PRIVACY POLICY

LaxID, operated by Cure Consulting Group Inc. ("we", "us", "our"), is committed to protecting the privacy of athletes, parents, and directors who use our tournament management and scouting platform. This policy explains how we collect, use, and safeguard your information.

COPPA Compliant

Information We Collect

Athlete profiles: name, date of birth, graduation year, position, team affiliation, class year, and optional photo.
Performance data: game statistics, efficiency scores, and tournament results captured during sanctioned events.
Registration data: contact email, guardian information (for minors), payment status, and event-specific details.
Usage data: page visits, feature interactions, and device information for service improvement.

COPPA Compliance

We comply with the Children's Online Privacy Protection Act (COPPA) for users under 13 years of age.
Parental or guardian consent is required before collecting, using, or disclosing personal information from children under 13.
During event registration, guardians must acknowledge and consent to data collection on behalf of minor athletes.
Parents/guardians may review, modify, or request deletion of their child's personal information at any time.
We do not condition participation on the disclosure of more personal information than is reasonably necessary.

California Consumer Privacy (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to Delete: You may request deletion of personal information we hold about you, subject to certain exceptions (e.g., legal compliance, completing a transaction).
Right to Opt-Out: We do not sell personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights — you will receive equal service and pricing.
To exercise these rights, contact support@laxid.app or submit a request through your account settings. We will verify your identity and respond within 45 days.

Parental Rights

Review personal information collected about your child by contacting your event director or our support team.
Request deletion of your child's personal information — we will process requests within 30 business days.
Revoke consent for future collection and use of your child's personal information.
Opt out of the display of your child's performance data on public leaderboards or ratings pages.

Third-Party Service Providers

Firebase (Google Cloud): Authentication, database (Firestore), analytics, crash reporting, and hosting. See Google's Privacy Policy at policies.google.com/privacy.
Stripe, Inc.: Payment processing for tournament registrations and subscriptions. See Stripe's Privacy Policy at stripe.com/privacy.
Vercel / Next.js: Website hosting and static content delivery. See Vercel's Privacy Policy at vercel.com/legal/privacy-policy.
Google Cloud Platform: Infrastructure, encryption, and data storage. All data stored in US-based data centers.
We share only the minimum information necessary for each service to function. All providers are bound by data processing agreements.

Cookies & Tracking

Our website uses essential cookies for session management and user preferences. These cannot be disabled.
Analytics: We use Firebase Analytics to understand usage patterns. You can opt out via your browser's cookie settings.
Our mobile applications do not use browser cookies. Mobile analytics use the Firebase SDK with anonymized identifiers.
We do not use cookies for advertising or cross-site tracking. We do not share cookie data with third parties for advertising purposes.

Data Retention & Deletion

Athlete performance data is retained for the duration of their active participation in sanctioned events.
Inactive profiles (no event participation for 24 months) are flagged for review and potential archival.
Data deletion requests can be submitted through your event director's compliance dashboard or by contacting support@laxid.app.
Upon deletion, all personally identifiable information is removed. Anonymized aggregate statistics may be retained.
Payment records are retained for 7 years in accordance with financial compliance requirements.

Data Security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256) via Google Cloud Platform infrastructure.
Access controls enforce role-based permissions — directors see only their event data.
Firebase Authentication provides secure identity verification for all user actions.
We conduct regular security reviews and follow industry best practices for data protection.
No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but strive to use commercially acceptable means to protect your information.

Last updated: March 2026. Questions? Contact support@laxid.app