Privacy Policy

This policy applies to everyone who uses Headstrong: club administrators, players (including players under 18), and parents/guardians of minor players. It is operated by [Legal entity name, ABN] (“we”, “us”).

We collect different information depending on your role:

• Players: full name, email address, date of birth, module completion records, and quiz attempt history (including scores and pass/fail results, but not which individual answers were selected).
• Parents/guardians of minor players: full name, email address, and a timestamped record that consent was given for a named player to use the platform.
• Club administrators: full name, email address, and the club’s subscription/billing status.
• Everyone: basic account/session data needed to keep you signed in.

Headstrong is used by minors as part of a club’s concussion education program. Where a player is under 18, we require a parent or guardian to confirm consent before that player can access any educational content or take a quiz. We collect the minor’s date of birth specifically to determine whether this consent requirement applies. We do not knowingly collect more information about a minor than is needed to deliver the education modules and produce a completion record for their club.

• To create and manage accounts, and to let players access the modules their club has assigned.
• To generate module completion records, which clubs use as evidence that a player has completed the required education.
• To send account-related emails — invitations to join a club, and requests for guardian consent.
• To process a club’s subscription payment (handled by our payment processor, described below — we do not see or store full card details).
• To operate, maintain, and improve the platform, and to meet our own legal obligations.

We use a small number of third-party services to run Headstrong. We don’t sell data to anyone.

• Supabase — hosts our database and handles account authentication.
• Stripe — processes club subscription payments. Stripe receives payment details directly; we only receive a subscription/payment status, not full card numbers.
• Resend — delivers the transactional emails described above (invites, consent requests).
• A club administrator can see the squad, consent status, and module completion records for players at their own club — this is the core compliance function of the product.

We retain account and completion-record data for as long as the associated club account is active, plus a reasonable period afterward for compliance record-keeping purposes. [Specific retention period to be confirmed.]

Depending on where you live, you may have rights to access, correct, or request deletion of your personal information (or, for a minor, their guardian may exercise these rights on their behalf). To make a request, contact us at [contact email].

We use industry-standard measures — including encrypted connections and database-level access controls — to protect the information we hold. No system is completely secure, and we can’t guarantee absolute security.

The web app uses a cookie to keep you signed in. The mobile app stores the equivalent session information locally on your device instead of using cookies. We don’t use advertising or third-party tracking cookies.

We may update this policy as the product changes. We’ll update the “last updated” date above when we do.

Questions about this policy or your data can be sent to [contact email].