Privacy

Our role, and the law that governs it

Half Court is a vendor to school districts. The records in it are education records, and the district is their custodian. We are not the owner of that data and we do not treat it as ours.

The governing law is the Family Educational Rights and Privacy Act (FERPA). We operate under its school official exception, 34 CFR 99.31(a)(1)(i)(B). In practice that means three commitments: we perform a function the district would otherwise handle with its own staff, we stay under the district's direct control over how those records are used and kept, and we do not re-disclose them to anyone without the district's authorization.

Where a district requires its own data privacy agreement, including a state or consortium standard form, we sign it. Those terms sit on top of this page, and where they conflict, the district's agreement wins.

What we hold

• Students. Name, school, grade, date of birth, the district's own student ID, and the teams and seasons they participate in.
• Parents and guardians. Name, relationship to the student, and the contact details the district has on file, so we can tell you a form is missing.
• Health and clearance records. Physicals, clearance forms, consent and insurance information, and their expiration dates, because an expired physical is the single most common reason a kid cannot play.
• Staff accounts. The name, work email, and role of the athletic directors, coaches, and trainers who use the product.
• Technical records. Ordinary server logs, covering which account made which request and when, kept so the service can be operated and debugged.

Where it comes from

From the district. Either their staff enter it, or it arrives through an import from the district's student information system. We do not buy contact lists, we do not rent them, and we do not collect them from anywhere else. There is no public sign-up: accounts are created for named district staff under an agreement with that district.

Health information, specifically

A physical collected by a school as part of athletic eligibility is an education record under FERPA. It is not protected health information under HIPAA, which expressly excludes FERPA education records, and Half Court is not a HIPAA covered entity or a business associate of one. We say this plainly because vendors often claim otherwise, and naming the wrong law is not a reassurance worth having.

What we do instead is apply the safeguards that regime is known for. Medical documents are visible only to the staff whose role requires them, typically the athletic director and the trainer rather than every coach. They are stored encrypted, and they are never used for anything except determining whether a student is cleared to play.

What we never do

We never sell student, guardian, or staff data. Not to advertisers, not to data brokers, not to recruiters, not to anybody, and there is no price that changes this. We do not serve advertising and we do not build advertising profiles. We do not use one district's data to build or improve anything for another district. We are a software business that is paid by districts for software, and that is the whole model.

Who can see a record

District staff see only their own district, and within it only what their role requires. A coach sees their teams. This is enforced in the software itself, at the layer every query passes through, rather than left to the interface to remember.

A small number of Half Court engineers can reach production data when operating or repairing the service. That access is limited to the people who need it and is used for keeping the system running, never for browsing.

Companies that help us run this

We keep this list short on purpose, and every one of them is bound to use the data only to provide their service to us.

• Fly.io hosts the application and the database, in the United States.
• Mailgun delivers our email, which means login links and notices that a form is missing or expiring.

Security

Traffic is encrypted in transit, and stored data is encrypted at rest. Half Court has no passwords to steal: signing in sends a single-use link that expires in fifteen minutes. Access is scoped by district and by role, and the boundary is enforced in one place in the code rather than repeated in dozens, which is what makes it something we can actually promise.

How long we keep it

For as long as the district asks us to. If a district ends its agreement with us, we return their data in a usable format and delete it from our systems within 30 days, backups included on their normal rotation. A district can ask us to correct or delete a specific record at any time and we will do it.

Parents, students, and your rights

FERPA gives parents, and students once they turn 18, the right to inspect their education records, to ask for corrections, and to control certain disclosures. Those rights are exercised with the school district, not with us, because the district is the custodian of the record. Contact the district and we will support whatever they ask us to do. If you are unsure who to ask, write to us and we will point you to the right person.

Children

Half Court is used by school staff and by parents. It is not directed to children, and we do not collect information directly from students. What we hold about a student comes from their district, under the district's authority.

Changes

If this policy changes in a way that matters, we will update the date at the top and tell the districts using Half Court before it takes effect. We will not quietly broaden what we do with data already collected.

Contact

Questions about any of this, including from a district evaluating us, go to hello@halfcourt.team and reach a person.