Children's Privacy

Who this is for

This notice is for the parents and guardians of young athletes whose clubs use Athlete Orchard. It explains what we hold about a child, who can see it, and how you get a copy or have it removed.

Your club decides what to collect and who at the club can see it. We run the software for them. If you want something changed or removed, you can come to us directly or ask your club, and either route works.

Children do not have accounts here

There is no sign-in for a child. Athlete Orchard has no account type for a young athlete, and a child is never asked to create one, log in, or give us anything directly.

Everything we hold about a child was entered by an adult: a parent or guardian during registration or on their child's record, or an authorized administrator or coach at the club.

We do not collect information from children. We store information about children, provided by the adults responsible for them.

What we store about a young athlete

Only what a club needs to run a season:

• Name
• Date of birth, used to place a child in the right age group
• Grade or division
• Jersey number, jersey size, position, and dominant hand
• Equipment needs
• Any medical or allergy notes a guardian or club chooses to enter
• An emergency contact given at registration: a name, how they are related to the child, and a phone number
• A membership number from a sport’s governing body, such as USA Hockey or USA Lacrosse, if the club records one
• Which clubs and teams the child is on and since which season, and which guardians they are linked to
• Registrations: the program or team, the waivers a guardian agreed to and when, their yes or no to the club using photos and video of the child, whether they offered to volunteer, whether they ordered the team’s kit, and what was paid or is owed
• Whether the child is coming to each practice or game, as a guardian or coach answered it, with any note they added
• Goals the child’s coaches set for them
• Volunteer sign-ups and jobs on a game or practice (snacks, a scorekeeper) a guardian took for the child or a coach gave them, and acknowledgments of must-read club messages a guardian made for the child
• While a coach imports a roster from a spreadsheet, its rows as the file had them, including any columns we do not use. Those copies are emptied when the import is finished, and an import left unfinished is deleted (or, if it already added athletes, emptied) after 30 days
• A log of edits to the child’s details, by the club’s staff or by their own family, and of registrations: who and when, not the details themselves. The log cannot be changed once written. And a log of each time someone on the club’s staff, or one of us, opened a page, a message or a download that shows the child: who, when and where, kept 13 months

That is the complete list. We do not hold a child’s email address, phone number, home address, school, student ID, photo, precise location, biometric data, or contacts, beyond what a coach’s spreadsheet carries while it is being imported. We do not ask a child for anything, because we never interact with one.

Medical and allergy notes are the most sensitive thing here. They are optional, they exist so a coach can keep a child safe at a practice, and they are visible only to the club staff described below.

Who can see it

• The child's own guardians, for their own children.
• Authorized staff at that one club: administrators, and the coaches and team staff for the teams the child is on. Access follows the role the club assigned.
• Nobody at another club. How, and its limits, is below.
• Not other families, beyond what your club chooses to publish to a team roster.
• Our founders, only to support the club. Athlete Orchard’s founders can open a club in the app, so we can support clubs and fix problems. We do so only to run the service or to look into a specific problem someone has reported. Every time we open a page that shows children, it is logged, and the club’s administrators see the list on their admin page. A school club’s data opens to us only while one of its administrators grants it, for a day or a week, and they can end it sooner.

How one club is kept apart from another

Every record belongs to exactly one club. On every request our servers work out who you are, then read only the records of the clubs you belong to, narrowed to what your role there allows. That check is in our own server code.

The database also has its own rules (row-level security) on the tables that hold club, roster and family data. Our servers read through a privileged connection that those rules do not apply to, so they are a second line for anything that reaches the database another way, not the line you rely on day to day.

What we never do

• We do not sell or rent a child's information. Not to anyone, for any price.
• We do not use it for advertising, and we show no ads.
• We do not build advertising or behavioral profiles.
• We do not run analytics, tracking pixels, or third-party trackers of any kind on this site. There are none. Not Google Analytics, not a Meta pixel, not a session recorder.
• We do not use your club's data, or any child's data, to train machine learning models.
• We do not disclose it except to the service providers listed below that are needed to run the platform, or where the law genuinely requires it.

Two places we went further than we had to

A photographed roster never leaves your device. Coaches often import a roster by photographing a sheet of paper. The text recognition runs inside your own browser. The photograph is never uploaded to us. Only the recognition software is downloaded to you, the first time you use it.

A child's name is never sent to our payment processor. When a family pays, the information attached to that payment identifies the club, the team, and the program. The athlete's name is not part of it.

Ask Ayo

Ask Ayo is the assistant inside Athlete Orchard. Parents and club staff can ask it how to do something, and staff can ask about their schedule and practices. It was built with children in mind, and these are rules the software keeps, not only ones it is asked to follow:

• Ayo never looks at players, families, rosters, registrations, payments, messages or RSVPs. Its tools have no way to read those records, and an automated check fails our tests if any of its code tries.
• What it can see. For club staff: the teams you can see (name, age group and the like, and how many players, not who), drills and the curriculum, upcoming events, practice plans (not coaches' notes) and notes you ask it to keep. For a parent, only the how-to guides for each page, the how-to articles and notes you ask it to keep.
• What you type is checked first. Before a message leaves your device, and again on our server, Ayo checks it and stops it if it has an email address, a phone number, a birth date, a list of names or someone's health details in it. When it stops a message, nothing is sent. What its tools read is checked the same way, and anything that fails is left out.
• Please leave children's names out. Ayo cannot always tell a first name from an ordinary word. The check is careful, not perfect.
• Anthropic. What you type is sent to Anthropic, the company whose AI model powers Ayo, with the conversation so far and what Ayo read for you, only to answer you.
• Your conversations. Your conversations are kept in Athlete Orchard so you can come back to them. In the app, only you can open them, and deleting your account deletes them. A note about how you work is kept only when you press Remember on it, and Forget them clears every note.
• It never acts on its own. When Ayo sets something up (a practice, a draft message, a practice plan), it shows you a card, and nothing happens until you confirm it.

Service providers

We use a small number of vendors to run the platform. Each is bound to use the information only to provide its service to us, with one exception: Stripe, as a payment processor, also uses payment details to prevent fraud and to improve its own services, under its own privacy policy. No child's name is sent to Stripe.

• Supabase, database and file storage, hosted in the United States
• Vercel, application hosting
• Clerk, sign-in for adults. Children have no accounts, so no child's information is held here
• Stripe, payments. Card details go directly to Stripe and never touch our servers or our database
• Resend, email delivery to adults
• Anthropic, the AI model behind two things. It reads a practice plan a coach imports from a photo, so the drills and notes come through intact: a plan is coaching content, not a child's record, though a coach's notes can mention a player; the photo is not kept by us, and a coach can choose to read it on their own device instead. And it answers Ask Ayo (above), which never reads a child's record. Rosters are never sent

Files shared in club messages

Attachments sent in club messaging, including anything a coach uploads such as a form or a roster, are stored privately. Opening one requires being signed in and being a member of that club: permission is checked every time a file is opened, not once when it was uploaded.

Keeping it, and getting rid of it

We keep a child's record while their club is active on the platform, because a club needs last season's roster to run this one.

A parent or guardian can, at any time:

• See everything the club holds about their child, medical notes included, and who has changed or opened it: sign in, open My kids, then the child's whole record
• Change their child's medical and allergy notes and emergency contact themselves, on that page. The club's coaches and admins see that the family changed them, and the club's activity log notes the change without what it says
• Say yes or no to the club using photos and video of their child, when registering and at any time after, on that page. No is completely fine and changes nothing about playing; the child's coaches see a no-photos mark beside their name
• Ask the club to correct anything else that is wrong, from that page (it opens a conversation with the club's admins about the child)
• Ask for a copy of everything we hold about their child
• Ask us to correct anything the club has not
• Ask us to delete their child's record
• Withdraw the medical or allergy notes specifically, while leaving the rest

Email legal@athleteorchard.com and say which child and which club. We will confirm who you are first, because a request to hand over a child's information is exactly the request an impostor would make. We aim to complete requests within 30 days, and usually much sooner.

A parent or guardian who deletes their own account (Your account, then Delete your account) is unlinked from their child at once. The child's record stays with the club, and any other guardian stays linked; to have the record deleted as well, email the address above.

When a club leaves, or asks us to, we give it a copy of its data if it wants one, then delete the data within 90 days of the request and confirm the deletion in writing. Copies in the database’s daily backups are gone 7 days after that.

If something goes wrong

If a club’s data is exposed or reached by someone who should not have it, we tell the club within 7 days of finding out, sooner where its agreement with us says so. We say plainly what happened, what was involved and what we are doing about it, and where guardians need to know directly, we work with the club to make sure they are told. Security reports are welcome at security@athleteorchard.com.

Teams run by a New York school

If your child's team is run by a New York school district, charter school or BOCES, New York's Education Law 2-d also covers your child's information. What we take on for those teams is on our security page, under New York schools and districts.

Changes

If we change this notice in a way that meaningfully affects a child's information, we will notify club administrators by email before it takes effect, and update the date at the top.

Contact

legal@athleteorchard.com

Athlete Orchard is operated by League Orchard, LLC. You can also raise anything through your club, whose administrators can reach us directly.