Privacy Policy

For privacy law purposes, the controller of your personal information is [COMPANY LEGAL NAME, INC.], [MAILING ADDRESS]. This Policy applies to personal information we process through the Service. It does not cover third-party sites or services we do not control (see Section 12).

We collect the following categories of personal information:

• Account information — name, email address, and authentication data. We support passwordless sign-in via passkeys and magic links and sign-in with Google; if you use Google, we receive basic profile information from your Google account.
• Content you submit — leagues, teams, rosters, schedules, scores, statistics, player profiles, photos, and other media ("Your Content"), including information about athletes.
• Payment information — for paid plans, billing details are collected and processed by our payment processor ([Stripe / PROCESSOR]); we do not store full card numbers.
• Communications — messages you send us, such as support requests or profile takedown/correction requests.
• Usage & device data — collected automatically, such as IP address, device and browser type, pages viewed, and actions taken, via cookies and similar technologies (see Section 4).

We practice data minimization — we collect only what is reasonably necessary to provide the Service, and we do not require more information than is needed to participate.

We use personal information to:

• Provide, operate, and maintain the Service, including public league, team, and player pages and the developer API;
• Authenticate you and secure your account (passkeys, magic links, and Google sign-in);
• Process payments and manage subscriptions;
• Respond to your requests and send service and transactional messages;
• Analyze and improve the Service, and develop new features;
• Detect, prevent, and address fraud, abuse, and security issues; and
• Comply with legal obligations and enforce our Terms.

Where required by law, we rely on a lawful basis to process your information — [e.g., contract performance, legitimate interests, consent, legal obligation].

We use cookies and similar technologies for essential functionality (such as keeping you signed in) and for [analytics — e.g., PostHog / Plausible / GA4]. You can control cookies through your browser settings, and we honor recognized opt-out preference signals such as Global Privacy Control (GPC) where required.

[Confirm exactly which analytics/advertising technologies are used and whether a cookie consent banner is required for your audience and regions.]

We share personal information only as described here:

• Public pages & API. Stats, scores, and profiles are public by design and may appear on public pages and through the developer API. Do not submit information you do not want to be public (see Section 7).
• Service providers. Vendors who process data on our behalf — such as hosting, payment processing, email, and analytics — under contracts that limit their use of the data.
• At your direction — for example, when you make content public or connect a third-party integration.
• Legal & safety. When required by law, to enforce our Terms, or to protect the rights, safety, and security of users and the public.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. [Confirm — update if any "sale" or "share" occurs under CCPA/CPRA definitions.]

The Service is not directed to children under 13, and they may not create their own accounts. We do not knowingly collect personal information directly from children under 13. Where a child under 13 uses the Service, it must be through a parent, guardian, or authorized league/team operator.

• Information about youth athletes is submitted by leagues, teams, coaches, or parents, who must have the authority and any required parental consent to do so.
• We retain children's personal information only as long as reasonably necessary for the purpose it was collected, and not indefinitely.
• Parents and guardians may review, request deletion of, or refuse further collection of a child's personal information by contacting us at [privacy@gostats.io].
• [If the Service knowingly collects data from under-13 users or discloses it to third parties, COPPA requires a dedicated notice, verifiable parental consent, and identification of third parties — counsel to confirm the consent flow.]

Player, team, and league pages are public so fans, recruiters, and the community can find them. You can manage what you submit, and athletes (or parents/guardians for minors) can request to claim, correct, or remove a profile.

To make a request, use our contact form or email [privacy@gostats.io]. We describe our takedown and correction process and timelines at [LINK].

We keep personal information only as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods depend on the type of data and why we hold it — for example, [account data for the life of the account + X months; billing records for Y years]. When no longer needed, we delete or de-identify it.

We use reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit and support for phishing-resistant passkey sign-in. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If a breach affects you, we will notify you and regulators as required by law.

California (CCPA/CPRA). California residents have the right to know, access, delete, and correct their personal information; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and to not be discriminated against for exercising these rights. We honor the Global Privacy Control. To exercise the opt-out, use [“Do Not Sell or Share My Personal Information” link / mechanism].

EEA/UK (GDPR). If you are in the EEA or UK, you have the right to access, rectify, erase, restrict, and port your data; to object to certain processing; and to withdraw consent. You may also lodge a complaint with your local supervisory authority.

Other U.S. states. Residents of states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out.

To exercise any right, contact us at [privacy@gostats.io] or via our contact form. We will verify your request as required and may ask for information to confirm your identity. You may use an authorized agent where permitted.

We are based in [COUNTRY] and may process information in other countries. Where we transfer personal information across borders, we use appropriate safeguards such as [Standard Contractual Clauses] as required by law.

The Service may link to or integrate with third-party sites and services that we do not control. Their handling of your information is governed by their own privacy policies, and we encourage you to review them.

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice — for example, by posting the updated Policy with a new "Last updated" date or by notifying you in-product or by email. Your continued use of the Service after the changes take effect means you accept the updated Policy.

Questions or requests about your privacy? Reach us at:

[COMPANY LEGAL NAME, INC.]
[MAILING ADDRESS]
Contact form · [privacy@gostats.io]

[If you serve EEA/UK users, name an EU/UK representative or Data Protection Officer and contact details here, if required.]