by default, and in any direct or group thread that includes their child and a non-family adult (§ 3.4)
• Teens have the same access, deletion, and portability rights as adults under applicable state law; their parents have additional rights where state law provides them

Who can see a minor athlete's information: their linked parent(s)/guardian(s); coaches and assistant coaches of their team(s); other members of the same team (roster and profile details); GameGrit personnel for support and safety; and our infrastructure processors (§ 7), who act only on our instructions. If the family shares a stat card (§ 3.2) or a calendar-feed link (§ 4) outside GameGrit, the recipients they share it with can see that content; anyone holding a stat card's verification link can confirm the card's validity, which reveals only the athlete's first name and sport. We never share minors' information with third parties for those parties' own purposes.

---

7. Service Providers

We use a small set of infrastructure providers, each bound by contract to process data only on our instructions:

Provider	Purpose	Data involved
Supabase	Database, authentication, file storage	Account, profile, and content data
Vercel	Web hosting	Request logs, IP addresses
Expo	Mobile app delivery, push-notification routing	Push tokens, app metadata
Apple (APNs) / Google (FCM)	Push-notification delivery to devices	Push tokens + notification payloads
Resend	Transactional email (invites, notifications)	Recipient email + message content
Stripe	Team-fee payment processing (§ 3.5)	Payment details (held by Stripe, not us)
Sentry	Error monitoring	Crash/error reports, passed through an automated personal-information scrubber before sending
Upstash	Abuse-prevention rate limiting	Hashed request keys + request counters — no readable profile data
Slack	Internal support alerts for submitted feedback (when enabled)	Feedback text + submitter name and role

We use no advertising, marketing-automation, data-brokerage, or behavioral-analytics providers. We may disclose information to authorities where the law requires it or to enforce our terms in connection with suspected abuse.

---

8. Data Retention

• Active accounts: kept while the account is active.
• Deleted accounts: database records are deleted immediately when the account is deleted; uploaded files and backup copies are removed within 30 days.
• Under-13 information discovered in error: deleted promptly upon discovery (§ 5).
• Medical and emergency information: deleted immediately when the parent or athlete removes it.
• Messages: messages you authored are deleted along with your account.
• Payment records: retained as needed for tax, accounting, and dispute-resolution obligations.

If we no longer need information for the purpose it was collected, we delete it sooner.

---

9. Account Deletion

Users can delete their own account in Settings (a club or team's sole leader must first transfer leadership; contact us if you need help). Effects:

• Athlete deletion (no linked guardian): profile removed from teams; if the athlete has activity history, identifying fields other than the athlete's name are scrubbed from remaining team records (stats, attendance); medical and emergency information is permanently deleted.
• Athlete login deletion (guardians linked): the athlete's login is removed; the family-managed athlete profile remains under the linked guardians' control, and the guardians can delete it fully.
• Parent deletion (another guardian linked): the parent's account is removed; the co-guardian's link to the athlete is unchanged.
• Parent deletion (sole guardian of a minor athlete without their own login): the minor's identifying information is deleted along with the parent's account, per the athlete-deletion rule above.
• Coach/Director deletion: teams and clubs are transferred or handled per our continuity rules; the departing user's personal account data is deleted.

Complete deletion beyond the defaults (including historical team records) can be requested at privacy@gamegrit.ai and is completed within 30 days.

---

10. Your California Privacy Rights (CCPA / CPRA)

California residents have the right to know, access, correct, and delete their personal information; to limit use of sensitive personal information (we already use it only to provide the service); and to non-discrimination for exercising these rights.

Opt out of sale or sharing: GameGrit does not sell personal information or share it for cross-context behavioral advertising — there is nothing to opt out of. For residents under 16, we do not sell or share personal information under any circumstances.

Contact privacy@gamegrit.ai; we respond within 45 days.

---

11. California Age-Appropriate Design Code

For users under 18, GameGrit defaults to the most protective settings:

• Age and location visibility on recruiting and discovery surfaces controlled by the athlete's family (§ 6)
• No geolocation tracking, no browsable public directory of athletes, no ad tech
• Children under 13 are not permitted on the platform at all; teens' communication includes linked parents
• No dark patterns in consent or privacy flows; privacy information is written in plain language
• A Data Protection Impact Assessment is maintained internally and updated with material product changes

---

12. FERPA (Schools and Districts)

When GameGrit serves a school or district under a written agreement, GameGrit acts as a "school official" under 34 C.F.R. § 99.31(a)(1) with a legitimate educational interest. The school remains the controller of student education records; GameGrit uses student data only as the school authorizes; parents retain their FERPA rights to inspect and request correction.

---

13. Security

• TLS encryption in transit; encryption at rest for all database contents
• Row-level security enforced at the database layer (every query is checked against the requesting user's role and relationships)
• Least-privilege access for GameGrit personnel
• Rate limiting on sensitive operations, dependency scanning, and recurring security reviews

No system is perfectly secure. If a breach of personal information occurs, we will notify affected users and regulators as required by applicable law.

---

14. International Users

GameGrit is operated from the United States and currently offered only in the U.S. Information is processed in the U.S. We do not offer the service in the European Economic Area or United Kingdom, and EU/UK residents should not create accounts.

---

15. Changes to This Policy

We will notify registered users by email and in-app notice at least 30 days before a material change takes effect. For changes that materially affect how we collect or use minors' information, linked parents are notified directly.

---

16. Contact

GameGrit Tech LLC — Privacy Email: privacy@gamegrit.ai

To report a suspected under-13 user, use the subject line "Under-13 Report" (see § 5).

---

Appendix A — Data Collected Per User Type

Category	Director	Coach	Parent	Athlete (13+)
Name	✓	✓	✓	✓
Email	✓	✓	✓	✓
Date of birth				✓
Bio / profile location	✓	✓	✓	optional
Phone / mailing address			optional
Height / weight				optional
Photos / videos	optional	optional	optional	optional
Medical / emergency info				optional
Messages	✓	✓	✓	✓
Performance / attendance				✓
Payment status (fees)	✓	✓	✓
Device push token	✓	✓	✓	✓

---