Privacy Policy (version 0.0.0-legacy.20260523)

Original page description: How Varsity Page collects, uses, and protects information for fans, parents, and student athletes — including location data, student privacy, and minor protections.

Development Placeholder Notice

This document is a development-stage placeholder and is not legal advice. Varsity Page makes no warranty that this content is suitable for production deployment or that it complies with any applicable law. It must be reviewed and rewritten by qualified legal counsel before public release. Bracketed values such as [Legal Entity Name] indicate fields that require real company information before publication.

1. Introduction

Varsity Page (“Varsity Page,” “we,” “us,” or “our”) is a free fan platform for high school athletics, operated by [Legal Entity Name]. This Privacy Policy explains what information we collect when you use our website and mobile experience, how we use it, who we share it with, and the choices you have about it.

By using Varsity Page you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the service.

2. Who This Policy Covers

This policy applies to three groups of people:

Fans — anyone who visits Varsity Page, whether browsing anonymously or signed in to an account.
Parents and guardians — including those verified by a school as a “Linked Parent” to a specific student athlete.
Student athletes — indirectly. Schools publish athlete information (name, jersey number, position, photo, stats) through VP Core, and Varsity Page displays what the school has chosen to make public. Schools control this data through a separate data agreement governed by their VP Core subscription.

3. Student Athlete Data & FERPA Awareness

Roster information, photos, and athletic statistics displayed on Varsity Page are published by schools through VP Core, which is the authoritative system of record. Schools — not Varsity Page — own and control what is published.

We are FERPA-aware. Where we receive student-identifiable information from a school, we operate as a “school official” for that school under the FERPA school official exception, subject to the school’s direct control. We do not retain student records beyond their useful display lifecycle, and we do not redisclose student records.

What we never receive: Documents, grades, transcripts, attendance records, disciplinary records, and any other educational records remain in VP Core and are never synced to the fan-facing database.

VP Core also includes a do_not_display flag that schools can apply to any athlete. Flagged athletes are excluded from every part of Varsity Page — rosters, search, VP Chat responses, and player detail pages — within seconds of the flag being set.

4. Parental Controls & Minor Privacy

Parents and guardians have meaningful control over how a minor athlete is represented on Varsity Page.

Opting an athlete out of display: Contact your school’s athletic director. They can flip the do_not_display flag in VP Core, and your athlete will be removed from rosters, search, VP Chat, and player pages. Changes propagate to Varsity Page within 1–3 seconds.
Linked Parent verification: To receive notifications about a specific student (practices, schedule changes, team events), parents must be verified by school staff as a Linked Parent in VP Core. This prevents non-family members from accessing student-specific notification streams.
Per-student notification controls: Verified Linked Parents can set notification preferences separately for each linked student.

5. Children Under 13

Varsity Page is designed for high school athletics, where most participants are between 14 and 18 years old. We do not knowingly collect personal information from children under 13. If a user under 13 attempts to create an account, we will delete the account and any associated information.

Athletic information about students (including those who may be under 13 in middle school feeder programs) is published by the school through VP Core under the school’s authority — it is not collected from the child. Parents or guardians who believe a minor’s information should not appear on Varsity Page should contact the school’s athletic director to apply the do_not_display flag.

Parents or guardians who believe a child under 13 has nonetheless created an account on Varsity Page should contact us immediately at privacy@varsitypage.com.

6. Information We Collect

6.1 Information You Provide

Account information: Email address, display name, optional avatar image when you sign up.
Profile information: Optional bio, followed schools, favorited teams, and (if applicable) Linked Parent associations verified by your school.
Contest entries: Your acknowledgment of contest rules and any contact details required to deliver a prize.
Parent ad submissions: Photo, written shout-out, and the athlete you selected. Schools moderate these before publication.
Communications: Anything you send us via support or the contact form.

6.2 Information We Collect Automatically

Device and usage data: Browser type, operating system, pages visited, time spent, referring URL.
Location data: Only when you actively opt in to enter a geofenced contest. See “Location Data & Geofencing” below for details.
VP Chat conversation history: Your recent questions and responses, retained briefly so you can re-access them. Auto-deleted (see Data Retention).
Cookies and similar technologies: See our Cookie Policy for details.

6.3 Information from Schools

Schools publish athletic information to VP Core, which syncs to Varsity Page. This includes team rosters, schedules, game results, sponsor placements, and parent ads they have approved. Privacy filters (do_not_display, is_active, content moderation status) are enforced at sync time so suppressed content never reaches the fan database.

7. Location Data & Geofencing

We use location data for one purpose only: verifying that you are present at a game venue when you choose to enter a geofenced contest.

Permission is per-entry: When you tap “Enter” on a geofenced contest, we request location permission through your browser’s Geolocation API. If you decline, your entry is declined; no other features of Varsity Page are affected.
What we check: Your device’s coordinates are compared against the venue’s geofence (typically a radius of ~805 meters / 0.5 miles, configurable per venue by the school in VP Core).
What we keep: The result of the check (inside-radius or outside-radius) and a timestamp. We do not retain raw latitude/longitude beyond the entry transaction.
When it’s active: The geofence only evaluates entries during the game window (a configurable number of minutes before kickoff through the end of the game).
Consent prompt: Before each geofenced entry, you will see a consent screen disclosing the purpose, retention policy, and contest rules. You must explicitly accept to proceed.

8. How We Use Information

We use the information described above to:

Operate, maintain, and improve Varsity Page.
Deliver the notifications you have opted into (game reminders, score updates, contest announcements, winner alerts).
Run contests and giveaways, verify geofenced entries, draw winners, and deliver prizes through sponsors.
Power VP Chat responses, including resolving the school or team context you are asking about.
Generate aggregated, anonymized engagement analytics for schools and sponsors (impressions, session length, contest participation rates). These analytics never identify individual fans.
Detect, prevent, and respond to fraud, abuse, security incidents, and policy violations.
Comply with legal obligations.

We do not sell personal data. We share information only in the following circumstances:

Schools: A school may see aggregated engagement metrics for its own page (e.g., follower count, page views, contest entry counts) and the content you submit specifically to that school (e.g., parent ads pending moderation).
Sponsors: Sponsors receive aggregated, anonymized engagement reporting (impressions, clicks, completion rates). Sponsors do not receive your name, email, or individual activity.
Service providers: We share information with vendors that help us run the service, including Supabase (authentication and database), Google Cloud (hosting, notifications, AI models for VP Chat), PostHog (product analytics, only if you accept analytics cookies), and similar infrastructure providers. These vendors are contractually limited to processing data on our behalf.
Never: student data to analytics providers. Published roster information — student names, photos, and athletic statistics — is never sent to our analytics provider. Our analytics runs with session recording and automatic click capture switched off precisely so that student information shown on a page cannot leave our systems as a side effect of you browsing it. See the Cookie Policy for specifics.
Legal requirements: We may disclose information when we believe in good faith that disclosure is required by law, legal process, or to protect the rights, property, or safety of Varsity Page, our users, or the public.
Business transfers: If Varsity Page is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different policy.

10. Data Retention

Account data: Retained until you delete your account.
VP Chat conversation history: Retained for a short window (typically a few days) so you can re-access recent questions, then automatically deleted.
Location data: Discarded immediately after the geofence check that produced it. We retain the boolean result (inside / outside) and a timestamp; we do not retain raw coordinates.
Contest entries: Retained until the contest is drawn, plus 30 days for prize delivery and dispute resolution.
Aggregated analytics: Anonymized and may be retained indefinitely for service improvement and sponsor reporting.
Legal holds: We may retain information longer if required by law or pending legal proceedings.

11. Your Rights

Depending on where you live, you may have some or all of the following rights:

Access: Request a copy of the personal information we hold about you.
Correction: Request that we correct inaccurate information.
Deletion: Request that we delete your account and associated personal data.
Portability: Request a portable copy of your data.
Withdraw consent: Revoke consent for location sharing, notifications, or other consent-based processing at any time.

Important: Information about student athletes is controlled by the school, not by Varsity Page. To remove or correct athlete display data (roster info, photos, stats), contact the school’s athletic director, who controls this in VP Core.

California residents (CCPA/CPRA): You have the right to know what personal information we collect, request deletion, opt out of sale of personal information (we do not sell personal information), and not be discriminated against for exercising your rights.

EU/UK residents (GDPR/UK GDPR): You have the right to lodge a complaint with your supervisory authority and to object to processing based on legitimate interests. Our lawful bases for processing are contract performance, legitimate interests, and consent.

To exercise any of these rights, contact us at privacy@varsitypage.com.

12. Cookies & Tracking

We use a small number of cookies and similar technologies to keep you signed in, remember your preferences, and understand how fans engage with the platform. For full details, see our Cookie Policy.

13. Security

We use industry-standard safeguards to protect your information, including encryption in transit and at rest, role-based access controls, row-level security on our database, and routine monitoring. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top of this page. For material changes, we will provide additional notice (such as an email to your registered address or a banner in the app).

15. Contact Us

Questions, requests, or complaints about this Privacy Policy or our data practices?

Privacy contact: privacy@varsitypage.com

General contact: support@varsitypage.com

Mailing address: [Legal Entity Name], [Address Line], [City, State ZIP]

Last Updated: 2026-05-23

This Privacy Policy is effective as of 2026-05-23. It is a development-stage placeholder and must be reviewed by qualified legal counsel before production deployment.