Privacy Policy

This policy describes how Ehren Stuber, a sole proprietor operating as Gridiron Studio, handles personal information in Gridiron Studio. During the current closed pilot, the service is offered only to invited participants in Utah, United States.

Gridiron Studio accounts and Calendar participation are only for people age 13 or older. We ask for an age range, not a birth date. A person under 13 may not create or use an account, and we do not offer a parental-consent path for under-13 participation.

Depending on how you use the service, we process:

• Account information, such as name, email address, authentication identifiers, and your selected age band.
• Team and roster information, roles, group membership, guardian-athlete links, invitations, and access settings.
• Football content, including playbooks, diagrams, practice plans, templates, instructions, and coach-created notes.
• Calendar information, including events, locations, audiences, RSVP history, participation expectations, and attendance.
• Notification preferences, push subscriptions, email and push delivery records, and limited provider status events.
• Support requests, privacy-request records, security events, device and browser data, and operational logs.

Coaches or team administrators may maintain an accountless roster record for team administration. An unknown-age athlete cannot use Calendar, receive direct notifications, RSVP, or link to a guardian until the required 13+ age-band attestation is complete.

We use information to provide and secure the service; operate team, roster, playbook, Calendar, practice, RSVP, and attendance features; enforce permissions and subscription limits; deliver requested communications; respond to support and privacy requests; prevent abuse; and maintain reliable records.

We do not sell personal information, serve targeted advertising, or use Calendar participation, attendance, or practice content for advertising.

Information is visible within a team according to role, audience, publication, and guardian-link settings. Authorized staff can see team operations and attendance. Players see only content deliberately published to them. A confirmed guardian link may provide logistics and proxy RSVP access for the linked athlete; it does not provide staff notes or attendance access.

We use Supabase for database and authentication services, Vercel for application hosting, Resend for transactional email, and browser push services for Web Push delivery. These providers process limited information on our behalf to perform those functions. We may also disclose information when required by law, to protect safety or the service, or as part of a business transfer subject to appropriate safeguards.

In-app notifications are part of the service. Operational email is enabled by default for adults and can be turned off. Athletes age 13–17 must opt in before receiving external email. Web Push always requires an in-product choice and browser permission.

External notifications are limited to team and event logistics. They do not include athlete identity, RSVP, attendance, medical information, coach notes, or practice content. You can change channel choices in notification settings and can revoke browser permission at any time.

Identifiable RSVP and attendance records are retained for 24 months after an event ends and then reduced to anonymous totals. Notification content and provider payloads are retained for up to 30 days; content-free delivery metadata is retained for up to 90 days. Completed under-13 incident audit records contain only limited identifiers, timestamps, actions, outcomes, and digests and are retained for 24 months after closure.

Other information is retained while needed to provide the service, meet team recordkeeping needs, resolve disputes, secure the service, or satisfy legal obligations. An authenticated deletion request overrides ordinary retention unless a narrow, documented legal or safety hold applies.

You may request access, review, correction, or deletion of information associated with you or a linked athlete, or revoke a guardian-athlete relationship. We verify the requester before releasing or changing information. These requests remain available regardless of a team's subscription status.

We acknowledge privacy requests within 2 business days and aim to complete them within 45 calendar days. When reasonably necessary, we may extend completion once by up to 45 additional days after notifying you of the reason before the initial period expires.

If we learn that an account holder may be under 13, we restrict account and delivery access while reviewing the report. We do not request additional child identity solely for that review. If under-13 status is confirmed, we delete direct account and notification destinations and anonymize participation, subject only to a documented legal or safety hold.

We may update this policy as the service changes. We will update the effective date and provide additional notice when a change materially affects how we handle personal information.

Questions, complaints, and privacy requests can be sent to estuber@auptim.com. You can also review the Terms of Service.