Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

1.1 Information You Provide Directly

• Account Information: When you create an account, we collect your name, email address, and password (or Google OAuth credentials).
• Athlete Profile Data: For player profiles, we collect the athlete's first and last name, date of birth, graduation year, school name, height, weight, positions, academic information (GPA), and photographs.
• Parent/Guardian Information: For accounts managing minor athletes, we collect the parent or legal guardian's name, email address, and relationship to the athlete.
• Payment Information: When you purchase a subscription, payment information (credit card number, billing address) is collected and processed directly by Stripe, Inc. We do not store full payment card details on our servers.
• Recruiting Communications: When you use the recruiting email feature, we collect the content of messages sent to college coaches and maintain a log of recruiting correspondence.
• Club and Team Information: Program directors and coaches provide organization names, team rosters, and event registration details.
• Media Uploads: Photographs, highlight video links, and other media files uploaded to the Platform.
• Phone Numbers: When you provide a mobile phone number during account registration, profile setup, or contact import, we collect it for the purpose of sending SMS notifications related to EHA events, schedules, and platform updates.

1.2 Information Collected Automatically

• Device and Browser Information: We collect information about the device and browser you use to access the Platform, including device type, operating system, browser type, and screen resolution.
• Usage Data: We collect information about how you interact with the Platform, including pages visited, features used, and the date and time of your activity.
• IP Address: Your Internet Protocol address is collected automatically when you access the Platform.
• Cookies and Similar Technologies: We use cookies and similar technologies for authentication, session management, and to remember your preferences. See Section 7 for more information.

1.3 Information from Third Parties

• Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Apple Sign In: If you sign in with Apple, we receive your name and email address (or a private relay email address if you choose to hide your email) from Apple. Apple may only provide your name on the first authorization.
• Exposure Events: We may receive team rosters, game schedules, and event information from the Exposure Events tournament management system for events administered through their platform.
• Stripe: We receive confirmation of payment status and subscription information from Stripe, Inc. We do not receive or store your full payment card details.

1.4 Program Connect Information

• Club membership: the teams and Clubs you belong to, and the players you joined for.
• Messages and posts: chats, announcements, comments, photos, videos and files you send in Program Connect, and who has read them.
• Schedules and RSVPs: your answers for practices, games and events.
• Paperwork and signatures: documents you sign, the exact version, the full name you typed, your relationship to the athlete, the date and time, IP address and device information, and your one-time consent to sign electronically.
• Club forms: answers and files a Club asks for, such as emergency contacts, medical information or uniform sizes.
• Club Payments: amounts, dates, payment plan and status of payments you make to a Club, and the last four digits and type of your card or bank account. Stripe collects the full payment details on the Club's behalf.

1.5 Event Tickets

When you buy tickets to an EHA event we collect your name, email address and (if you give it) phone number, the tickets you bought, and when each ticket was scanned at the door. Stripe collects your card details and tells us whether the payment went through; we never receive your full card number. We use this to send you your tickets, check them at the door, answer your questions, prevent fraud and respond to payment disputes. Event staff scanning tickets see the buyer's name so they can look tickets up at the door. We keep ticket records as payment records.

1.6 Proof of Age for Age-Verified Events

Some EHA events are age-verified: every player on a youth team (14U and under) must show proof of age before they can play. A parent or legal guardian gives it to us by uploading it from their account or through the team's age-check link, or by showing it to EHA staff at the event. For this we collect:

• The document: a photo or PDF of a birth certificate, passport or government ID showing the player's name and birth date — and, only when we ask for one, a report card or school record showing the player's grade.
• The result we keep: the player's birth date; the grade and school year when a school document was needed; the type of document that confirmed it; whether the check passed or was turned down; and who decided and when.

We use this only to check that a player can play in their division (by grade and an age limit) and to show whether they may play in an age-verified event. An automated reader provided by OpenAI reads the name, birth date and grade from the document. When the document is clear and the name matches the player, the check passes without a person looking at it; otherwise an EHA administrator reviews it.

We delete the document. We keep the photo or file in our own database — never at a public web address — only until the check is decided, passed or turned down, and then delete it. We keep only the result, for as long as the athlete profile exists, so the player doesn't have to show proof again for later events. You can ask us to delete the result at any time (Section 8.3); the player would then need to show proof again to play in an age-verified event.

Who sees it. EHA administrators see a document while it waits for review, and the result. Event scorekeepers and the team's age-check link show only whether a player may play — never a birth date or a document. The parents and guardians on the profile can see the result, including the birth date on file. A player's public profile may show an "Age Verified" badge, but never the birth date. Apart from that badge, we don't share this information with college coaches or other users, sell it, or use it for anything else.

2. How We Use Your Information

We use the personal information we collect for the following purposes:

• Platform Operations: To create and maintain your account, manage athlete profiles, process subscriptions, and deliver the core features of the Platform.
• Athletic Performance Tracking: To record, display, and aggregate game statistics, leaderboard rankings, and career performance data for athletes participating in EHA events.
• Recruiting Services: To facilitate communication between athletes (or their parents/guardians) and college coaching staff through the Platform's recruiting tools.
• Event Administration: To manage tournament registrations, game schedules, live scoring, bracket management, and results reporting.
• Communications: To send transactional emails related to your account, including guardian invitations, recruiting correspondence, password resets, and subscription confirmations.
• SMS Notifications: To send text messages to users who have provided a phone number and opted in, including event reminders, schedule updates, game notifications, and general organization announcements. Messages are sent via Twilio. Message frequency varies. Message and data rates may apply. You may opt out at any time by replying STOP to any message, or reply HELP for assistance.
• Push Notifications: To send real-time alerts through the mobile application about game updates, schedule changes, event reminders, and platform announcements via Apple Push Notification Service (APNs) and Firebase Cloud Messaging (FCM). You may manage your push notification preferences within the app settings or through your device's notification settings at any time.
• Security and Fraud Prevention: To protect the Platform and its users from unauthorized access, fraud, and other harmful activity.
• Legal Compliance: To comply with applicable laws, regulations, and legal obligations.
• Platform Improvement: To analyze usage patterns and improve the functionality, performance, and user experience of the Platform.

2.1 Program Connect

We use Program Connect information to run it for you and your Club: to show team spaces and schedules, deliver messages and notifications (push, email and text), record RSVPs, collect signatures and send you signed copies, show Clubs who has paid, and keep users — especially minors — safe. We check messages and photos automatically for harmful content before they are posted.

3. How We Share Your Information

We do not sell your personal information. We do not share, rent, or otherwise disclose consumer personally identifiable information (PII) with affiliated or unaffiliated third parties for their own purposes. We may share your information only in the following limited circumstances:

3.1 Athlete Profile Visibility

Athlete profiles are visible to other Platform users based on the following access rules:

• Basic profile information (name, school, graduation year, position) is publicly visible on the Platform.
• Detailed performance statistics are accessible to the athlete's guardians, club directors with the athlete on their roster, users with an active subscription, and Platform administrators.
• Approved college recruiters may view athlete profiles for legitimate recruiting purposes as described in our Terms of Service.

3.2 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Stripe, Inc.: Payment processing for subscriptions and one-time purchases.
• Resend: Transactional email delivery.
• Vercel: Web application hosting and file storage.
• Cloudinary: Image processing and delivery.
• NeonDB: Database hosting.
• Twilio: SMS text message delivery.
• Exposure Events: Tournament and event management synchronization.
• OpenAI: automated checks of chat messages and photos for harmful content, and reading roster files that clubs upload.
• Expo (650 Industries): delivery of push notifications to the mobile app.
• OpenAI: reading proof-of-age documents for age-verified events (see Section 1.6). The document is sent only to read it; we delete our copy as soon as the check is decided.

These service providers are contractually obligated to use your information only to perform the services we have engaged them to provide and in accordance with applicable data protection laws.

3.3 SMS Opt-In Data

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the Text Message services (e.g., Twilio). Mobile phone numbers collected for SMS notifications are used solely to deliver the messages you have opted into and are never sold, rented, or disclosed to third parties for marketing purposes.

3.4 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a valid legal process.

3.5 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

3.6 Your Clubs

When you join a Club's Program Connect, the Club's directors can see your name and contact information, the players you joined for, your RSVPs, the documents you signed and your payments to that Club. Coaches see what they need for their own team — schedules, RSVPs and emergency and medical information — and not payments or documents. Other families on a team can see your name in team chats and rosters. Clubs are responsible for how they use this information and have agreed to use it only for their program.

3.7 Payments on a Club's behalf

Payments you make to a Club are processed by Stripe on the Club's own Stripe account. If you pay from a bank account, you connect it by signing in to your bank through Stripe (Stripe Financial Connections); your bank login goes to Stripe, never to the Company or the Club. Stripe's use of your information is governed by Stripe's privacy policy.

3.8 Photos, Video and Promotion

EHA events are photographed, filmed and live-streamed. We use that media, with athletes’ names, teams, jersey numbers, schools, graduation years and game statistics, to report on and promote EHA, its events and the Platform, as described in Section 21 of our Terms of Service. Some of this content may be presented with or alongside our sponsors and partners. We do not give sponsors or partners athletes’ or families’ contact information or other personal information. A sponsor may use an athlete’s name, image or likeness in its own advertising only with separate written permission from a parent or guardian (or the athlete, if 18 or older). A parent or guardian, or an athlete 18 or older, can ask us to stop featuring the athlete in future promotional content at support@ehaconnect.com. Your phone number and text-message consent are never shared for marketing (Section 3.3).

4. Children's Privacy (COPPA Compliance)

The Platform is designed to serve youth athletes. We take the privacy of children seriously and are committed to compliance with the Children's Online Privacy Protection Act (“COPPA”), 15 U.S.C. §§ 6501–6506.

4.1 Parental Consent Required

The Platform does not permit children under the age of thirteen (13) to create accounts independently. All accounts for minor athletes must be created and managed by a parent or legal guardian. By creating an athlete profile for a minor, the parent or guardian provides verifiable parental consent for the collection and use of the minor's information as described in this Privacy Policy.

4.2 Information Collected from Minors

For minor athletes, we collect only the information reasonably necessary to provide the Platform's services, including the athlete's name, school, graduation year, physical measurements, athletic statistics, and photographs provided by the parent or guardian.

4.3 Parental Rights

Parents and guardians have the right to:

• Review the personal information collected about their child;
• Request correction of inaccurate information;
• Request deletion of their child's personal information and athlete profile;
• Refuse further collection or use of their child's information.

To exercise any of these rights, please contact us at the address provided in Section 11.

4.4 Unauthorized Collection

If we become aware that we have collected personal information from a child under thirteen (13) without verifiable parental consent, we will promptly delete such information from our records.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Platform's services. Specific retention periods include:

• Active Accounts: Personal information and athlete profile data are retained for the duration of your active account.
• Cancelled Subscriptions: Account data is retained but access to premium features is suspended. Profile data remains visible per the Platform's access rules.
• Terminated Accounts: Athlete profile data is retained for ninety (90) days following termination, after which it may be permanently deleted.
• Game Statistics: Athletic performance data and game statistics may be retained indefinitely as part of the Platform's historical records, even after account deletion, in anonymized or aggregated form.
• Legal and Compliance Records: Certain records, including Terms of Service acceptance logs and payment transaction records, may be retained as required by applicable law or for legitimate business purposes.
• Signed Documents: Signed documents and their signature records are kept at least until the athlete turns twenty-one (21), or longer if the law or a legal claim requires, because claims involving minors can be brought for years.
• Messages: Messages are kept while the chat exists. A deleted message is hidden from the chat but may be kept for safety review and to respond to reports, legal requests or claims.
• Club Forms and Uploads: Answers and files a Club collects are kept for the Club’s season and as the Club needs them. Sensitive uploads such as birth certificates may be deleted once verified.
• Payment Records: Records of payments to Clubs are kept as long as needed for accounting, tax and legal purposes.
• Proof of Age: The document is deleted as soon as the age check is decided. The result (birth date, grade and school year, passed or turned down) is kept while the athlete profile exists, or until a parent or guardian asks us to delete it.

6. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL;
• Secure password hashing using bcrypt;
• JWT-based session management with signed tokens;
• Role-based access controls limiting data visibility;
• Secure storage of authentication tokens on mobile devices;
• Regular review of security practices and access controls.

No method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials.

If a security incident affects your personal information, we will notify you and, where required, regulators, as required by applicable law.

7. Cookies and Tracking Technologies

The Platform uses the following cookies and similar technologies:

• Authentication Cookies: Essential cookies that maintain your signed-in session. These are strictly necessary for the Platform to function and cannot be disabled.
• CSRF Protection Cookies: Security cookies that protect against cross-site request forgery attacks.
• Preference Cookies: Cookies that remember your display preferences (such as theme selection).
• Preview Cookies: Cookies used to manage early access and preview functionality during pre-launch periods.
• Analytics: The website uses Google Analytics to count visits and the pages viewed. This helps us see which features are used and fix problems. It sets cookies and sends usage data, including device and browser information and an approximate location from your IP address, to Google. We do not use it for advertising. You can block Google Analytics with your browser’s settings or Google’s opt-out browser add-on.

The Platform does not use third-party advertising cookies or tracking pixels. We do not engage in behavioral advertising or cross-site tracking.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

8.1 Access and Portability

You have the right to request a copy of the personal information we hold about you. You may access and download your athlete profile data at any time through the Platform.

8.2 Correction

You have the right to request correction of inaccurate or incomplete personal information. You may update your account information and athlete profiles directly through the Platform.

8.3 Deletion

You have the right to request deletion of your personal information. Deletion requests will be processed within thirty (30) days. Certain data may be retained as required by law or as described in Section 5.

8.4 Account Cancellation

You may cancel your account at any time through your account settings or by contacting us in writing. Upon cancellation, your data will be handled in accordance with the retention periods described in Section 5.

8.5 Communication Preferences

You may manage your notification preferences through the Platform's settings. Transactional communications necessary for account operation (such as password resets and subscription confirmations) cannot be opted out of while your account remains active.

8.6 SMS Opt-Out

If you have opted in to receive SMS text messages from EHA Connect, you may opt out at any time by replying STOP to any message. After opting out, you will receive a one-time confirmation message and no further SMS messages will be sent unless you re-subscribe. You may reply HELP to any message for assistance or contact us at support@ehaconnect.com. Message frequency varies. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

9. California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), including:

• The right to know what personal information is collected, used, shared, or sold;
• The right to request deletion of personal information;
• The right to opt out of the sale or sharing of personal information;
• The right to non-discrimination for exercising your privacy rights.

We do not sell personal information. To exercise your California privacy rights, please contact us at the address provided in Section 11.

10. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Material changes will be communicated to registered users via email or in-app notification no less than thirty (30) days prior to taking effect. Non-material changes may take effect immediately upon posting to the Platform. Your continued use of the Platform following notice of any change constitutes your acceptance of the revised Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

11. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

For COPPA-related inquiries or to exercise parental rights regarding your child's information, please include “COPPA Request” in the subject line of your correspondence.