Privacy Policy

Most of the people this policy is about are minors. It is written on that assumption throughout.

1. The commitments, up front

We do not sell personal information, and we do not share it for cross-context behavioural advertising.
We do not record anonymous profile views. If someone looks at your profile without telling us who they are, that view is not logged against you at all — not as an aggregate, not as a count. Identity is volunteered or it is not counted.
We do not host your game film, so we do not hold it. Film is embedded from wherever you already published it.
A guardian controls every outward-facing action for an athlete under 18, and can revoke that permission at any time.
Verified measurements are shareable but withdrawable. Every share link you create can be revoked by you, and deletion reaches the signed copies too.

In plain English

The one that surprises people: your profile-view count is deliberately incomplete. We could inflate it by counting every anonymous hit. We don’t, because “47 coaches viewed you” is only worth knowing if all 47 were real people who identified themselves.

2. What we collect

2.1 Information you give us

Account: name, email address, and your role (athlete, parent/guardian, coach, or brand).
Athlete profile: date of birth, graduation year, position, sport, level, city and state, height and weight, and your profile URL.
Guardian detailsfor an athlete under 18: your guardian’s name and email, so we can request the consents described below.
Academic information you choose to enter, such as GPA and test scores.
Measurements you self-report, and video you submit for measurement.
Messages you send through the Service, and the notes you keep on your own recruiting pipeline.

2.2 Information we produce about you

Verified measurements. From video you submit, we derive the measurement and record how it was produced: the drill, the value, the timing convention, the software version, the device model, and the capture frame rate. We keep an unedited copy of the submitted video for audit and appeal. That original is never shown publicly.
Cognitive training results from Play Canvas — which scenarios you attempted and how you answered.
Consent records: what was granted, by whom, when, and whether it has since been withdrawn.
Identified profile views and recruiting-funnel events — see §1 on anonymous views.
Billing state: your plan and tier, and an identifier from our payment processor. We never receive your full card number.

2.3 Technical information

Standard server logs (IP address, user agent, timestamps, and the pages requested) for security, abuse prevention, and debugging. We use cookies for one purpose: keeping you signed in. We do not run third-party advertising or cross-site tracking cookies.

3. Why we use it

To run your account and profile, which is the service you asked for.
To produce and publish measurements, including the signed records anyone can verify.
To deliver messages between you and coaches.
To obtain and honour guardian consent, which is a legal obligation as well as a product feature.
To take payment for paid plans.
To keep people safe — moderation, abuse and fraud prevention, and escalation of anything involving a minor’s safety to a human.
To improve the Service, using aggregated data. Any published market-level statistic is aggregate-only and never describes a group small enough to identify an individual.

We do not use your personal information to train third-party AI models, and we do not permit our processors to do so.

3.1 How AI features use your data

Some features draft text for you — a message to a coach, a profile summary. These send only the information needed for that specific task to our AI processor, and they operate under a hard constraint: the model is not permitted to state a measurement we have not measured. If it lacks a verified number, it uses your recorded one or omits the claim. Output is yours to edit or discard before anything is sent.

4. Who sees your information

4.1 Other people on the Service

Your published profile is public — visible to coaches, search engines, and anyone with the link. It contains what you chose to publish. If you are under 18, it stays hidden until a guardian permits publication.
Coaches you message see your message and your profile.
Anyone you send a share link to sees that specific measurement. You can revoke any share link at any time, which takes effect immediately.
Your guardian, if you are under 18, can see your account activity and controls the consents in §5.

4.2 Service providers

We use a small number of processors, each for one job, each bound to use the data only for that job:

Provider	What for	What they receive
Supabase	Database and authentication	All account and profile data
Vercel	Application hosting	Request data and server logs
Stripe	Payments	Email, billing details you enter with them
Resend	Transactional email	Name, email, message content
Anthropic	AI drafting features	Only the fields needed for the specific draft

4.3 Signed verified records

A signed record is designed to be validated by anyone, offline, without contacting us. It deliberately contains no name, no email, and no date of birth — only an opaque reference, the measurement, how it was produced, and what it may be used for. It travels because you send it to someone.

4.4 Legal and safety

We may disclose information where the law requires it, or where necessary to prevent imminent harm — particularly harm to a minor. Where we are permitted to notify you of a legal request, we will.

5. Guardian consent

For an athlete under 18, three things require a guardian’s specific, recorded permission, and cannot happen without it:

Publication of the athlete’s profile beyond recruiting use;
Contact by a brand or commercial party;
Any NIL activity.

Recording video for measurement also requires consent. Each permission is separate — granting one does not grant the others — and each can be withdrawn at any time. Withdrawal is not retroactive to what has already lawfully happened, but it stops everything going forward, revokes the relevant share links, and adds any affected signed records to the withdrawal list.

6. Your rights

Whatever state or country you are in, you can:

See what we hold about you;
Correct it;
Delete it, and your account with it;
Export it in a portable format;
Withdraw a consent you previously gave;
Object to a use you disagree with.

A guardian may exercise all of these on behalf of an athlete under 18. Email privacy@yourecruithq.com. We will not charge you, and we will not make the Service worse for you because you asked.

Depending on where you live, you may also have the right to appeal a refusal and to complain to your state attorney general or data-protection authority.

6.1 What deletion actually does

Deletion is not a soft flag. Your profile comes down, your measurements and their video are deleted, your share links stop working, and every signed record about you is added to the published withdrawal list so that copies already in circulation stop validating.

In plain English

This is the part most services get wrong. A signed record that keeps verifying after you asked to be deleted is not deletion — so withdrawal reaching those copies was designed in from the first record, not added afterwards.

We may retain a minimal record of the deletion itself, and transaction records we are legally required to keep. Backups age out on their normal cycle.

7. How long we keep things

Account and profile: while your account is open.
Verified measurements and their audit video: while your account is open, because the record’s value is that it is longitudinal.
Consent records: kept after withdrawal, because we have to be able to show what was permitted and when.
Server logs: a short operational window.
Payment records: as long as tax and accounting law requires.

8. Security

Data is encrypted in transit and at rest. Access to athlete data is enforced at the database level rather than only in application code, so a bug in a page cannot expose rows the viewer was never entitled to. Original audit video is excluded from every public path by design. Access by our own staff is limited to what is needed to operate and support the Service.

No system is perfectly secure. If a breach affects your information we will notify you and the relevant regulators as required, and we will tell you what we know rather than the minimum we can get away with.

9. Children

You must be at least 13 to hold an account, and the Service is not directed to children under 13. See our Children’s Privacy notice for the detail, including what happens if we learn an under-13 account exists.

10. Where your data is

The Service is operated from the United States and your information is processed there. If you use it from outside the US, you are sending your information to the US.

11. Changes

If we change how we use your data in a way that materially affects you, we will notify you in the Service or by email before it takes effect — and, for a minor, the guardian on file.

12. Contact

privacy@yourecruithq.com · yourecruithq.com