CompeteHQ ("we," "us," or "our") operates the CompeteHQ web application and mobile application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide

When you register for an account, create or manage a team, or use features of the Service, you may provide us with:

• Account information: name, email address, password, and optional phone number and mailing address
• Profile information: profile photo, role (e.g., head coach, assistant coach, parent), and user preferences
• Team information: team name, season, age group, league, team logo, and team colors
• Roster information: player names, jersey numbers, positions, batting/throwing hand, birth dates, and optional player photos and notes
• Guardian/parent information: names, email addresses, phone numbers, and relationship to the player
• Staff information: coach and staff names, email addresses, phone numbers, and roles
• Coaching content: practice plans, custom drills, block templates, coaching notes, and community-shared content
• Uploaded files: images including team logos, player photos, and profile pictures

1.2 Information Collected Automatically

When you access or use the Service, we may automatically collect:

• Device information: device type, operating system, app version, and unique device identifiers (for push notifications)
• Usage data: pages viewed, features used, and interactions with the Service (collected via Vercel Analytics)
• Error and performance data: crash reports, error logs, and performance metrics (collected via Sentry)
• Log data: IP address, browser type, access times, and referring URLs

1.3 Information from Third-Party Services

If you sign in using Google or Apple, we receive your name and email address from those services. We do not receive or store your Google or Apple passwords.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Create and manage your account and team(s)
• Process and store your practice plans, drills, and coaching content
• Enable team collaboration features (roster sharing, practice distribution, coach delegation)
• Send push notifications you have opted into (practice reminders, delegation alerts)
• Send transactional emails (password resets, team invitations, practice sharing)
• Monitor and improve the performance, security, and reliability of the Service
• Diagnose technical problems and fix bugs
• Enforce our Terms of Service and protect against misuse
• Comply with legal obligations

We do not sell your personal information. We do not use your data for advertising. We do not use your data to train AI or machine learning models.

3. How We Share Your Information

We share your information only in the following circumstances:

3.1 With Your Team

When you join or create a team, certain information (your name, role, and coaching content) is visible to other members of that team. Practice plans you share are visible to coaches on your team. If you share content to the Community feature, it becomes visible to all CompeteHQ users.

3.2 With Service Providers

We use trusted third-party service providers to operate the Service. These providers only access your data as needed to perform services on our behalf and are obligated to protect it:

• MongoDB Atlas— database hosting and storage
• Vercel— application hosting, analytics, and file storage
• Sentry— error tracking and performance monitoring
• Resend— transactional email delivery
• Upstash— rate limiting and background job processing
• Expo (EAS)— mobile push notification delivery
• Google & Apple— authentication (sign-in only)

3.3 For Legal Reasons

We may disclose your information if required to do so by law, in response to a valid legal process (such as a court order or subpoena), or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

3.4 Business Transfers

If CompeteHQ is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.

4. Children's Privacy

CompeteHQ is designed for use by coaches, parents, and other adults involved in youth sports. Children under 13 do not create accounts or directly use the Service.

However, coaches and team administrators may enter information about minor players on their team rosters, including names, jersey numbers, positions, and birth dates. This information is entered by authorized adults (coaches and parents) for the purpose of team management.

We limit the collection of children's information to what is reasonably necessary for team management purposes. We do not:

• Require children to disclose more information than is reasonably necessary
• Use children's information for marketing or advertising
• Share children's information with third parties for their own purposes
• Allow children to make their information publicly available

Parents and guardians may request to review, correct, or delete their child's information at any time by contacting us at support@competehq.io or by contacting their team's head coach. We will respond to verified requests within 30 days.

5. Cookies and Tracking Technologies

We use the following cookies and similar technologies:

• Authentication cookies: essential cookies to keep you signed in and maintain your session (required for the Service to function)
• Analytics: Vercel Analytics collects anonymous page view and performance data to help us improve the Service. This data is not linked to your identity.

We do not use advertising cookies, retargeting pixels, or cross-site tracking. We do not participate in ad networks.

6. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest (passwords hashed using bcrypt)
• JWT-based authentication with secure, httpOnly cookies
• Rate limiting on authentication endpoints to prevent brute-force attacks
• Security headers (Content Security Policy, HSTS, X-Frame-Options, and others)
• Regular security monitoring via Sentry error tracking
• Refresh token rotation with SHA-256 hashing and automatic expiration (mobile app)

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents and notifying affected users as required by law.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide you the Service. Specifically:

• Account data: retained while your account is active, deleted within 30 days of account deletion request
• Team and roster data: retained while the team is active; when a team is deleted, associated player and staff records are deleted
• Coaching content: practice plans and custom drills are deleted when you delete them or when your account is deleted
• Community-shared content: content you share to the Community may remain available after account deletion as an anonymized snapshot
• Authentication tokens: refresh tokens and device tokens automatically expire and are cleaned up via TTL indexes
• Error logs:Sentry error data is retained according to Sentry's retention policies (typically 90 days)

We may retain certain information as required by law or for legitimate business purposes (e.g., resolving disputes, enforcing our Terms). When retention is no longer necessary, we securely delete or anonymize the data.

8. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate information (you can also update most information directly through your account settings)
• Deletion: request deletion of your account and personal information
• Data portability: request a machine-readable copy of your data
• Opt-out of communications: unsubscribe from non-essential emails; disable push notifications in your device settings
• Withdraw consent: where processing is based on consent, you may withdraw at any time

To exercise any of these rights, contact us at support@competehq.io. We will respond to verified requests within 30 days. We will not discriminate against you for exercising your privacy rights.

8.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. As stated above, we do not sell personal information. To submit a request, email support@competehq.io.

8.2 European Residents (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, our legal bases for processing your information are: performance of our contract with you (providing the Service), our legitimate interests (improving and securing the Service), and your consent (where applicable). You have the additional right to lodge a complaint with your local data protection authority.

9. Third-Party Links

The Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the Service with a new "Last Updated" date, and where feasible, by sending you an email notification. Your continued use of the Service after such changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: support@competehq.io
• Website: competehq.io/contact

We aim to respond to all inquiries within 30 days.