Privacy Policy

AthleteVault (“we,” “us”) provides league management and coaching software for youth basketball at athletevault.net. Our customers are league operators; the people who use the platform include league administrators, coaches, scorekeepers, and parents or guardians of youth players. Because our product exists to run youth sports, protecting children’s information is the core of this policy, not a footnote to it.

Questions or requests about this policy can be sent to hello@athletevault.net.

• Children never create accounts and never submit their own information. Player information is provided by a parent, guardian, or league administrator.
• We collect only what a league needs to run a season. No advertising, no behavioral analytics, and we never sell data.
• Parents control their child's information: access is granted only through a verified-email claim, and parents can request a copy or deletion of their child's data at any time.
• When our AI coaching feature runs, players' names are replaced with anonymous aliases before anything is sent to our AI provider.

Adult account information. Name and email address, provided when an adult creates an account through our authentication provider or accepts an invitation from a league. Coaches applying to volunteer also provide a phone number and coaching background at their option, plus their consent to a background check.

Player (child) information. Provided by a parent, guardian, or league administrator — never by the child: player name, birthdate, grade, skill notes, jersey number and position, game and attendance records, and the guardian’s own contact information. Birthdates are collected because age determines division placement and because youth-privacy law requires us to know when a player is under 13.

Operational records. Schedules, scores, standings, announcements, and administrative audit trails a league generates by using the platform.

What we do not collect: no advertising identifiers, no behavioral analytics or tracking pixels, no location data, and no payment card numbers (card processing is handled entirely by Stripe — see “Service providers”). We use only essential cookies, for signing in and keeping your session.

Our platform is designed so that children do not interact with us directly:

• No child accounts or self-signup. Public registration forms are completed by a parent or guardian and create only a pending registration record for league review. A child cannot create an account, and a registration by itself grants no access to anyone.
• Verified guardianship before access. A parent gains access to their child’s information only by claiming an invitation sent to the guardian email on file — access is never granted on an unverified match.
• Recorded consent. When a guardian registers a player, we record who consented and when. League administrators have a dedicated review surface that flags any player missing a linked guardian or consent record, and consent cannot be recorded without a linked guardian.
• Parental access and deletion rights. A parent may request a copy of their child’s information or its deletion from their parent portal at any time. Requests are reviewed and documented by the league, and deletion is honored except where a record must be kept (for example, official game results subject to league retention rules) — in which case we document what was retained and why.
• Data minimization for AI features. Our Bench Notes feature sends roster statistics to our AI provider with each player identified only by an alias (“P1,” “P2”) — names never leave our systems for this purpose, prompts are logged for accountability, and our AI provider does not use the data to train its models.
• No marketing to minors. Accounts flagged as minors are excluded from every email we send.

Solely to operate the platform for your league: running registration, building rosters, scheduling, recording results and standings, generating coaching insights for your team’s coaches, sending transactional email (invitations, announcements, receipts, administrative notices), and facilitating the coach screening workflow a league configures. We do not use personal information for advertising, and we do not sell or rent it to anyone.

We share data only with the vendors required to run the service, only for the purposes described here:

• Clerk — account authentication for adults (name, email, sign-in credentials).
• Stripe — payment processing for league operators’ subscription fees. Card details go directly to Stripe; we never see or store them. Family registration fees are not processed through AthleteVault.
• Resend — delivery of the transactional emails described above.
• Anthropic — AI generation for coaching insights, with player names replaced by aliases as described above.
• Hostinger — infrastructure hosting for our servers and database.

No child’s personal information is disclosed to any third party for purposes beyond these functional ones. If that ever changed, it would require separate, affirmative parental consent first.

• Registration-pool records that never resulted in a roster placement are purged when the league archives that season.
• Roster, schedule, and official game records are retained while the league account is active, because they are the league's operational history.
• Routine database backups are kept on a rolling 14-day window.
• A verified deletion request removes the child's personal information as described under Children's privacy.

All traffic is encrypted in transit (HTTPS). Access to data is scoped by role — a coach sees their team, a parent sees their own children, a league administrator sees their league. Session tokens are stored hashed, and administrative actions that touch player or consent data are recorded in audit trails.

If we make material changes to this policy — especially any change affecting children’s information — we will notify league administrators by email before the change takes effect. For any privacy question, request, or concern, contact hello@athletevault.net.