SportsTabi Privacy Policy (with Children's Privacy Section).
SportsTabi LLC, a Virginia limited liability company ("SportsTabi"), operator and publisher of SportsTabi. Draft — not lawyer-reviewed.
1. Summary
SportsTabi runs SportsTabi for youth hockey clubs. No ads, no selling or "sharing" for cross-context advertising, no cross-site tracking.
2. What we collect
Adults: name, email, phone (optional), role, team, sign-in/device. Players: name, jersey, team, age group, attendance, messages. All: schedules, RSVPs, uploads, support. Ask Tabi (if on): questions/answers.
3. How we use it
Run teams, reminders, security, safety scanning, support, legal duties. Not for ads or profiling minors.
4. Who we share with
Club staff and team; named service providers (hosting, email, safety scanning, AI provider); authorities when law requires or to protect a child. [LAWYER REVIEW: name each before launch.]
5. Message scanning
Messages involving under-18s are scanned for bullying and unsafe behavior; flags go to parents and club safety admin (form 02).
6. Ask Tabi
Off for under-18s until a parent turns it on. Kept 30 days with names removed, then deleted. Provider: our AI provider deletes inputs and outputs within 30 days by default and does not use them to train its models; the provider may keep flagged content up to 2 years [LAWYER REVIEW: written terms before launch]. Parents of under-13s can read and delete; parents of 13–17 can delete only.
7. Calendar feeds
Links show rink address and notes without sign-in; unique per user; resettable.
8. Retention
Active while the account exists; deleted within [__] days after deletion; Ask Tabi 30 days; safety flags [__] days. Written retention policy (legal-drafts/08). Messages you sent in team or direct chats stay, but they show as "Deleted user" and your name and profile are removed.
9. Security
We follow NIST CSF 2.0. [PROOF NEEDED before stating RLS/MFA as fact.]
10. Your rights
Access, correct, delete, download, opt out, withdraw consent — Settings → Privacy or [privacy@]; honored for all users. [LAWYER REVIEW: which state laws apply at SportsTabi's size.]
11. California Age-Appropriate Design Code (CAADCA)
If CAADCA applies, high-privacy defaults for minors, age-appropriate notices and visible monitoring signals are provided (parents are copied/notified, and minors are told). Status: NetChoice v. Bonta, No. 25-2366 (9th Cir. Mar. 12, 2026), mandate Apr. 3, 2026, affirmed the injunction only as to Cal. Civ. Code §§ 1798.99.31(b)(1)–(4) and (b)(7) and vacated the rest — so most of CAADCA (including age estimation, defaults, notices, monitoring signal) is enforceable now. Source: ca9.uscourts.gov opinion; Wiley alert Apr. 3, 2026. [LAWYER REVIEW: coverage thresholds; remand proceedings.]
12. New York
NY Child Data Protection Act applies to minors' data (eff. June 20, 2025) [UNVERIFIED cite]. SAFE for Kids Act (N.Y. Gen. Bus. Law 1500–1508; 13 NYCRR Part 700) takes effect Jan 25, 2027 and covers "Addictive Online Platforms" (algorithmic feeds); SportsTabi has no algorithmic feed, so likely out of scope [Inference; LAWYER REVIEW]. Source: NY AG press release July 28, 2026.
13. Children's Privacy (COPPA)
Operator: SportsTabi, [address], [phone], [privacy@]. Collect from under-13s: name, username, team, jersey, attendance, messages; Ask Tabi only if parent opts in. Use: team app only. Disclosure: team staff, teammates' families (roster), service providers; parents may consent to core use without third-party AI disclosure. Parents may review, delete, refuse further collection; we don't require more than needed. Consent method: [LAWYER REVIEW — CRITICAL, README (a)].
14. Changes/contact
In-app notice of material changes; new parent consent for material changes to children's data use.
Service provider: cybersecurity
Cyber Eye Industries LLC (CEI), a Virginia company under common control with SportsTabi, provides cybersecurity services to us and may access your information to provide them. CEI acts only on our instructions and only for security purposes:
- it may not use your information for anything else;
- it may not sell or share it;
- it may not use it to train AI;
- it may not disclose it.
Access is limited to named staff who use multi-factor authentication. Each access is logged and needs an approved ticket. CEI must tell us promptly about any breach and must delete or return the data when we ask. We remain responsible for your information.