This policy describes how SportsHero, Technologies, Inc. (“SportsHero,” “we”) handles personal information on sportshero.app. It matches how the site works today.
Information we collect
Account: email address and a password stored as a bcrypt hash. We do not store the password itself. You must confirm the email before you can log in.
Athlete profile: first and last name, birthdate, sport, team, position, jersey number, school, graduation year, city, state, season stats, bio, whether the profile is published, and whether it may appear in search.
Photos: the picture you upload to make a card, and the styled versions we generate. We strip location data and other camera metadata from the upload before we store it.
Parent or guardian, for an athlete under 18: name, email, a record that the consent box was checked, and the time of that consent. We email a confirmation link to that address.
Sponsor quick sign-up: email and first name. Last name, ZIP code, relationship, and how you heard about us are optional. If you check the marketing box, we store that choice and the time you checked it. The box starts unchecked.
Contact form: name, email, message, and subject if you add one.
Orders and gifts: the amount, pack, note, and whether a cheer is anonymous. When checkout is not handled by Stripe, we store the shipping name and address you type. When Stripe Checkout is on, Stripe collects the card payment and the US shipping address, and we store the shipping details Stripe sends back, plus the Stripe session and payment ids.
Cookies: a sign-in cookie (sh_session or sh_sponsor) that is httpOnly and SameSite=Lax, and a CSRF cookie (sh_csrf) used to check form posts. The sign-in cookie holds a random value. The server stores only a hash of it.
How we use it
We use this information to create and show trading cards, run athlete profiles, take sponsorships and print orders, send the messages you ask for (confirmation, password reset, parent consent, sponsor sign-in, receipts, shipping notes), run the giveaway, and answer contact messages.
We use marketing email only for sponsors who opted in. Each of those messages has an unsubscribe link.
Search results for a published, searchable athlete show a first name, last initial, sport, team, and photo. School and contact details are not in the search results. A parent can turn search off. The profile page itself shows the name saved on the card to anyone with the link.
Service providers
Stripe, when a Stripe secret key is set, processes card payments and collects the shipping address for printed packs. Without that key, checkout is a practice run on our server and no card is charged.
Resend, when an API key is set, sends our email. Without it, confirmation and receipt links stay on the screen instead of being mailed.
OpenAI, when an API key is set, creates the six portrait styles from the uploaded photo. For an athlete under 18, we do not send the photo to OpenAI until parent consent is stored. If the call fails, or there is no key, we use local filters on our server. We allow up to 3 style batches per account per day.
Printed cards are queued for a print partner. The current build records a Printful placeholder and does not transmit the order to a printer yet.
The site is hosted by [HOSTING PROVIDER].
Children
SportsHero cards are for youth athletes ages 5–19. We treat anyone under 18 as a minor. A parent or legal guardian must give their name, email, and check a consent box before the profile can be public, before friends can fund it, and before we send a minor’s photo to OpenAI. We also email that parent a confirmation link.
Under 13, the Children’s Online Privacy Protection Act requires verifiable parental consent before we collect a child’s personal information. The consent step we run today is the parent checkbox and email link described above. [VERIFIABLE PARENTAL CONSENT METHOD] is not a separate check yet.
A parent using the account can review and edit the athlete profile, turn off search, and delete the athlete profile. To ask us to review or delete a child’s information, email contact@sportshero.app. Public giveaway winner lists show a minor as a first name and last initial.
Marketing choices
Sponsor marketing email is optional and off until you check the box. Use the unsubscribe link in a marketing email, or email contact@sportshero.app, to stop those messages. We can still send account, receipt, and giveaway messages.
Retention and security
We keep account, profile, order, and message records for [DATA RETENTION PERIOD], unless a longer period is required for taxes, a dispute, or a giveaway winner record. You may ask us to delete your account and the athlete profile you control, subject to those exceptions.
Passwords are hashed with bcrypt. Session tokens are hashed on the server. The sign-in cookie is httpOnly. No method of storage is perfect.
Your choices and rights
You may ask us to access, correct, or delete personal information we have about you, or about a child whose account you control. Email contact@sportshero.app. We will respond as the law requires.
We do not sell personal information. We do not share it for cross-context behavioral advertising. California residents may also ask us to disclose the categories of information we collected and to delete it. We will not discriminate against you for asking.
International
[INTERNATIONAL TRANSFERS]. The site is aimed at families in the United States. If you use it from another country, you send information to the United States.
Changes and contact
We will post changes on this page and change the “Last updated” date. If a change is material, we will also email the address on the account when we have one.
SportsHero, Technologies, Inc., a Delaware corporation, [MAILING ADDRESS]. Email contact@sportshero.app.
See also the Privacy Policy, the Terms of Service, and the Official Rules.