Children's Privacy Policy

This policy applies to children under 13 who use Drift Hockey through a managed child account created and controlled by a verified parent or legal guardian (the "parent"). Children cannot create their own accounts.

For purposes of COPPA, Drift Hockey LLC is the "operator" of the Service (16 C.F.R. § 312.2). Drift Hockey is not an educational technology service; we do not accept school authorization in lieu of verifiable parental consent.

If you are a parent and believe your child has provided us information without your consent, contact us at privacy@drifthockey.com.

Before we collect any personal information from a child, we provide direct notice to the parent and obtain verifiable parental consent in compliance with 16 C.F.R. § 312.5. Our process:

1. The parent creates their own Drift Hockey account using their real name and email.
2. The parent initiates creation of a managed child account and confirms they are the child's parent or legal guardian.
3. We send a direct-notice email to the parent describing what we collect, how we use it, the parent's rights under COPPA, and a link to this policy.
4. The parent confirms consent by clicking the verification link from their email account (an email-plus method permitted by 16 C.F.R. § 312.5(b)(2) for internal-use-only data).
5. The child account is activated only after consent is confirmed. Consent revocation immediately suspends the account.

We log the consent event (timestamp, IP address, user-agent) so the parent can audit it from the Parent Dashboard.

16 C.F.R. § 312.5(b) authorizes several verifiable-parental-consent (VPC) methods. We currently use email-plus (permitted because we use children's information for internal Service operations only) and reserve the right to use any of the following methods if our use of children's information ever expands beyond internal operations:

• Email-plus — current method.
• Government-issued identification verification with prompt secure deletion.
• Knowledge-based authentication (KBA) using questions of sufficient difficulty.
• Facial-recognition match between an ID photo and a live image, with human review.
• Signed consent form returned by mail, fax, or electronic scan.
• Toll-free telephone or video conference with trained personnel.
• Use of a payment system (e.g., monetary transaction confirmation).

We will provide updated direct notice and re-obtain consent if we materially change the VPC method or the use of children's information.

We collect only the minimum needed to provide the Service. For child accounts, this includes:

• Account credentials — email and password, set by the parent.
• Profile — first name, last name, date of birth.
• Team data — team affiliations, jersey number, position (added by coaches).
• Usage — pages visited and features used, for app functionality and security.
• Device & persistent identifiers — push-notification token (only if the parent enables notifications), session token, and authentication identifiers used solely to support internal Service operations as described in Section 3b.

We do not collect from children: precise geolocation, contact lists, financial information, advertising identifiers, or persistent device identifiers used for cross-context tracking.

We do not collect biometric identifiers from children, including fingerprints, voiceprints, handprints, retina or iris patterns, genetic data, or facial-recognition templates derived from photos or video. Photos and videos uploaded to a team are stored as media only; we do not run them through facial recognition or any biometric template generation.

Consistent with Apple's Kids Category requirements and Google Play's Designed for Families program, the child experience in Drift Hockey contains:

• No advertising SDKs of any kind — no behavioral, contextual, or in-app advertising is shown to children, and no advertising identifiers are collected.
• No third-party analytics SDKs — we do not embed Google Analytics, Firebase Analytics, Mixpanel, Amplitude, Segment, Adjust, AppsFlyer, Branch, or any equivalent analytics or attribution SDK in the child experience.
• No social-network SDKs — no Facebook, X/Twitter, TikTok, Snap, Reddit, or similar social SDKs are present.

The only third-party services that may receive any data tied to a child account are the sub-processors listed in Section 5: Supabase (database, authentication, storage), Apple Push Notification service and Firebase Cloud Messaging (push delivery, only if the parent enables notifications), Sentry (crash logs scrubbed of personal information), Mux (only if a coach uploads team video), and Resend (email to the parent). Each is contractually limited to processing data on our behalf for the internal Service operations described in Section 3b, and is prohibited from using child data for behavioral profiling, advertising, or model training.

We do not collect medical, health, concussion, injury, mental-health, SafeSport, or background-check information about children, and no field in Drift Hockey is intended for that data. Coaches, parents, and clubs must not enter such information about a child into notes, messages, roster fields, or any other free-text area. If we discover prohibited information has been uploaded about a child, we may delete it without notice.

Exception for Drift Sessions registrations. When a parent or guardian registers a child for a program, the organization's registration form may include its own optional questions, such as allergies, medical notes, or special needs. Only the parent or guardian answers them, and answering is their choice. We store the answers only on behalf of that organization, share them only with its authorized staff, use them only to manage the registration, and never sell them or use them for analytics or advertising.

Drift Hockey LLC is not a HIPAA Covered Entity or Business Associate (45 C.F.R. § 160.103) and is not a FERPA "school official" (34 C.F.R. § 99.31). Do not transmit Protected Health Information or FERPA-protected education records about a child through the Service.

When a parent or guardian registers a child for a program through Drift Sessions, the parent enters the child's information, such as name, date of birth, and emergency contacts, and signs any waivers the organization requires. Children do not register themselves. We process this information on behalf of the organization running the program, share it only with that organization, and use it only to manage the registration.

We collect persistent identifiers from child accounts for the sole purpose of supporting the following internal operations of the Service:

• Authentication and session management (keeping the child signed in).
• Security, fraud prevention, and abuse detection.
• Routing operational push notifications the parent has enabled (e.g., schedule updates).
• Crash and error logging to fix bugs.
• Aggregated, de-identified analytics to operate and maintain the Service.

We do not use these identifiers for behavioral advertising, targeted content, profile-building, or any purpose that would amount to contacting the child for non-Service purposes. Vendor contracts with Supabase, Apple Push Notification service, Firebase Cloud Messaging, and Sentry forbid downstream reuse for advertising or profile-building.

• Provide access to Drift Hockey (team schedules, rosters, messages within their team).
• Display content that coaches have shared with the child's team.
• Allow the parent to review, update, or delete their child's information.
• Maintain the security and integrity of the Service.

We do not use children's information for advertising, behavioral profiling, marketing emails, model training (including third-party generative AI), or any purpose beyond providing the core Service. Push notifications to children are limited to operational categories (schedule changes, messages from their team, safety alerts); we do not use engagement-prolonging push patterns. Information collected from a child is used for internal purposes only — a category of use for which COPPA permits the email-plus parental-consent method we use (16 C.F.R. § 312.5(b)(2)).

We do not sell, rent, or share children's information for any third party's own use, and we do not disclose children's personal information for monetary compensation, advertising, or for the development or training of artificial-intelligence systems. The 2025 COPPA amendments confirm that none of those purposes are ever "integral to the Service."

If we ever propose to disclose a child's personal information to a third party for any purpose beyond the categories listed below, we will first obtain a separate, opt-in verifiable parental consent for that disclosure.

The categories of third parties who receive child information strictly to perform services on our behalf, and the purposes of each, are:

• Supabase — cloud database, authentication, file storage.
• Mux — processing and delivery of team videos uploaded by coaches.
• Resend — delivery of transactional and consent-related email to the parent.
• Apple Push Notification service & Firebase Cloud Messaging — push-notification delivery, only if the parent enables notifications.
• Sentry — crash and error logging.

All sub-processors are contractually limited to processing data on our behalf for the purposes above. We may disclose information if required by law or to protect a child's safety; we will notify the parent whenever legally permitted.

Severe safety violations involving CSAM are reported to the National Center for Missing & Exploited Children (NCMEC) and law enforcement as required by 18 U.S.C. § 2258A.

In addition to COPPA, several US states impose heightened privacy duties for services used by minors, including the California Age-Appropriate Design Code Act (Cal. Civ. Code § 1798.99.28 et seq.), Connecticut's online-services-for-minors provisions (Conn. Gen. Stat. § 42-515 et seq.), the Texas SCOPE Act, and the New York SAFE for Kids Act. To the extent any of these laws apply to Drift Hockey, we comply by: (i) not profiling minors, (ii) not using minors' personal information for behavioral advertising, targeted content, or model training, (iii) applying the highest privacy settings to minor accounts by default, (iv) not using engagement-prolonging design patterns (autoplay, infinite scroll, algorithmic feeds, streaks), and (v) providing parental controls described in Section 6.

As a parent or legal guardian, you have the following rights at any time:

• Review — view all information we have collected about your child via the Parent Dashboard.
• Correct — update your child's profile through the Parent Dashboard.
• Delete — request deletion of your child's account via Profile → Managed Accounts → Delete Account.
• Revoke consent — withdraw consent at any time via Profile → Managed Accounts → Revoke Consent.
• Restore consent — re-grant consent later from the same screen.
• Refuse further collection — by deleting the account.

Revoking consent immediately blocks the child's access until consent is restored. Revocation does not delete data — submit a separate deletion request for that. We respond to requests within 5 business days.

We maintain a written information-security program covering all personal information we collect, including children's information. The program is appropriate to the sensitivity of children's data and to the size, complexity, and nature of our operations, and includes:

• Encryption of all data in transit (TLS 1.2+) and at rest.
• Row-Level Security restricting each row to the child, their parent, and authorized coaches.
• Email-verified parental consent before any child account is activated.
• Time-limited authentication tokens and revocation links.
• Vendor-risk review of every sub-processor that handles children's information.
• Incident-response procedures with breach notification to parents and regulators within 72 hours of becoming aware where required by law.
• Annual review of the program and after any material change to the Service.

We retain children's personal information only as long as is reasonably necessary to provide the Service and to fulfill the specific purposes for which it was collected. We do not retain children's information indefinitely. Specific retention periods:

On deletion, we permanently delete the child's account and associated information within 30 days, except where a longer retention period is required by law (for example, safety reports retained for 7 years under federal recordkeeping requirements). We confirm the deletion to the parent by email.

Approximately 30 days before a child's 13th birthday, we email the parent to explain that on the child's 13th birthday the account will transition out of parental oversight: the child becomes a regular user under our Privacy Policy, the parent's management access ends, and the parent loses the ability to delete the account on the child's behalf. The parent may delete the account before the transition by visiting Profile → Managed Accounts → Delete Account.

Drift Hockey LLC is not currently a member of an FTC-approved COPPA safe-harbor program. We self-certify compliance with COPPA and review our practices regularly. We will join an approved safe-harbor program if our scale or risk profile warrants it and update this policy accordingly.

We will notify parents by email of any material changes at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

For privacy questions or to exercise parental rights, contact:

This policy is provided in compliance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq., and the FTC's COPPA Rule, 16 C.F.R. Part 312, as amended in 2025.