Privacy Policy

1 Scope and Applicability

This Privacy Policy applies to all users of the LeagueLinkd Platform, including league administrators and organization staff, coaches and assistant coaches, parents and legal guardians who create accounts and manage player profiles, and any other individuals who access or use the Platform.

This Policy does not apply to third-party websites, services, or applications that may link to or integrate with the Platform. We are not responsible for the privacy practices of those third parties.

2 Information We Collect

Account Registration:

• Full legal name, email address, phone number, and physical address (street, unit, city, state, zip)
• Password (stored in encrypted, hashed form — we never store plaintext passwords)
• Confirmation that you are at least 18 years old (collected as an affirmative attestation at signup; we do not retain your date of birth)
• Optional profile information you choose to provide, including profile photo, bio, gender, sport interests, alternate-contact information (name, relationship, email), zip code, and notification preferences

Player Profiles (created by parent or guardian):

• Player name (first, last, middle initial, suffix, and optional preferred names) and date of birth
• Profile photo (optional)
• Player gender
• Player contact information (email, phone) where applicable for older players
• Player physical address (street, unit, city, state, zip), used for league eligibility and communication
• Emergency contact name and phone number
• Allergies or other voluntary medical notes (only if entered by the guardian)

League and Registration Data:

• Division and team assignments
• Registration package selections, status, and history
• Jersey size and apparel sizing
• RSVP responses for scheduled events
• Volunteer and task signup information

Game and Performance Data (recorded by coaches):

• Goals, assists, minutes played, disciplinary cards, and substitution records
• Game attendance records and lineup positions

Communications:

• Messages sent through in-app team and league chat channels
• Direct messages between users
• Photos, images, and media shared on the Platform
• Announcements created by league administrators

Payment Information:

• Transaction records for league registration fees, including amount, status, and Stripe transaction identifiers
• We do not store full payment card numbers, CVV codes, or bank account details — all payment data is handled directly by our PCI-compliant payment processor, Stripe, Inc.

When you use the Platform, we may automatically collect:

• Device identifiers and mobile device type
• Operating system version and app version
• IP address and general location data derived from IP
• App usage data, session duration, and feature interaction logs
• Push notification tokens (for sending app notifications)
• Crash reports and error logs used for debugging and performance improvement

We receive limited information from third-party service providers in connection with operating the Platform:

• Stripe, Inc. provides transaction confirmation, payment status, and payout information
• Supabase provides authentication and database hosting — session tokens and authentication events are logged by Supabase on our behalf
• Resend provides email delivery confirmation and bounce/unsubscribe status for transactional emails

3 Children's Privacy and COPPA Compliance

The LeagueLinkd Platform is designed for adults who manage youth sports activities. We comply with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq., and applicable state children's privacy laws.

We do not knowingly collect personal information directly from children under the age of 13. All accounts must be created by an adult (18 years of age or older). Player profiles for children are created and managed exclusively by a parent or legal guardian.

We do not collect personal information about a child under 13 unless we have first obtained verifiable parental consent. Verifiable parental consent is obtained through the following process:

• The parent or legal guardian creates an authenticated account, having affirmatively confirmed they are at least 18 years of age
• The guardian reviews and accepts these Terms and our Privacy Policy following email verification
• The guardian voluntarily creates a player profile for their child within their authenticated account
• For paid league registrations, the guardian completes a transaction using their own payment method, which provides additional verification of consent through transaction notifications to the primary account holder

By creating a player profile, the parent or legal guardian warrants they have legal authority to provide consent on the child's behalf and accepts responsibility for the accuracy of all information entered.

Parents and guardians may at any time:

• Review the information we hold about their minor child by accessing the player profile in the app
• Correct or update any inaccurate information by editing the player profile
• Soft-delete a player profile from within the app, which removes the player from active rosters and excludes the profile from future queries
• Request permanent deletion of a player's data by contacting us at privacy@leaguelinkd.com or through the in-app permanent deletion option, which removes the player record and all associated data within 48 hours of the request
• Request deletion of an entire account at any time by contacting privacy@leaguelinkd.com

• Minor player data is accessible only to authorized users within the same league organization (administrators, coaches assigned to the player's team, and the player's registered guardians)
• We will never sell minor player data to any third party
• We will never use minor player data for advertising, marketing, behavioral profiling, or any purpose unrelated to operating the Platform
• Minor player data is not used to train third-party artificial intelligence or machine-learning models
• Player profile photos uploaded by guardians are stored securely and are not used in any LeagueLinkd marketing or promotional materials without express written consent

For players between the ages of 13 and 17, all account creation and profile management is performed by a parent or guardian. Teen players do not create their own accounts on the Platform. All data handling protections in this Section 3 apply equally to teen players.

4 How We Use Your Information

• Creating and maintaining user accounts and player profiles
• Processing league registrations and managing team assignments
• Facilitating event scheduling, RSVPs, and communications between league participants
• Enabling in-app chat, messaging, and media sharing features
• Recording and displaying game statistics and performance data
• Processing registration payments and remitting funds to leagues

• Sending transactional emails such as account verification, registration confirmation, password reset links, and account-deletion confirmations
• Delivering in-app notifications and push notifications related to league activity, including new messages, schedule changes, announcements, and team updates
• Sending one-time reminder emails when a registration started in our app remains incomplete for more than seven days
• Responding to support requests directed to support@leaguelinkd.com

• Detecting and preventing fraud, abuse, and unauthorized access
• Reviewing user-generated content (including chat messages, announcements, and shared media) when reported through our in-app reporting tools, to enforce our community standards
• Maintaining records of reports filed and administrative actions taken in response, for accountability and audit purposes
• Applying per-organization content filters (such as blocked-term lists configured by your organization's administrators) to messages at the time of sending
• Enforcing rate limits on message sending to prevent spam and abuse
• Investigating reports involving child safety concerns and escalating such reports to LeagueLinkd staff for additional review, including by automated notification to our internal moderation inbox
• Within an organization, administrators may have access to player data and chat messages in channels and direct messages within their league, in order to support their administrative responsibilities and respond to reports of policy violations
• Enforcing our Terms and Conditions and Platform policies
• Complying with applicable law and responding to lawful requests from law enforcement

• Analyzing aggregated, de-identified usage data to improve Platform features and performance
• Diagnosing technical issues using crash reports and error logs

5 How We Share Your Information

LeagueLinkd does not sell personal information. We share information only in the following limited circumstances.

Information you provide and data generated through your use of the Platform is shared with other authorized users within your league organization as necessary to operate the Platform. League administrators have access to guardian account information, player profiles, registration data, and payment records. Coaches have access to the roster, contact information, and game data for players on their assigned teams. Registered co-guardians have access to the same player profile information as the primary guardian.

Within an organization, administrators may have visibility into chat messages in channels and direct messages within their league, in order to support administrative responsibilities and respond to reports of policy violations. Data is scoped by organization — administrators and coaches in one league organization cannot access data belonging to a different organization on the Platform.

We share information with the following third-party service providers strictly for the purpose of providing those services:

All service providers are contractually prohibited from using your information for any purpose other than providing services to LeagueLinkd.

We may disclose information when required to comply with applicable law or legal process, protect the rights, property, or safety of LeagueLinkd, our users, or the public, or detect, prevent, or address fraud, security, or technical issues.

In the event of a merger, acquisition, or similar transaction involving LeagueLinkd, user information may be transferred to the acquiring entity. We will provide notice of any such transfer and any material changes to this Privacy Policy prior to the transfer taking effect.

6 Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to provide the Platform, and to comply with our legal obligations.

• Active account data is retained for the duration of your account
• Player profile data is retained until the guardian requests deletion or the account is closed
• When a guardian requests permanent deletion of a player profile through the app, the player record and all associated data (registrations, team memberships, game lineups, and statistics) are permanently removed within 48 hours of the request
• Transaction records are retained for a minimum of seven (7) years for financial recordkeeping and tax compliance
• Game statistics and performance records are retained for the duration of the associated league season plus one (1) year
• Chat messages and media are retained while the associated channel or direct message conversation is in use. Messages may be deleted by the sender within 15 minutes of posting or by an authorized administrator at any time. We do not delete chat messages automatically based on age. When a user account is deleted, their authored messages are retained in their original conversations but the author attribution is removed
• Records of reports filed through our content moderation tools, administrative actions taken in response, blocked-term lists configured by organizations, and account deletion audit entries are retained for accountability and audit purposes, including after the underlying account is closed
• Upon account deletion, your account is anonymized: personal information is removed from your profile, your messages remain in their conversations with author attribution removed, and transaction records are retained as required for financial recordkeeping. Aggregated, de-identified data derived from your usage may be retained indefinitely

For organizations that terminate their account, data export and deletion follows the Organization Terms and Conditions (Section 5.5): 30-day export window followed by deletion from active systems within 90 days.

7 Data Security

We implement industry-standard technical, administrative, and physical safeguards to protect personal information:

• All data is encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted using AES-256 encryption
• Passwords are stored using bcrypt hashing — we never store or transmit plaintext passwords
• Access to production systems is restricted to authorized personnel and protected by multi-factor authentication
• Payment card data is handled exclusively by PCI DSS-compliant processors — we never store card numbers, CVV codes, or bank account details
• Our database provider, Supabase, maintains SOC 2 Type II compliance

No method of electronic transmission or storage is 100% secure. In the event of a security breach that affects your personal information, we will notify you as required by applicable law.

8 Your Privacy Rights and Choices

You may access and update most of your personal information directly through your account profile in the app. For assistance, contact [email protected].

You may request deletion of your account at any time by contacting privacy@leaguelinkd.com or by using the deletion option in your account settings. When you submit a deletion request, you will receive an email confirmation, and your account enters a 30-day waiting period before deletion is processed.

You may cancel a pending deletion request at any time during the 30-day waiting period by emailing privacy@leaguelinkd.com. After the 30-day period elapses, deletion proceeds automatically: your account is anonymized, all associated player profiles are permanently removed, and your personal data is removed from active systems. Transaction records are retained as required for financial recordkeeping.

Parents and guardians may withdraw consent for the collection and use of their minor child's data at any time by requesting deletion of the player profile through the in-app permanent deletion option (processed within 48 hours) or by contacting privacy@leaguelinkd.com.

You may disable push notifications at any time through your device's system settings. Disabling push notifications will not affect your ability to use the Platform but may result in you missing time-sensitive league communications.

Transactional emails (account verification, password reset, registration confirmation, registration reminders, and account-deletion confirmations) are necessary for operation of the Platform and cannot be opted out of while you maintain an account. If we send promotional communications in the future, we will provide an opt-out mechanism.

California residents may have additional rights under the CCPA, including the right to know what personal information we collect, the right to request deletion, and the right to opt out of sale of personal information. LeagueLinkd does not sell personal information. To exercise your CCPA rights, contact [email protected]. We will not discriminate against you for exercising your privacy rights.

Nevada residents may have the right to opt out of the sale of personal information. LeagueLinkd does not sell personal information. If you have questions, contact [email protected].

9 Cookies and Tracking Technologies

The LeagueLinkd mobile application does not use browser cookies. We use the following limited tracking technologies in the app:

• Session tokens — stored securely on your device to maintain your authenticated session. Required for Platform operation.
• Device identifiers — used for push notification delivery and session security
• Analytics data — aggregated, de-identified usage metrics to monitor Platform performance

Our website at leaguelinkd.com is hosted on Cloudflare and may set technical cookies (such as __cf_bm) used by Cloudflare for bot detection, security, and performance. We do not use third-party advertising trackers, behavioral tracking pixels, or cross-site tracking technologies on our website.

10 Third-Party Links and Integrations

The Platform may contain links to external websites or services. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party services you access through the Platform.

Payment processing is handled by Stripe, Inc. When you complete a payment through the Platform, you are also subject to Stripe's Privacy Policy.

11 Data Transfers

LeagueLinkd is based in the United States. All data we collect is stored and processed in the United States. If you are located outside the United States, please be aware that your information will be transferred to and processed in the United States, which may have different data protection standards than your country of residence.

By using the Platform, you consent to the transfer of your information to the United States and its processing in accordance with this Privacy Policy.

12 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform's features, or applicable law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Policy
• Notify registered users via email to their registered address
• Require you to review and accept the updated Policy upon your next login

Your continued use of the Platform following acceptance of the updated Policy constitutes your agreement to it. If you do not agree to the updated Policy, you should discontinue use and may request account deletion.

For changes that materially affect the collection or use of minor player data, we will provide at least 30 days' advance notice and, where required by COPPA, seek renewed parental consent before the changes take effect.

13 Governing Law

This Privacy Policy is governed by the laws of the State of Utah, without regard to its conflict of laws principles, consistent with the dispute resolution provisions in our User Terms and Conditions.

14 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us. We will respond to all privacy-related requests within 30 days.