Privacy Policy

My Athlete LLC · Last updated: September 29, 2026 · Privacy Policy wording corrections only, saying that we stopped using PostHog on September 28, 2026 and describing the age question at sign-up. The Terms of Service text is unchanged, and no protection was reduced. The September 23 revision and its effective-date notice below still apply

1. Our Service & Your Privacy

My Athlete LLC ("My Athlete", "we", "our", or "us") is a youth sports development tracking application that enables parents, guardians, and coaches to record physical measurements, sport-specific assessments, growth tracking, and team collaboration. This Privacy Policy describes what data we collect, how we use it, who we share it with, and the rights and choices you have. It applies to the My Athlete mobile apps, the web app at app.myathlete.team, our website at myathlete.team, and the emails and notifications we send.

Who we are: My Athlete LLC, a Georgia limited liability company, operates the service and is the controller of the personal information described here. Our contact details are in the "Contact Us" section at the end of this policy.

Who this policy covers: parents and guardians; coaches, team administrators, and program or league staff; athletes aged 13 and older who hold their own account; athletes of any age whose data is managed by a parent, guardian, or coach; and visitors to our website. We write in plain language on purpose; where a law gives a term a specific meaning (for example "sell", "share", or "consumer health data") we say so.

Data Protection Commitment: We do NOT sell your data. We do NOT use child data for behavioral advertising. We disclose information to operate the service, at your direction, and as described in Sections 7 and 19. Optional adult advertising measurement has the separate choices in Section 12; it does not include athlete or health records. We collect only what we need and follow the retention and deletion schedule in Section 8, including its stated exceptions.

2. Information We Collect & Why

We collect only what we need to operate the app. Each data type is retained as noted below:

Data Type	Why We Collect It	Retention
Email, Password	Account login & recovery.	Retained until account deletion + 30 days.
Name, Role	Display & permission model.	Retained until account deletion + 30 days.
Date of Birth (DOB) ⚠️ sensitive	Age-group assessment matching; age-appropriate developmental guidance per LTAD research; age-based account requirements.	Retained until account deletion + 30 days.
Sign-Up Age Answer ⚠️ sensitive	Updated sign-up screens first ask for a birth month and year (Section 3). We do not store the month and year given as the answer (athlete sign-up asks separately for the full date of birth, in the row above). From the answer we keep only whether it was adult or teen, the version of the question and when it was given, and, for athlete accounts that give a birth date, the date the account turns 18, which is used only to decide when the account may switch to a parent or coach account. An answer under 13 is not stored by us or sent to us.	Deleted with the account.
Biological Sex ⚠️ sensitive	Sex-specific CDC percentiles & sport-category eligibility.	Retained until account deletion + 30 days.
Height, Weight, BMI ⚠️ sensitive	Growth tracking & CDC percentile benchmarks; general training-safety awareness and age-appropriate exercise guidance.	Retained until account deletion + 30 days.
Assessment Scores & Performance Metrics	Skill tracking & benchmarking.	Retained until account deletion + 30 days.
Score Provenance & the Verified Mark (added September 18, 2026)	For each score: who recorded it (the account and its role), the date, and - where the recorder said so - the timing method, measurement method, trial number, and whether it came from a Measurement Day, an imported event or a documented protocol. Our servers use only that provenance to decide whether a score carries the Verified mark; the mark describes how a result was recorded, never how good an athlete is, and it is not shared with anyone the score itself is not.	Retained with the score and deleted with it.
Messages, Comments & Community Activity (if feature enabled)	Posts and comments you write in team/program/league Messages, read receipts, focus-item completion marks, and any reports or blocks you file. Visible to the group they were posted to (see Section 7 → Community Content Visibility).	Retained until deleted by you or group staff, subject to the group-content and account-deletion exceptions in Section 8.
Schedule, RSVPs & Attendance (if your program uses the Schedule)	Event details and locations posted by your coach or program to a team calendar, your per-athlete RSVP answers and any note you add to them, and attendance marks your coach records. Visible to the team or program the event is posted to (see Section 7 → Schedule Visibility); attendance marks only to the athlete's own family and the program's staff.	Retained while the team or program keeps the event (staff can remove it), with the account-deletion exceptions in Section 8.
Weekly Wellness Check-In Ratings (if feature enabled)	Simple 1–5 self-reported family ratings (sleep, energy, mood, soreness) recorded by a parent/guardian for their own athlete; displayed back to the family only. Informational — not medical records or health monitoring (see Section 6).	Retained until account deletion + 30 days.
Team Roster (name + role)	Coach collaboration & team leaderboards. A coach can view a rostered athlete's data only while the athlete is on an active roster. When a season ends, the coach keeps read-only access limited to that season's records; when a parent/athlete leaves a team, the coach's access ends immediately.	Retained until team deletion + 30 days.
Coach-Created Play & Tactics Data	Plays, formations, and token layouts created by coaches on the Tactics Board. Linked to the coach's account and team — not personal athlete data.	Retained until team or account deletion + 30 days.
Analytics Dashboard Activity	Aggregated views of team assessment scores, roster activity, and growth data already collected above. No new data is collected by the Analytics Dashboard; it only computes summary statistics from existing records.	—
Event Timestamps, Feature Usage	Optional product analytics, stored in our own database and tied to a pseudonymous account ID. Updated app versions keep them off until you choose them. We stopped using PostHog for product analytics on September 28, 2026 (Section 7).	Identifiable events are limited to 30 days; all events are deleted within 90 days under the Section 8 schedule.
Crash Logs, Error Traces	Bug fixing & security (Sentry).	Retained 90 days; then deleted.
IP Address, Device Type	Security & abuse prevention.	Retained 180 days; then deleted.
Install & Marketing Attribution	A referral code you enter, tracked-link parameters (UTM tags, ad click IDs, including the tag that marks a link from one of our own emails to an organization), and on Android the Google Play install-referrer string — used to measure which marketing produced an install or signup and to credit partner referrals. Describes how the adult account creator arrived; never collected from or about athletes' profiles.	Retained until account deletion + 30 days.
Website Page Views	On myathlete.team only: the page path, tracked-link parameters (UTM tags), the referring site's domain, and whether the screen is phone-sized — sent by a small script on our own pages so we can count which ad or link led to a page view and to a sign-up. After the website measurement choice, campaign tags may be remembered in this browser tab using session storage. This first-party counter uses no cookies or account ID; the IP address is used only to limit request volume and is not stored. Individual rows are deleted after 13 months; only aggregate counts are kept longer. (Added September 17, 2026.)	—
Sign-in Provider Details (Sign in with Apple / Google)	If you sign in with Apple or Google, the provider sends us your name and email address (Apple may send a private relay address instead of your real one) so we can create and recognise your account. We never receive your provider password and we do not store profile photos.	Retained until account deletion + 30 days.
Push Notification Token	A device token issued by Apple or Google so we can deliver the notifications you enable.	Retained until you disable notifications, sign out on that device, or delete your account.
Consent & Acceptance Records	The date and document version of your acceptance of the Terms and this Privacy Policy, parental-consent confirmations, feature opt-ins (for example the adult-height estimate, Enhanced Growth Velocity, or benchmark contribution) and email preferences, kept so we can demonstrate what was agreed and honour your choices.	Retained until account deletion + 30 days.
Support Communications	Emails and messages you send us, so we can respond and improve support.	Retained 2 years after the conversation closes, then deleted.
Parent/Guardian Email (teen accounts)	Given by an athlete aged 13–17 when they create their own account, so we can email that parent or guardian a code to link to the teen's profile. Used only for that invitation and to honour parental requests; never for marketing.	Retained until account deletion + 30 days.

Try-before-you-register data: the optional guest reaction test stores its result only on your device. Nothing is sent to us unless you later create an account, at which point the score attaches to the athlete profile you create and follows the retention rules above.

Programs, Leagues & Competitions (added September 16, 2026)

A coach's team can belong to a program (a club or a school's athletics program), and a program can belong to a league. Staff of those organizations use the app to run a season, and the app stores what a season needs. None of it is collected from a family directly: it is entered by the organization's staff or by a coach, or computed from scores and results already in the app.

Data Type	Why We Collect It	Retention
Competition structure	The league's competitions, divisions, regions and the TEAM names in them (a school or program name, never a person).	Retained while the competition exists; deleted with the competition or the league.
Fixtures, scores & standings	Games between teams, scores submitted by a coach or by league staff (with corrections kept as a record), and the region and overall standings, tie-break outcomes and playoff brackets the app computes from them. Team-level records only.	Retained with the competition.
Certified eligibility roster ⚠️ sensitive	Per league team: an athlete's name (or the name the league listed), jersey number and eligibility status (pending, eligible, restricted, playing down, suspended, ineligible); who affirmed the row (the team's own coach or program staff, by typed name) and who certified it (a person from a different program the league assigned, or league staff, by typed name); the residency OUTCOME the certifier checked (in district, an approved exception and the season it covers, or out of district) with a short note; and two checks (birth date verified against the league's record, waiver on file). The app never stores the athlete's address, birth certificate or waiver itself. Visible to the league's staff, the program's staff, the team's coach and the assigned certifying program; the opposing team's coach may read it within a day of a scheduled game; never public.	Retained with the competition.
Certification photo ⚠️ sensitive	Where a league checks identity at certification with a headshot: one small photo of the athlete in uniform, taken by league staff on the web app and only after the parent's separate written consent is recorded (a signed consent page the league files, with its date). Visible to that league's staff ONLY — never to families, coaches or program staff through the app, never on a report, certificate, leaderboard, public page or export. Withdrawing the consent deletes the photo the same instant; the photo is also deleted with the roster row and the competition. See Section 4.	—
Game-day report ⚠️ sensitive	Filed by a coach before a game: athletes sitting out an ejection, injured/absent/sick athletes (names only, no medical detail), discipline entries, jersey changes, and the coach's typed signature. Visible to league staff and the two teams' coaches; never public.	Retained with the competition.
League weigh-in ⚠️ sensitive	For divisions a league's rules define by weight: an athlete's weight in pounds on a date and a weight class, recorded by league or program staff at certification. Visible to that staff ONLY — never to families or coaches through the app, never on a report, certificate, leaderboard or export. Retained with the competition. See Section 4.	—
Competition audit log	Who changed what and when inside a competition (account IDs and the change), append-only, readable by league staff.	Retained with the competition.
Message audience	A post a league or program addresses to a staff group (program owners, head coaches, all coaches, staff) instead of to everyone; who may read it is decided by role inside the organization.	Retained with the post.
Training block & report delivery	A coach's training block on a team (a date window, the Measurement Days that begin and end it, the tests it measures) and a record of each progress report sent to an athlete's family (which report, to which family account, when, and whether the family opened it).	Retained with the team.
Attendance, certificates & leaderboards	Attendance marks per event (present, late, absent) recorded by a coach; a printable milestone certificate showing the athlete's first name and the milestone; team and program leaderboards showing initials.	Retained with the team.

Data We Do NOT Collect

• Precise GPS location (no location-based ads, tracking, or geofencing)
• Photos or videos of athletes — the app has no photo or video upload (the exercise library is curated, not user-generated). The one exception is a league certification photo, taken by league staff on the web app only with the parent's separate written consent (Section 4)
• Microphone, contacts, or device-calendar access. The web league-certification photo feature requests camera access only when league staff use that separately authorized feature
• Biometric identifiers (fingerprints, face geometry, voiceprints)
• Government-issued identifiers (e.g., Social Security, driver's license, or passport numbers)
• Payment card numbers, bank details, or billing addresses (the app stores handle family and coach subscriptions; Stripe handles Program Plan payments)
• Persistent identifiers used for cross-app tracking or ad targeting (no IDFA, no Android Advertising ID)
• Medical files or detailed diagnoses (no psychiatric, sexual, or substance-abuse information). Limited injury/sickness status, league weigh-ins and voluntarily provided support details are described above
• Data purchased from data brokers or appended from outside sources about you (the team-level schedules and scores we read from a league's own public website are about teams, not people — see below)

Where Your Information Comes From

Almost everything we hold was typed into the app by you or by the parent, guardian, or coach who manages an athlete. The only outside sources are the sign-in provider you choose (Apple or Google); the app store that processes your subscription (purchase status via RevenueCat, never card details); the delivery and crash-reporting services that report back whether an email, notification, or app session succeeded; and the marketing-attribution parameters described above. For a league that runs its season on the app, we also read that league's own public website (its published schedule, score and standings pages) to keep the team's calendar and the standings in step; those pages hold team names, dates, venues and scores, and we take nothing about a person from them. We do not buy data about you and we do not combine your data with outside profiles.

Organizations We Write To & Booking a Call (added September 18, 2026)

Business contacts at youth-sports organizations. To tell programs, leagues, gyms and trainers that the app exists, we keep a list of organizations and, for each, a role-based business address (a program's general inbox or a staff role's address published on the organization's own website or in a public youth-sports directory), the organization's name and sport, and what its own public pages say about it. We do not add a named person's address at a free consumer email provider, we take nothing about families or athletes from those pages, and we do not buy lists. We use the list to send a small number of emails introducing the app and to record who asked us to stop. Every such email carries our postal address and a plain way to opt out (reply "no thanks" or use the link); an opt-out goes on a do-not-send list that we keep for as long as we send mail, so that it is honoured. Three providers process this list on our behalf and nothing else: Smartlead sends the mail and records replies, Mission Inbox hosts the mailboxes it goes from, and EmailListVerify checks that an address exists before we write to it. None of them receives app-user, family, athlete or health data. If you want your organization's address removed, write to us and we will remove it, keeping only the record that you asked.

Booking a call with us. If you book a call from our website, Google's appointment page collects your name, email address and the time you chose under Google's own privacy policy, and the booking appears in our calendar. We use it only to hold the call.

Cookies, Local Storage & Similar Technologies

Web app (app.myathlete.team): we use browser local storage to keep you signed in, to remember your consent and display preferences, and to cache data for offline use. If Meta advertising measurement loads (Sections 7 and 12 explain exactly when it can and how to opt out), Meta may set its own cookies (for example _fbp) governed by Meta's policies.

Marketing website (myathlete.team): we set no analytics cookies of our own; our hosting provider (Cloudflare) may collect aggregate, cookieless performance and security metrics. The site loads Meta's measurement code only if your browser does not send a Global Privacy Control or Do Not Track signal; it records that a page was viewed, how far down it was scrolled, whether the sign-up button came into view, and that a download or sign-up button was clicked, never anything about an athlete. No other third-party advertising cookies are used.

Mobile apps: no cookies. The apps store your session, preferences, and offline cache on the device only.

3. Children's Information: Adult-Managed Records (COPPA)

Adult-Managed Athlete Records

Children under 13 may not create or operate their own account. A parent, legal guardian, or authorized adult coach may provide information about an athlete. Information provided online by an adult about a child is different from information collected online directly from a child. Creating an account, saving data, checking a box, or holding a claim code does not by itself constitute verified guardianship or legally required verifiable parental consent under COPPA. If a feature involves collection directly from a child under 13, we must meet applicable COPPA duties, including direct notice and an appropriate verification method, before that collection.

The Age Question at Sign-Up

Updated sign-up screens first ask for a birth month and year, without saying which answers are accepted. An answer under 13 is not stored by us or sent to us, and sign-up does not continue; the device keeps a note of it for 7 days so the question is not simply retried (browser storage on the web, app storage on phones). In the app, a teen answer leads to the athlete sign-up, which asks for the full date of birth and a parent or guardian's email (Section 16). Our website's sign-up and waitlist forms are for adults only (the waitlist asks for a birth year alone): any answer under 18 ends the form with nothing sent to us, and the browser keeps a 7-day note too. If an account was already created through Google or Apple sign-in, the question comes next: a teen answer signs the account out and points to the athlete sign-up, and an answer under 13 closes the account. Either way the account is deleted when it is new and empty, and otherwise signed out and kept. If error reporting is on, an account kept after an answer under 13, or a deletion that fails, is reported to us so we can look into it; the report carries no name, email, account ID, month or year. We do not store the month and year given as the answer (athlete sign-up asks separately for the full date of birth): from the answer we keep only whether it was adult or teen, the version of the question and when it was given, and, for athlete accounts that give a birth date, the date the account turns 18, which is used only to decide when the account may switch to a parent or coach account (Section 2).

Parent or Guardian Adds an Athlete

The adult supplies the athlete's name, date of birth, sex and sports information to create a profile and requests the associated age-based features. Updated add-athlete screens ask the adult to affirm their authority before submitting the profile. Optional health features, benchmark contribution and exercise-risk acknowledgment remain separate choices; the profile authorization does not opt you into those features.

Coach Adds or Imports Athletes

Coach-created records may contain a name, date of birth, sex, sport and team data before a family claims them. They are not anonymous placeholders. Before entering or importing a minor's data, the coach must provide this notice and obtain the required parent or guardian authorization, or establish another lawful basis that actually applies to the organization and the data. The updated add/import flow requires an express affirmation before submission. A coach must not submit records when the required authorization is missing. These responsibilities do not replace My Athlete's own obligations under privacy law.

Parent Claims an Existing Record

A claim code lets a parent or guardian link a coach-created athlete record to their family. The updated claim flow asks the claimant to affirm their relationship and authorize that link before redemption. The code proves possession of an invitation, not the legal relationship. Team access follows the roster and organizational permissions in Sections 4 and 7. A claim does not give consent to advertising, optional health features, benchmark contribution or an exercise release. Contact us if a record was created or claimed without authority.

Authorization records: updated add, import and claim flows record the signed-in adult's account ID, the action, the number of records covered, the authorization version and a server timestamp. A receipt records an affirmation before an attempt; it does not prove the attempted creation or claim succeeded. Successful claims separately record the athlete, family and claim time. We do not backdate authorization for older records. These records are deleted with the account or within 30 days, except where a specific legal hold requires preservation.

Parent Rights Under COPPA

• Review: Access all data we hold about your child in the app, or ask us for a copy.
• Refuse further collection: You may refuse to permit further collection or use of your child's information at any time; we will then stop and delete what we hold, which may make the athlete profile unusable.
• Request Deletion: Delete your child's profile yourself in the app, or ask us; all profiles, scores, and measurements are deleted within 30 days.
• Request Export: Receive your child's data in CSV or JSON format.
• Opt-Out: Disable optional features (e.g., Combine Benchmarks, Cognitive Baseline, the adult-height estimate, Enhanced Growth Velocity, benchmark contribution); some core features are required for the app to function.

No over-collection: We do not condition a child's participation in any activity on the child disclosing more personal information than is reasonably necessary to participate. The adult-managed profile fields and their purposes are listed in Section 2; optional features remain optional.

How we verify a parent's request: we confirm control of the parent account email that manages the athlete; where a request comes from someone other than the managing account, we ask for reasonable proof of the parent or guardian relationship before acting.

To exercise these rights, use the app or contact us at support@myathlete.team. Our full operator contact details are in the "Contact Us" section at the end of this policy.

4. Sensitive Health Data & DOB Justification

Age (Date of Birth): We collect DOB because it enables age-appropriate assessment recommendations and calculates Peak Height Velocity (PHV), which guides training intensity during growth-sensitive windows (ages 11–15 typically). This is supported by published LTAD (Long-Term Athlete Development) frameworks.

Growth Measurements (Height/Weight/BMI): We collect these because CDC growth percentiles show how an athlete's development compares to age/sex peers. If you prefer not to provide DOB or growth data, some app features will be unavailable; the app will notify you of these limits.

Your Right to Limit Use of Sensitive Data

You may request that we limit the use of an athlete's sensitive data (date of birth, biological sex, height, weight, and BMI) solely to (1) providing the service you requested, (2) ensuring safety and security, and (3) complying with our legal obligations. We do not use sensitive data for advertising, profiling, or any secondary purpose. To exercise this right, contact support@myathlete.team.

Not Protected Health Information (PHI): My Athlete is not a healthcare provider and does not provide medical or healthcare services. The growth and performance data we collect is not "protected health information" (PHI) under HIPAA. However, we treat it as sensitive and protect it accordingly.

Optional Estimated Adult Height Range

My Athlete may offer an optional feature that estimates an athlete's possible adult-height range using the athlete's growth measurements, age, biological sex, publicly available CDC growth-reference data, and parent-entered biological parent heights. This feature is parent/guardian-controlled and may be disabled at any time. We store the parents' entered heights and a timestamped record of the opt-in consent; you may remove the parent heights or turn the feature off whenever you like.

The estimate is provided for general informational and educational purposes only. It is not a medical assessment, diagnosis, screening tool, growth evaluation, or guarantee of adult height. It does not determine whether an athlete's growth is normal, abnormal, delayed, advanced, or medically concerning. Many factors affect growth, and actual adult height may fall outside the estimated range. For individualized growth questions, consult a pediatrician or qualified healthcare professional.

How this data is handled: Only a parent or guardian may enable this feature or enter the biological parents' heights. We use the parent heights, the athlete's measurements, and the derived estimate only to provide and display the estimate and to keep the consent record — never for advertising, profiling, or any unrelated purpose, and we do not sell it. If you remove the parent heights or turn the feature off, we delete those height values and the derived estimate; we keep only the minimal opt-in/consent record as needed for security and legal compliance (see Section 8).

Optional Enhanced Growth Velocity

My Athlete offers an optional Enhanced Growth Velocity feature that lets a parent or legal guardian record an athlete's body measurements over time — standing height, weight, sitting height (and the height of the box/stool used), and optional left/right foot length — and view observed changes based on those measurements. Shoe size, if entered, is stored only as context and is never used in any calculation. From what you enter, we calculate raw change since a previous session, annualized observed rates of change, derived leg length and body-segment ratios, and a measurement-quality rating (how well the session was measured — not confidence in the athlete's biological status). This feature is informational and educational only.

It does not diagnose or detect peak height velocity, puberty, biological maturity, a growth disorder, abnormal growth, a medical condition, or injury risk, and it is not a substitute for a pediatrician or other qualified healthcare professional. Annualized rates are estimates and can be affected by measurement technique, equipment, posture, clothing, time of day, and the length of the interval between sessions.

Parent control & visibility: Enhanced Growth Velocity is parent-controlled and private by default. Growth-measurement data is not shown on public profiles or leaderboards and is not available to coaches. Any future option to give a coach access would require a separate, affirmative parent choice. You can edit or delete individual sessions, or delete the athlete's complete growth-measurement history, at any time. We record a versioned opt-in consent (who agreed, when, and to which text). We do not sell this data, disclose it to data brokers, or use it for targeted or cross-context behavioral advertising; we disclose it only to service providers that host, secure, and operate the app on our behalf, when you direct us to, or when legally required. Please do not enter medical diagnoses, Tanner stage, puberty status, or other intimate information in notes.

League Weigh-Ins (added September 16, 2026)

Some youth leagues define a division by weight, and their rules require a weigh-in at certification. Where a league runs its season on the app, league staff and the program's staff may record an athlete's weigh-in (pounds, a date, a weight class) for that purpose. This is the only weight in the app that a family does not enter itself: it is visible to that league's and program's staff only, it is never shown to the team's coach, to the family or on any family surface, and it is never used in a report, certificate, leaderboard or export. It is not used for any other purpose, is not shared with anyone else, and is deleted with the competition. A family may ask the league what it recorded and may ask us to delete it (Section 13). The family's own growth measurements above remain separate and remain the family's to control.

Certification Photos (added September 16, 2026)

Some youth leagues check a player's identity at certification and on game day with a headshot in uniform. Where a league runs its season on the app, its staff may keep one such photo per athlete, and only after the parent or guardian's separate written consent is recorded — the league files the signed consent page with its date, and the app records that it did — or the parent or guardian gives that consent in the app, from their athlete's card in Settings, where they can withdraw it at any time; the app records the date and the policy version they agreed to. The photo is taken on the web app, reduced to a small image, and stored with the athlete's roster row. It is visible to that league's staff only: it is never shown to families, coaches or program staff through the app, and it is never used on a report, certificate, leaderboard, public page or export. It is not used for any other purpose, is not shared with anyone else, and is not used for facial recognition or any automated matching. A parent or guardian may withdraw consent at any time through the league or by asking us (Section 13); the photo is deleted the instant the consent is withdrawn, and in any case with the roster row and the competition.

5. How We Use Your Information

• Calculate CDC growth percentiles and equivalent ages
• Grade and track athletic assessment progress
• Display developmental stage recommendations based on age and LTAD research
• Enable team collaboration between coaches and parents
• Provide age-appropriate exercise guidance and wellness resources
• Improve the app (anonymized analytics)
• Comply with legal obligations (data retention, breach notification)

We do NOT use child data for behavioral profiling, targeted advertising, or marketing. We do NOT share child, athlete or health records with ad networks or data brokers. Optional adult advertising measurement is described in Sections 7 and 12.

Marketing Content & AI Tools

Some images, videos, or other marketing materials on our website, social media, or advertising may be created or edited using third-party design, editing, or generative-AI tools. We do not use personal information from children, athletes, parents, coaches, or other users to create synthetic marketing content.

No AI / Machine-Learning Training Without Consent

We do NOT use identifiable personal data, athlete health/fitness data, growth measurements, performance scores, images, or private support communications to train artificial-intelligence or machine-learning models, unless you provide a separate, explicit, opt-in consent for that specific purpose. We may use fully aggregated or anonymized data to improve the app and analyze performance.

Optional Benchmark Contribution (Per-Athlete Opt-In)

Where offered, a parent or guardian may choose, separately for each athlete, to let us use that athlete's de-identified assessment scores, together with age at test, sex, sport, position, measurement protocol, timing method, event or site, and verification status, to build aggregate benchmark and percentile reference tables. Individual scores and identity are never published. Declining or withdrawing has no effect on score recording, reports, team access, or any other feature. Permission covers only eligible scores recorded after it is granted, and it can be withdrawn at any time for future benchmark releases; withdrawal does not retract aggregate tables already built without identifying data. We record which version of the permission text was agreed to, and when.

No Automated Decisions With Legal or Similar Effects

Percentiles, grades, "equivalent age" outputs, and other calculations in the app are informational estimates shown to you and to the coaches you authorize. We do not use personal information to make automated decisions that produce legal or similarly significant effects about you or an athlete (for example decisions about eligibility, selection, pricing, or access), and we do not profile users for such purposes.

6. Exercise & Wellness Content — Liability Disclaimer

My Athlete includes an Exercise Library with 1,900+ demonstration videos, coaching cues, and instructional content (licensed). This content is provided for educational reference only and is NOT medical advice, medical treatment, or rehabilitation protocol.

Important Safety Precautions

• Not a Substitute for Professional Coaching: Always consult a qualified coach, athletic trainer, or physician before beginning new training.
• Medical Clearance Required: Ensure the athlete has medical clearance for physical activity before performing any exercise or assessment.
• Adult Supervision: All exercise should be performed under the supervision of a qualified coach or responsible adult.
• Stop if Pain Occurs: Discontinue immediately on sharp pain, dizziness, shortness of breath, or other concerning symptoms.
• Age-Appropriateness: Screen content for the athlete's age, ability level, and available environment.
• Assumption of Risk: By accessing the Exercise Library, you accept full responsibility for any injury, loss, or damage arising from exercise use. My Athlete LLC is not liable for such injury.

Wellness Guides & Weekly Check-Ins

The app's nutrition, recovery, and sleep guides are general educational content for families, drawn from published consensus guidance. They are not medical, dietetic, or training advice; they are never individualized to a specific athlete; and they do not diagnose, screen for, treat, or monitor any condition. For guidance specific to your athlete, consult your pediatrician or a registered dietitian nutritionist.

If enabled, the weekly wellness check-in lets a parent or guardian record simple 1–5 ratings (such as sleep, energy, mood, and soreness) for their own athlete. These entries are self-reported, informational family notes — not medical records, symptom tracking, or health monitoring. My Athlete LLC does not review these entries, draws no conclusions or alerts from them, and has no duty to detect, interpret, or act on anything they may reflect. Do not use check-ins to record medical information; contact a healthcare professional directly with any health concern.

7. Third-Party Processors & Data Sharing

We do NOT sell or rent your data for money. The providers below receive the information needed for their services. Some, including app stores, payment providers and Meta, also act under their own terms rather than solely as our processors. User-directed team, program and league sharing is described separately below; Section 19 explains other limited disclosures.

• Supabase (database + authentication): Hosts athlete profiles, assessments, team data. AWS us-east-1 (United States); encrypted in transit (HTTPS) and at rest.
• Cloudflare (web hosting, delivery, security): Serves the website, the web app, and Exercise Library videos, and protects them from abuse. May collect aggregate, cookieless performance and security metrics.
• Apple and Google (sign-in, app distribution, push delivery): If you use Sign in with Apple or Google, the provider authenticates you and sends us your name and email. Apple and Google also process your subscription purchase under their own terms and deliver push notifications to your device (Expo's push service relays them on our behalf; the notification text passes through it and is not retained for any other purpose).
• Resend (email delivery): Sends service emails and, only if you opted in, our informational newsletter. Receives your email address and the message content; reports delivery, bounce, and unsubscribe events back to us.
• PostHog (former product analytics provider): We stopped using PostHog on September 28, 2026; product analytics are now kept in our own database (Section 2). Before then it received feature-usage events tied to a pseudonymous account ID and role only, with no name, email, or athlete data. We have asked PostHog to delete our data, and deletion of our PostHog project is scheduled for October 1, 2026. App versions from before September 28, 2026 that have not been updated may still send it events until then. Until that deletion, PostHog remains contractually limited to providing analytics on our behalf, not for targeted advertising, profiling, or independent commercial use; it does NOT profile children or serve targeted ads.
• Sentry (crash & error reporting): Crash logs and diagnostics to fix bugs, tagged with the account's role (app versions before September 28, 2026 also send an account ID). Contractually limited to providing crash diagnostics on our behalf; sensitive data is filtered.
• RevenueCat (subscription processing): Processes in-app subscriptions via the Apple App Store and Google Play. Payment card data is NOT sent to us or to RevenueCat.
• Stripe (Program Plan payments): Processes the card payment when an organization buys a Program Plan on our website. Stripe receives the payer's name, email, business name and card details and handles them under its own privacy policy; card data is never sent to us. We keep a record of each purchase (name, email, business name, amount and Stripe's reference identifiers) as described in Section 8. Stripe receives no athlete, family or health information of any kind.
• Meta (optional advertising measurement — adults only): after a separate affirmative advertising choice, Meta Pixel can measure visits, registrations and plan interactions on marketing and approved non-health web pages. The marketing site also measures scrolling and sign-up-button visibility. Meta receives browser and network information, including IP address, browser identifiers, cookies and the page address. These are personal information even when they do not include a name or email. Global Privacy Control and Do Not Track override a choice to allow measurement. Athlete accounts and health screens are excluded. Updated mobile clients do not automatically log installs or app opens to Meta; adult registration measurement requires the advertising choice, uses Limited Data Use and disables advertising-identifier collection. We do not send athlete records or Consumer Health Data to Meta.

Server-side purchase matching: our earlier integration could send hashed adult email and account identifiers, purchase information and available ad-click/browser identifiers to Meta. Hashing allowed matching and did not make the identifiers anonymous. This matching is paused; it will not resume without an account-level consent and withdrawal control and any notice or consent required by law. Meta is not solely our service provider for advertising measurement, which may constitute sharing for cross-context behavioral advertising. Section 12 explains your choices.

Programs and leagues (added September 16, 2026): when a coach links a team to a program, or a program joins a league, the staff of that organization can see what their role needs and nothing more. Program staff see their teams' rosters, attendance, the progress reports a coach sends and the eligibility rows for their teams. League staff see every team's eligibility rows, game-day reports, scores, standings, brackets and the audit log, and record weigh-ins where their rules need them. No organization sees a family's growth measurements, wellness check-ins or private notes. Organization staff are bound by the Terms of Service (Section 6) and by their own athlete-safety and privacy obligations; ask the organization what it does with the data it records.

Smartlead, Mission Inbox and EmailListVerify (introduction emails to organizations): process only the business-contact list described in Section 2 - an organization's name and a role-based business address - to send our introduction emails, host the mailboxes they go from, and check that an address exists. They receive no app-user, family, athlete or health data of any kind.

Google Calendar appointment scheduling (booking a call): when someone books a call from our website, Google's page collects their name, email address and chosen time under Google's own privacy policy and shows the booking in our calendar.

Public competition page: a league may switch on a login-free web page for a competition that shows team names, the schedule, finalized scores, standings and brackets. That page shows no person — no athlete, no roster, no coach, no family, no report, no weigh-in — and it is served only while the league keeps the switch on. The league decides whether to publish it and is responsible for that decision.

Service-Provider Obligations: Our service providers (Supabase, Cloudflare, Resend, Expo, Sentry, RevenueCat, Stripe, Smartlead, Mission Inbox, EmailListVerify) are contractually required to process personal information only on our behalf, only to provide their services, and not for targeted advertising, profiling, or independent commercial use. Apple and Google act under their own developer and platform terms.

Consent to Collection Is Separate from Third-Party Sharing: Your consent for us to collect and use a child's information does not authorize us to disclose that information to third parties for any purpose beyond operating the app (such as advertising or profiling). We do not make such disclosures. If we ever proposed to share a child's personal information with a third party for a non-core purpose, we would first obtain separate verifiable parental consent.

Categories of Third Parties & Affiliates

For readers whose state law asks for it in these terms: the categories of third parties that may receive personal information are (1) hosting, database, and content-delivery providers; (2) sign-in, app-distribution, payment, and push-delivery platforms (Apple, Google); (3) email delivery, analytics, and crash-reporting providers; (4) an advertising-measurement partner (Meta), which receives no child, athlete, or health data; (5) the coaches and group members you or your athlete's parent choose to share with (see "Community Content Visibility" below and Section 6 of the Terms of Service); and (6) authorities or other parties where required by law (Section 19). We have no affiliates or subsidiaries and share no data with any. The named providers above are the complete list of third parties with whom Consumer Health Data is shared.

Community Content Visibility (Messages, if feature enabled)

Posts and comments in the Messages feature are shared with the group they are posted to — the team, program, or league — meaning every coach, staff member, parent/guardian, and athlete account holder who belongs to that group can read them, along with the author's display name. This sharing is user-directed (you choose to post) and group-internal; it is not disclosure to outside third parties. There is no private direct messaging. A league or program may address a post to a staff group (program owners, head coaches, all coaches, staff) instead of to everyone; such a post is readable only by the adult staff in that role and never by an athlete or a family account. Coaches and organization staff can additionally see whether group members have seen a post ("Seen by" counts) and, for attached training items, per-athlete completion status. Group staff and My Athlete may remove content under the Terms of Service Acceptable Use rules.

Schedule Visibility (Events, RSVPs & Attendance, if your program uses the Schedule)

Events a coach or program posts to a team calendar — the title, time, location and notes — are shared with that team or program in the same way as Messages: every coach, staff member, parent/guardian and athlete account holder who belongs to the group can see them, along with the poster's display name. Each athlete's RSVP answer, and any note added to it, is visible to that same group and its staff. Attendance marks are narrower: they are visible only to the athlete's own family and to the program's staff. Posting is user-directed and group-internal; it is not disclosure to outside third parties.

8. Data Deletion & Retention Schedule

When You Delete Your Account

• Immediate: All athlete profiles, assessment scores, growth measurements, wellness check-ins, team memberships, and exercise history are removed from the live database, and your sign-in is deleted. Teams you coach are deleted with their rosters, their Messages and their events; a family that has claimed its athlete keeps its own copy of that athlete's history. Messages and events you posted to another coach's team or to a program stay with that group under your name as it was, so the group's record is not broken; your comments are deleted. You can delete your posts before closing your account or request removal of retained personal information afterward. These exceptions remain subject to applicable deletion rights. RSVP answers and attendance marks you recorded stay with the athlete but are no longer tied to you.
• Within 30 days: Remaining application data (consent logs, delivery records) is purged from primary storage, except the records listed below.
• Backup/Disaster Recovery: Backup copies may persist up to 180 days for system recovery; these are not accessed in the ordinary course and are automatically overwritten.
• Analytics and diagnostics: our retention schedule limits identifiable feature-usage events to 30 days and all feature-usage events and crash diagnostics to 90 days. Pseudonymous account IDs are personal information, not anonymous data. These limits apply to our own storage and the processor copies we control; request deletion through Section 13.
• Payment Records: Subscription/payment history (never card numbers) retained for 7 years per tax-record requirements. For a Program Plan purchase this record is the buyer's name, email, business name, the amount paid and Stripe's reference identifiers.
• Support Correspondence: Retained up to 2 years so we can resolve any follow-up dispute.
• Legal Holds: Where we are legally required to preserve information (for example for a pending dispute, a regulator's request, or a child-safety report) we keep only what the obligation requires, for as long as it lasts.
• Competition & program records: a league's competition data (structure, fixtures, scores, standings, eligibility rows, game-day reports, weigh-ins and the audit log) is retained while the competition exists and is deleted when the league deletes the competition or its account; an athlete's eligibility and weigh-in rows are also deleted when that athlete's family deletes the athlete. A coach's training blocks and report-delivery records are deleted with the team.

Inactive Accounts

An account with no activity (no sign-ins, assessments, or data changes) for 24 consecutive months becomes eligible for deletion. Before deleting, we send a notice to the registered email address and wait at least 30 days; signing in during that time keeps the account. Athlete data managed under an inactive coach account is handled the same way, and families who have claimed their athlete keep their own copy regardless.

Written Retention Policy

We do not retain personal information indefinitely. We maintain a written data-retention policy; the retention periods listed in Section 2 and in this section are that policy. We delete or de-identify data once it is no longer reasonably necessary for the specific purpose for which it was collected, or as required by law, and children's personal information is never retained longer than reasonably necessary to fulfil the purpose for which it was collected. We review these periods at least annually. Deletion may be carried out by secure erasure or by irreversible de-identification.

9. FERPA & School-Affiliated Data

Family-directed use does not by itself make My Athlete a school's service provider. School-directed use may involve education records and obligations under FERPA and other student-privacy laws. Those obligations depend on the actual relationship, records and lawful disclosure basis, not simply on who entered the data or a statement that parents own it.

Schools must obtain their required approval and identify a lawful basis before using My Athlete with student records. Where a school relies on FERPA's school-official exception, the applicable arrangement must address the school's direct control over use and maintenance, authorized educational purposes, redisclosure limits, and return or deletion. Parent consent is not unlimited permission for subsequent use. Contact support@myathlete.team for a school agreement before uploading records that require one. An applicable signed school agreement governs those records; family privacy rights remain available subject to that arrangement and applicable law.

10. Your Privacy Rights by State

United States — All Residents

Comprehensive consumer-privacy laws are in force in California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states. Many apply only to businesses above a size threshold. We extend the rights below to every U.S. resident, whatever your state and whether or not a particular law applies to us.

• Know / Access: Confirm whether we process your personal information and receive a copy of it.
• Correct: Request correction of inaccurate data (most fields can be edited in the app).
• Delete: Request deletion of your data (subject to legal-obligation exceptions), or delete your account in Settings.
• Portability: Receive your data in a portable, machine-readable format (CSV/JSON export).
• Opt out of sale, sharing, and targeted advertising: We do NOT sell personal information, and we never share child, athlete, or health data for advertising. We do use Meta advertising measurement for adult account holders (Section 7), which may constitute "sharing" for cross-context behavioral advertising under California law; Section 12 explains how to opt out, including by Global Privacy Control, which we treat as a valid universal opt-out signal.
• Opt out of profiling: We do not profile anyone in furtherance of decisions that produce legal or similarly significant effects (Section 5).
• Limit use of sensitive data: See Section 4. We process sensitive data (date of birth, sex, growth measurements, health-related check-ins) only with your consent and only for the purposes you requested.
• Appeal: If we decline a request you may appeal (Section 13) and then contact your state Attorney General.
• Non-discrimination: We will never deny service, charge more, or degrade quality because you exercised a right.

To submit a request, email support@myathlete.team with "Privacy Request" in the subject line. Include your account email and enough information to route the request. Section 13 explains verification, request-specific deadlines and appeals. An authorized agent may act for you as applicable law allows.

California

Categories of personal information we collect are listed in Section 2: identifiers and account details; sensitive personal information such as date of birth and health-related measurements; commercial information about subscriptions; internet activity such as feature usage; and inferences limited to growth percentiles and assessment grades. Sources and purposes are in Sections 2 and 5; disclosures for a business purpose are in Section 7. We have not sold personal information in the preceding 12 months. Information collected from consumers we know to be under 16 is treated as sensitive personal information and is never sold or shared. Minors: California residents under 18 may request removal of content they posted in Messages by deleting the post themselves or by contacting us. Shine the Light: we do not disclose personal information to third parties for their own direct marketing.

Colorado, Connecticut, Texas, Oregon & Other States Recognising Universal Opt-Out Signals

We honour the Global Privacy Control signal as an opt-out of sale, sharing, and targeted advertising on our web properties. Where state law requires parental consent to process a known child's data, or opt-in consent before a minor receives targeted advertising, we do not process it without the parent or guardian authorization described in Section 3, and we serve minors no targeted advertising of any kind.

Nevada

We do NOT sell personal information as defined by Nevada law. You can request confirmation at support@myathlete.team. Nevada's consumer health data law is addressed in Section 11.

11. Consumer Health Data Notice

This section applies to information that may be considered Consumer Health Data under applicable U.S. state consumer-health-privacy laws (such as Washington's My Health My Data Act, Nevada's SB 370, and similar laws), to the extent they apply to us. A standalone Consumer Health Data Privacy notice is also published on our website (myathlete.team/consumer-health-data).

Consumer Health Data may include information linked or reasonably linkable to an athlete that relates to physical health or development — for example, body measurements, height, weight, BMI, growth tracking, performance metrics, weekly wellness check-in ratings, cognitive-baseline results, injury or sickness status on game-day reports, league weigh-ins and weight classes, eligibility information that reveals health status, and related support communications.

We use Consumer Health Data only to:

• Provide and operate the app and its features
• Calculate growth percentiles, developmental guidance, and progress tracking
• Provide service communications and support
• Ensure safety, security, and fraud prevention
• Comply with legal obligations and protect legal rights

We do NOT sell Consumer Health Data; use it for targeted or cross-context behavioral advertising; or use it to train AI/ML models (without separate explicit opt-in). We disclose it only to processors under our instructions and, where authorized or otherwise permitted by the applicable health-data law, the team, program, league and assigned certification recipients described in Sections 2, 4 and 7 and our standalone health notice. Collection and sharing consent, when required, are separate choices; an optional-feature opt-in does not authorize every organizational disclosure. You may request access, deletion, correction, or withdrawal of consent at support@myathlete.team.

12. Do Not Sell or Share My Personal Information

We do not sell personal information for money or use child, athlete or Consumer Health Data for advertising. Optional adult Meta measurement may be sharing for advertising purposes. Updated clients and the marketing website keep optional measurement off until an affirmative choice; silence or an unreadable preference is not consent. The app separates product analytics, crash reports and advertising. Essential account, subscription, security and service-delivery processing continues.

• Browser signals: Global Privacy Control and Do Not Track prevent Meta loading and override advertising consent on our website and web app.
• Change your choice: use Privacy choices on the marketing website or Settings → Manage Privacy in the app. Essential Only refuses optional measurement. Choices are stored on the device or browser where made; manage each surface you use. Withdrawal stops new optional collection and does not undo disclosures already made.
• Account-level request: email support@myathlete.team with "Do Not Share" to request an account-level opt-out or deletion of matching data previously disclosed. Server-side purchase matching is paused as described in Section 7.

Opting out does not affect access or pricing. We do not knowingly sell or share personal information of consumers under 16. Advertising measurement is intended for adults only; athlete accounts are excluded.

13. How to Submit a Privacy Request (Workflow & Appeals)

Submitting a Request

To exercise any privacy right (know, access, correct, delete, limit sensitive data, opt out), email support@myathlete.team with "Privacy Request" in the subject line. Include your name, account email, state of residence, and the nature of your request. An authorized agent may submit a request on your behalf with proof of authorization.

Identity Verification & Response Time

For access, correction and deletion, we use verification proportionate to the request and risk, normally confirmation through the account email. We request only what is reasonably needed. Sale/sharing or targeted-advertising opt-outs do not require a verified consumer request; we do not require a new account or identity documents for them. We honor recognized browser opt-out signals directly and may ask for the account email only when needed to apply an account-level choice.

We respond to access, correction and deletion requests within 45 days, or sooner if applicable law requires. We extend only where permitted, with timely notice and reasons. We implement sale/sharing and targeted-advertising opt-outs as soon as practicable and within 15 business days, or any shorter applicable deadline. Consumer Health Data requests and downstream deletion follow the applicable health-data law, including its backup requirements; our general backup window does not extend a statutory deadline.

Appeals

If we deny a request, reply to the denial or email support@myathlete.team with "Privacy Appeal". We explain our decision in writing within 45 days, or sooner where required. You may also contact your state Attorney General or applicable privacy authority, including the California Privacy Protection Agency.

Non-Discrimination

We will not deny service, charge a different price, or provide a different quality of service because you exercised your privacy rights.

14. Push Notifications & Email Communications

Email Communications (added August 31, 2026)

We send service emails (account confirmation, password recovery, team join requests, policy-change notices) as needed to operate the app. Separately, and only with your opt-in, we send a recurring informational email for parents and coaches summarizing youth-sports research and app features. You can opt out at any time using the unsubscribe link in every such email or the toggle in Settings; unsubscribing never affects service emails. Athlete accounts (ages 13–17) are not included in this program. Delivery is processed by Resend on our behalf under service-provider obligations (see Section 7); we retain only aggregate delivery statistics, never email content analytics tied to a child.

We may send service notifications related to your account and use of the app (e.g., subscription confirmations, security alerts, assessment reminders, important updates). These are part of providing the service.

With your separate consent, we may also send marketing or informational notifications (e.g., feature announcements, tips). You can opt out of these at any time in your device settings or by contacting us; opting out of marketing does not stop essential service notifications.

Children: Notifications relating to a minor's profile are sent to the managing parent/guardian or coach account, not directly to children.

Progress reports & staff channels (added September 16, 2026): a coach or program may send an athlete's progress report to that athlete's family through the app (in-app, by a share link, or in print); we record that it was sent and when the family opened it, and nothing about a report goes to anyone outside the family and the team's staff. Messages that a league or program addresses to a staff group (program owners, head coaches, all coaches, staff) reach only the adult staff in that role; a family is never in a staff channel and is never notified of one.

Asking for a store rating (added September 18, 2026): after an earned moment in the app - a milestone on an athlete's record - your phone may show Apple's or Google's own rating prompt. It is the store's prompt, not ours: we never ask how you feel about the app before showing it, we never decide who sees it from an opinion, and we ask at most once per app version and rarely after that. Dismissing it changes nothing. If something is not right, Settings has a direct line to us at any time.

Emails to organizations: the introduction emails described in Section 2 go to organizations, not to app users. A family or athlete account never receives them, and an opt-out is honoured through the do-not-send list.

15. Third-Party Communication Channels

If you communicate with us or with a team through any third-party channel (e.g., email, SMS, or a messaging platform), your use of that channel is also governed by that provider's terms and privacy policy, which we do not control.

Do not post sensitive information in shared or group channels. You should not post medical records, government identification, payment/bank details, or other highly sensitive information in any team chat or group channel where it may be visible to others. To share sensitive information with us for support, use the private contact email above.

16. Children's Privacy

My Athlete is designed for parent/coach management of youth data, not for child-directed marketing, and it is not directed to children under 13. We do NOT:

• Allow children under 13 to create accounts directly (athlete sign-ups must enter a date of birth and under-13 registrations are declined; parent and coach accounts are for adults)
• Collect data directly from children under 13
• Market to children, or use child data for behavioral profiling or targeted ads
• Place any child or teen in a private one-to-one conversation with an adult (there is no direct messaging)

Who enters information about children under 13: Children under 13 may not create or operate their own account. Information about an athlete under 13 comes through an adult's account: a parent or guardian in their own account, a coach who adds or imports the athlete to a team roster, or program or league staff for league play (Section 2). The updated screens a parent, guardian or coach uses to add or import an athlete profile ask them to affirm, before submitting, that they are the athlete's parent or guardian or have the parent or guardian's authorization (Section 3). Program and league staff record league information, such as eligibility rosters and weigh-ins, under their league's rules and our Terms of Service. A parent or guardian can link a coach-created record to their family with a claim code and can then review, correct or delete it; the code shows that an invitation was received, not the legal relationship. If you believe information about a child under 13 was entered without the required authorization, contact us at support@myathlete.team so we can review it and delete information entered without that authorization. If we learn that we collected personal information directly from a child under 13 without the required parental consent, or that information about a child under 13 was entered without the required authorization, we delete it promptly.

Teen Athlete Accounts (Ages 13–17)

Athletes aged 13 to 17 may hold their own account so they can record and view their own progress. We know these account holders are minors, and we treat them accordingly:

• We collect only what the account needs to work: name, email, date of birth, sex, sport, and the measurements and scores the athlete records.
• No marketing email, no advertising measurement (Meta is switched off for athlete accounts), no targeted advertising, no sale of data, and no precise geolocation, ever.
• No private direct messaging; group Messages are visible to the whole team including its parents and guardians. Staff-only channels exist between adult league and program staff, and no athlete account is ever in one.
• The parent-controlled features described in Section 4 (the adult-height estimate, Enhanced Growth Velocity, benchmark contribution) are meant to be enabled by a parent or guardian, not by the teen.
• A parent from day one: A teen must give a parent or guardian's email address when they create the account. We email that parent a link code; once they use it, they can see the teen's progress and manage the account. A parent or guardian may also link later with the same code.
• Parental tools: A linked parent, or any parent or guardian who contacts us and confirms the relationship, may at any time ask us to review, correct, restrict, or delete the teen's account data, or to close the account.
• If an app store provides us an age category or parental-consent signal for an account, we use it only to apply age-appropriate settings and for no other purpose.

Teens: do not enter medical information, and do not post personal details such as your address or phone number in Messages. If anything in the app makes you uncomfortable, tell a parent, a coach, or us at support@myathlete.team.

17. Security & Data Protection

• HTTPS encryption for all data in transit
• AES-256 encryption for data at rest
• Row-Level Security (RLS) policies on our database: each account can reach only the family, team or organization records its role allows
• Security testing of our access rules before database changes, and periodic checks of what an unauthenticated visitor can reach
• Limited staff access to production data (need-to-know basis)

Information Security Program: We maintain a written information security program, coordinated by a designated person (currently our founder), with administrative, technical, and physical safeguards reasonably designed to protect the confidentiality, integrity, and availability of personal information, appropriate to its sensitivity, including information about children. We assess risks to that information and evaluate the program at least once a year, and we test our safeguards regularly.

Data Breach Notification: In the event of a data breach, we will notify affected users and regulators as required by applicable law.

Incident Response & Breach Notification: We maintain an incident-response process. If a breach affects your personal information, we will notify you and any regulator without undue delay and within the time required by applicable law, tell you what happened and what we are doing about it, and never charge for that notice.

Your part: keep your password private, use a unique password, sign out on shared devices, and tell us at once if you suspect unauthorized access. No system is perfectly secure; we cannot guarantee absolute security, but we will always be straightforward with you about incidents.

18. International Users

My Athlete is operated from the United States and directed to U.S. families and coaches. Our servers and service providers are located in the United States, so if you use the app from elsewhere your information is transferred to, stored, and processed in the United States, where privacy laws may differ from those of your country. By using the app you understand that this transfer takes place.

European Economic Area, United Kingdom & Switzerland

If you are in the EEA, the UK, or Switzerland, My Athlete LLC is the controller of your personal data. Our legal bases are: performance of a contract (providing the app you signed up for); consent (children's data entered by a parent, sensitive health-related data, optional features, marketing emails, analytics and advertising measurement, each withdrawable at any time); legitimate interests (security, fraud prevention, service communications, and improving the app, balanced against your rights); and legal obligation. You have the rights of access, rectification, erasure, restriction, portability, and objection; the right to withdraw consent without affecting prior processing; and the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office). Transfers to the United States rely on standard contractual clauses with our service providers or on your explicit consent. We do not appoint a representative in the EEA or UK because we do not target those markets.

Canada, Australia & Elsewhere

Residents of Canada (PIPEDA and provincial laws), Australia (the Privacy Act and the Australian Privacy Principles), and other countries have comparable rights to access and correct their information and to complain to a privacy regulator. We honour those rights on request at support@myathlete.team. Where local law requires parental consent for a minor older than 13, the parent-managed model described in Section 3 applies.

19. Legal Process, Safety, Business Transfers & Other Disclosures

Beyond the service providers in Section 7, we may disclose personal information only:

• To comply with law: in response to a subpoena, court order, lawful request from a public authority, or where disclosure is otherwise required by law. We review each request, disclose only what is legally required, and, unless legally prohibited or the request concerns an emergency or a child's safety, we try to notify the affected account holder.
• To protect people: where we believe in good faith that disclosure is necessary to protect the safety of a child or any person, to investigate suspected abuse of the service, or to prevent fraud or harm. If we receive a credible report that a child is at risk, we may report it to the appropriate authorities.
• To enforce our agreements: to establish, exercise, or defend legal claims, and to enforce the Terms of Service.
• Business transfers: if My Athlete LLC is involved in a merger, acquisition, financing, reorganization, or sale of all or substantially all of its assets, personal information may be transferred as part of that transaction. Any successor must honour this Privacy Policy for the information it receives, and any change in how children's information is used would require fresh parental consent. We will notify you by email and in-app before your information becomes subject to a materially different privacy policy.
• At your direction: when you ask us to (for example a data export you send to a third party, or a coach or program you join).

De-identified and aggregated data that cannot reasonably be linked to any person (for example how many athletes in a sport recorded a test) is not personal information; we may use and share it, and we commit not to try to re-identify it.

20. Changes to This Privacy Policy

We may update this policy from time to time; the "Last updated" date at the top tells you when. For material changes, especially any that would expand how we use or share children's data, sensitive data, or Consumer Health Data, we will give at least 30 days' notice by email and in-app before the change takes effect, and where the law requires it (for example a new use of a child's information) we will obtain fresh consent rather than rely on notice. Continued use of the app after a change takes effect constitutes acceptance of the updated policy for all other changes. Continued use does not replace an affirmative consent required by law. Earlier versions are linked from the change notice and available on request. We review this policy at least once every 12 months.

21. YouTube API Services

My Athlete LLC operates the YouTube channel @MyAthlete, where we publish our own original marketing and educational videos. To publish and schedule that content we use YouTube API Services, both through our own internal publishing tooling and through third-party scheduling tools that we authorize against our own channel.

Because we use YouTube API Services, we are bound by the YouTube Terms of Service. Google's collection and handling of information through those services is described in the Google Privacy Policy.

This does not involve your data. Our use of YouTube API Services is limited to publishing our own videos to our own channel. We do not use YouTube API Services to collect, request, store, or process any information about you, your athletes, or your team. We do not access viewer data, comments, subscriber lists, watch history, or analytics belonging to any other channel or YouTube user, and we do not use any YouTube data for advertising, profiling, or training machine-learning models.

What is stored: the only credential involved is an OAuth token that authorizes our publishing tools to upload videos to our own channel. That token belongs to the channel owner, is never associated with a My Athlete user account, and is held outside the My Athlete application and database. The material we upload is our own marketing and educational content together with its title, description, and category.

Revoking access: the channel owner may revoke our publishing tools' access to the channel at any time through Google's security settings page. Because we store no YouTube user data, there is nothing further for us to delete; any stored authorization credential is destroyed when access is revoked or when the tool is retired.

22. Contact Us

Questions about this Privacy Policy, or to exercise any right described in it:

My Athlete LLC

Email: support@myathlete.team (put "Privacy Request", "Privacy Appeal", "Do Not Share", or "Consumer Health Data Request" in the subject line so we can route it quickly)

Mailing address: 2500 Dallas Hwy, Ste 202-135, Marietta, GA 30064, USA

Phone: 763-447-1271

We aim to acknowledge every privacy inquiry within 5 business days and to resolve it within the statutory deadline.