Privacy Policy

Overview

GridIron Hub is a private, invitation-only platform for high school football coaching staffs. We are committed to protecting the privacy of coaches, players, parents, and prospects whose information passes through our service. This page explains exactly what we collect, why, and your rights.

Who this policy covers

• Coaches — head and assistant coaches with accounts
• Players — roster information entered by coaches (most rostered players are minors; see below)
• Parents / guardians — contact information entered by coaches

What we collect

From coaches (account holders):

• Email address (login)
• Name, optional contact email, phone, title
• Team affiliation and role

About players (entered by coaches):

• Name, jersey number, height, weight, GPA, class year
• Position, performance metrics (combine numbers, lifts)
• Optional photo
• Player and parent phone, email, and address
• Coach's notes, badges, attendance, offers, and stats text

Automatically:

• IP address and basic device info for security and abuse prevention
• Server logs of API requests (kept up to 30 days)

We do not use third-party advertising trackers, behavioral analytics, or marketing pixels. We do not sell data.

Information about minors

Player profiles typically describe individuals under 18. GridIron Hub is a tool for school-sanctioned athletic programs; we rely on the school or coaching staff to obtain the consents required under their state and federal obligations (e.g. FERPA-style records, parental consent for photos). We do not knowingly let players under 13 create accounts. If you believe a minor has created an account without parental consent, email support@gridironhub.app and we will remove it.

How we use information

• To provide the core features of the app (roster, depth chart, attendance, metrics, recruiting share sheets)
• To send transactional emails (login confirmations, password resets, team invitations)
• To diagnose service issues and prevent abuse

We do not send marketing email without explicit opt-in.

Sharing and disclosure

The platform is multi-tenant — each team's data is isolated. Coaches on the same team can see each other's entries. Players themselves only see their own profile and limited team-wide info.

Public-facing recruiting share pages display only the information a coach explicitly opts a player into sharing (the “Shareable profile” toggle).

We use the following processors:

• Supabase (database, auth, file storage) — data hosted in AWS US-West-2
• Vercel (web hosting and edge serving)
• Apple Push Notification service and Expo (push delivery for the mobile app)

We may disclose information when required by law, to respond to a valid subpoena, or to protect the rights or safety of users or the public.

Security

Connections are encrypted with TLS. Database rows are protected by row-level security policies that prevent cross-team access. Coaching staff are responsible for keeping their login credentials confidential.

Retention

We retain account data for as long as the team has an active subscription plus 30 days. After deletion, backups are purged within 90 days. Coaches may request immediate deletion of any player record at any time.

Your rights

• Access — request a copy of the data we hold about you
• Correction — fix anything inaccurate
• Deletion — request removal of your account or a player record
• Portability — receive your data in a machine-readable format

Email support@gridironhub.app to exercise any of these rights. We respond within 30 days.

Children's privacy (COPPA)

GridIron Hub is intended for school-sanctioned athletic programs. We do not knowingly collect personal information directly from children under 13. Any minor-player information that exists in the system is entered by a coach acting under the school's educational and athletic mandate.

Changes to this policy

We will post any updates to this page and revise the “Last updated” date. Material changes will be announced via in-app notification or email.

Contact

GridIron Hub
support@gridironhub.app