Privacy Policy

PlayrPath's designated Privacy Officer is contactable at privacy@playrpath.ca. They oversee compliance with this policy and PIPEDA, and respond to access, correction, and complaint requests within 30 calendar days.

We collect only the information needed to operate sport-management workflows for clubs you join:

• Identity: first name, last name, date of birth, email, phone, city/province
• Family link: guardian / parent contact details for athletes under 18
• Sport participation: club, team, registrations, attendance, statistics
• Coaching: NCCP credentials, training records (where applicable)
• Safeguarding: registration-attempt audit trail, coach discipline records (where applicable)

We do NOT collect biometric data, health data, or training-load data in the v1 pilot. When those features ship later they will be opt-in with a separate consent flow described in project rule P-9.

For athletes under 18, registration is initiated by a parent/guardian who must provide explicit consent at sign-up. Linking an existing PlayrPath profile to a new club registration always requires confirmation from the existing parent/guardian (see project rule P-12). PlayrPath never auto-links profiles based on guessable identifiers such as name + birthday alone.

All personal information is stored in Canada (Supabase Postgres database, ca-central-1 region in Montreal). Transactional emails sent on behalf of clubs are dispatched through Canadian providers selected for PIPEDA compliance. Some operational telemetry (error tracking, performance metrics) may transit through North American CDN nodes during delivery; no personal information is included in those telemetry streams.

We keep your personal information only as long as needed for the purposes above, or as required by law. Specific retention periods:

• Active athlete + family records: while your club affiliation is active, plus 7 years for sport-organization audit purposes.
• Coach administrative records: 90 days post-resolution (project rule P-14, Tier 1).
• Coach code-of-conduct records: 1 year after resolution (P-14 Tier 2).
• Substantiated safeguarding records: permanent. Required for child-safety due-diligence under sport-organization governance.
• Audit logs (immutable): retained indefinitely as required for legal and safeguarding evidence.

Inside the platform: each club only sees the athletes affiliated with that club. Multi-club athletes choose what crosses club boundaries (project rule P-11) — by default, nothing.

Outside the platform: we never sell personal information. We disclose substantiated coach safeguarding findings to the relevant National Sport Organization (NSO), the Canadian Sport Dispute Commissioner (CSDC), and (once the integration ships) Canada's future national sport infrastructure platform — per project rule P-15. Allegations under investigation are NOT disclosed externally until findings are substantiated.

Service providers: Supabase (database + auth), our Canadian transactional email provider, and our hosting platform (Vercel) process data on our behalf under written agreements that require equivalent protection.

• Encryption in transit (HTTPS / TLS) and at rest
• Row-level security policies enforced in the database — each club admin can only see their own club's data
• Immutable audit logs on safeguarding-tier actions
• Independent middleware lockout for suspended coaches (project rule P-14)
• Production access restricted to PlayrPath staff under written confidentiality terms

You can request a copy of your personal information, ask us to correct it, or request its removal. For minors, a parent/guardian on file makes the request. Use the "Request Data Removal" button on your profile, or email privacy@playrpath.ca. Note that some records (immutable audit logs, substantiated safeguarding findings) are retained as described above and may be anonymized rather than deleted to preserve safety obligations.

See our dedicated Cookies notice for what cookies we set and how to control them.

If we don't resolve your concern to your satisfaction, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or by phone at 1-800-282-1376.