DRAFT — needs lawyer review. Not yet in effect.

Privacy Policy

Draft dated October 28, 2026. [One Huddle legal entity name] (“One Huddle”, “we”).

The short version

• We run websites and apps for youth flag football leagues. Most of the information we handle belongs to a league and its families, and we handle it only to run that league's site for them.
• Many of the players are children. Children don't sign up themselves — a parent or guardian registers them.
• We never sell personal information, never show ads, and never use children's information for marketing.
• Every league has its own separate, private database.

Who this covers

This policy covers (1) onehuddleflag.com, our product site, and (2) the league websites we operate for our customer leagues (each on the league's own web address). On a league's site, the league decides what information it collects and why; we process that information on the league's behalf and following its instructions, as its service provider. Leagues may have their own privacy notice too.

Information on onehuddleflag.com

When a league signs up, we collect the contact's name, email, phone, the league's name and city, and what they tell us about their league. We use it only to contact them about One Huddle and set up their league. We record a salted, one-way hash of the visitor's IP address to stop spam; we don't store the IP itself. This site uses no advertising or tracking cookies; staff who sign in to our admin get one sign-in cookie.

Information on league sites

Depending on what a league turns on, a league site may hold:

• Parents / guardians: name, email, phone, address, household members, emergency contacts, sign-in details, waiver signatures, and payment records (card details are handled by Stripe — we never see or store full card numbers).
• Players (often children): name, date of birth or age group, gender division, team, jersey number, school or grade if the league asks, medical notes or allergies if the league asks, and game statistics such as touchdowns.
• Coaches, referees and league staff: name, contact details, role, and the games they work.
• Game information: schedules, scores, standings and plays, which leagues usually publish on their public pages.
• Technical information: sign-in sessions, security logs, error reports, and privacy-friendly page-view counts that don't use advertising cookies or build profiles of people.

Children's information

• Parents are in control. A player's information is entered by their parent or guardian (or by the league from its registration), not collected from the child. Children don't create accounts. We don't knowingly collect personal information directly from children under 13; if we learn we have, we delete it.
• Only what the league needs. We collect children's information only to run the league: registration, rosters, schedules, scoring, safety (such as emergency contacts and medical notes), and communication with their family.
• What's public is the league's choice. Public pages show what the league chooses to publish, such as team names, schedules and scores. Family contact details, birth dates and medical notes are never public. Only the league's authorized staff and the child's own family can see them.
• Never sold, never used for ads. We don't sell or rent children's information, use it for advertising, or build marketing profiles from it.
• Parent rights. A parent or guardian can review their child's information, correct it, or ask for it to be deleted, through their league or by writing to support@onehuddleflag.com. We'll check that the request comes from the child's parent or guardian, and work with the league to respond. Some records, such as payment records, may need to be kept for legal or accounting reasons.

How we protect it

• Each league's information lives in its own separate database. One league can never see another's.
• Data is encrypted in transit (HTTPS) and at rest by our database provider. Database access is locked down: only our servers, after checking who is signed in, can read family information.
• Staff access is limited to people who need it to support the league.
• Backups are encrypted and kept for a limited time.

Who we share it with

Only with the service providers that help us run the sites, and only to do that: Vercel (website hosting), Supabase (databases), Resend (email delivery), Stripe (payments) and our backup storage provider. Each is bound to protect the information and use it only for us. We may also share information if the law requires it, or to protect someone's safety. If One Huddle is ever sold or merged, this policy will continue to protect the information already collected.

How long we keep it

League information is kept for as long as the league uses One Huddle, so it can keep its history (past seasons, standings and records). When a league leaves, we return its information to the league on request and delete it within [90] days, apart from backups, which expire on their own schedule, and records we must keep by law.

Your choices

You can ask to see, correct or delete your information, or stop non-essential emails, by writing to support@onehuddleflag.com. Depending on where you live, you may have more rights under your state's privacy laws; we'll honor them.

Changes

If we change this policy in a way that matters, we'll update the date above and tell our leagues before the change takes effect.

Contact

support@onehuddleflag.com · [One Huddle legal entity name, mailing address]