Privacy

Our role, and the law that governs it

Half Court is a vendor to school districts. The records in it are education records, and the district is their custodian. We are not the owner of that data and we do not treat it as ours.

The governing law is the Family Educational Rights and Privacy Act (FERPA). We operate under its school official exception, 34 CFR 99.31(a)(1)(i)(B). In practice that means three commitments: we perform a function the district would otherwise handle with its own staff, we stay under the district's direct control over how those records are used and kept, and we do not re-disclose them to anyone without the district's authorization.

Where a district requires its own data privacy agreement, including a state or consortium standard form, we sign it. Those terms sit on top of this page, and where they conflict, the district's agreement wins.

What we hold

• Students. Name, school, grade, date of birth, the district's own student ID, the email and phone the district has on file, and the teams and seasons they participate in.
• Parents and guardians. Name, relationship to the student, and the contact details the district has on file, so we can tell you a form is missing.
• Health and clearance records. Physicals, clearance forms, consent and insurance information, and their expiration dates, because an expired physical is the single most common reason a kid cannot play.
• An athlete's fundraising page. A photo if they add one, a line in their own words, their goal, and the people they chose to ask: a name and the phone or email the athlete typed in. Those contacts are used for that fundraiser and nothing else.
• Tryout sign-ups. The student's name and grade, an email, and a guardian's name, entered by the family on a team's tryout page.
• Messages. For every email and text we send: the address it went to, what kind of message it was, when, and what the carrier told us. We also keep every request to stop, so we can honor it.
• Payments. The payer's email, the amount, the fees, whether it was a card or a bank, where it stands, and Stripe's reference for it. A gift can carry the name and the note the giver chose to add. For a booster or club that receives money, the name of its bank and the last four digits of the account. We never receive or store a card number or a full bank account number.
• Staff accounts. The name, work email, and role of the athletic directors, coaches, and trainers who use the product.
• Technical records. Ordinary server logs, covering which account made which request and when, kept so the service can be operated and debugged.

Where it comes from

Most of it comes from the district or club. Either their staff enter it, or it arrives through an import from the district's student information system. There is no public sign-up for accounts: they are created for named staff under an agreement with that district or club.

Some of it comes from other people, and some of it may be about you without you having typed it:

• Coaches and staff add and correct guardian contacts for the students on their teams.
• Athletes raising for their team add the relatives and family friends they want to ask, with a parent beside them or on their own.
• Families fill in a team's tryout page themselves.
• People who pay or give enter their own email, and a name and a note if they want one shown with a gift.
• Stripe tells us whether a payment went through, was refunded, or was disputed.

Whoever adds a contact tells us that person agreed to be reached, and our terms hold them to it. We do not buy contact lists, we do not rent them, and we do not collect them from anywhere else. If someone gave us your number or email and you did not expect it, reply STOP, use the unsubscribe link, or write to us and we will remove it.

Text messages

A school, club, or booster can text you through Half Court about a team fee, and an athlete you know can text you about their fundraiser. You get these texts because you gave your number to the school for contact about your student, or to the athlete who is asking. Every text names the school or team it is for and ends with how to stop.

• We never sell phone numbers or share them for marketing. Our text carrier, Twilio, gets a number and the words of the message only to deliver it.
• When a booster club registers its own name for texting, its legal details go to Twilio and the carrier registry. No family's number goes with them.
• Reply STOP to stop. You get one reply confirming it, and then nothing more from any school or athlete on Half Court. Reply START to hear from us again. STOP is the fastest way. You can also write to us, which takes longer.
• Reply HELP for help, or write to support@halfcourt.team.
• Agreeing to texts is never a condition of paying a fee or making a gift. Every pay link and every ask can reach you by email instead.
• Message frequency varies with what you are part of. Message and data rates may apply. Questions about your text or data plan go to your wireless carrier.
• Carriers are not liable for delayed or undelivered messages.
• If your number changes, tell your school, since the record is theirs, or tell us.

Payments

Team fees and gifts are paid on a page run by Stripe. The card or bank details you type there go to Stripe and never to us. We send Stripe the payer's email when we have it, the name of the fee with the student's first name, and the amount. Stripe tells us whether the payment went through, and later whether it was refunded or disputed.

A booster or club that receives money sets up its own Stripe account from inside Half Court. We pass Stripe its name and the email of the person setting it up. Stripe collects the rest from them directly, including the legal name, the tax ID, and the bank account. We never see the tax ID or the full account number. What Stripe does with what it holds is covered by Stripe's privacy policy.

Health information, specifically

A physical collected by a school as part of athletic eligibility is an education record under FERPA. It is not protected health information under HIPAA, which expressly excludes FERPA education records, and Half Court is not a HIPAA covered entity or a business associate of one. We say this plainly because vendors often claim otherwise, and naming the wrong law is not a reassurance worth having.

What we do instead is apply the safeguards that regime is known for. A student's medical record opens for the staff who can approve their paperwork, which in most districts is the athletic director and the trainer rather than every coach. A coach can still reach a student's allergies when they need to care for them, in one tap and with no approval to wait for. Every look at a medical record is recorded: who looked, at which student, and when. The documents are stored encrypted, and they are never used for anything except determining whether a student is cleared to play.

What we never do

We never sell student, guardian, or staff data. Not to advertisers, not to data brokers, not to recruiters, not to anybody, and there is no price that changes this. We never sell phone numbers or share them for marketing. We do not serve advertising and we do not build advertising profiles. We do not use one district's data to build or improve anything for another district. We are a software business that is paid by districts for software, and that is the whole model.

Who can see a record

District staff see only their own district, and within it only what their role requires. A coach sees their teams. This is enforced in the software itself, at the layer every query passes through, rather than left to the interface to remember.

A small number of Half Court engineers can reach production data when operating or repairing the service. That access is limited to the people who need it and is used for keeping the system running, never for browsing.

Companies that help us run this

We keep this list short on purpose, and every one of them is bound to use the data only to provide their service to us.

• Fly.io hosts the application and the database, in the United States.
• Tigris stores uploaded files: forms, photos, and logos. They are private and encrypted at rest.
• OpenAI and Anthropic read an uploaded form to check that it is complete and to pull out its dates. They also help a coach draft a fundraiser's story from the coach's own sentence, with nothing from a roster and nothing medical. Both work under a signed agreement that limits them to that job, and every reading of a form is recorded.
• Mailgun delivers our email, which means login links, notices that a form is missing or expiring, pay links, and fundraiser asks.
• Twilio delivers our text messages. It gets the phone number and the words of the message, and nothing else.
• Stripe takes payments and pays them out, as the Payments section above describes.

Security

Traffic is encrypted in transit, and stored data is encrypted at rest. Half Court has no passwords to steal: signing in sends a single-use link that expires in fifteen minutes. Access is scoped by district and by role, and the boundary is enforced in one place in the code rather than repeated in dozens, which is what makes it something we can actually promise.

How long we keep it

For as long as the district asks us to. If a district ends its agreement with us, we return their data in a usable format and delete it from our systems within 30 days, backups included on their normal rotation. A district can ask us to correct or delete a specific record at any time and we will do it.

Parents, students, and your rights

FERPA gives parents, and students once they turn 18, the right to inspect their education records, to ask for corrections, and to control certain disclosures. Those rights are exercised with the school district, not with us, because the district is the custodian of the record. Contact the district and we will support whatever they ask us to do. If you are unsure who to ask, write to us and we will point you to the right person.

Children

Half Court is used by school staff, by parents, and by student athletes raising money for their team. An athlete gets a fundraising page only when their coach sets one up, and what they add to it is small: a photo if they want one, a line in their own words, and the people they want to ask. A parent can do it with them or for them. A family can also fill in a team's tryout page. Everything else we hold about a student comes from their district or club, under its authority.

Changes

If this policy changes in a way that matters, we will update the date at the top and tell the districts using Half Court before it takes effect. We will not quietly broaden what we do with data already collected.

Contact

Questions about any of this, including from a district evaluating us, go to support@halfcourt.team and reach a person.