Privacy Policy
Draft. This document has not yet been reviewed by a licensed attorney and may change. If it changes in a way that matters, we will tell you and ask you to accept it again.
1. Who we are
ShowUp Soccer is a private, non-commercial project built and run by Carlos Zaragoza (“we”, “us”) for his family and a closed circle of people he knows and has personally invited. It is not a company and not open to the general public; access requires an invite code. This policy covers our website (showupsoccer.com) and app (app.showupsoccer.com). Questions and requests: contact@showupsoccer.com.
2. Children’s privacy
ShowUp Soccer is for young players (roughly ages 11 to 17), but it is built around the parent. We follow the principles of the U.S. Children’s Online Privacy Protection Act (COPPA):
- Only a parent or legal guardian can create a player profile. Players have no email address and cannot sign up on their own. A player is activated on their device with a one-time code the parent generates.
- We collect from and about a child only the information listed in section 3, and only to run the features a parent has set up.
- We do not show ads, build marketing profiles, allow public profiles, or offer chat. Players connect only in person by scanning a QR code, and both parents must approve each friendship. Friends can send only four preset emoji reactions.
- We do not disclose a child’s information to third parties, except the service providers in section 6 that help us run the app.
- We do not condition a child’s participation on providing more information than the app needs.
Parents’ rights. At any time a parent can review what we hold (a full data export), delete a player’s profile and all its data, or refuse further collection by deleting the profile. See section 9. You can also write to contact@showupsoccer.com.
How we confirm you are the parent. ShowUp Soccer is private and invitation-only: every parent account is created with an invite code that Carlos Zaragoza gave personally to someone he knows. Each time a parent adds a player, they confirm in the app that they are that player’s parent or legal guardian and consent to the information described in section 3. We record the date and the version of that confirmation with the player’s profile, and a profile cannot be created without it. If ShowUp Soccer were ever opened to the public, we would add a stronger verification method before accepting new players.
3. What we store, why, and for how long
| What | Why we need it | How long we keep it |
|---|---|---|
| Invite code: the short code you were given, when it was created, an optional label the admin wrote for their own reference (e.g. who it was for), and which account redeemed it. | To keep the app invite-only: an account can only be created together with a valid, unused code. | Kept as a record of how each account was let in; removed if the parent account is closed. |
| Parent account: email address; a password (we never see it: our sign-in provider stores only a secure hash); quiet-hours setting; when you accepted the Private Use Agreement and Privacy Policy, and which version; account creation date. | To create and secure your account, let you sign in, send account and important messages, and keep a record that you agreed to our terms. | While your account is open. Deleted when the parent account is closed (see section 9). |
| Player profile (entered by the parent): nickname, birth year (not full birthday), position, video-recording on/off setting; when the parent gave consent for this player, and which version of the consent text. | To set up the player, and to tailor things like drill levels. We suggest a nickname, not a full name. | Until the parent deletes the profile, or the parent account is closed. |
| Player’s own settings: optional famous player name (free text the player types), identity statement, “habit stack” sentence, reminder time. | To personalize the home screen and reminders. Please don’t enter sensitive or identifying details in free-text fields. | Same as the player profile. |
| Training activity: weekly plans, rest days and goals; session logs (date, drill, duration, whether it was the 2-minute version, a result number); XP, level, streaks, badges, focus-game scores. | To run the habit features: streaks, progress charts, badges and the parent’s weekly summary. | Same as the player profile. |
| Games and gear: opponent, place (text the parent or player types, never GPS), date and time, uniform color, notes; gear checklists; pre-game routine. | To power the game calendar and “bag ready” checklists. | Same as the player profile. |
| Private journal: what went well, what to improve, mood and feelings text. | For the player’s own reflection. It is not shown in the parent dashboard, but it is included in the parent’s full data export. | Same as the player profile. |
| Friends: short-lived friend-invite tokens, friendship records and both parents’ approvals, preset emoji reactions. | To connect friends safely, in person, with parent approval. | Invites expire within minutes. Everything else: same as the player profile. |
| Reminders (only if a player turns them on): the browser’s push-notification address and keys, the device time zone, and a record of which reminder was sent on which day. | To deliver a reminder at the right local time. Reminders never contain personal details. | Until reminders are turned off or the profile is deleted. |
| Security records: for code-guessing protection, a one-way hash of the network address (not the address itself), whether the attempt worked, and the time. | To stop people from guessing activation codes. | About one day; a cleanup job removes them periodically. |
| Technical logs kept by our hosting providers: IP address, browser type, time and page requested. | To deliver the site, keep it secure and fix problems. | According to each provider’s log-retention settings, typically days to weeks. |
Kept only on the device, not by us: the sign-in session, cached app files, settings, and any video a player records. Videos are stored in the browser on that phone and are never uploaded; we cannot see or recover them, and clearing the app’s data or uninstalling it deletes them.
What we do not collect: photos or videos uploaded to us, precise or approximate location, contacts, microphone audio, card or payment information, players’ real names, addresses or phone numbers, government IDs, or advertising identifiers. The app loads no third-party analytics, ad or tracking scripts, and its fonts are hosted by us, not fetched from a font service.
4. How we use information
- To provide the app’s features to the parent and player.
- To keep accounts secure and prevent abuse.
- To email the parent about the account: confirming sign-up, resetting a password, security notices, and important updates about the service, our terms or this policy.
- To deliver reminders a player has switched on.
- To meet legal obligations.
We do not use information for advertising, marketing profiles, or “interest-based” targeting; we do not sell or rent it; we do not use it to train AI models; and we make no automated decisions that have legal or similarly significant effects. If we ever want to send marketing email, we will ask you separately first.
7. Retention
The table in section 3 gives the period for each kind of data. In short: we keep data only while an account is active, and delete it when a parent asks.
- Deleting a player permanently removes that player’s profile, activity, journal, friendships, reminders and sign-in account. It cannot be undone.
- Closing a parent account removes the parent record and any players under it. Email contact@showupsoccer.com to request this.
- Inactive accounts. We do not yet delete inactive accounts automatically. We plan to delete accounts that have been inactive for 24 months, after warning the parent by email. Until then, data stays until a parent deletes it.
- Consent forms from our earlier process. We no longer ask for a signed form. Any form a parent already sent us is kept only while that player’s profile exists, and deleted when the parent deletes the profile or the account.
- Backups. Our database provider may keep encrypted backups for a limited time after deletion. Deleted data is not restored to the live service.
- We may keep the minimum needed to meet legal obligations, resolve disputes and enforce our terms (for example, the record that you accepted them).
8. Security
We use HTTPS, database rules that limit each account to its own data, hashed passwords, expiring single-use activation codes with attempt limits, and server-side-only secret keys. No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.
9. Your choices and rights
- Access / export: in the parent dashboard, open the player and choose the data export. It includes everything we store about the player, including journal entries.
- Delete a player: in the same screen, choose delete (you will confirm by typing the nickname).
- Correct information, close your parent account, or ask any question: email contact@showupsoccer.com. We aim to reply within 30 days.
- Reminders: a player can turn them off at any time; a parent can set quiet hours.
- Video: a parent can turn video recording off.
Depending on where you live, you may have additional rights, such as to know, correct or delete your information, or to appeal a decision. We honor them for every parent. We do not sell or share personal information for advertising.
10. Where information is processed
ShowUp Soccer is operated from the United States. Our providers may process and store information in the United States and other countries where they operate.
11. Changes to this policy
If we change this policy in a way that matters, we will update the version and date at the top, tell parents by email or in the app, and ask them to accept it again. We will not use information we already hold for a new purpose that affects a child without asking the parent first.
12. Contact
Carlos Zaragoza. Email: contact@showupsoccer.com. See also our Private Use Agreement.