Privacy Policy

Sportal ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and web services (collectively, the "Services"). This policy complies with applicable privacy laws including GDPR, CCPA, and follows Apple App Store guidelines.

Information We Collect

Age Information and Age Gating

What we do retain on your account record is limited to:

• Age check completed — a flag noting that an age check was completed, and the date and time it happened.
• Adult status — whether you indicated you are 18 or older.
• Failed age check — a flag recorded if an answer indicated an age under 13.
• Adult attestation — that you confirmed you are 18 or older in order to use public open-play events or free agency listings, when you confirmed it, and which screen prompted the confirmation.

Kids Teams, Parents, and Guardian Links

Sportal supports kids team rosters, which include coaches, parents or guardians, and youth players. These rosters involve some additional information:

• Guardian links. A parent or guardian can generate a link code, and a child's account can redeem it. When redeemed, we store a record pairing the guardian account with the child account, along with the date it was created.
• Link codes. Link codes are 8 characters, expire after 24 hours, and can be used only once.
• Minor status on a roster. For kids team players, we store a self-declared indicator that the player is under 18, and which guardians on that roster are responsible for that child.
• Parent role and "playing for". A parent can hold a roster spot on behalf of their child. In that case the parent enters the child's first name, which is displayed to other members of that roster so the team knows who the parent is responding for. Please enter only a first name or nickname, and only for a child you are responsible for.

A parent or guardian may contact us at the email address below to review, correct, or request deletion of information associated with their linked child's account, or to remove a guardian link.

Data Sharing and Disclosure

Visibility Within Sportal

Third-Party Sharing

We may share information in these specific circumstances:

• Service Providers: Firebase/Google Cloud for hosting, Apple/Google for push notifications, and subcontractors providing customer service support
• Legal Requirements: When required by law or to protect rights and safety
• Business Transfers: In case of merger, acquisition, or sale of business assets
• With Consent: Any other sharing will require your explicit permission

Data Security & Protection

Breach Notification. If we determine that a security incident has resulted in the unauthorized acquisition of, or access to, your personal information, we will notify you and applicable regulators without unreasonable delay and in accordance with applicable law.

AI and Machine Learning

We do not use your personal information to train third-party generative AI or large language models. To the extent we use AI-assisted features within the Services, we use providers under contractual restrictions that prohibit them from using your data to train their models, and we apply data-minimization practices to limit what is processed.

Third-Party Services

These services have their own privacy policies. We recommend reviewing them:Google Privacy Policy,Apple Privacy Policy,Twilio Privacy Policy,RevenueCat Privacy Policy

Your Privacy Rights

Data Retention

• Account Data: Retained while your account is active
• Event Data: Kept for 90 days for historical purposes, can be deleted by an event manager at any time
• Messages: Stored for team coordination, can be deleted individually
• Birth Date: Not retained — used momentarily to calculate an age band, then discarded
• Age Flags: Age check and adult attestation flags are retained while your account is active
• Guardian Links: Retained while the link is active; removed when a guardian link is removed or either account is deleted
• Guardian Link Codes: Expire after 24 hours and are single-use
• Deleted Accounts: Personal data removed within 30 days (except legal requirements)

Children's Privacy

Users aged 13 to 17. Teens 13 and older may use Sportal. A player under 18 must have a linked parent or guardian in order to join a kids team roster. Minors are excluded from public open-play events and free agency listings, cannot enable contact sharing, and are subject to the messaging restrictions described above.

What we do not claim. Sportal does not operate a verifiable parental consent mechanism under COPPA, and our age checks are self-reported rather than verified. The guardian link feature is a coordination tool for kids teams; it is not a COPPA consent process.

International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States, where our servers are located. For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards, including the EU-U.S. Data Privacy Framework (and the UK Extension and Swiss-U.S. DPF) where the recipient is certified, and otherwise the European Commission's Standard Contractual Clauses (SCCs). You may request a copy of the safeguards we use by contacting us at the email below.

Your U.S. State Privacy Rights

Depending on where you live, you may have additional rights under state privacy laws. This section describes those rights and how to exercise them. To submit a request, email sportalpdx@gmail.com with the subject "Privacy Rights Request" and the state you reside in. We will verify your request using information already associated with your account and respond within the time required by law (generally 45 days).

California (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and (if applicable) sell or share, including the categories of sources and third parties.
• Access a copy of the personal information we hold about you.
• Delete personal information we have collected about you, subject to legal exceptions.
• Correct inaccurate personal information.
• Limit use and disclosure of sensitive personal information.
• Opt out of the "sale" or "sharing" of personal information and of targeted advertising.
• Non-discrimination for exercising your rights.

We do not sell your personal information for money and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CPRA. We do not use or disclose sensitive personal information for purposes that require an opt-out under California law.

You may also designate an authorized agent to make a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your own identity directly.

Opt-Out Preference Signals. We honor opt-out preference signals, including the Global Privacy Control (GPC), where required by law. When we receive a GPC signal from a browser or device associated with you, we treat it as a valid request to opt out of the "sale" or "sharing" of personal information and of targeted advertising, to the extent applicable.

Oregon (OCPA)

If you are an Oregon resident, you have the right under the Oregon Consumer Privacy Act to:

• Confirm whether we process your personal data and access that data.
• Obtain a list of the specific third parties to which we have disclosed your personal data.
• Correct inaccuracies in your personal data.
• Delete personal data we maintain about you.
• Obtain a portable copy of personal data you provided to us.
• Opt out of (a) the sale of personal data, (b) targeted advertising, and (c) certain profiling that produces legal or similarly significant effects.

We do not sell personal data, engage in targeted advertising, or conduct profiling that produces legal or similarly significant effects. If you are dissatisfied with our response, you may appeal by replying to our decision; you may also contact the Oregon Attorney General.

Other U.S. States

Residents of other states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Montana, Tennessee, Iowa, Indiana, Delaware, New Jersey, New Hampshire, Minnesota, Maryland, and others as they take effect) may have similar rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of sale, targeted advertising, and certain profiling. You may exercise those rights using the same contact method above.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last Updated" date