Privacy Policy

1. Scope and Roles

1.1 Customer Control. HC provides the Service to school districts, schools, and clubs. The records in the Service are education records, and Customer is their custodian. HC does not own Subscriber Data and does not treat it as its own.

1.2 FERPA. The Family Educational Rights and Privacy Act (“FERPA”) governs these records. HC operates under the school official exception at 34 CFR 99.31(a)(1)(i)(B). Accordingly, HC (a) performs a function that Customer would otherwise perform with its own staff; (b) remains under Customer’s direct control with respect to the use and maintenance of those records; and (c) does not re-disclose those records without Customer’s authorization.

1.3 Customer Data Privacy Agreements. Where Customer requires its own data privacy agreement, including a state or consortium standard form, HC will sign it. Those terms supplement this Privacy Policy, and if they conflict with this Privacy Policy, Customer’s data privacy agreement controls.

2. Information We Collect

HC collects the following categories of information:

• Students. Name, school, grade, date of birth, Customer’s student ID, the email and phone number Customer has on file, and the teams and seasons in which the student participates.
• Parents and Guardians. Name, relationship to the student, and the contact details Customer has on file, which HC uses to give notice that a form is missing.
• Health and Clearance Records. Physicals, clearance forms, consent and insurance information, and their expiration dates.
• Athlete Fundraising Pages. A photo if the athlete adds one, a statement in the athlete’s own words, the fundraising goal, and the contacts the athlete chose to ask, consisting of a name and the phone number or email the athlete entered. HC uses those contacts for that fundraiser only.
• Tryout Sign-Ups. The student’s name and grade, an email, and a guardian’s name, entered by the family on a team’s tryout page.
• Messages. For each email and text message HC sends, the recipient address, the message type, the time sent, and the delivery status reported by the carrier. HC also retains every opt-out request in order to honor it.
• Payments. The payer’s email, the amount, the fees, the payment method type (card or bank), the payment status, and Stripe’s reference for the payment. A gift may include the name and note the giver chose to add. For a booster or club that receives funds, the name of its bank and the last four digits of the account. HC does not receive or store card numbers or full bank account numbers.
• Authorized Users. The name, work email, and role of the athletic directors, coaches, and trainers who use the Service.
• Usage Data. Server logs recording which account made which request and when, which HC retains to operate and maintain the Service.

3. Sources of Information

3.1 Customer. Most Subscriber Data is provided by Customer, either entered by its staff or imported from Customer’s student information system. Accounts are not available through public sign-up. HC creates accounts for named Authorized Users under an Agreement with Customer.

3.2 Other Sources. HC also receives information from the following sources, which may include information about you that you did not provide:

• Coaches and Staff add and correct guardian contacts for the students on their teams.
• Athletes raising funds for their team add the relatives and family friends they want to ask, with or without a parent present.
• Families complete a team’s tryout page.
• Payers and Donors enter their own email, and optionally a name and a note to display with a gift.
• Stripe reports whether a payment succeeded, was refunded, or was disputed.

3.3 Contact Consent. Any person who adds a contact represents that the contact agreed to be reached, as required by HC’s terms. HC does not buy, rent, or otherwise collect contact lists. If your number or email was provided to HC without your expectation, you may reply STOP, use the unsubscribe link, or write to HC, and HC will remove it.

4. Text Messages

A school, club, or booster may send you text messages through the Service regarding a team fee. You receive these messages because you provided your number to the school for contact about your student. Each message identifies the school or team it concerns and states how to opt out.

• We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. HC’s text message carrier, Twilio, receives a phone number and the message content solely to deliver the message.
• Booster Registration. When a booster club registers its own name for text messaging, its legal details are provided to Twilio and the carrier registry. No family’s phone number is included.
• Reply STOP to opt out. You will receive one confirmation reply and no further messages from any school on the Service. Reply START to resume messages. You may also opt out by writing to HC, which takes longer.
• Reply HELP for help, or write to support@halfcourt.team.
• Consent to text messages is not a condition of paying a fee or making a gift. Every payment link and every request is also available by email.
• Message frequency varies with your participation. Message and data rates may apply. Questions about your text or data plan should be directed to your wireless carrier.
• Carriers are not liable for delayed or undelivered messages.
• Number Changes. If your number changes, notify your school, as the record belongs to the school, or notify HC.

5. Payments

5.1 Payment Processing. Team fees and gifts are paid on a page operated by Stripe. Card and bank details entered on that page are sent to Stripe and not to HC. HC provides Stripe the payer’s email when available, the name of the fee with the student’s first name, and the amount. Stripe reports to HC whether the payment succeeded, and later whether it was refunded or disputed.

5.2 Receiving Accounts. A booster or club that receives funds sets up its own Stripe account through the Service. HC provides Stripe its name and the email of the person completing setup. Stripe collects all other information directly, including the legal name, tax ID, and bank account. HC does not receive the tax ID or the full account number. Stripe’s handling of that information is governed by Stripe’s privacy policy.

6. Health Information

6.1 Applicable Law. A physical collected by a school for athletic eligibility is an education record under FERPA. It is not protected health information under HIPAA, which expressly excludes FERPA education records, and HC is not a HIPAA covered entity or a business associate of one.

6.2 Safeguards. HC nonetheless applies safeguards of the kind HIPAA requires. A student’s medical record is available to the staff who can approve that student’s paperwork, which in most organizations is the athletic director and the trainer. A coach may view a student’s allergies at any time without approval in order to provide care. HC records every access to a medical record, including who accessed it, which student it concerns, and when. These documents are stored encrypted and are used solely to determine whether a student is cleared to play.

7. Use Restrictions

HC will never sell student, guardian, or staff data to any person, including advertisers, data brokers, and recruiters. HC does not sell phone numbers or share them for marketing. HC does not serve advertising or build advertising profiles. As provided in the Agreement, HC owns de-identified, aggregated usage data and performance metrics derived from the Service, and may use them to maintain, analyze, and improve its products and services. HC is paid by Customers for software, and that is the whole of its business model.

8. Access to Records

8.1 Authorized Users. Authorized Users see only their own organization, and within it only what their role requires. A coach sees that coach’s teams. The Service enforces this restriction at the layer through which every query passes, not only in the user interface.

8.2 HC Personnel. A limited number of HC engineers may access production data to operate or repair the Service. That access is restricted to personnel who require it and is used solely to maintain the Service.

9. Subprocessors

HC uses the following subprocessors, each of which is bound to use the data only to provide its service to HC:

• Fly.io hosts the application and the database in the United States.
• Tigris stores uploaded files, including forms, photos, and logos. These files are private and encrypted at rest.
• OpenAI and Anthropic read uploaded forms to confirm they are complete and to extract their dates. They also help a coach draft a fundraiser’s story from the coach’s own sentence, using no roster or medical information. Each operates under a signed agreement limiting it to that purpose, and HC records every reading of a form.
• Mailgun delivers HC’s email, including login links, notices of missing or expiring forms, payment links, and fundraiser requests.
• Twilio delivers HC’s text messages. It receives the phone number and the message content only.
• Stripe processes payments and payouts as described in Section 5.

10. Security

HC encrypts data in transit and at rest. The Service does not use passwords. Sign-in is by a single-use link that expires after fifteen minutes. Access is restricted by organization and by role, and that restriction is enforced in a single place in the code.

11. Retention and Deletion

HC retains Subscriber Data for as long as Customer directs. Upon termination of the Agreement, HC will return Customer’s data in a usable format and delete it from HC’s systems within thirty (30) days, with backups deleted on their normal rotation. Customer may request correction or deletion of a specific record at any time, and HC will comply.

12. Rights of Parents and Eligible Students

FERPA gives parents, and students who have reached 18 years of age, the right to inspect their education records, to request corrections, and to control certain disclosures. These rights are exercised with Customer, as custodian of the record, and not with HC. HC will support any request Customer makes. If you are unsure whom to contact, write to HC and HC will direct you to the appropriate person.

13. Children

The Service is used by school staff, parents, and student athletes raising funds for their team. An athlete receives a fundraising page only when the athlete’s coach creates one, and the athlete may add only a photo, a statement in the athlete’s own words, and the contacts the athlete wishes to ask. A parent may do so with or for the athlete. A family may also complete a team’s tryout page. All other information HC holds about a student is provided by Customer under Customer’s authority.

14. Changes

If HC changes this Privacy Policy in a material way, HC will update the date above and notify Customers before the change takes effect. HC will not expand its use of data already collected without notice.

15. Contact

Questions regarding this Privacy Policy, including from an organization evaluating HC, may be sent to support@halfcourt.team and will be answered by a person.