Privacy Policy

A. Who We Are

ProPath is operated by [LEGAL ENTITY NAME], located at [BUSINESS ADDRESS]. For privacy questions or requests, contact [PRIVACY EMAIL].

B. Scope

This Policy applies to the ProPath website, application, and all three products (Teams, Performance, College), since they run on one shared platform and data model.

C. User Types

This Policy addresses several types of users: parents/guardians, minor players (through their linked profile), coaches, team/club users, adult athletes using ProPath individually, and website visitors who are not yet registered users.

D. Information Collected

Account information: name, email address, role (parent, player, coach), and authentication credentials (handled by our authentication provider — see Section L).

Contact information: email address; for a coach, a title/bio they choose to add. ProPath does not collect a player's phone number or home address as part of the core product.

Player profile information: first and last name, date of birth (used to determine age-appropriate handling, including COPPA status — see Section F), position, preferred foot, jersey number where used, graduation year, current level, and a profile photo if added.

Development information: individual development plans, coach-set development focuses, structured assignments, training records, goals, and progress records.

Check-in information: weekly check-in responses, including general wellness indicators (energy, mood, physical feeling, confidence) and structured development-focus selections.

Team information: team/roster membership, coach assignments, and related team-management data.

Coach information: name, email, title/bio, and records of which players and teams a coach is authorized to access.

Transaction/payment information: subscription tier and status. Card and payment details themselves are handled by our payment processor, Stripe — see Section L.

Communications: content and metadata of parent emails sent by a coach through ProPath's Email Parent feature — see Section K.

Technical/device information: standard web request information (such as IP address and browser type) as part of normal server operation.

Usage information: how the Service is used, to the extent reflected in the product's own data (for example, which assignments are completed) — ProPath does not currently operate a separate behavioral-analytics tool (see Section M).

Cookie information: see Section M.

Support communications: information you provide when contacting [SUPPORT EMAIL].

Security logs: records of sensitive actions (see AuditEvent in the product's architecture) kept for security and safeguarding purposes.

Consent records: records of parental consent and Terms acceptance, including version and timestamp — see Section F.

E. Children's Information

ProPath Teams is built around a parent-controlled structure: for every player under 18, a parent or legal guardian is the account owner, and the player has a linked profile.

Information collected about a minor player is limited to what is described in Section D under "Player profile information," "Development information," and "Check-in information" — ProPath does not collect a minor player's home address, personal phone number, school address, precise geolocation, government identification, or detailed health/medical information as part of the core product.

Who sees a minor player's information: the player themselves; their parent/guardian; and coaches authorized to access that specific player through a direct assignment or team membership. Coaches cannot privately message a minor player through ProPath — see the Parental Consent & Minor Privacy Notice and Section J below.

Coaches may communicate with the registered adult parent/guardian through ProPath's Email Parent feature — see Section K.

Parental consent: see Section F for the general consent architecture and Section G for COPPA-specific protections for players under 13.

Deletion/withdrawal: a parent may request deletion of their child's profile or withdraw consent at any time — see Section V.

Retention: see Section Q.

No sale, no behavioral advertising: ProPath does not sell a minor player's personal information, and does not share or use a minor player's personal information for cross-context behavioral advertising or targeted advertising.

F. Parental Consent

A parent or guardian must acknowledge the Parental Consent & Minor Privacy Notice before using the parent portal, and must specifically confirm their relationship to each linked player before that player's development information becomes visible to them. These acknowledgments are recorded with a version and timestamp.

For a player under 13, additional protections apply — see Section G.

G. COPPA

ProPath treats any player under 13 as covered by the Children's Online Privacy Protection Act ("COPPA"). For a covered under-13 player, ProPath restricts collection and use of that player's personal information, and restricts that player's access to development features requiring such collection, until a parent or guardian has completed a verifiable-parental-consent process.

[LEGAL REVIEW REQUIRED BEFORE PRODUCTION]: the consent method implemented as of this writing is an authenticated-parent checkbox attestation (a parent, having signed in through a verified email invite, confirms they are the child's parent/guardian and authorize the described permissions). Whether this method satisfies COPPA's verifiable-parental-consent requirement for the specific personal information ProPath collects has not yet been confirmed by qualified counsel, and a stronger method may be adopted before this is relied on for a general under-13 population at scale.

A parent of a covered under-13 child has the right, as applicable, to: review the information collected about their child; request deletion of that information; refuse further collection or use of that information; and withdraw consent at any time. Contact [PRIVACY EMAIL] to exercise these rights.

H. Why Information Is Used

ProPath uses the information described in Section D to: provide and operate accounts; authenticate users; operate player-development tools (IDPs, assignments, check-ins); support team administration; provide the Email Parent communication feature; provide customer support; process payments; prevent fraud and abuse; maintain platform security; meet legal obligations; and improve the product.

I. Information Sharing

ProPath shares information in these categories: with service providers who process data on ProPath's behalf (see Section L); with the authorized parent/guardian of a linked player; with authorized coaches/team staff, scoped as described in Section J; where required by law or legal process; in connection with a corporate transaction (such as a merger or acquisition); and with professional advisers (such as legal or accounting) where appropriate.

Sharing information with a service provider that helps operate the Service, as described above, is not characterized here as "selling" that information — see Section I(1) below for ProPath's sale/advertising policy.

I(1). Sales / Advertising

ProPath does not sell personal information, as that term is generally understood, and does not sell minor-player personal information. ProPath does not share minor-player information for cross-context behavioral advertising, and does not use minor-player personal information for targeted advertising. ProPath does not currently operate advertising technology on the Service — see Section M.

J. Coach Access

A coach can access only players connected to them through a direct coach-player assignment or shared team membership, enforced in the product's access-control logic rather than left to policy alone. A coach cannot search all ProPath players, cannot view players on unrelated teams, and cannot access a player's phone number, private personal email, or home address, because ProPath does not expose that information to a coach in the first place — see Section D.

A coach cannot privately message a minor player through ProPath. A coach's only human-communication channel is Email Parent — see Section K.

K. Parent Emails

Authorized coaches may send development-related emails through the platform to the registered parent/guardian using Email Parent. ProPath's infrastructure resolves and sends these emails server-side; a coach does not see the parent's raw email address in the product interface.

ProPath stores metadata about each parent email sent (coach, parent, player, team, subject, template if used, delivery status, and timestamp) for safety, audit, and support purposes. Message body content is retained for a defined operational period rather than indefinitely — see Section Q.

L. Payment Data

Payment-card details are handled directly by our payment processor, Stripe, and are not stored by ProPath. ProPath's authentication and database infrastructure is provided by Supabase. ProPath's application is hosted on Vercel. If email delivery for Email Parent is configured with a third-party email provider, that provider processes the email content and recipient address solely to deliver the message.

M. Cookies / Analytics

ProPath uses essential cookies necessary for authentication and core site functionality. ProPath does not currently operate a separate analytics, advertising, or behavioral-tracking tool on the Service, and does not deploy advertising technology in any authenticated player area. If that changes in the future, this Policy will be updated first, and any tracking technology in an authenticated minor-player area will undergo a separate legal/privacy review before deployment.

N. California Privacy

Depending on ProPath's size and operations, some or all California Consumer Privacy Act ("CCPA")/California Privacy Rights Act rights described below may or may not be legally required to be offered by ProPath, depending on whether ProPath meets the statute's applicability thresholds. [LEGAL REVIEW REQUIRED BEFORE PRODUCTION]: this section should be finalized once ProPath's CCPA applicability is confirmed by counsel.

Where legally applicable, California residents may have the right to: know/access the personal information ProPath has collected about them; request deletion; request correction; opt out of the sale or sharing of personal information (ProPath does not sell or share personal information as described in Section I(1)); limit the use or disclosure of sensitive personal information where applicable; and not be discriminated against for exercising these rights. An authorized agent may submit a request on a consumer's behalf, subject to identity verification. California residents can submit requests to [PRIVACY EMAIL].

California law also provides specific protections for minors' information; ProPath's minor-specific practices are described in Sections E and G above.

O. California Online Privacy Disclosures

As required by the California Online Privacy Protection Act, this Policy discloses how ProPath handles Do Not Track signals: ProPath's Service does not currently have technical support for responding differently to Do Not Track or Global Privacy Control signals, because ProPath does not operate the kind of cross-site tracking those signals are designed to limit (see Section M).

P. Sensitive Personal Information

ProPath recognizes that information about minors, and certain wellness-related information collected through the weekly check-in, can warrant heightened care. ProPath minimizes collection of this information to what is genuinely useful for player development (see Section D) and does not collect detailed medical, mental-health, or reproductive health information as part of the core product.

Q. Data Retention

ProPath retains information on a purpose-based basis rather than indefinitely. As a general framework:

• Active player-development records: retained while the player profile is active, plus a limited post-cancellation window
• Account records: retained while the account is active, plus a limited period after closure for legal/fraud-prevention purposes
• Payment records: retained per applicable financial record-keeping requirements
• Consent records: retained for the life of the account plus a defined period after, as evidence of what was consented to and when
• Communications metadata (Email Parent): retained for a defined operational window
• Email body content (Email Parent): retained for a shorter, defined window than metadata
• Audit/security logs: retained per security/operational requirements
• Deleted-account backups: purged from backups on a rolling schedule after deletion

[LEGAL REVIEW REQUIRED BEFORE PRODUCTION]: the exact retention periods above are operational placeholders pending legal sign-off — see src/lib/privacy-requests.ts in the product's own architecture for where these are implemented.

R. Data Security

ProPath uses reasonable technical and organizational safeguards appropriate to the sensitivity of the information involved, including encrypted transport (HTTPS), authentication through a dedicated identity provider, server-side authorization checks, and role-based access separating parent, player, and coach access. No system can be guaranteed to be completely secure, and ProPath does not represent that the Service is 100% secure.

S. International Users

ProPath is currently designed and operated for users in the United States. ProPath does not represent that it complies with the EU/UK General Data Protection Regulation or other non-U.S. data-protection frameworks. [FUTURE LEGAL REVIEW REQUIRED BEFORE ACTIVE UK/EU CHILD ACCOUNTS.]

T. Privacy Requests

A privacy request (access, deletion, correction, or another request described in this Policy) can be submitted through the in-product privacy-request workflow (see the Parent Portal's privacy settings) or by emailing [PRIVACY EMAIL]. ProPath will acknowledge and process requests consistent with applicable law.

U. Parental Rights

A parent or guardian may review their child's ProPath information, request its deletion, disconnect a linked player, or withdraw consent at any time from the Parent Portal's privacy settings, or by contacting [PRIVACY EMAIL]. Withdrawing consent for a covered under-13 child restricts that child's profile going forward, consistent with Section G.

V. Account Deletion

A parent may request deletion of a linked child's profile, or of their own parent account, through the Parent Portal's privacy settings or by contacting [PRIVACY EMAIL]. An adult user (coach or adult athlete) may request deletion of their own account the same way. Deletion is subject to the retention exceptions described in Section Q (for example, payment records retained for accounting purposes).

W. Policy Changes

ProPath may update this Privacy Policy from time to time. A material change will be reflected in an updated version number and "Last updated" date at the top of this page, and, where appropriate, additional notice will be given.

X. Contact

Privacy questions or requests: [PRIVACY EMAIL]. General support: [SUPPORT EMAIL]. Mailing address: [BUSINESS ADDRESS].