Youth Registrant Privacy Notice

1. Scope of this notice

This notice applies specifically to the personal information of children under 13 years old ("child" or "youth registrant") who are registered for youth sports programs offered by organizations that use the leagues.sh platform. It supplements our Privacy Policy and explains how we handle children's information in accordance with the Children's Online Privacy Protection Act (COPPA) and applicable state laws.

leagues.sh is a platform-as-a-service provider. The sports organization (your child's league, club, or program) is the party collecting registration information. leagues.sh processes that information on the organization's behalf. Neither leagues.sh nor the organization directs the platform to children — all accounts, registrations, and data submissions are performed by parents or guardians.

2. What information we collect about children

leagues.sh collects only the minimum information a parent or guardian submits when registering a child for a program. This typically includes:

• Name — first and last name of the child.
• Date of birth — used to verify age eligibility for the program.
• Gender — where the sport or division requires it for team placement.
• Emergency contact information — provided by the parent or guardian for safety purposes.
• Program participation records — the programs, sessions, and teams the child is enrolled in.
• Health and medical notes — only if the sports organization requires them for safety, and only as submitted by the parent or guardian.

We do not collect a child's email address, phone number, or any direct online contact information from the child. All contact is with the parent or guardian. We do not create child accounts — children do not log in to leagues.sh.

3. Parent and guardian consent requirement

Only a parent or legal guardian may register a child under 13 or submit the child's information through leagues.sh. By completing a registration for a child, you confirm that:

• You are the child's parent or legal guardian.
• You consent to leagues.sh and the sports organization collecting and using the child's information as described in this notice.
• All information you submit is accurate.

If we learn that a child's information was submitted without verifiable parental consent, we will promptly delete that information. To report a concern, contact [email protected].

4. How we use children's information

We use children's information only to:

• Register the child for the sports programs selected by the parent or guardian.
• Place the child on the correct team, age group, or division.
• Communicate program schedules, changes, and safety information to the parent or guardian.
• Process fees associated with the program registration (payment is attributed to the parent/guardian account).
• Enable the sports organization to manage rosters, schedules, and team assignments.

We do not use children's information for advertising, marketing, profiling, or any purpose beyond providing the registered sports program services.

5. No advertising · no behavioral tracking on child surfaces

leagues.sh does not display advertisements to users, does not share children's information with advertisers, and does not use children's data for behavioral ad targeting. The league and team pages accessible to families do not run third-party advertising scripts or behavioral tracking pixels.

A sports organization that uses leagues.sh may add a Google Analytics measurement ID to their site configuration. If enabled, Analytics tracks only aggregate page-view counts using cookieless measurement; it does not receive children's personal data from leagues.sh.

6. Who we share children's information with

We share children's information only as follows:

• The sports organization: the league, club, or program the child is registered with receives the registration data required to run their programs.
• Service providers (sub-processors): we use a limited set of vetted infrastructure providers — including payment processing (Stripe), transactional email (Postmark), and hosting (AWS) — that process data on our behalf under data processing agreements that prohibit any independent use of personal data. Our current sub-processor list is available at leagues.sh/privacy/sub-processors.
• Legal requirements: we may disclose information when required by law, court order, or to protect the safety of a child or the public.

We do not sell children's personal information. We do not share it with third parties for their own marketing or commercial purposes.

7. Your parental rights

As the parent or legal guardian of a registered child, you have the right to:

• Review the personal information we have collected about your child. Contact us at [email protected] to request a copy.
• Correct inaccurate information. You can update most details directly in your account profile. For corrections to closed-season records, contact us directly.
• Delete your child's personal information. Submit a deletion request to [email protected]. We will complete verified requests within 30 days, subject to any legal record- retention obligations (for example, payment records required for tax purposes).
• Refuse further collection or revoke consent at any time by contacting us. Note that revoking consent may prevent the child from continuing to participate in programs that require the data.

To exercise any of these rights, email [email protected] from the email address associated with your account. We may ask you to verify your identity before processing the request. We will respond within 30 days.

8. Data retention and deletion

We retain children's information for as long as the family account is active and for a limited period afterward to satisfy legal record-keeping obligations:

• Active registration data: retained while the child has an active enrollment in any program.
• Post-program tail: registration records are kept for up to 3 years after a program ends to support the organization's administrative needs (for example, verifying prior participation).
• Payment records: retained for 7 years as required by tax and accounting law. Payment data is linked to the parent/guardian account, not the child profile.
• Upon parental deletion request: non-financial child data is purged within 30 days of a verified request.
• Account closure: child profile data is deleted within 90 days of account closure, unless a retention obligation applies.

When retention periods expire, data is automatically purged from our systems. Database backups are overwritten on a rolling 30-day schedule.

9. Contact us

For questions about this notice, to exercise your parental rights, or to report a concern about a child's privacy:

• Email: [email protected]
• Subject line suggestion: Youth Privacy Request — [your name]

For our general privacy practices and full GDPR/CCPA rights notice, see our Privacy Policy.