Privacy Policy

My Athlete LLC · Last updated: September 18, 2026 · Score provenance and the Verified mark described, what the Meta measurement on our website records, how we write to youth-sports organizations and who processes those business contacts, booking a call, the store rating prompt, and the Training option. Nothing here changes how we use or share data about children

1. Our Service & Your Privacy

My Athlete LLC ("My Athlete", "we", "our", or "us") is a youth sports development tracking application that enables parents, guardians, and coaches to record physical measurements, sport-specific assessments, growth tracking, and team collaboration. This Privacy Policy describes what data we collect, how we use it, who we share it with, and the rights and choices you have. It applies to the My Athlete mobile apps, the web app at app.myathlete.team, our website at myathlete.team, and the emails and notifications we send.

Who we are: My Athlete LLC, a Georgia limited liability company, operates the service and is the controller of the personal information described here. Our contact details are in the "Contact Us" section at the end of this policy.

Who this policy covers: parents and guardians; coaches, team administrators, and program or league staff; athletes aged 13 and older who hold their own account; athletes of any age whose data is managed by a parent, guardian, or coach; and visitors to our website. We write in plain language on purpose; where a law gives a term a specific meaning (for example "sell", "share", or "consumer health data") we say so.

Data Protection Commitment: We do NOT sell your data. We do NOT use child data for behavioral advertising. We do NOT share data with third parties except as necessary to operate the app, and only under strict contractual obligations. We collect the minimum we need, keep it only as long as we need it, and delete it when you ask.

2. Information We Collect & Why

We collect only what we need to operate the app. Each data type is retained as noted below:

Data Type	Why We Collect It	Retention
Email, Password	Account login & recovery.	Retained until account deletion + 30 days.
Name, Role	Display & permission model.	Retained until account deletion + 30 days.
Date of Birth (DOB) ⚠️ sensitive	Age-group assessment matching; age-appropriate developmental guidance per LTAD research; COPPA compliance.	Retained until account deletion + 30 days.
Biological Sex ⚠️ sensitive	Sex-specific CDC percentiles & sport-category eligibility.	Retained until account deletion + 30 days.
Height, Weight, BMI ⚠️ sensitive	Growth tracking & CDC percentile benchmarks; general training-safety awareness and age-appropriate exercise guidance.	Retained until account deletion + 30 days.
Assessment Scores & Performance Metrics	Skill tracking & benchmarking.	Retained until account deletion + 30 days.
Score Provenance & the Verified Mark (added September 18, 2026)	For each score: who recorded it (the account and its role), the date, and - where the recorder said so - the timing method, measurement method, trial number, and whether it came from a Measurement Day, an imported event or a documented protocol. Our servers use only that provenance to decide whether a score carries the Verified mark; the mark describes how a result was recorded, never how good an athlete is, and it is not shared with anyone the score itself is not.	Retained with the score and deleted with it.
Messages, Comments & Community Activity (if feature enabled)	Posts and comments you write in team/program/league Messages, read receipts, focus-item completion marks, and any reports or blocks you file. Visible to the group they were posted to (see Section 7 → Community Content Visibility).	Retained until deleted by you or group staff, or account deletion + 30 days.
Schedule, RSVPs & Attendance (if your program uses the Schedule)	Event details and locations posted by your coach or program to a team calendar, your per-athlete RSVP answers and any note you add to them, and attendance marks your coach records. Visible to the team or program the event is posted to (see Section 7 → Schedule Visibility); attendance marks only to the athlete's own family and the program's staff.	Retained while the team or program keeps the event (staff can remove it), and removed with your account as described in Section 8.
Weekly Wellness Check-In Ratings (if feature enabled)	Simple 1–5 self-reported family ratings (sleep, energy, mood, soreness) recorded by a parent/guardian for their own athlete; displayed back to the family only. Informational — not medical records or health monitoring (see Section 6).	Retained until account deletion + 30 days.
Team Roster (name + role)	Coach collaboration & team leaderboards. A coach can view a rostered athlete's data only while the athlete is on an active roster. When a season ends, the coach keeps read-only access limited to that season's records; when a parent/athlete leaves a team, the coach's access ends immediately.	Retained until team deletion + 30 days.
Coach-Created Play & Tactics Data	Plays, formations, and token layouts created by coaches on the Tactics Board. Linked to the coach's account and team — not personal athlete data.	Retained until team or account deletion + 30 days.
Analytics Dashboard Activity	Aggregated views of team assessment scores, roster activity, and growth data already collected above. No new data is collected by the Analytics Dashboard; it only computes summary statistics from existing records.	—
Event Timestamps, Feature Usage	Product analytics (PostHog); anonymized after 30 days, deleted after 90 days.	—
Crash Logs, Error Traces	Bug fixing & security (Sentry).	Retained 90 days; then deleted.
IP Address, Device Type	Security & abuse prevention.	Retained 180 days; then deleted.
Install & Marketing Attribution	A referral code you enter, tracked-link parameters (UTM tags, ad click IDs, including the tag that marks a link from one of our own emails to an organization), and on Android the Google Play install-referrer string — used to measure which marketing produced an install or signup and to credit partner referrals. Describes how the adult account creator arrived; never collected from or about athletes' profiles.	Retained until account deletion + 30 days.
Website Page Views	On myathlete.team only: the page path, tracked-link parameters (UTM tags), the referring site's domain, and whether the screen is phone-sized — sent by a small script on our own pages so we can count which ad or link led to a page view and to a sign-up. No cookies and no account are involved; the IP address is used only to limit request volume and is not stored. Individual rows are deleted after 13 months; only aggregate counts are kept longer. (Added September 17, 2026.)	—
Sign-in Provider Details (Sign in with Apple / Google)	If you sign in with Apple or Google, the provider sends us your name and email address (Apple may send a private relay address instead of your real one) so we can create and recognise your account. We never receive your provider password and we do not store profile photos.	Retained until account deletion + 30 days.
Push Notification Token	A device token issued by Apple or Google so we can deliver the notifications you enable.	Retained until you disable notifications, sign out on that device, or delete your account.
Consent & Acceptance Records	The date and document version of your acceptance of the Terms and this Privacy Policy, parental-consent confirmations, feature opt-ins (for example the adult-height estimate, Enhanced Growth Velocity, or benchmark contribution) and email preferences, kept so we can demonstrate what was agreed and honour your choices.	Retained until account deletion + 30 days.
Support Communications	Emails and messages you send us, so we can respond and improve support.	Retained 2 years after the conversation closes, then deleted.
Parent/Guardian Email (teen accounts)	Given by an athlete aged 13–17 when they create their own account, so we can email that parent or guardian a code to link to the teen's profile. Used only for that invitation and to honour parental requests; never for marketing.	Retained until account deletion + 30 days.

Try-before-you-register data: the optional guest reaction test stores its result only on your device. Nothing is sent to us unless you later create an account, at which point the score attaches to the athlete profile you create and follows the retention rules above.

Programs, Leagues & Competitions (added September 16, 2026)

A coach's team can belong to a program (a club or a school's athletics program), and a program can belong to a league. Staff of those organizations use the app to run a season, and the app stores what a season needs. None of it is collected from a family directly: it is entered by the organization's staff or by a coach, or computed from scores and results already in the app.

Data Type	Why We Collect It	Retention
Competition structure	The league's competitions, divisions, regions and the TEAM names in them (a school or program name, never a person).	Retained while the competition exists; deleted with the competition or the league.
Fixtures, scores & standings	Games between teams, scores submitted by a coach or by league staff (with corrections kept as a record), and the region and overall standings, tie-break outcomes and playoff brackets the app computes from them. Team-level records only.	Retained with the competition.
Certified eligibility roster ⚠️ sensitive	Per league team: an athlete's name (or the name the league listed), jersey number and eligibility status (pending, eligible, restricted, playing down, suspended, ineligible); who affirmed the row (the team's own coach or program staff, by typed name) and who certified it (a person from a different program the league assigned, or league staff, by typed name); the residency OUTCOME the certifier checked (in district, an approved exception and the season it covers, or out of district) with a short note; and two checks (birth date verified against the league's record, waiver on file). The app never stores the athlete's address, birth certificate or waiver itself. Visible to the league's staff, the program's staff, the team's coach and the assigned certifying program; the opposing team's coach may read it within a day of a scheduled game; never public.	Retained with the competition.
Certification photo ⚠️ sensitive	Where a league checks identity at certification with a headshot: one small photo of the athlete in uniform, taken by league staff on the web app and only after the parent's separate written consent is recorded (a signed consent page the league files, with its date). Visible to that league's staff ONLY — never to families, coaches or program staff through the app, never on a report, certificate, leaderboard, public page or export. Withdrawing the consent deletes the photo the same instant; the photo is also deleted with the roster row and the competition. See Section 4.	—
Game-day report ⚠️ sensitive	Filed by a coach before a game: athletes sitting out an ejection, injured/absent/sick athletes (names only, no medical detail), discipline entries, jersey changes, and the coach's typed signature. Visible to league staff and the two teams' coaches; never public.	Retained with the competition.
League weigh-in ⚠️ sensitive	For divisions a league's rules define by weight: an athlete's weight in pounds on a date and a weight class, recorded by league or program staff at certification. Visible to that staff ONLY — never to families or coaches through the app, never on a report, certificate, leaderboard or export. Retained with the competition. See Section 4.	—
Competition audit log	Who changed what and when inside a competition (account IDs and the change), append-only, readable by league staff.	Retained with the competition.
Message audience	A post a league or program addresses to a staff group (program owners, head coaches, all coaches, staff) instead of to everyone; who may read it is decided by role inside the organization.	Retained with the post.
Training block & report delivery	A coach's training block on a team (a date window, the Measurement Days that begin and end it, the tests it measures) and a record of each progress report sent to an athlete's family (which report, to which family account, when, and whether the family opened it).	Retained with the team.
Attendance, certificates & leaderboards	Attendance marks per event (present, late, absent) recorded by a coach; a printable milestone certificate showing the athlete's first name and the milestone; team and program leaderboards showing initials.	Retained with the team.

Data We Do NOT Collect

• Precise GPS location (no location-based ads, tracking, or geofencing)
• Photos or videos of athletes — the app has no photo or video upload (the exercise library is curated, not user-generated). The one exception is a league certification photo, taken by league staff on the web app only with the parent's separate written consent (Section 4)
• Camera, microphone, contacts, or calendar access — the app does not request these permissions
• Biometric identifiers (fingerprints, face geometry, voiceprints)
• Government-issued identifiers (e.g., Social Security, driver's license, or passport numbers)
• Payment card numbers, bank details, or billing addresses (the app stores handle family and coach subscriptions; Stripe handles Program Plan payments)
• Persistent identifiers used for cross-app tracking or ad targeting (no IDFA, no Android Advertising ID)
• Sensitive health data beyond growth/performance (no psychiatric, sexual, or substance-abuse information; no medical records)
• Data purchased from data brokers or appended from outside sources about you (the team-level schedules and scores we read from a league's own public website are about teams, not people — see below)

Where Your Information Comes From

Almost everything we hold was typed into the app by you or by the parent, guardian, or coach who manages an athlete. The only outside sources are the sign-in provider you choose (Apple or Google); the app store that processes your subscription (purchase status via RevenueCat, never card details); the delivery and crash-reporting services that report back whether an email, notification, or app session succeeded; and the marketing-attribution parameters described above. For a league that runs its season on the app, we also read that league's own public website (its published schedule, score and standings pages) to keep the team's calendar and the standings in step; those pages hold team names, dates, venues and scores, and we take nothing about a person from them. We do not buy data about you and we do not combine your data with outside profiles.

Organizations We Write To & Booking a Call (added September 18, 2026)

Business contacts at youth-sports organizations. To tell programs, leagues, gyms and trainers that the app exists, we keep a list of organizations and, for each, a role-based business address (a program's general inbox or a staff role's address published on the organization's own website or in a public youth-sports directory), the organization's name and sport, and what its own public pages say about it. We do not add a named person's address at a free consumer email provider, we take nothing about families or athletes from those pages, and we do not buy lists. We use the list to send a small number of emails introducing the app and to record who asked us to stop. Every such email carries our postal address and a plain way to opt out (reply "no thanks" or use the link); an opt-out goes on a do-not-send list that we keep for as long as we send mail, so that it is honoured. Three providers process this list on our behalf and nothing else: Smartlead sends the mail and records replies, Mission Inbox hosts the mailboxes it goes from, and EmailListVerify checks that an address exists before we write to it. None of them receives app-user, family, athlete or health data. If you want your organization's address removed, write to us and we will remove it, keeping only the record that you asked.

Booking a call with us. If you book a call from our website, Google's appointment page collects your name, email address and the time you chose under Google's own privacy policy, and the booking appears in our calendar. We use it only to hold the call.

Cookies, Local Storage & Similar Technologies

Web app (app.myathlete.team): we use browser local storage to keep you signed in, to remember your consent and display preferences, and to cache data for offline use. Product analytics (PostHog) sets a pseudonymous identifier tied to your account ID. If Meta advertising measurement loads (Sections 7 and 12 explain exactly when it can and how to opt out), Meta may set its own cookies (for example _fbp) governed by Meta's policies.

Marketing website (myathlete.team): we set no analytics cookies of our own; our hosting provider (Cloudflare) may collect aggregate, cookieless performance and security metrics. The site loads Meta's measurement code only if your browser does not send a Global Privacy Control or Do Not Track signal; it records that a page was viewed, how far down it was scrolled, whether the sign-up button came into view, and that a download or sign-up button was clicked, never anything about an athlete. No other third-party advertising cookies are used.

Mobile apps: no cookies. The apps store your session, preferences, and offline cache on the device only.

3. Verifiable Parental Consent (COPPA)

Path A: Parent Adds Their Own Child

When a parent/guardian registers an account and enters their child's information (DOB, sex, measurements, assessments), by saving that data you provide verifiable parental consent under COPPA (15 U.S.C. § 6501) for us to store the child's date of birth and demographics, calculate developmental stage guidance and CDC growth percentiles, enable coach collaboration if the child joins a team, and provide exercise and wellness guidance via the app.

What we log: Parent email address, account creation timestamp, athlete ID, and acceptance of this Privacy Policy. These records are retained for 30 days after account deletion for compliance audit purposes.

Path B: Coach Adds a Minor (Claim-Code Flow)

When a coach creates an athlete profile and generates a unique "claim code" to share with a parent/guardian:

• Coach creates a limited pending profile: The coach enters only the minimal placeholder information needed to generate a 6-character claim code (expires in 30 days) — for example, a first name or jersey label and the sport. Sensitive details such as full name, date of birth, biological sex, and measurements are not required and should not be entered at this step.
• Parent receives code: Parent registers an account (if needed) and agrees to our Terms and Privacy Policy.
• Parent enters claim code: Before the claim is final, we show a full COPPA consent screen confirming the parent/guardian relationship, authorizing storage of the athlete's name, age, sex, and performance data, accepting the Assumption of Risk for exercise content, and accepting the Terms and Privacy Policy.
• Consent recorded: Parent email, timestamp, claim code, athlete ID, coach email, and acceptance are logged.

Annual Re-Consent: At each subscription renewal (or annually if free), before first access to the Exercise Library that period, we re-present the Assumption-of-Risk consent. This maintains fresh, informed consent for ongoing exercise access.

Coach Responsibility for Consent

When a coach adds athletes, creates team rosters, or enters any personal information about individuals into the app, the coach — not My Athlete LLC — is responsible for ensuring that the necessary parental or guardian consent has been obtained before entering that information. By entering another person's data, the coach represents and warrants that they have the right to provide that information to us. The claim-code flow above exists so that the parent's own consent is recorded with us before any sensitive detail is stored.

Parent Rights Under COPPA

• Review: Access all data we hold about your child in the app, or ask us for a copy.
• Refuse further collection: You may refuse to permit further collection or use of your child's information at any time; we will then stop and delete what we hold, which may make the athlete profile unusable.
• Request Deletion: Delete your child's profile yourself in the app, or ask us; all profiles, scores, and measurements are deleted within 30 days.
• Request Export: Receive your child's data in CSV or JSON format.
• Opt-Out: Disable optional features (e.g., Combine Benchmarks, Cognitive Baseline, the adult-height estimate, Enhanced Growth Velocity, benchmark contribution); some core features are required for the app to function.

No over-collection: We do not condition a child's participation in any activity on the child disclosing more personal information than is reasonably necessary to participate. A coach-created pending profile needs only a first name or jersey label and a sport.

How we verify a parent's request: we confirm control of the parent account email that manages the athlete; where a request comes from someone other than the managing account, we ask for reasonable proof of the parent or guardian relationship before acting.

To exercise these rights, use the app or contact us at [email protected]. Our full operator contact details are in the "Contact Us" section at the end of this policy.

4. Sensitive Health Data & DOB Justification

Age (Date of Birth): We collect DOB because it enables age-appropriate assessment recommendations and calculates Peak Height Velocity (PHV), which guides training intensity during growth-sensitive windows (ages 11–15 typically). This is supported by published LTAD (Long-Term Athlete Development) frameworks.

Growth Measurements (Height/Weight/BMI): We collect these because CDC growth percentiles show how an athlete's development compares to age/sex peers. If you prefer not to provide DOB or growth data, some app features will be unavailable; the app will notify you of these limits.

Your Right to Limit Use of Sensitive Data

You may request that we limit the use of an athlete's sensitive data (date of birth, biological sex, height, weight, and BMI) solely to (1) providing the service you requested, (2) ensuring safety and security, and (3) complying with our legal obligations. We do not use sensitive data for advertising, profiling, or any secondary purpose. To exercise this right, contact [email protected].

Not Protected Health Information (PHI): My Athlete is not a healthcare provider and does not provide medical or healthcare services. The growth and performance data we collect is not "protected health information" (PHI) under HIPAA. However, we treat it as sensitive and protect it accordingly.

Optional Estimated Adult Height Range

My Athlete may offer an optional feature that estimates an athlete's possible adult-height range using the athlete's growth measurements, age, biological sex, publicly available CDC growth-reference data, and parent-entered biological parent heights. This feature is parent/guardian-controlled and may be disabled at any time. We store the parents' entered heights and a timestamped record of the opt-in consent; you may remove the parent heights or turn the feature off whenever you like.

The estimate is provided for general informational and educational purposes only. It is not a medical assessment, diagnosis, screening tool, growth evaluation, or guarantee of adult height. It does not determine whether an athlete's growth is normal, abnormal, delayed, advanced, or medically concerning. Many factors affect growth, and actual adult height may fall outside the estimated range. For individualized growth questions, consult a pediatrician or qualified healthcare professional.

How this data is handled: Only a parent or guardian may enable this feature or enter the biological parents' heights. We use the parent heights, the athlete's measurements, and the derived estimate only to provide and display the estimate and to keep the consent record — never for advertising, profiling, or any unrelated purpose, and we do not sell it. If you remove the parent heights or turn the feature off, we delete those height values and the derived estimate; we keep only the minimal opt-in/consent record as needed for security and legal compliance (see Section 8).

Optional Enhanced Growth Velocity

My Athlete offers an optional Enhanced Growth Velocity feature that lets a parent or legal guardian record an athlete's body measurements over time — standing height, weight, sitting height (and the height of the box/stool used), and optional left/right foot length — and view observed changes based on those measurements. Shoe size, if entered, is stored only as context and is never used in any calculation. From what you enter, we calculate raw change since a previous session, annualized observed rates of change, derived leg length and body-segment ratios, and a measurement-quality rating (how well the session was measured — not confidence in the athlete's biological status). This feature is informational and educational only.

It does not diagnose or detect peak height velocity, puberty, biological maturity, a growth disorder, abnormal growth, a medical condition, or injury risk, and it is not a substitute for a pediatrician or other qualified healthcare professional. Annualized rates are estimates and can be affected by measurement technique, equipment, posture, clothing, time of day, and the length of the interval between sessions.

Parent control & visibility: Enhanced Growth Velocity is parent-controlled and private by default. Growth-measurement data is not shown on public profiles or leaderboards and is not available to coaches. Any future option to give a coach access would require a separate, affirmative parent choice. You can edit or delete individual sessions, or delete the athlete's complete growth-measurement history, at any time. We record a versioned opt-in consent (who agreed, when, and to which text). We do not sell this data, disclose it to data brokers, or use it for targeted or cross-context behavioral advertising; we disclose it only to service providers that host, secure, and operate the app on our behalf, when you direct us to, or when legally required. Please do not enter medical diagnoses, Tanner stage, puberty status, or other intimate information in notes.

League Weigh-Ins (added September 16, 2026)

Some youth leagues define a division by weight, and their rules require a weigh-in at certification. Where a league runs its season on the app, league staff and the program's staff may record an athlete's weigh-in (pounds, a date, a weight class) for that purpose. This is the only weight in the app that a family does not enter itself: it is visible to that league's and program's staff only, it is never shown to the team's coach, to the family or on any family surface, and it is never used in a report, certificate, leaderboard or export. It is not used for any other purpose, is not shared with anyone else, and is deleted with the competition. A family may ask the league what it recorded and may ask us to delete it (Section 13). The family's own growth measurements above remain separate and remain the family's to control.

Certification Photos (added September 16, 2026)

Some youth leagues check a player's identity at certification and on game day with a headshot in uniform. Where a league runs its season on the app, its staff may keep one such photo per athlete, and only after the parent or guardian's separate written consent is recorded — the league files the signed consent page with its date, and the app records that it did — or the parent or guardian gives that consent in the app, from their athlete's card in Settings, where they can withdraw it at any time; the app records the date and the policy version they agreed to. The photo is taken on the web app, reduced to a small image, and stored with the athlete's roster row. It is visible to that league's staff only: it is never shown to families, coaches or program staff through the app, and it is never used on a report, certificate, leaderboard, public page or export. It is not used for any other purpose, is not shared with anyone else, and is not used for facial recognition or any automated matching. A parent or guardian may withdraw consent at any time through the league or by asking us (Section 13); the photo is deleted the instant the consent is withdrawn, and in any case with the roster row and the competition.

5. How We Use Your Information

• Calculate CDC growth percentiles and equivalent ages
• Grade and track athletic assessment progress
• Display developmental stage recommendations based on age and LTAD research
• Enable team collaboration between coaches and parents
• Provide age-appropriate exercise guidance and wellness resources
• Improve the app (anonymized analytics)
• Comply with legal obligations (data retention, breach notification)

We do NOT use child data for behavioral profiling, targeted advertising, or marketing. We do NOT share data with ad networks or data brokers.

Marketing Content & AI Tools

Some images, videos, or other marketing materials on our website, social media, or advertising may be created or edited using third-party design, editing, or generative-AI tools. We do not use personal information from children, athletes, parents, coaches, or other users to create synthetic marketing content.

No AI / Machine-Learning Training Without Consent

We do NOT use identifiable personal data, athlete health/fitness data, growth measurements, performance scores, images, or private support communications to train artificial-intelligence or machine-learning models, unless you provide a separate, explicit, opt-in consent for that specific purpose. We may use fully aggregated or anonymized data to improve the app and analyze performance.

Optional Benchmark Contribution (Per-Athlete Opt-In)

Where offered, a parent or guardian may choose, separately for each athlete, to let us use that athlete's de-identified assessment scores, together with age at test, sex, sport, position, measurement protocol, timing method, event or site, and verification status, to build aggregate benchmark and percentile reference tables. Individual scores and identity are never published. Declining or withdrawing has no effect on score recording, reports, team access, or any other feature. Permission covers only eligible scores recorded after it is granted, and it can be withdrawn at any time for future benchmark releases; withdrawal does not retract aggregate tables already built without identifying data. We record which version of the permission text was agreed to, and when.

No Automated Decisions With Legal or Similar Effects

Percentiles, grades, "equivalent age" outputs, and other calculations in the app are informational estimates shown to you and to the coaches you authorize. We do not use personal information to make automated decisions that produce legal or similarly significant effects about you or an athlete (for example decisions about eligibility, selection, pricing, or access), and we do not profile users for such purposes.

6. Exercise & Wellness Content — Liability Disclaimer

My Athlete includes an Exercise Library with 1,900+ demonstration videos, coaching cues, and instructional content (licensed). This content is provided for educational reference only and is NOT medical advice, medical treatment, or rehabilitation protocol.

Important Safety Precautions

• Not a Substitute for Professional Coaching: Always consult a qualified coach, athletic trainer, or physician before beginning new training.
• Medical Clearance Required: Ensure the athlete has medical clearance for physical activity before performing any exercise or assessment.
• Adult Supervision: All exercise should be performed under the supervision of a qualified coach or responsible adult.
• Stop if Pain Occurs: Discontinue immediately on sharp pain, dizziness, shortness of breath, or other concerning symptoms.
• Age-Appropriateness: Screen content for the athlete's age, ability level, and available environment.
• Assumption of Risk: By accessing the Exercise Library, you accept full responsibility for any injury, loss, or damage arising from exercise use. My Athlete LLC is not liable for such injury.

Wellness Guides & Weekly Check-Ins

The app's nutrition, recovery, and sleep guides are general educational content for families, drawn from published consensus guidance. They are not medical, dietetic, or training advice; they are never individualized to a specific athlete; and they do not diagnose, screen for, treat, or monitor any condition. For guidance specific to your athlete, consult your pediatrician or a registered dietitian nutritionist.

If enabled, the weekly wellness check-in lets a parent or guardian record simple 1–5 ratings (such as sleep, energy, mood, and soreness) for their own athlete. These entries are self-reported, informational family notes — not medical records, symptom tracking, or health monitoring. My Athlete LLC does not review these entries, draws no conclusions or alerts from them, and has no duty to detect, interpret, or act on anything they may reflect. Do not use check-ins to record medical information; contact a healthcare professional directly with any health concern.

7. Third-Party Processors & Data Sharing

We do NOT sell or rent your data. We share data only with trusted service providers who process data solely to operate the app on our behalf:

• Supabase (database + authentication): Hosts athlete profiles, assessments, team data. AWS us-east-1 (United States); encrypted in transit (HTTPS) and at rest.
• Cloudflare (web hosting, delivery, security): Serves the website, the web app, and Exercise Library videos, and protects them from abuse. May collect aggregate, cookieless performance and security metrics.
• Apple and Google (sign-in, app distribution, push delivery): If you use Sign in with Apple or Google, the provider authenticates you and sends us your name and email. Apple and Google also process your subscription purchase under their own terms and deliver push notifications to your device (Expo's push service relays them on our behalf; the notification text passes through it and is not retained for any other purpose).
• Resend (email delivery): Sends service emails and, only if you opted in, our informational newsletter. Receives your email address and the message content; reports delivery, bounce, and unsubscribe events back to us.
• PostHog (product analytics): Feature-usage events tied to a pseudonymous account ID and role only, with no name, email, or athlete data. Contractually limited to providing analytics on our behalf; does NOT profile children or serve targeted ads.
• Sentry (crash & error reporting): Crash logs and diagnostics to fix bugs, tagged with an account ID only. Contractually limited to providing crash diagnostics on our behalf; sensitive data is filtered.
• RevenueCat (subscription processing): Processes in-app subscriptions via the Apple App Store and Google Play. Payment card data is NOT sent to us or to RevenueCat.
• Stripe (Program Plan payments): Processes the card payment when an organization buys a Program Plan on our website. Stripe receives the payer's name, email, business name and card details and handles them under its own privacy policy; card data is never sent to us. We keep a record of each purchase (name, email, business name, amount and Stripe's reference identifiers) as described in Section 8. Stripe receives no athlete, family or health information of any kind.
• Meta (advertising measurement — adults only): We run ads on Facebook and Instagram to reach parents and coaches, and we measure which ads work. On the web, Meta's measurement code loads only on our marketing website and on the web app's sign-in, sign-up, and plan pages, and never on any screen that shows or records growth, assessment, wellness, or other health-related information, so the address of such a screen is never sent to Meta. It records that a page view, registration, or subscription occurred and, on the marketing website only, how far down a page was scrolled and whether the sign-up button came into view, with no direct identifiers, and it does not load at all if you decline analytics or your browser sends a Global Privacy Control or Do Not Track signal. In the mobile apps, it records only that the app was installed or opened and, for adult parent and coach accounts only and never athlete accounts, that a registration occurred. Advertising-identifier collection is disabled (no IDFA, no Android Advertising ID), we do not request iOS tracking permission because we do not track, Meta's Limited Data Use restriction is enabled, and iOS ad attribution for Meta campaigns flows only through Apple's aggregate, anonymous SKAdNetwork. If we run ads on the App Store itself, iOS may additionally provide us Apple's own AdServices attribution: a record of which Apple Ads campaign preceded an install, containing campaign identifiers only and no user or device identifier of any kind, which our subscription processor uses to measure, in aggregate, which campaigns lead to subscriptions. On every surface we send Meta no athlete or child information of any kind and no Consumer Health Data. When an adult subscribes, our server may send a one-way cryptographic hash of that adult's own email and account ID solely to match the purchase to the ad that produced it. Meta is not a service provider acting solely on our behalf for this purpose; see Section 12 for your choices.

Programs and leagues (added September 16, 2026): when a coach links a team to a program, or a program joins a league, the staff of that organization can see what their role needs and nothing more. Program staff see their teams' rosters, attendance, the progress reports a coach sends and the eligibility rows for their teams. League staff see every team's eligibility rows, game-day reports, scores, standings, brackets and the audit log, and record weigh-ins where their rules need them. No organization sees a family's growth measurements, wellness check-ins or private notes. Organization staff are bound by the Terms of Service (Section 6) and by their own athlete-safety and privacy obligations; ask the organization what it does with the data it records.

Smartlead, Mission Inbox and EmailListVerify (introduction emails to organizations): process only the business-contact list described in Section 2 - an organization's name and a role-based business address - to send our introduction emails, host the mailboxes they go from, and check that an address exists. They receive no app-user, family, athlete or health data of any kind.

Google Calendar appointment scheduling (booking a call): when someone books a call from our website, Google's page collects their name, email address and chosen time under Google's own privacy policy and shows the booking in our calendar.

Public competition page: a league may switch on a login-free web page for a competition that shows team names, the schedule, finalized scores, standings and brackets. That page shows no person — no athlete, no roster, no coach, no family, no report, no weigh-in — and it is served only while the league keeps the switch on. The league decides whether to publish it and is responsible for that decision.

Service-Provider Obligations: Our service providers (Supabase, Cloudflare, Resend, Expo, PostHog, Sentry, RevenueCat, Stripe, Smartlead, Mission Inbox, EmailListVerify) are contractually required to process personal information only on our behalf, only to provide their services, and not for targeted advertising, profiling, or independent commercial use. Apple and Google act under their own developer and platform terms.

Consent to Collection Is Separate from Third-Party Sharing: Your consent for us to collect and use a child's information does not authorize us to disclose that information to third parties for any purpose beyond operating the app (such as advertising or profiling). We do not make such disclosures. If we ever proposed to share a child's personal information with a third party for a non-core purpose, we would first obtain separate verifiable parental consent.

Categories of Third Parties & Affiliates

For readers whose state law asks for it in these terms: the categories of third parties that may receive personal information are (1) hosting, database, and content-delivery providers; (2) sign-in, app-distribution, payment, and push-delivery platforms (Apple, Google); (3) email delivery, analytics, and crash-reporting providers; (4) an advertising-measurement partner (Meta), which receives no child, athlete, or health data; (5) the coaches and group members you or your athlete's parent choose to share with (see "Community Content Visibility" below and Section 6 of the Terms of Service); and (6) authorities or other parties where required by law (Section 19). We have no affiliates or subsidiaries and share no data with any. The named providers above are the complete list of third parties with whom Consumer Health Data is shared.

Community Content Visibility (Messages, if feature enabled)

Posts and comments in the Messages feature are shared with the group they are posted to — the team, program, or league — meaning every coach, staff member, parent/guardian, and athlete account holder who belongs to that group can read them, along with the author's display name. This sharing is user-directed (you choose to post) and group-internal; it is not disclosure to outside third parties. There is no private direct messaging. A league or program may address a post to a staff group (program owners, head coaches, all coaches, staff) instead of to everyone; such a post is readable only by the adult staff in that role and never by an athlete or a family account. Coaches and organization staff can additionally see whether group members have seen a post ("Seen by" counts) and, for attached training items, per-athlete completion status. Group staff and My Athlete may remove content under the Terms of Service Acceptable Use rules.

Schedule Visibility (Events, RSVPs & Attendance, if your program uses the Schedule)

Events a coach or program posts to a team calendar — the title, time, location and notes — are shared with that team or program in the same way as Messages: every coach, staff member, parent/guardian and athlete account holder who belongs to the group can see them, along with the poster's display name. Each athlete's RSVP answer, and any note added to it, is visible to that same group and its staff. Attendance marks are narrower: they are visible only to the athlete's own family and to the program's staff. Posting is user-directed and group-internal; it is not disclosure to outside third parties.

8. Data Deletion & Retention Schedule

When You Delete Your Account

• Immediate: All athlete profiles, assessment scores, growth measurements, wellness check-ins, team memberships, and exercise history are removed from the live database, and your sign-in is deleted. Teams you coach are deleted with their rosters, their Messages and their events; a family that has claimed its athlete keeps its own copy of that athlete's history. Messages and events you posted to another coach's team or to a program stay with that group under your name as it was, so the group's record is not broken; your comments are deleted. RSVP answers and attendance marks you recorded stay with the athlete but are no longer tied to you.
• Within 30 days: Remaining application data (consent logs, delivery records) is purged from primary storage, except the records listed below.
• Backup/Disaster Recovery: Backup copies may persist up to 180 days for system recovery; these are not accessed in the ordinary course and are automatically overwritten.
• Anonymized Analytics: Feature-usage events anonymized after 30 days, fully deleted after 90 days.
• Payment Records: Subscription/payment history (never card numbers) retained for 7 years per tax-record requirements. For a Program Plan purchase this record is the buyer's name, email, business name, the amount paid and Stripe's reference identifiers.
• Support Correspondence: Retained up to 2 years so we can resolve any follow-up dispute.
• Legal Holds: Where we are legally required to preserve information (for example for a pending dispute, a regulator's request, or a child-safety report) we keep only what the obligation requires, for as long as it lasts.
• Competition & program records: a league's competition data (structure, fixtures, scores, standings, eligibility rows, game-day reports, weigh-ins and the audit log) is retained while the competition exists and is deleted when the league deletes the competition or its account; an athlete's eligibility and weigh-in rows are also deleted when that athlete's family deletes the athlete. A coach's training blocks and report-delivery records are deleted with the team.

Inactive Accounts

An account with no activity (no sign-ins, assessments, or data changes) for 24 consecutive months becomes eligible for deletion. Before deleting, we send a notice to the registered email address and wait at least 30 days; signing in during that time keeps the account. Athlete data managed under an inactive coach account is handled the same way, and families who have claimed their athlete keep their own copy regardless.

Written Retention Policy

We do not retain personal information indefinitely. We maintain a written data-retention policy; the retention periods listed in Section 2 and in this section are that policy. We delete or de-identify data once it is no longer reasonably necessary for the specific purpose for which it was collected, or as required by law, and children's personal information is never retained longer than reasonably necessary to fulfil the purpose for which it was collected. We review these periods at least annually. Deletion may be carried out by secure erasure or by irreversible de-identification.

9. FERPA & School-Affiliated Data

If your team is school-affiliated, be aware of FERPA (Family Educational Rights and Privacy Act):

• My Athlete is NOT a "School Official": We do not maintain education records on behalf of your school. Parents own the data.
• Data Ownership: Parents retain ownership and can delete athlete profiles or revoke coach access anytime, regardless of school involvement.
• School Policy Compliance: If your school prohibits non-approved third-party tools, consult your administration first. My Athlete LLC is not liable for your violation of school policy.
• School DPA Available: If your school requests a Data Processing Agreement (DPA), contact us at [email protected]. We can provide one at no cost.

10. Your Privacy Rights by State

United States — All Residents

Comprehensive consumer-privacy laws are in force in California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states. Many apply only to businesses above a size threshold. We extend the rights below to every U.S. resident, whatever your state and whether or not a particular law applies to us.

• Know / Access: Confirm whether we process your personal information and receive a copy of it.
• Correct: Request correction of inaccurate data (most fields can be edited in the app).
• Delete: Request deletion of your data (subject to legal-obligation exceptions), or delete your account in Settings.
• Portability: Receive your data in a portable, machine-readable format (CSV/JSON export).
• Opt out of sale, sharing, and targeted advertising: We do NOT sell personal information, and we never share child, athlete, or health data for advertising. We do use Meta advertising measurement for adult account holders (Section 7), which may constitute "sharing" for cross-context behavioral advertising under California law; Section 12 explains how to opt out, including by Global Privacy Control, which we treat as a valid universal opt-out signal.
• Opt out of profiling: We do not profile anyone in furtherance of decisions that produce legal or similarly significant effects (Section 5).
• Limit use of sensitive data: See Section 4. We process sensitive data (date of birth, sex, growth measurements, health-related check-ins) only with your consent and only for the purposes you requested.
• Appeal: If we decline a request you may appeal (Section 13) and then contact your state Attorney General.
• Non-discrimination: We will never deny service, charge more, or degrade quality because you exercised a right.

To submit a request, email [email protected] with "Privacy Request" in the subject line. Include your name, account email, and state of residence. We respond within 45 days (extendable once by 45 days with notice). An authorized agent may act for you with written proof of authority.

California

Categories of personal information we collect are listed in Section 2: identifiers and account details; sensitive personal information such as date of birth and health-related measurements; commercial information about subscriptions; internet activity such as feature usage; and inferences limited to growth percentiles and assessment grades. Sources and purposes are in Sections 2 and 5; disclosures for a business purpose are in Section 7. We have not sold personal information in the preceding 12 months. Information collected from consumers we know to be under 16 is treated as sensitive personal information and is never sold or shared. Minors: California residents under 18 may request removal of content they posted in Messages by deleting the post themselves or by contacting us. Shine the Light: we do not disclose personal information to third parties for their own direct marketing.

Colorado, Connecticut, Texas, Oregon & Other States Recognising Universal Opt-Out Signals

We honour the Global Privacy Control signal as an opt-out of sale, sharing, and targeted advertising on our web properties. Where state law requires parental consent to process a known child's data, or opt-in consent before a minor receives targeted advertising, we do not process it without the parent-managed consent described in Section 3, and we serve minors no targeted advertising of any kind.

Nevada

We do NOT sell personal information as defined by Nevada law. You can request confirmation at [email protected]. Nevada's consumer health data law is addressed in Section 11.

11. Consumer Health Data Notice

This section applies to information that may be considered Consumer Health Data under applicable U.S. state consumer-health-privacy laws (such as Washington's My Health My Data Act, Nevada's SB 370, and similar laws), to the extent they apply to us. A standalone Consumer Health Data Privacy notice is also published on our website (myathlete.team/consumer-health-data).

Consumer Health Data may include information linked or reasonably linkable to an athlete that relates to physical health or development — for example, body measurements, height, weight, BMI, growth tracking, performance metrics, weekly wellness check-in ratings, cognitive-baseline results, injury information you voluntarily provide, and related support communications.

We use Consumer Health Data only to:

• Provide and operate the app and its features
• Calculate growth percentiles, developmental guidance, and progress tracking
• Provide service communications and support
• Ensure safety, security, and fraud prevention
• Comply with legal obligations and protect legal rights

We do NOT sell Consumer Health Data; use it for targeted or cross-context behavioral advertising; or use it to train AI/ML models (without separate explicit opt-in). We disclose it only to service providers that process it on our behalf under our instructions (see Section 7). You may request access, deletion, correction, or withdrawal of consent at [email protected].

12. Do Not Sell or Share My Personal Information

We do NOT sell personal information for money. We do NOT use child or athlete data for cross-context behavioral advertising, and we do NOT use Consumer Health Data for advertising of any kind.

We do use Meta advertising measurement for adult account holders (Section 7 lists exactly what is and is not sent, and on which pages it can load). Your choices:

• Global Privacy Control / Do Not Track: On our website and web app, if your browser or an extension sends a Global Privacy Control or Do Not Track signal, Meta's code never loads. We treat GPC as a valid opt-out request wherever the law recognises it.
• Consent prompt: Where we show an analytics consent prompt (the web app shows one to visitors in the European Economic Area and United Kingdom), choosing "Essential Only" also keeps Meta's code from loading.
• Ask us: Email [email protected] with "Do Not Share" in the subject and we will exclude your account from the server-side purchase match described in Section 7 and confirm in writing.
• Mobile apps: the in-app measurement is aggregate, contains no advertising identifier and no direct identifiers, runs under Meta's Limited Data Use restriction, and is not used by us for cross-context behavioral advertising, so there is nothing for a browser opt-out to switch off. If you object to it, tell us and we will work with you in good faith.

Opting out never affects your access to any feature. We do not knowingly sell or share the personal information of consumers under 16 and never will without the opt-in consent the law requires.

13. How to Submit a Privacy Request (Workflow & Appeals)

Submitting a Request

To exercise any privacy right (know, access, correct, delete, limit sensitive data, opt out), email [email protected] with "Privacy Request" in the subject line. Include your name, account email, state of residence, and the nature of your request. An authorized agent may submit a request on your behalf with proof of authorization.

Identity Verification & Response Time

To protect your data, we verify your identity before fulfilling a request (typically by confirming control of the account email). We will respond within 45 days. If we need more time, we may extend by an additional 45 days and will notify you of the extension and the reason.

Appeals

If we deny your request, you may appeal by replying to our denial or emailing [email protected] with "Privacy Appeal" in the subject line. If you remain unsatisfied, you may contact your state Attorney General or applicable privacy authority (for example, the California Privacy Protection Agency).

Non-Discrimination

We will not deny service, charge a different price, or provide a different quality of service because you exercised your privacy rights.

14. Push Notifications & Email Communications

Email Communications (added August 31, 2026)

We send service emails (account confirmation, password recovery, team join requests, policy-change notices) as needed to operate the app. Separately, and only with your opt-in, we send a recurring informational email for parents and coaches summarizing youth-sports research and app features. You can opt out at any time using the unsubscribe link in every such email or the toggle in Settings; unsubscribing never affects service emails. Athlete accounts (ages 13–17) are not included in this program. Delivery is processed by Resend on our behalf under service-provider obligations (see Section 7); we retain only aggregate delivery statistics, never email content analytics tied to a child.

We may send service notifications related to your account and use of the app (e.g., subscription confirmations, security alerts, assessment reminders, important updates). These are part of providing the service.

With your separate consent, we may also send marketing or informational notifications (e.g., feature announcements, tips). You can opt out of these at any time in your device settings or by contacting us; opting out of marketing does not stop essential service notifications.

Children: Notifications relating to a minor's profile are sent to the managing parent/guardian or coach account, not directly to children.

Progress reports & staff channels (added September 16, 2026): a coach or program may send an athlete's progress report to that athlete's family through the app (in-app, by a share link, or in print); we record that it was sent and when the family opened it, and nothing about a report goes to anyone outside the family and the team's staff. Messages that a league or program addresses to a staff group (program owners, head coaches, all coaches, staff) reach only the adult staff in that role; a family is never in a staff channel and is never notified of one.

Asking for a store rating (added September 18, 2026): after an earned moment in the app - a milestone on an athlete's record - your phone may show Apple's or Google's own rating prompt. It is the store's prompt, not ours: we never ask how you feel about the app before showing it, we never decide who sees it from an opinion, and we ask at most once per app version and rarely after that. Dismissing it changes nothing. If something is not right, Settings has a direct line to us at any time.

Emails to organizations: the introduction emails described in Section 2 go to organizations, not to app users. A family or athlete account never receives them, and an opt-out is honoured through the do-not-send list.

15. Third-Party Communication Channels

If you communicate with us or with a team through any third-party channel (e.g., email, SMS, or a messaging platform), your use of that channel is also governed by that provider's terms and privacy policy, which we do not control.

Do not post sensitive information in shared or group channels. You should not post medical records, government identification, payment/bank details, or other highly sensitive information in any team chat or group channel where it may be visible to others. To share sensitive information with us for support, use the private contact email above.

16. Children's Privacy (COPPA Comprehensive)

My Athlete is designed for parent/coach management of youth data, not for child-directed marketing, and it is not directed to children under 13. We do NOT:

• Allow children under 13 to create accounts directly (athlete sign-ups must enter a date of birth and under-13 registrations are declined; parent and coach accounts are for adults)
• Collect data directly from children under 13
• Market to children, or use child data for behavioral profiling or targeted ads
• Place any child or teen in a private one-to-one conversation with an adult (there is no direct messaging)

Parental Control: All under-13 data is entered and managed by parents/guardians, or by coaches with the parent/guardian's authorization through our claim-code consent flow. If you believe we've collected unauthorized data from a child under 13, contact us immediately so we can delete it. If we learn that we hold personal information from a child under 13 without the required consent, we delete it promptly.

Teen Athlete Accounts (Ages 13–17)

Athletes aged 13 to 17 may hold their own account so they can record and view their own progress. We know these account holders are minors, and we treat them accordingly:

• We collect only what the account needs to work: name, email, date of birth, sex, sport, and the measurements and scores the athlete records.
• No marketing email, no advertising measurement (Meta is switched off for athlete accounts), no targeted advertising, no sale of data, and no precise geolocation, ever.
• No private direct messaging; group Messages are visible to the whole team including its parents and guardians. Staff-only channels exist between adult league and program staff, and no athlete account is ever in one.
• The parent-controlled features described in Section 4 (the adult-height estimate, Enhanced Growth Velocity, benchmark contribution) are meant to be enabled by a parent or guardian, not by the teen.
• A parent from day one: A teen must give a parent or guardian's email address when they create the account. We email that parent a link code; once they use it, they can see the teen's progress and manage the account. A parent or guardian may also link later with the same code.
• Parental tools: A linked parent, or any parent or guardian who contacts us and confirms the relationship, may at any time ask us to review, correct, restrict, or delete the teen's account data, or to close the account.
• If an app store provides us an age category or parental-consent signal for an account, we use it only to apply age-appropriate settings and for no other purpose.

Teens: do not enter medical information, and do not post personal details such as your address or phone number in Messages. If anything in the app makes you uncomfortable, tell a parent, a coach, or us at [email protected].

17. Security & Data Protection

• HTTPS encryption for all data in transit
• AES-256 encryption for data at rest
• Row-Level Security (RLS) policies: users can only access their own family or team data
• Regular security audits and vulnerability testing
• Limited staff access to production data (need-to-know basis)

Information Security Program: We maintain a written information security program, overseen by a designated member of our team, that includes administrative, technical, and physical safeguards reasonably designed to protect the confidentiality, integrity, and availability of personal information, appropriate to its sensitivity.

Data Breach Notification: In the event of a data breach, we will notify affected users and regulators as required by applicable law.

Incident Response & Breach Notification: We maintain an incident-response process. If a breach affects your personal information, we will notify you and any regulator without undue delay and within the time required by applicable law, tell you what happened and what we are doing about it, and never charge for that notice.

Your part: keep your password private, use a unique password, sign out on shared devices, and tell us at once if you suspect unauthorized access. No system is perfectly secure; we cannot guarantee absolute security, but we will always be straightforward with you about incidents.

18. International Users

My Athlete is operated from the United States and directed to U.S. families and coaches. Our servers and service providers are located in the United States, so if you use the app from elsewhere your information is transferred to, stored, and processed in the United States, where privacy laws may differ from those of your country. By using the app you understand that this transfer takes place.

European Economic Area, United Kingdom & Switzerland

If you are in the EEA, the UK, or Switzerland, My Athlete LLC is the controller of your personal data. Our legal bases are: performance of a contract (providing the app you signed up for); consent (children's data entered by a parent, sensitive health-related data, optional features, marketing emails, analytics and advertising measurement, each withdrawable at any time); legitimate interests (security, fraud prevention, service communications, and improving the app, balanced against your rights); and legal obligation. You have the rights of access, rectification, erasure, restriction, portability, and objection; the right to withdraw consent without affecting prior processing; and the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office). Transfers to the United States rely on standard contractual clauses with our service providers or on your explicit consent. We do not appoint a representative in the EEA or UK because we do not target those markets.

Canada, Australia & Elsewhere

Residents of Canada (PIPEDA and provincial laws), Australia (the Privacy Act and the Australian Privacy Principles), and other countries have comparable rights to access and correct their information and to complain to a privacy regulator. We honour those rights on request at [email protected]. Where local law requires parental consent for a minor older than 13, the parent-managed model described in Section 3 applies.

19. Legal Process, Safety, Business Transfers & Other Disclosures

Beyond the service providers in Section 7, we may disclose personal information only:

• To comply with law: in response to a subpoena, court order, lawful request from a public authority, or where disclosure is otherwise required by law. We review each request, disclose only what is legally required, and, unless legally prohibited or the request concerns an emergency or a child's safety, we try to notify the affected account holder.
• To protect people: where we believe in good faith that disclosure is necessary to protect the safety of a child or any person, to investigate suspected abuse of the service, or to prevent fraud or harm. If we receive a credible report that a child is at risk, we may report it to the appropriate authorities.
• To enforce our agreements: to establish, exercise, or defend legal claims, and to enforce the Terms of Service.
• Business transfers: if My Athlete LLC is involved in a merger, acquisition, financing, reorganization, or sale of all or substantially all of its assets, personal information may be transferred as part of that transaction. Any successor must honour this Privacy Policy for the information it receives, and any change in how children's information is used would require fresh parental consent. We will notify you by email and in-app before your information becomes subject to a materially different privacy policy.
• At your direction: when you ask us to (for example a data export you send to a third party, or a coach or program you join).

De-identified and aggregated data that cannot reasonably be linked to any person (for example how many athletes in a sport recorded a test) is not personal information; we may use and share it, and we commit not to try to re-identify it.

20. Changes to This Privacy Policy

We may update this policy from time to time; the "Last updated" date at the top tells you when. For material changes, especially any that would expand how we use or share children's data, sensitive data, or Consumer Health Data, we will give at least 30 days' notice by email and in-app before the change takes effect, and where the law requires it (for example a new use of a child's information) we will obtain fresh consent rather than rely on notice. Continued use of the app after a change takes effect constitutes acceptance of the updated policy for all other changes. Earlier versions are available on request. We review this policy at least once every 12 months.

21. YouTube API Services

My Athlete LLC operates the YouTube channel @MyAthlete, where we publish our own original marketing and educational videos. To publish and schedule that content we use YouTube API Services, both through our own internal publishing tooling and through third-party scheduling tools that we authorize against our own channel.

Because we use YouTube API Services, we are bound by the YouTube Terms of Service. Google's collection and handling of information through those services is described in the Google Privacy Policy.

This does not involve your data. Our use of YouTube API Services is limited to publishing our own videos to our own channel. We do not use YouTube API Services to collect, request, store, or process any information about you, your athletes, or your team. We do not access viewer data, comments, subscriber lists, watch history, or analytics belonging to any other channel or YouTube user, and we do not use any YouTube data for advertising, profiling, or training machine-learning models.

What is stored: the only credential involved is an OAuth token that authorizes our publishing tools to upload videos to our own channel. That token belongs to the channel owner, is never associated with a My Athlete user account, and is held outside the My Athlete application and database. The material we upload is our own marketing and educational content together with its title, description, and category.

Revoking access: the channel owner may revoke our publishing tools' access to the channel at any time through Google's security settings page. Because we store no YouTube user data, there is nothing further for us to delete; any stored authorization credential is destroyed when access is revoked or when the tool is retired.

22. Contact Us

Questions about this Privacy Policy, or to exercise any right described in it:

My Athlete LLC

Email: [email protected] (put "Privacy Request", "Privacy Appeal", "Do Not Share", or "Consumer Health Data Request" in the subject line so we can route it quickly)

Mailing address: 2500 Dallas Hwy, Ste 202-135, Marietta, GA 30064, USA

We aim to acknowledge every privacy inquiry within 5 business days and to resolve it within the statutory deadline.