Privacy Policy
Last updated: July 19, 2026
START ("we" or "our") is committed to protecting the privacy of our users, particularly the families and minor athletes who use our platform. This policy explains what data we collect, why we collect it, how long we keep it, and your rights regarding your data.
What Data We Collect
| Data Category | Examples | Why We Collect It |
|---|---|---|
| Account Information | Guardian name, email, phone, address | Create your family account, communicate about registrations, process payments |
| Athlete Profiles | Name, birth date, gender, school, structured health and accessibility responses, physician details when supplied, emergency contact, and additional guardian contacts | Register athletes for programs, ensure safety during training, coordinate with coaches |
| Registration Data | Program selection, training group, goals, safety acknowledgments, waiver signatures, and answers to club-defined registration questions | Process program enrollment, capacity management, compliance with liability waivers |
| Payment Records | Invoice amounts, payment status, payment method, Stripe customer and card identifiers, card brand, last four digits, expiry, and installment autopay authorization time/version. Full card numbers and security codes stay with Stripe. | Process fees, maintain financial records, issue receipts |
| Performance Data | Personal bests, race results, meet participation | Track athlete progress, generate rosters, record meet results |
| Media | Photos, videos from practices and meets | Document club activities, promote programs (only with explicit consent) |
| Communication | Chat messages, announcement reads, RSVPs | Coordinate schedules, share club updates, organize volunteer needs |
How We Use Your Data
- Program Registration: Process your athlete's enrollment, manage program capacity, and communicate registration status.
- Safety: Access medical notes and emergency contacts during training sessions and meets.
- Communication: Send club updates, schedule changes, and optional broadcasts based on your preferences. Essential registration confirmations, approval or decline notices, and payment receipts may be emailed regardless of marketing opt-in.
- Financial Management: Generate invoices, process payments, and maintain records for tax purposes.
- Platform Improvement: Aggregate usage patterns to improve the platform (no individual PII is used for analytics).
Operational text messages are optional. If you opt in, START records the phone number, consent text version, time and source. Frequency varies; message and data rates may apply. Reply STOP to revoke consent. Replying START only unblocks the number; sign in to opt in again. Changing your phone number requires fresh consent. Private delivery records support status tracking and spending limits.
Data Retention
We retain data based on the following policies, which are set at the season level by each club:
- Active Seasons: All data is retained in full while a season is active or recently completed.
- Archived Seasons (Indefinite): Data is retained indefinitely for historical records.
- Archived Seasons (Anonymize): After a season is archived, personal identifiers (names, contact info, medical data) are anonymized. Financial records, registration records, and safety acknowledgments are retained for accounting, legal, and compliance purposes.
- Archived Seasons (Delete): After a season is archived, all associated data is soft-deleted and no longer accessible through the platform.
- Payment Records: Retained for a minimum of 7 years regardless of season status, to comply with tax and accounting requirements.
Your Rights
As a guardian using START, you have the following rights regarding your family's data:
- Access: View all data we store about your household through the Settings page.
- Export: Request a complete export of your family's data in JSON format. Use the "Export My Data" button in Settings.
- Correction: Update athlete profiles, account information, and communication preferences at any time through the Settings page.
- Deletion: Contact us to request deletion of specific data. Note that we cannot delete payment records within the legally required retention period.
- Withdrawal: Withdraw any athlete's registration at any time through the My Registration page.
Data Security
- Passwords are hashed using scrypt with random salts before being stored.
- Session tokens are stored in HTTP-only cookies with same-site protection.
- All API endpoints use CSRF token verification for mutation operations.
- Database queries use parameterized statements to prevent SQL injection.
- Rate limiting is applied to login and registration endpoints to prevent brute-force attacks.
Third-Party Services
START does not currently share data with third-party services for marketing or analytics. If we integrate payment processors or email services in the future, this policy will be updated to reflect those relationships.
Children's Privacy
START is designed for use by parents and guardians on behalf of minor athletes. We do not collect data directly from children without guardian consent. All athlete profiles are created and managed by guardians through their account.
A guardian may invite an athlete aged 13 or older (or a higher age set by the club) to a separate athlete login. The athlete chooses their own password and sees only their own schedule, results, and the team chats the club opens to athletes, which their guardians can also see. Athlete logins cannot view billing, documents, or household details, never receive private messages, and receive notifications without message content. The guardian can revoke the login at any time.
Contact
For privacy questions, data requests, or concerns, please contact your club administrator directly, or reach us at privacy@usestart.app.