Privacy Policy

What we collect

• Account information: your email address and password (passwords are stored only in encrypted form by our sign-in provider).
• Athlete information you add: name, date of birth, gender and home location; optionally height and weight.
• Waiver information: the signer's name, relationship, contact details and address, an emergency contact, answers to the health questions, the consents given, the typed signature, and the date, IP address and browser of the signing.
• Combine results: the measurements and scores recorded by staff at a combine or testing session.
• Payment information: what was paid, when, and the billing address needed to calculate sales tax. Card numbers are entered on Stripe's pages and never reach us.
• Host gym information: the gym's name, address, contact details, facility and courts. Identity and bank details for payouts are given directly to Stripe.
• Usage information: pages visited and how the site is used, through Google Analytics and the cookies described below.

How we use it

• To run combines and testing sessions: registration, check-in, recording results and keeping athletes safe (health answers are used only for safety).
• To show families an athlete's results and progress over time. Results are released only after staff have reviewed them.
• To compare an athlete with others of the same age group and gender as a percentile. These comparisons use reviewed results only and never identify anyone else.
• To take payments, calculate and remit sales tax, and pay host gyms their share.
• To send what you ask for or need: account emails, waiver copies, receipts and registration details. Marketing emails are sent only if you opted in on the waiver, and you can unsubscribe at any time.
• To keep the site secure and working, and to improve it.

Height and weight

Height and weight entered by a family are private. They are used only for analysis, are visible only to the athlete's parents or guardians on the account and to our own staff, and are never shown in public, on a leaderboard or to a partner gym.

What is public

Nothing about an athlete is public unless the waiver gave permission. The public leaderboard shows an athlete's first name and results only when the signed waiver agreed to leaderboards and to media use. You can withdraw either consent by contacting us.

Who can see an athlete's information

• The parents and guardians on the account. A request to link an account to an athlete who already exists is checked by our staff before anything is shown.
• Our staff, who run combines and review results.
• A partner gym's staff see the full record of athletes whose home location is their gym. For an athlete visiting their event, they see only what is needed to run that event: the registration, the waiver answers copied onto it, and the results taken there.
• The coach of a team or club, for that team's athletes at the combine the team booked.

Service providers

We use trusted providers to run the site. They process information on our behalf and only for that purpose: Supabase (database and sign-in), Railway (hosting), Stripe (payments, sales tax and payouts to host gyms), Resend (email), Google Analytics (site statistics) and Google Maps (address suggestions as you type). Some of these providers store information outside Canada, including in the United States, where it may be accessible to authorities under local law.

Cookies

We use cookies to keep you signed in and, through Google Analytics, to understand how the site is used. You can block or delete cookies in your browser; signing in requires them.

How long we keep it

• Signed waivers and their records are kept for 24 months, as the waiver states.
• Accounts, athlete profiles and results are kept while the account exists, so that progress can be shown across years. You can ask us to delete them.
• Payment and tax records are kept as long as the law requires.

Your choices and rights

You can ask to see the personal information we hold about you or an athlete in your care, ask us to correct it, withdraw a consent, or ask us to delete it, by writing to privacy@combinebasketball.com. We will answer within 30 days. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Security

Information is sent over encrypted connections and access is limited by role: families see only their own athletes, and staff and partner gyms see only what their role allows. No system is perfectly secure; if a breach puts you at risk, we will tell you and the regulator as the law requires.

Changes and contact

We will post any change to this policy on this page with a new date, and tell account holders of significant changes by email. Questions or requests: privacy@combinebasketball.com.