Privacy Policy

The short version

This summary helps you find your way. It does not replace the full policy below.

• Who we are. Athlema is a platform for sports tournaments, leagues, events and pickup games. Athlema, Inc. runs it. Write to us at privacy@athlema.com.
• What we collect. Your account details, the profile you choose to fill in, your registrations and payments, your teams and chats, and some technical data such as your IP address. We do not ask for health information.
• Organizers get your registration. When you sign up for an organizer's program, we share your registration with that organizer because you asked us to. The organizer then uses it under its own rules.
• Results are public. The name you enter for a program, your team name, your profile photo, and your schedule, scores, standings and awards can appear on athlema.com, on organizers' own websites, and in search engines.
• We do not sell your personal information. We do not share it for targeted advertising. We do not show ads. We do not use advertising or analytics cookies, or third-party analytics tools.
• Stripe handles card payments. We never receive your full card number.
• You are in control. You can see, correct or delete your data. You can delete your account in the app at any time. You can turn off notifications you do not need.
• Adults only. You must be 18 or older to have an account. A parent or guardian can register a minor aged 13 to 17 for an organizer's program, where the organizer allows it. Children under 13 cannot take part.
• We use service providers such as hosting, email and payment companies. They may use your data only to provide their services to us. You can see the full list at /legal/subprocessors.

---

1. Who we are and what this policy covers

1.1 Who we are

Athlema is a technology platform. Organizers use it to run sports tournaments, leagues, events and pickup games. Players use it to find programs, register, pay, play and follow results.

In this policy, "Athlema", "we", "us" and "our" mean Athlema, Inc.. "You" means any person whose personal information we handle. "Personal information" means information that identifies you or can reasonably be linked to you.

You can contact us at:

• Email: privacy@athlema.com
• Mail: Athlema, Inc., Attn: Privacy (mailing address available on request at legal@athlema.com)
• Web: athlema.com/contact

1.2 What this policy covers

This policy covers the personal information we handle through:

• our website athlema.com, including the signed-in player area;
• hub.athlema.com, the portal that organizers and their staff use;
• the Athlema app for iOS and Android;
• the emails we send; and
• the embeds, which are widgets that organizers put on their own websites to show schedules, results and other public program information.

We call all of these together the "Services".

1.3 What this policy does not cover

• Organizers' own practices. Each organizer is responsible for the personal information it receives from us or uploads itself, and for what it does with that information. Organizers have their own privacy practices. Please read them or ask the organizer. See section 2.
• Third-party websites and services. This includes an organizer's own website (even when it shows one of our embeds), Stripe's payment pages and services, and Apple's and Google's sign-in services. Their own privacy policies apply.
• Our own employees and job applicants. We handle their information under separate notices.

---

2. Who is responsible for your information

More than one party handles your information on Athlema. This section explains who is responsible for what.

2.1 Athlema

We are responsible (the "controller" or "business") for the personal information we use to run the platform. This includes your account, your profile and Player Card, your sign-in, your teams and chats, your Athlema+ membership, the reports and blocks you make, and our security records.

2.2 Organizers, for the registrations you make

An organizer is an organization, such as a league, club, social sports company or facility, that runs programs on Athlema. When you register for an organizer's tournament, league, event or pickup game, we share your registration with that organizer. We do this because you asked us to: registering is your instruction to share your registration with the organizer that runs the program.

Once the organizer receives your registration, the organizer is a separate controller of it. That means the organizer decides how it uses that information for its own purposes, for example to run its program, contact you, check you in, or keep its own records. The organizer is responsible for that use under its own privacy practices.

2.3 Organizers, for information they upload themselves

Organizers can also put their own information into Athlema. For example, they can import a contact book from a spreadsheet, add contacts by hand, write notes, add custom fields, keep the list of their own staff and their roles in the hub, and send emails to their participants. For this information, we act as the organizer's service provider (also called a "processor"). We handle it only to provide our services to the organizer, following the organizer's instructions and our contract with the organizer. The organizer is responsible for it.

If an organizer has your details in its contact book, please make any privacy request about that information to the organizer. If you contact us instead, we will pass your request on to the organizer or tell you how to reach it.

2.4 How to contact an organizer

You can usually find an organizer's contact details on its program or organization page on athlema.com, in emails it sends you, or on its own website. If you cannot reach an organizer, write to privacy@athlema.com. We will try to help you reach the organizer.

2.5 Pickup game hosts

Any player can host a free pickup game. The host sees who joins the game. The host is responsible for how it uses that information.

---

3. The information we collect

We collect information in three ways: you give it to us, we collect it automatically when you use the Services, and other people or companies give it to us.

3.1 Information you give us

Your account

• Your first and last name and your email address.
• How you sign in: with an email and password, an email code, Apple, or Google. If you use a password, our authentication provider stores it in a protected (hashed) form. We never store it in plain text.

Your profile and Player Card (all optional)

• A profile photo and up to six Player Card photos.
• A short bio, your home city, the languages you speak, and the sports you play, with your own rating of your skill level and how many years you have played.
• Your gender, date of birth, height and shirt size.
• Ratings from rating systems such as DUPR, UTR or NTRP, as you enter them yourself.

You choose whether to add these details. Organizers sometimes use gender or age to set up categories, and shirt size for event shirts.

Your registrations

• The programs you register for, and the display name you choose for each entry.
• Information about other people that you give us. For doubles, you may give us your partner's name and email address. For team entries, you may give us your team name and your teammates' names, even if they do not have an Athlema account. If you give us information about another person, please tell them, and only do so if you are allowed to. We use their information only to manage the entry and to invite or notify them.
• Waivers you sign. When you sign an organizer's waiver, we record the full legal name you type, the time, which waiver you signed, and the program it is for.
• Discount codes you use, your check-ins (how and when you checked in; we do not record your location), transfers between programs, deposits, credit, payment requests, refunds and your payment history.

Payments

• When you pay, you enter your card details into Stripe's secure payment form. Stripe receives your card number, not us. We receive payment information from Stripe, such as the amount, the payment method type, the payment status and Stripe's reference numbers. To show you a receipt, we may read the card brand and last four digits from Stripe; we do not store them.

Teams, chat and pickup games

• Teams: team name, photos, color, members, and the email invitations you send to people to join.
• Team chat: the messages you send (text, up to 2,000 characters each).
• Pickup games you host: the title, description, photos, the location you type in, and the time. Pickup games you join: your RSVP.
• Your availability, and records of results, awards and match events (for example, conduct cards).

Referees

• If an organizer invites you to referee, we keep your referee assignments and the pay amounts the organizer records. Organizers pay referees outside Athlema.

Reports and blocks

• Reports you make: the reason, an optional note, and a copy (a "snapshot") of the content you reported. We keep your identity private (see section 5.5).
• Blocks you make: who you have blocked.

Organizers and their staff

• Staff names, email addresses and roles; the organization's contact email, phone number and address; and the information organizers upload themselves (see section 2.3).
• Organizer Agreement acceptance. When someone accepts our Organizer Agreement for an organization, we record who accepted, for which organization, which version, when, where they accepted it, and the IP address and browser information (user agent) used. We keep these records as legal records, including after that person deletes their account (see section 11).

Support and contact

• What you tell us when you contact our support team or write to one of our email addresses.

Our organizer enquiry form

The enquiry form on athlema.com (on our contact page and behind "Talk to us" buttons) asks for:

• your name, work email and organization name (required);
• your role and your organization's type;
• your phone number, where you are based, and your organization's website (optional);
• the sports you run, roughly how many programs a year and how large they are, the tool you use today, and anything you write in the notes box; and
• whether you want product news from us by email.

We also record the IP address the form was sent from. We use it to protect the form from abuse.

Our waitlist

Before Athlema opens to everyone, you can join a waitlist on athlema.com. It asks for your email address and, if you choose to say, whether you play, organize, or both. We use it only to tell you when Athlema opens and about early access. We store the list with our email provider (Resend). Every email we send to the list has an unsubscribe link, and you can ask us to remove you at any time. We briefly use your IP address to limit how often the form can be sent (rate limiting).

3.2 Information we collect automatically

• IP address. We record IP addresses in security and audit records for account and money actions, and briefly to limit how often requests can be made (rate limiting).
• Embeds. When you view an organizer's website that shows one of our embeds, your browser loads it from our servers. So we receive your IP address and the address of the website that shows the embed. We count how many times each embed is loaded on each website, so organizers can see where their embeds run. We do not store your IP address for this count.
• App and device information. The app platform (iOS or Android) and the app version.
• Activity records. Request identifiers, the time you were last active, and audit records of important actions (for example, sign-in changes, payments, refunds, permission changes and account deletion).
• Error reports. When something breaks, we send an error report to our monitoring provider (Sentry). We set it up so that it does not collect personal information by default. It never attaches what you submitted in a form. On the website, in the hub, in our API and in the app, it is configured to remove typed search text and location coordinates from the page and request addresses it reports. In our API and app it also removes one-time links and secret tokens. It may process your IP address.
• Performance data. We measure how fast each part of the Services responds, in two ways. First, short-lived counters that are not linked to who you are, which we keep for about two hours. Second, a small sample of requests that we send to our monitoring provider, which keeps them for its own limited period. These samples follow the same removal rules as error reports.
• Cookies and device storage. See section 7.
• Approximate location, only when you ask. See section 8.

We do not use third-party analytics or advertising tools in the website or the app. We do not use session recording (session replay). We do not use facial recognition.

3.3 Information we receive from others

• Organizers. An organizer may add you to a roster, enter a result, import you into its contact book, or invite you to referee or join its staff.
• Other players. A partner, team captain or teammate may enter your name or email address to invite you to a team or entry.
• Apple and Google. If you sign in with Apple or Google, they share your name and email address with us. Apple may give us a private relay email address instead of your real one. Google may provide a link to your Google profile photo; our authentication provider keeps it, and we do not show it.
• Stripe. Stripe tells us about payments, refunds, disputes (chargebacks) and, for organizers, the status of their payout account.

---

4. How we use your information

We use personal information for these purposes:

We do not use your personal information to make decisions about you that have legal or similarly significant effects based only on automated processing. We do not build profiles about you for advertising.

4.1 Legal bases (for readers in places that require them)

Some laws, for example in the European Union, the United Kingdom and some other countries, require us to name a "legal basis" for each use. Where those laws apply, we rely on:

• Contract: to provide the Services you asked for, including your account, registrations and payments.
• Legitimate interests: to keep the Services safe and secure, prevent fraud and abuse, fix and improve the Services, share results publicly as part of organized sport, and handle legal claims. We only rely on this when our interests are not outweighed by your rights.
• Consent: for product news emails, for your device's location when you tap "near me", and for anything else where we ask you first. You can withdraw consent at any time.
• Legal obligation: to keep tax and accounting records and to meet other legal duties, such as child-safety reporting.

---

5. What is public and who can see what

Organized sport is partly public: schedules, draws and results are meant to be seen. This section explains exactly what other people can see.

5.1 Public to everyone (including people who are not signed in)

For published programs, the following is public on athlema.com, can be shown in organizers' embeds on their own websites, and can be found through search engines such as Google:

• the display name you entered for the entry, and your team name;
• your profile photo (avatar);
• your seed, schedule, scores, standings, bracket position and awards.

For pickup games, the public page shows the game details the host entered (title, description, photos, location text, city and time), the number of players going, and the host's display name. The list of players who joined a pickup game is not public (see section 5.2 for what signed-in users see).

If a parent or guardian registers a minor, the display name the parent enters for that entry is public in the same way.

Photos you upload are public by link. Once you post a photo (for example, a profile photo, a Player Card photo, a team photo or a pickup game photo), anyone who has the link to the image file can view it. We remove hidden information from images when you upload them, including GPS location.

5.2 Visible to signed-in Athlema users

Your Player Card is visible to anyone who is signed in to Athlema. It can show your name, photos, bio, home city, languages, sports, stats, awards and history. Players you have blocked, and players who have blocked you, cannot see your card.

Your Player Card never shows your email address, phone number, age or date of birth, height or shirt size, or the gender you set in your profile. It does show whether you are an Athlema+ member. Your event history on the card shows the category you played in (for example, men's, women's or mixed).

Pickup game RSVPs. Signed-in users who can see a pickup game can also see who has said they are going, maybe going or not going. This list is not shown to people who are not signed in.

5.3 Visible to organizers

• Organizers whose programs you join see your registration for their program. This includes your name, email address, entry display name, partner or teammate details, waiver signatures, check-ins, and payment and refund status.
• In their player directory, those organizers also see your profile photo and your gender, if you added them to your profile. They also see the sports you have played with them, how many of their programs and matches you took part in, and when you were last active in their programs.
• Organizer staff can search for Athlema users by name or email address, to add someone to a program. This search covers all Athlema users, not only people who have joined that organizer's programs. The search result shows the person's name, email address and profile photo.
• Organizers see the information they uploaded themselves (section 2.3).

5.4 Visible to your teammates, partners and other players

• Members of your team see the team's details, its members and its chat.
• Your doubles partner sees your shared entry.
• Players see the display name of the host of a pickup game, and the host sees who has joined.
• People in a chat see the messages you send there.

5.5 Never shown to other users by us

We never show other users your password, your payment card details, your sign-in method, or the reports you have filed. We never tell anyone who reported them.

5.6 How to limit what others see

• Choose your display name for each entry. It does not have to be your full name.
• Remove your profile photo or Player Card photos, and leave optional profile fields empty.
• Block a player in the app (Player Card > More options > Block).
• Ask the organizer to change or remove your name from a program's public pages.
• Ask us at privacy@athlema.com.

Search engines and other websites may keep copies of public pages for a while after a change. We cannot control those copies.

---

6. How we share your information

We share personal information only as described here.

6.1 With organizers, at your direction

When you register for a program, we share your registration with the organizer that runs it (see sections 2.2 and 5.3). Organizers use it under their own responsibility.

6.2 With other users

We show some information to other users and to the public as described in section 5.

6.3 With our service providers

We use companies that help us run the Services, such as hosting, database, email delivery, error monitoring and address search. They may use personal information only to provide their services to us, under contracts that limit how they can use it. The categories are:

• hosting, database, file storage and sign-in (for example, Supabase, Amazon Web Services and Vercel);
• email delivery (Resend);
• error and performance monitoring (Sentry);
• address search and map coordinates (Geoapify and Geocodio);
• AI tools for organizers (Anthropic, see section 9).

You can see the full list, what each provider does, and where it operates on our Subprocessors page.

6.4 With Stripe, for payments

We use Stripe to process payments. Stripe is an independent company and is responsible for the payment information it collects. When you provide personal data in connection with Athlema payments, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy: https://stripe.com/privacy (opens in a new tab). Organizers who receive payouts give their identity and bank details directly to Stripe.

6.5 With Apple and Google, and with map providers

• Sign-in. If you choose to sign in with Apple or Google, we exchange sign-in information with them. Their own privacy policies apply to what they do.
• Maps in the app. In the app, maps are provided by Google (Google Maps). Your phone sends map requests, including its IP address, to Google, and Google handles them under its own privacy policy: https://policies.google.com/privacy (opens in a new tab).
• Maps in the hub. In the hub, your browser loads map images directly from MapTiler and OpenFreeMap. They receive your IP address and the map area you view, and handle them under their own terms.

These companies are not our service providers for this information. They decide for themselves how they use it.

6.6 For legal reasons and to protect people

We may share personal information when we believe in good faith that it is needed to:

• comply with the law or a valid legal process, such as a subpoena, court order or search warrant;
• report apparent child sexual exploitation to the National Center for Missing & Exploited Children (NCMEC), as US law requires, and to law enforcement;
• respond to an emergency involving a risk of death or serious physical harm;
• protect the rights, property and safety of our users, organizers, the public or Athlema; or
• enforce our terms and investigate fraud or abuse.

6.7 In a business transfer

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, personal information may be transferred as part of that deal. We will require the new owner to protect it in line with this policy, or tell you before a different policy applies.

6.8 With your consent

We may share personal information in other ways if you ask us to or agree.

6.9 What we do not do

• We do not sell personal information, and we have not sold it in the last 12 months.
• We do not share personal information for cross-context behavioral advertising (advertising based on your activity across other companies' websites and apps), and we have not done so in the last 12 months.
• We do not show targeted advertising.
• We do not use profiling to make decisions that have legal or similarly significant effects on you.

---

7. Cookies and similar technologies

A cookie is a small text file a website stores in your browser. Local storage is a similar place in your browser where a website can keep small pieces of information. Apps can keep information on your device in similar ways.

We use only cookies and storage that are strictly necessary to run the Services or to remember choices you make. We do not use advertising cookies, analytics cookies or tracking pixels, and we do not record your sessions.

7.1 What we use

7.2 Third-party cookies

• Stripe. On payment pages, Stripe's payment form may set Stripe cookies to prevent fraud. See https://stripe.com/privacy (opens in a new tab).
• Google sign-in. On some public pages, when you are signed out, we may show Google's sign-in options (Google One Tap or the Google button). To do this, your browser loads a script from Google, which may set Google cookies. See Google's privacy policy at https://policies.google.com/privacy (opens in a new tab).
• Fonts in emails. Some of our emails load web fonts from Google when you open them. This tells Google your IP address and that a font was requested.

7.3 How to control cookies

You can block or delete cookies and local storage in your browser settings. If you block the cookies we use, you will not be able to sign in. You can clear the app's stored data by signing out or deleting the app.

7.4 Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track" signal or a Global Privacy Control (GPC) signal. We do not track you across other companies' websites, and we do not allow third parties to track you across websites through our Services for advertising. We do not sell personal information or share it for cross-context behavioral advertising, so these signals change nothing today. If we ever start selling or sharing personal information, we will honor a GPC signal as a request to opt out for that browser.

---

8. Location

• We only use your device's location when you ask. When you tap "near me" (or a similar button) to find programs or games nearby, we ask for permission to use your location.
• We use only an approximate location, accurate to about 1 kilometer. In the app, we ask your phone only for an approximate, low-accuracy location. On Android, the app asks only for the "approximate location" permission. On the website, your browser may share a precise location with the page, but we round it to about 1 kilometer before we use it. So what reaches our servers is approximate.
• We use the location for that search only. It is sent to our servers to run that search. We do not store it in your profile or keep a history of your locations. On the website, the rounded location becomes part of the page address for that search. Because of this, it may appear for a limited time in our server logs and our hosting provider's logs. We remove it from error reports (see section 3.2). In the app, your phone may remember the last area you searched so it can show it next time.
• Typed searches. When you type a city or address into a search box, the text you type is sent from our servers to our address-search providers to suggest matches. We do not send them your name or account details.
• You can say no. You can refuse or turn off location permission at any time in your phone or browser settings and still search by typing a city.
• Photos. We remove location data (GPS) and other hidden data from images when you upload them.
• Venues. Organizers' and venues' addresses are turned into map coordinates by a geocoding provider so we can show them on a map.

8.1 Permissions the app asks for

The app asks for a permission only when you tap a button that needs it, for example during setup or in a feature. It does not ask when it starts.

• Photos and camera: only when you choose or take a photo for your profile or Player Card.
• Calendar: only when you tap "Add to calendar". Your phone's own add-event screen opens. We never read your calendar.
• Location: only when you ask for results near you (see above).
• Notifications: only when you tap the button to turn on alerts. See section 10 for what the app uses this permission for.

You can change each permission at any time in your phone's settings.

---

9. AI tools for organizers

Organizers can use optional AI tools in the hub to (a) draft rulebooks and waivers and (b) tidy the formatting of a program description. The text the organizer types or pastes is sent to Anthropic, our AI provider, to produce the result. Anthropic handles this text as our service provider (subprocessor). We do not store the result unless the organizer saves it.

• A program description often contains the organizer's own contact details, such as a contact name, email address or phone number. Those details are sent too.
• We do not send player records, rosters or registrations to these tools.
• The tools help write text. We do not use them to make decisions about people.
• Organizers must not put players' or other people's personal information into these tools, beyond the contact details they would publish on the program page anyway.

---

10. Emails and notifications

• Service emails. We send emails needed to run the Services: sign-in codes, receipts, registration confirmations, schedule changes, team and chat notices, and moderation and account notices. We send them through our email provider.
• In-app notifications. We show notifications inside the Services.
• Your settings. You can turn off notification types you do not need at athlema.com/me/notifications. Some essential messages, such as security and safety notices, are always sent.
• Organizer messages. Organizers can send emails to the participants in their programs through Athlema. The organizer decides what to send and is responsible for it, including following anti-spam laws. You can turn off organizer announcements at athlema.com/me/notifications after you sign in, or ask the organizer directly.
• Marketing. We do not run a general marketing email list today. We send product news only to people who asked for it on our enquiry form, and launch news to people who joined our waitlist. You can unsubscribe at any time with the link in the email or by writing to privacy@athlema.com. If we start sending marketing emails to other people, we will follow the law, include an unsubscribe link, and honor unsubscribe requests.
• Notifications on your phone. The app may ask for permission to show notifications. Today it uses that permission only to show game-day information on your lock screen (a Live Activity on iPhone, an ongoing notification on Android), for example your next court and time. The app can also show this in a home-screen widget you add. The app builds this information from what it downloaded itself while you used it. We do not send push notifications from our servers today, and we do not collect a push token for your device. If we add server-sent push notifications, we will update this policy. You will then be able to choose which kinds you get in your settings, and you can turn notifications off at any time in your device settings.
• Text messages. We do not send text messages (SMS).

---

11. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, unless the law requires or allows us to keep it longer. When we no longer need it, we delete it or make it anonymous.

We may keep information longer if we must keep it for a legal claim, an investigation or a legal hold.

---

12. Deleting your account

You can delete your account in the Athlema app: Profile > Account settings > Delete account. If you cannot use the app, email privacy@athlema.com from the email address on your account. We complete deletion requests sent by email within 30 days after we verify them. Our Delete your account page gives step-by-step instructions and the full details.

Deletion starts right away, usually finishes within minutes, and cannot be undone. In short:

• We erase: your name and email address, your photos and Player Card, your bio and profile details (city, gender, date of birth, height, languages, shirt size, sports), your ratings, your sign-in methods, your blocks, staff notes about you, and your permissions.
• We keep, shown as "Deleted User": past results, rosters, brackets, standings and awards, and team-chat messages you sent, because they are part of other people's records and conversations.
• We keep for legal, tax and accounting reasons: payments, refunds, payment requests, disputes, waivers you signed (including the name you typed), records of your acceptance of our Organizer Agreement (including the IP address and browser information used), and audit records.
• We keep reports you filed for moderation, showing you as "Deleted User".
• We keep child-safety evidence where the law requires it.
• Organizers and Stripe keep their own records. Organizers keep their own contact-book records and the guest lists of events they invited you to, and Stripe keeps its own payment records. Ask them directly.

Before you delete, some things need attention, such as team ownership, shared entries and referee pay. Athlema+ ends immediately with no refund for unused time, and any organizer credit is lost. The Delete your account page explains these.

---

13. Your choices and rights

We give the rights in this section to all our users in the United States, whatever state you live in. Some state laws give these rights only to their residents or only once a company reaches a certain size. We choose to offer them to everyone.

13.1 Your rights

• Access and copy. You can ask what personal information we hold about you and ask for a copy in a portable format. Our team prepares the copy for you, within the time limits in section 13.6. There is no self-serve download yet.
• Correction. You can edit most of your profile yourself. For anything else, ask us.
• Deletion. You can delete your account in the app, or ask us to delete it or specific information (see section 12).
• Notifications. You can turn off notifications you do not need (see section 10).
• Opt out of sale, sharing and targeted advertising. We do not do these things, so there is nothing to opt out of (see section 7.4 about GPC signals).
• Appeal. If we refuse your request, you can appeal (see section 13.5).

Some limits apply. For example, we may keep information we must keep by law (see section 11), and we cannot give you information that would reveal personal information about someone else, such as who reported you.

13.2 How to make a request

• Email privacy@athlema.com. Please tell us what you want us to do, and send it from the email address on your account if you can.
• Delete your account in the app (Profile > Account settings > Delete account).
• You can also reach us through athlema.com/contact.

You do not need an account to make a request. For example, if you sent our enquiry form, you can ask for a copy, correction or deletion of what you sent.

13.3 Verification

To protect you, we check that a request really comes from you before we act on it. Usually we will ask you to confirm the request from the email address on your account. If you do not have an account (for example, you only sent our enquiry form), we will ask you to confirm from the email address you used on the form. If we cannot verify you that way, we may ask for a little more information. We use that information only to verify you. If we still cannot verify you, we will tell you and explain why.

13.4 Authorized agents

You can ask someone else (an authorized agent) to make a request for you. We will ask the agent for proof that you gave them permission, such as a signed authorization, and we may also ask you to confirm your identity with us directly, unless the agent has a valid power of attorney.

13.5 Appeals

If we decline your request, in whole or in part, we will tell you why. You can appeal by replying to our decision, or writing to privacy@athlema.com with the subject "Privacy appeal", within 60 days of our decision. We will answer your appeal in writing within the time the law of your state allows (generally 45 to 60 days) and explain the result. If we deny your appeal, you may contact your state attorney general.

13.6 How fast we respond

We will confirm that we received your request and respond within 45 days. If we need more time, we may extend this once by up to 45 more days. If we do, we will tell you why within the first 45 days. Account deletion requests sent by email are completed within 30 days after we verify them (see our Delete your account page).

13.7 No discrimination

We will not treat you differently for using your privacy rights. We will not deny you the Services, charge you a different price, or give you a lower quality of service because you made a request. Some requests, such as deleting your account, mean we can no longer provide the Services to you.

---

14. Your US state privacy rights

This section adds information that some US state laws require. The rights in section 13 apply to all US users.

14.1 California

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), gives California residents these rights:

• Right to know the categories of personal information we collect, the categories of sources, the purposes, and the categories of third parties we disclose it to.
• Right to know specific pieces of personal information we hold about you, and to receive a copy in a portable format.
• Right to delete personal information we collected from you, with some exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell or share it.
• Right to limit the use of sensitive personal information. We use sensitive personal information only for the purposes the CCPA allows without this right (such as providing the Services you asked for, security and safety), so we do not offer a separate "limit" link.
• Right not to be discriminated against for using these rights.

We do not sell or share the personal information of anyone, and we have no actual knowledge of selling or sharing the personal information of people under 16.

14.2 Categories of personal information (last 12 months)

The table below describes the personal information we have collected in the last 12 months, using the categories in the CCPA. For each category, we have not sold it and have not shared it for cross-context behavioral advertising.

Purposes. We collect and use each category for the purposes in section 4: to provide the Services, process payments, share registrations with organizers at your direction, communicate with you, keep people safe, secure and improve the Services, and comply with law.

Retention. See section 11.

About sensitive personal information.

• Sign-in credentials are used only to let you sign in and to protect your account.
• Team chat messages are used only to deliver the chat to its members and for safety and moderation (for example, when someone reports a message).
• Precise geolocation. The CCPA treats location within about 1,850 feet as "precise geolocation". We do not collect precise geolocation. In the app, we ask only for an approximate location. On the website, we round the location your browser shares to about 1 kilometer before we use it. In either case we use it only to show results near you, at your request, and we do not keep it in your profile or a location history.
• We do not collect health information, government ID numbers, Social Security numbers, financial account numbers (Stripe handles card numbers), biometric information, or information about racial or ethnic origin, religion, union membership, sex life or sexual orientation.

Notice at collection. This policy, including section 4 and the table above, is our notice at collection.

14.3 "Shine the Light"

California Civil Code Section 1798.83 lets California residents ask which personal information a company shared with third parties for their own direct marketing. We do not share personal information with third parties for their direct marketing purposes.

14.4 Minors in California

California law (Business and Professions Code Section 22581) lets minors who are registered users ask to remove content they posted. Our accounts are only for adults (see section 16). If you believe a minor has posted content on Athlema, write to privacy@athlema.com and we will remove it.

14.5 Other states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island have rights under their state privacy laws. Depending on the state, these include the right to:

• confirm whether we process your personal information and access it;
• correct inaccurate personal information;
• delete personal information;
• get a copy in a portable format;
• opt out of targeted advertising, the sale of personal information, and profiling that leads to legal or similarly significant decisions; and
• appeal our decision on your request.

Some states also give the right to get a list of the specific third parties we disclosed personal information to. You can ask for this at privacy@athlema.com.

We extend these rights to all US users. We do not sell personal information, do not use it for targeted advertising, and do not use it for profiling with legal or similarly significant effects. We do not process sensitive data that requires your consent under these laws without asking you first. To make a request or appeal, follow sections 13.2 to 13.5.

14.6 Nevada

Nevada residents can ask us not to sell certain personal information. We do not sell personal information as Nevada law defines it. You can still send a request to privacy@athlema.com.

---

15. Consumer health data

We do not collect consumer health data. We do not ask for medical or health information, such as medical conditions, injuries, medications or health status.

This section is our statement under the Washington My Health My Data Act, Nevada's consumer health data law, and similar state laws. Organizers are not allowed to use Athlema to collect health information, for example through custom fields, contact imports, notes or waiver text. If you see an organizer asking for health information through Athlema, please tell us at privacy@athlema.com.

---

16. Children and minors

• Accounts are for adults. You must be 18 or older, or the age of majority where you live if it is higher, to create an Athlema account.
• Minors in programs. A person aged 13 to 17 may take part in an organizer's program only where the organizer's program allows it, and only if a parent or legal guardian who has an Athlema account registers them. The parent or guardian accepts the waivers for the participant, as their guardian. Minors may not have their own accounts, use chat, or host pickup games.
• No youth features yet. Athlema does not yet have special features for minors or guardians. We do not check anyone's age or whether someone is really a participant's parent or guardian. The display name entered for a minor's entry may be public, like any entry (see section 5.1).
• Children under 13. Children under 13 cannot take part in programs on Athlema, even through a parent. We do not knowingly collect personal information from children under 13. Organizers must not enter information about children under 13 into Athlema (for example, in rosters or contact imports).
• What we do if we find out. If we learn that an account holder is under 18, we close the account. If we learn that we have personal information of a child under 13, we delete it.
• Tell us. If you believe we have information about a child under 13, or that a minor has an account, write to privacy@athlema.com.

---

17. Security

We use reasonable safeguards designed to protect personal information, including:

• encryption in transit (TLS) for connections to and between our systems;
• access controls, managed by a central permission service, so people see only what their role allows;
• limited staff access, based on role;
• passwords handled by our authentication provider, never stored by us in plain text;
• card data handled by Stripe, which is certified to the Payment Card Industry Data Security Standard (PCI DSS); we never receive full card numbers;
• audit logs of sensitive actions, with older records kept in an encrypted archive; and
• error reports scrubbed of personal information.

No system is completely secure, and we cannot guarantee the security of your information. Please use a strong, unique password, keep your devices secure, and tell us right away at support@athlema.com if you think your account has been misused.

If a security breach affects your personal information, we will notify you and the authorities as the law requires.

---

18. Where we process information

Athlema is a US company and the Services are designed for people in the United States. We store and process personal information in the United States, and our service providers may process it in other countries where they operate (see our Subprocessors page). Privacy laws in those places may be different from the laws where you live.

We do not offer the Services to people in the European Union or the United Kingdom. If you use the Services from outside the United States, your information is processed in the United States. If you live in Canada, you can ask us about the personal information we hold about you and ask us to correct it, by writing to privacy@athlema.com. We respond as Canadian privacy law requires. If you live in another country, write to us and we will tell you what we can do.

---

19. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed.

If we make a material change, we will tell you at least 30 days before it takes effect, by email, by a notice in the Services, or both. We may make changes sooner where the law requires it or where the change is only about a new feature. We will not use personal information we already hold in a materially different way without telling you first and, where the law requires, asking for your consent.

---

20. Contact us

For questions, requests or complaints about privacy:

• Email: privacy@athlema.com
• Mail: Athlema, Inc., Attn: Privacy (mailing address available on request at legal@athlema.com)
• Web: athlema.com/contact

For general help, write to support@athlema.com.