VarsityIQ ("VarsityIQ," "we," "us," "our") provides an athletic program management platform licensed to K-12 schools and school districts ("Schools"). This Privacy Policy describes how we collect, use, and disclose information when Schools, coaches, athletes, parents, and other authorized users ("Users") access the VarsityIQ platform at varsityiq.app and affiliated subdomains (the "Service").
We take student and staff privacy seriously and design VarsityIQ to comply with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and applicable state student data-privacy laws.
1. How VarsityIQ is licensed
VarsityIQ operates as a "school official" under FERPA §99.31(a)(1). The School is the data controller; VarsityIQ is the data processor acting under the School's direction. Schools own their records; VarsityIQ stores and processes that data solely to operate the Service on the School's behalf.
2. Information we collect
We collect only what's needed to operate the Service:
- Account information: name, school email address, role (coach, athlete, trainer, admin), associated sport(s) and team(s).
- Authentication data: sign-in timestamps and Google OAuth tokens used to authenticate users. We do not receive or store Google account passwords.
- Program data entered by Users: roster information, attendance records, lifting entries, performance test results, equipment assignments, event schedules, financial events, and similar athletic program records.
- Device and usage data: IP address, browser user agent, pages accessed, and timestamps, used for security monitoring and product analytics in aggregate form.
- Communications: messages you send to info@varsityiq.app or similar support addresses.
We do not knowingly collect information from children under 13 outside the scope of the School's authority. Any such data collected under School direction is treated as School Data subject to this policy and the School's service agreement.
3. How we use information
We use information solely to provide and improve the Service, including to:
- Authenticate Users and enforce role-based access
- Operate product features the School has enabled (rosters, attendance, lifting, equipment, finances, reporting, etc.)
- Maintain security, prevent abuse, and investigate suspicious activity
- Communicate with Users about the Service, product updates, and support inquiries
- Generate aggregate, de-identified analytics to measure product performance
We do not sell User data. We do not serve advertising. We do not use student information to build marketing profiles or targeted advertising of any kind.
4. Who we share information with
We share information only with the service providers required to operate VarsityIQ:
- Google LLC — identity / authentication (OAuth), hosted fonts
- Google Firebase / Firestore — database and file storage for School Data
- Vercel Inc. — application hosting
- Resend — transactional email delivery (invite links, notifications)
Each of these providers processes data under their own security and privacy commitments and only receives data necessary to perform their role. We do not share User data with third parties for marketing or advertising.
We may disclose information if required by law, valid legal process, or to protect the rights and safety of Users, the School, or VarsityIQ. We will notify the School of any such request to the extent legally permitted.
5. Data retention
We retain School Data for as long as the School maintains an active license or as required by law. Upon termination of a School's license, we will export School Data in a portable format on request and delete remaining production copies within 60 days, subject to standard backup retention schedules.
6. Security
We use industry-standard safeguards to protect School Data, including TLS in transit, encryption at rest (via our cloud providers), role-based access controls, tenant isolation in our database, audit logging for sensitive operations, and regular credential rotation. No method of transmission or storage is perfectly secure; we continue to invest in security improvements as VarsityIQ grows.
7. Parental rights
Parents of enrolled athletes may contact their School to review, correct, or delete their child's records stored in VarsityIQ. Because VarsityIQ operates under the School's direction, parent requests are routed through the School.
8. Cookies and local storage
VarsityIQ uses a session cookie to keep Users signed in. We use local browser storage to remember non-sensitive UI preferences (selected team, dashboard layout). We do not use third-party advertising cookies or cross-site tracking cookies.
9. International users
VarsityIQ is operated in the United States. By using the Service you consent to the processing and storage of information in the United States.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced to Schools in advance. The "Last updated" date at the top of this page reflects the current version.
11. Contact
Questions, concerns, or requests about this Privacy Policy can be sent to info@varsityiq.app. We will respond within a reasonable time.