Security

Where your data lives

• Database and files: Supabase, in the eastern United States, encrypted at rest and in transit.
• Application hosting: Vercel, served over HTTPS only: browsers are told never to use a plain connection (HSTS), and no other site can frame our pages.
• Sign-in: Clerk. We never see or store your password.
• Payments: Stripe. Card numbers go directly to Stripe from your browser. They never touch our servers, our logs, or our database. We store only the status of a payment.
• Email: Resend.

How one club is kept separate from another

Every record belongs to exactly one club. On every request our servers work out who you are, then read only the records of the clubs you belong to, narrowed to what your role there allows. That check is in our own server code.

The database also has its own rules (row-level security) on the tables that hold club, roster and family data. Our servers read through a privileged connection that those rules do not apply to, so they are a second line for anything that reaches the database another way, not the line you rely on day to day.

The privileged connection's key is held only on our servers and never reaches a browser.

Who can see what

Access follows the role your club assigns: administrator, coach, team manager, scheduler, treasurer, or view-only. Each role maps to a defined set of capabilities, and pages and actions are filtered by it.

Guardians see their own children. Coaches see the teams they are assigned to. Nobody sees another organization.

Athlete Orchard’s founders can open a club in the app, so we can support clubs and fix problems. We do so only to run the service or to look into a specific problem someone has reported. Every time we open a page that shows children, it is logged, and the club’s administrators see the list on their admin page. A school club’s data opens to us only while one of its administrators grants it, for a day or a week, and they can end it sooner.

Files and attachments

Files uploaded into club messaging are stored in private storage. Opening one requires being signed in and being a member of that club, and that permission is checked every time the file is opened, not once when it was uploaded. Links to attachments are short-lived and are not shareable with someone outside the club.

Public storage is used only for things that are meant to be public, such as an organization's own logo.

Things we deliberately do not do

• No analytics, tracking pixels, or session recorders. There are none on this site.
• No advertising, and no advertising profiles.
• We do not sell data.
• We do not train machine learning models on your club's data.
• A photographed roster is never uploaded. Text recognition for roster imports runs inside your own browser; only the recognition software is downloaded to you.
• A child's name is never sent to our payment processor.

What we have not done yet

We are in beta, and a security page that lists only strengths is not worth reading. Currently:

• We have not completed a SOC 2 or comparable third-party audit.
• We have not had an external penetration test.
• We do not yet offer single sign-on or enforced multi-factor authentication for club administrators. Sign-in security follows what Clerk provides, and we recommend turning on every factor it offers.
• We do not yet publish an uptime status page.
• We do not yet have automated alerts for unusual sign-ins or reads.
• Automated data retention and expiry are not built yet.

If any of these matter to your board, ask us where they stand. We would rather tell you than have you assume.

Reporting a vulnerability

Please report anything you find to security@athleteorchard.com. Include what you found, how to reproduce it, and what you think the impact is. We will acknowledge within 3 business days and keep you updated until it is resolved. We will credit you if you would like us to.

Safe harbour. If you act in good faith under the rules below, we will not pursue legal action against you and will treat your report as authorized research.

Please do:

• Test only against accounts and organizations you create yourself.
• Stop as soon as you have confirmed a vulnerability exists.
• Give us reasonable time to fix it before telling anyone else.
• Tell us immediately if you encounter any real person's data, and delete your copy.

Please do not:

• Access, modify, or download data belonging to a real club, family, or child. The whole platform is records about children; there is no version of "just to prove it" that is acceptable here.
• Run denial of service, load testing, or automated scanning that degrades the service.
• Use social engineering, phishing, or physical attacks against our staff, our clubs, or our vendors.
• Leave test data, backdoors, or persistent access behind.

We do not currently run a paid bug bounty. We do read every report.

If something goes wrong

If a club’s data is exposed or reached by someone who should not have it, we tell the club within 7 days of finding out, sooner where its agreement with us says so. We say plainly what happened, what was involved and what we are doing about it, and where guardians need to know directly, we work with the club to make sure they are told.

Who does what, in what order, is our written incident plan.

Leaving, and deletion

A club’s administrators can download everything the club holds, as spreadsheets, from the club’s admin page. Its owner can delete the club there too. The deletion waits at least 30 days, while every administrator is told and any of them can cancel; then everything the club holds is erased at once, its files included, and its administrators get a certificate of deletion by email. People’s own accounts are not deleted with a club: they are each person’s, and some belong to other clubs too.

When a club leaves, or asks us to, we give it a copy of its data if it wants one, then delete the data within 90 days of the request and confirm the deletion in writing. Copies in the database’s daily backups are gone 7 days after that.

New York schools and districts

When a New York school district, charter school or BOCES uses Athlete Orchard for a school team or league, New York’s Education Law 2-d covers its students’ information. Before any student’s information is entered, we sign the district’s data privacy agreement, including its Parents’ Bill of Rights. Under that agreement:

• We use students’ information only to run the school’s teams. It is never sold, never used for advertising or marketing, and never used to build other products.
• Only people who need it to run those teams can reach it, and nobody else gets it without a parent’s written consent unless the law requires it.
• It is encrypted when stored and whenever it moves, and kept in the United States.
• If it is exposed, we tell the district within 7 calendar days of discovering it, sooner where its agreement says so, cooperate with the district, the state and law enforcement, and pay for, or promptly reimburse the district for, the full cost of the notifications a breach attributed to us requires.
• When the agreement ends, we return the district’s data and delete it within 90 days, and confirm the deletion in writing.
• Everyone at Athlete Orchard who can reach students’ information is trained first.

We have not yet signed an agreement with a New York school or district. Our Data Security and Privacy Plan says what we do for a school’s data, category by category, and marks what we finish before one signs.

Questions

security@athleteorchard.com