Privacy Policy

Drift Hockey distinguishes between two categories of personal information:

• User Data — information about people who hold their own account (coaches, parents, players age 13+, club staff). This is provided directly by the user.
• Player Data — information a Team Admin enters about a Roster Member who may not have an account (e.g., a youth player's name, jersey number, position, or guardian contact). The Team Admin is responsible for confirming they have authority to enter this information; we process it on the club's behalf.

We collect only what we need to operate the Service. Categories include:

• Identifiers & account — name, email, password (hashed), date of birth, optional phone number, optional avatar image, time zone.
• Team & roster data — clubs and teams you belong to, your role (owner, manager, coach, player, parent), jersey number, position, guardian relationships.
• Schedule & attendance — events you create or attend, attendance status, locations and opponents you save.
• Messages & content — messages, photos, drills, practice plans, video uploads, notification preferences.
• Safety data — reports you submit, blocks you set, content flagged by automated filtering, suspension history.
• Device & usage — IP address, user-agent, app version, push-notification token, crash logs, basic analytics on which features you use.
• Location lookups — addresses you type into venue or opponent fields are sent to Google Maps Platform to convert into coordinates and rendered on a map. We do not collect your device's GPS location.
• Billing — for paid subscriptions, Stripe handles your payment-card data; we receive only a customer ID, plan, and billing status.
• Drift Sessions registrations — when you book a program, we collect what the organization's registration form asks for, such as the participant's name and date of birth, parent or guardian contact details, emergency contacts, and signed waivers. We process this on behalf of the organization you register with, which decides what its form asks for and uses the information to run its program. Stripe handles card data for bookings; we receive only the payment status, amount, and refund history.

We do not collect biometrics or advertising identifiers, and we do not sell or "share" personal information for cross-context behavioral advertising (as those terms are defined under California's CCPA/CPRA).

No health, medical, or SafeSport data in Drift Teams. Except as described in the next paragraph for Drift Sessions registrations, the Service is not designed to receive medical, health, concussion, injury, mental-health, SafeSport, or background-check information about any user or roster member, and no field in Drift Hockey is intended for that data. Coaches, parents, and clubs must not type such information into notes, messages, roster fields, or any other free-text area. If we determine that prohibited categories of information have been uploaded, we may delete it without notice and the uploading club is solely responsible for any breach-notification obligations that result.

Health information in Drift Sessions registrations. Drift Hockey does not ask for health information. However, an organization's registration form may include its own optional questions, such as allergies, medical notes, or special needs, so it can safely run its program. Answering is the family's choice. We store these answers only on behalf of that organization, use them only to manage the registration, do not use them for analytics or advertising, and never sell them. Only the organization's authorized staff can see them. The organization decides what it asks, must ask only for what it needs to run the program, and is responsible for how it uses the answers. HIPAA does not apply to this information, and Drift Hockey is not a medical record. Depending on where you live, laws such as Washington's My Health My Data Act and California's CCPA/CPRA may give you rights over this information. Contact the organization or us to exercise them.

Not a HIPAA Covered Entity, Business Associate, or FERPA School Official. Drift Hockey LLC is not a "Covered Entity" or "Business Associate" as those terms are defined under the Health Insurance Portability and Accountability Act (HIPAA, 45 C.F.R. § 160.103) and we will not enter into Business Associate Agreements; do not transmit Protected Health Information ("PHI") through the Service. Drift Hockey LLC is also not a "school official" under the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g; 34 C.F.R. § 99.31), and the Service has not been designated as such by any educational institution; do not transmit education records subject to FERPA through the Service. Clubs that operate within or on behalf of a school remain solely responsible for their own HIPAA and FERPA obligations.

• Provide and operate the Service (accounts, schedules, messaging, video, billing).
• Send transactional and notification emails and push notifications you have opted into.
• Send marketing emails about features, tips, and updates (with one-click unsubscribe in every email, per the CAN-SPAM Act).
• Enforce our Terms — including automated keyword filtering, rate limiting, and abuse detection.
• Maintain security, prevent fraud, and respond to legal requests.
• Improve the Service through aggregated, de-identified analytics.

Where the GDPR or UK GDPR applies, we rely on the following legal bases: (a) contract — to provide the Service you requested; (b) legitimate interests — for security, abuse prevention, and product improvement; (c) consent — for optional notifications, marketing emails, and certain processing of children's data via verified parental consent; and (d) legal obligation — to comply with applicable law.

We share personal information only as necessary to operate the Service and never sell it. Categories of recipients:

• Other users in your clubs and teams — your name, role, and content you share with them.
• Sub-processors — see the table in Section 6. All are contractually limited to processing data on our behalf.
• Law enforcement & legal — when required by law, court order, or to protect safety. Severe safety violations (e.g., CSAM) are reported to NCMEC and law enforcement.
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to this Policy.

The following providers process personal information on our behalf:

Sub-processor changes. When we engage a new sub-processor that will handle personal information, we will update the table above and give at least 30 days' advance notice (in-app banner or email to the address on your account) before the sub-processor receives any personal information. If you object, your remedy is to stop using the affected feature or close your account before the change takes effect.

For User Data (information about people with their own account), Drift Hockey LLC is the data controller. For Player Data (information a Team Admin enters about a Roster Member), Drift Hockey LLC acts as a data processor on behalf of the club, which is the controller. Clubs may request a Data Processing Addendum (DPA) by emailing legal@drifthockey.com.

We retain personal information only as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods:

Player Data entered by a Team Admin is retained until the club deletes it or the Roster Member requests deletion through the club. Aggregated and de-identified data may be retained indefinitely; we commit not to attempt to re-identify it.

We do not use solely automated processes that produce legal or similarly significant effects about you (GDPR Article 22). Automated keyword and pattern moderation flags content for human review; account suspensions and terminations are decided by our safety team.

We do not sell, license, or otherwise share User Content or Player Data with third-party generative-AI providers for model training. Any internal ML use is limited to aggregated, de-identified data for product improvement and will be disclosed in this Policy if it changes.

We honor browser-based Global Privacy Control (GPC) signals as a request to opt out of "sale" or "sharing" of personal information. As we do not sell or share personal information for cross-context behavioral advertising, the practical effect is the same regardless of GPC.

Subject to applicable law, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correct — update inaccurate information through your profile or by contacting us.
• Delete — request deletion of your account from Profile → Account → Delete Account, or by emailing us.
• Export — request a portable copy of your data.
• Opt out of marketing — click "unsubscribe" in any marketing email, or email privacy@drifthockey.com.
• Manage notifications — push and email preferences in Settings → Notifications.
• Object / restrict — for EU/UK users, object to or restrict certain processing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Lodge a complaint — with your local data-protection authority.

To exercise any right, email privacy@drifthockey.com. We respond within 30 days.

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including the right to know, the right to delete, the right to correct, the right to limit use of sensitive personal information ("SPI"), and the right to non-discrimination for exercising privacy rights.

Categories of personal information collected: identifiers, customer records, internet/network activity, geolocation (city-level only), professional/team-affiliation information, and inferences for product improvement. Sensitive personal information: account credentials (username and password). We do not use SPI for inferring characteristics about you.

Sale or sharing of personal information: we do not sell or share personal information for cross-context behavioral advertising.

Shine the Light (Cal. Civ. Code § 1798.83): California residents may request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing.

To exercise any California right, email privacy@drifthockey.com with the subject "California Privacy Request." We may need to verify your identity before responding.

Residents of the following states have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of "sale," targeted advertising, and certain profiling activities that produce legal or similarly significant effects:

• Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA) — in effect.
• Delaware (DPDPA), Iowa (ICDPA), Nebraska (NDPA), New Hampshire (NHDPA), New Jersey (NJDPA), Tennessee (TIPA) — in effect in 2025.
• Minnesota (MCDPA) — effective July 31, 2025.
• Maryland (MODPA) — effective October 1, 2025.
• Indiana (ICDPA), Kentucky (KCDPA), Rhode Island (RIDTPPA) — effective January 1, 2026.

We do not sell personal information, do not share personal information for cross-context behavioral advertising, and do not engage in profiling that produces legal or similarly significant effects about you. To exercise any state privacy right, email privacy@drifthockey.com with your state of residence in the subject line. We respond within 45 days. If we deny your request, you may appeal within 60 days by replying to that decision; if your appeal is denied, you may contact your state attorney general.

You may use an authorized agent to submit a privacy request on your behalf. We require: (a) signed written permission from you authorizing the agent for the specific request; (b) verification of your identity directly with us; and (c) verification of the agent's identity. We may deny agent requests that do not meet these requirements. California residents may also use a registered agent under California Civil Code § 1798.140(i).

If you are a California resident under 18 and a registered user, you may request removal of content or information you have publicly posted on the Service by emailing privacy@drifthockey.com with subject "California Minor Removal Request." Removal does not guarantee complete or comprehensive removal of content (for example, content republished by another user is outside our control), and we may retain anonymized records as permitted by law.

We send marketing email only to the email address on your account, and only if you have not opted out. Every marketing email contains a one-click unsubscribe link, and we honor opt-outs within 10 business days as required by the CAN-SPAM Act. Transactional and account-related messages (security alerts, billing receipts, notification preferences you opted into) are not subject to the marketing opt-out.

Drift Hockey is a youth-sports coordination service used by clubs, coaches, parents, and players. It is not a "social media platform," "digital service provider," or "covered platform" of the type targeted by the Texas Securing Children Online through Parental Empowerment (SCOPE) Act, the New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act, or similar state laws. We do not serve algorithmic feeds, infinite scroll, autoplay, push notifications designed to maximize engagement, behavioral advertising, or engagement-based recommendations to any user, and we do not collect personal information from minors except as expressly described in our Children's Privacy Policy. Where these laws apply by their terms to any feature we offer, we comply with them, including by offering the parental controls and minor-protections detailed in our Children's Privacy Policy. Consistent with the California Age-Appropriate Design Code Act (Cal. Civ. Code § 1798.99.28 et seq.), we apply the highest privacy settings by default to accounts known to belong to minors and do not profile minors.

All data is encrypted in transit (TLS 1.2+) and at rest. Access is governed by Row Level Security policies in our database, restricting each row to the users explicitly authorized to see it. We require strong authentication, conduct regular security reviews, and maintain audit logging. In the event of a personal-data breach, we will notify affected users and applicable regulators without undue delay and, where required (e.g., GDPR Article 33), within 72 hours of becoming aware.

We are based in the United States and our sub-processors store data in the US and EU. If you access the Service from outside these regions, your information will be transferred to and processed in the US under appropriate safeguards (Standard Contractual Clauses where applicable). We do not currently target or actively market the Service to EU or UK residents at scale and therefore have not appointed a GDPR Article 27 representative; we will appoint one if/when our EU/UK user base meets the regulatory threshold and update this Policy with their contact details.

For users in Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) and substantially-similar provincial privacy laws, including Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25 (in full force since September 22, 2024).

• Privacy Officer. Our designated Privacy Officer (PIPEDA Principle 4.1.4 and Law 25 art. 3.1) can be reached at privacy@drifthockey.com.
• Cross-border transfers. Personal information of Canadian users is stored and processed in the United States by the sub-processors listed in Section 6. We use contractual safeguards (including Standard Contractual Clauses where applicable) to require equivalent protection, as contemplated by Law 25 art. 17 and PIPEDA Principle 4.1.3.
• Minors. For users under 14 in Quebec, confidentiality settings are enabled by default (Law 25 art. 4.1). Children under 13 may use the Service only through a managed child account created by a verified parent or guardian — see our Children's Privacy Policy.
• Your rights. Canadian users have the right to access, correct, and request deletion of their personal information; to withdraw consent (subject to legal or contractual restrictions); to data portability; to de-indexation in limited circumstances; and to receive information about automated decision-making affecting them. Contact privacy@drifthockey.com to exercise any right.
• Complaints. If you are dissatisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), or your provincial privacy regulator.

The Service is not directed to children under 13 except through managed child accounts created by a verified parent or guardian. See our Children's Privacy Policy for COPPA-specific disclosures, parental rights, and contact information.

Our web app uses essential cookies and local storage to keep you signed in and to cache your data for offline access. We do not use advertising or third-party tracking cookies. You can clear local storage from your browser at any time; doing so will sign you out.

Our marketing website (drifthockey.com) uses Google Tag Manager and Google Ads conversion measurement cookies to count, in aggregate, how many ad-driven visitors book a demo or start a signup. This measurement does not collect content you create or what you do inside the app, and we do not use it for cross-context behavioral advertising or to build remarketing audiences.

The data categories listed in this Policy are intended to match the disclosures we make in the Apple App Store "Privacy Nutrition Label" and the Google Play "Data Safety" form. If you spot a discrepancy, please email privacy@drifthockey.com and we will reconcile.

We will post material changes in-app at least 30 days before they take effect. The "Effective" date at the top reflects the latest version. Continued use of the Service after the effective date constitutes acceptance.

Drift Hockey LLC, 521 Brookline Blvd, Havertown, PA 19083.
Privacy Team: privacy@drifthockey.com · Legal: legal@drifthockey.com. See also our Terms of Service.