Parents' Bill of Rights for Data Privacy & Security

PlayEligible holds academic information about students, much of it about minors. That places obligations on us that go beyond ordinary consumer software. This page states, in plain language, what those obligations are and how we meet them. It applies to every family using PlayEligible, whether you signed up yourself or your school did.

1. Student data is not sold, and never will be

We do not sell student personal information. We do not rent, trade, or license it. There is no version of our business model in which student data is the product.

2. Student data is not used for advertising

We do not use student information to target advertising, and we do not build advertising or marketing profiles from student activity. We do not permit our vendors to do so either. Marketing email is sent only to the adult who created an account, only with their consent, and can be switched off at any time from email preferences.

3. Parents can see, correct, and remove their child's data

You have the right to:

• See it. Every record we hold about an account can be downloaded in full from Settings → Privacy & data → Export my data.
• Correct it. If a grade or detail entered by a coach or school is wrong, you can file a correction request from the same place. It creates a tracked record rather than an informal message.
• Delete it. You can request deletion of the account and its data at any time. Deletion runs after a 30-day grace period so a mistaken or unauthorized request can be reversed.

Where a school district is the party that placed student data with us, the district may direct these requests and we act on their instruction, as education-records law requires.

4. Children under 13

A student under 13 cannot open their own PlayEligible account. A parent or guardian creates the account, provides consent, and links the student. We ask for date of birth at signup for exactly this reason — without it we could not apply the right protections. A parent may withdraw that consent at any time, which ends collection and allows deletion of what was collected.

5. Who can see a student's information

Access is enforced in the database itself, not merely hidden in the interface. A request for data the requester is not entitled to returns nothing, regardless of how it is made.

• The student always sees their own information.
• A linked parent or guardian sees their student's information.
• Coaches and school staff see only students on their own roster.
• College recruiters see a student only after that student (or their guardian) shares access — and even then they see the athletic profile, eligibility standing, and Sport IQ results. Raw grades and marking-period records are never exposed to recruiters.
• PlayEligible staff may access accounts for support, security, and safety. Administrative access is logged.

Students and guardians can see who has viewed a profile, and can revoke any access they granted, from the recruiting controls in the app.

6. How long we keep it

We keep account data while the account is active, and delete it on request. Full detail is on our data retention schedule. Records we are legally required to keep — principally financial records of payments — are retained without the identifying link to a person.

7. How it is protected

• Data is encrypted in transit and at rest by our infrastructure providers.
• Access rules are enforced at the database row level, per user and per role.
• Passwords are stored only as salted hashes; nobody at PlayEligible can read them.
• Account activity (sign-ins, password changes) is recorded and visible to the account holder.
• Administrative actions on user accounts are written to an audit log.

No system is perfectly secure. If a breach affects student data, we will notify affected families and, where a district placed the data with us, that district — promptly, and with what we know.

8. Who else processes the data

We use a small number of vendors to run the service — hosting, database, payments, email, and AI features. Each is listed, with what they receive and why, on our subprocessor page. They act on our instructions and may not use student data for their own purposes.

9. For school districts

When a district contracts with PlayEligible, we act as a school official with a legitimate educational interest under FERPA, use student data only to provide the service, and follow the district's instructions on retention and deletion. We will sign a district's data protection agreement, and this Bill of Rights is intended to be appended to it.

10. Complaints

If you believe your student's data has been handled improperly, contact us at privacy@playeligible.com. If a school district placed the data with us, you may also raise the matter with the district, and — in states that provide one, including New York — with the state education department's chief privacy officer.