Privacy Policy
Last updated: 25 October 2026
Athlete Atlas holds information about children: their names, dates of birth, and what their coaches think of how they play. This policy says, in plain words, what we collect, why, who can see it, where it is kept, and what you can do about it. It is written to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the guidance of the Office of the Privacy Commissioner of Canada on meaningful consent and on children's information.
The short version
- A coach records evaluations and goals for the players on their team. A parent or guardian sees their own child's record, and nothing else, after the head coach confirms them.
- Your minor hockey association decides who coaches whom and what is recorded. It is the organization accountable for its members' information. Athlete Atlas is its service provider and follows its instructions.
- We never sell personal information, never show advertising, and never use children's information for marketing or to train any software.
- The data is stored with Google Cloud in the United States. We say so because it matters to some families, and the law requires us to tell you.
- You can ask for a copy of your or your child's information, ask us to correct it, or ask for it to be deleted. We answer within 30 days.
1. Who we are and what this covers
Athlete Atlas is operated by [legal entity name], [address], Ontario, Canada ("Athlete Atlas", "we"). This policy covers the Athlete Atlas application at app.athleteatlas.io, the website at athleteatlas.io, and any email we send. It applies to coaches, parents and guardians, association administrators, players with their own accounts, and visitors to the website.
Our privacy officer is responsible for this policy and for answering your questions: [name], mattmayer@hotmail.com, [postal address].
2. Two roles: your association and Athlete Atlas
Minor hockey associations and clubs ("associations") use Athlete Atlas to run player evaluations and development for their teams. For the players' records, evaluations, goals and the roster, the association is the organization accountable for the information: it decides what is collected, who may record it, and how long it is kept, within the rules of this policy and our agreement with it. Athlete Atlas holds and processes that information on the association's behalf and on its instructions, and does not use it for any purpose of its own.
For some information Athlete Atlas is accountable directly: your account as an adult user, the website and its wait-list, our emails to you, support conversations, and the technical logs that keep the service secure.
If you have a question about why your association records something, or want it changed, you can ask us and we will route it to your association; you can also ask the association directly.
3. What we collect
Adults (coaches, parents and guardians, administrators). Name, email address, password (stored only as a one-way hash), an optional phone number and profile photo, role, association and team, the terms and privacy versions you accepted and when, the time of your last sign-in, and default notification preferences (not yet editable). For an association, the name, email, phone and postal address of its contact person. For a parent's account we also record which child you asked for and that the head coach confirmed you as that child's guardian.
Children (players). First and last name, date of birth, position, jersey number, team and status (active, archived), together with the name, email address and phone number of the child's parent or guardian as the association's roster or the coach gives them, so that the right adult can be confirmed. From the association's roster or the coach, never from the child. We do not collect a child's email, phone number, photo, location or login unless a player account is created under section 6. If a player of 13 or over writes to us about their record, we pass the message to the association's privacy contact the same day, who answers with a second adult from the association copied, and we delete our copy when the request is closed.
Evaluations and goals. Scores from 1 to 10 on the skills and qualities named in the evaluation criteria in use (Athlete Atlas's own criteria today: skating, puck and stick skills, game understanding, and character and attitude, such as effort, coachability and sportsmanship; an association may adopt its own), written feedback for the family, an overall comment, the coach's next steps and a placement recommendation (a staff-only field: coaching staff see it, families do not see it in the app but can ask for it, section 14), the coach's role, the team, age group, season and criteria used, and development goals. Written by the coaching staff.
Private staff notes. Not available today. When the feature is switched on, the coaching staff of a team can keep notes that help them plan each player's development. They are encrypted and not shown to families in the app; section 14 explains how a family can ask for them and what the association must do with such a request.
Consent records. For your acceptance of the terms and the privacy policy: the document version and the time. The guardian's statement is recorded the same way, and a player account approval once player accounts exist. From the December release, also a keyed hash of your IP address and your browser's identifier. We keep these to show that consent was given.
Technical information. Request identifiers, IP address, browser and device type, pages requested, errors and sign-in attempts, kept in server logs for security and troubleshooting. We do not use analytics cookies or advertising trackers; the only cookie is the one that keeps you signed in. While a coach works, their browser also keeps a copy of the player being evaluated and of evaluations not yet sent, on that device only, so nothing is lost when the rink has no signal; it is removed when the coach uses Sign out (which first sends or deletes unsent evaluations) or when another account signs in on that browser, but not when a session simply expires.
Website wait-list. If you ask to try Athlete Atlas, your name, email, association, role, an optional note, the consent wording you agreed to and when, and a hash of your browser identifier, used only to contact you about the pilot.
What we do not collect. Health or medical information (no form collects it; please do not put it in free text), payment details, government identifiers, and children's contact details (other than as described above for a player's own request). If a future feature needs new information (a registry number entered by a parent, an evaluation video clip), we will update this policy and ask for consent before it is collected.
4. Why we use it
Each purpose, the information it needs, and the basis for it:
| Purpose | Information | Basis |
|---|---|---|
| Run the association's player development program: record and show evaluations and goals. Where the association chooses, its coaching staff may also use evaluations when teams are picked (for example at tryouts), with a placement recommendation that the app shows only to staff (a family can ask for it, section 14); the association makes those decisions, not Athlete Atlas | Player record, evaluations, goals | The association's operation of its program, under its agreement with us, with notice to families; the guardian's statement when they join |
| Let a parent or guardian see their own child | Guardian link, consent records | The guardian's request and statement; the head coach's confirmation |
| Provide and secure your account | Account, technical information | Necessary to provide the service you asked for |
| Send you notifications about your child's record, your account, and changes to this policy | Email address, notification preferences | Necessary to provide the service; you will be able to turn optional notices off (December release) |
| Contact you about the pilot if you asked us to | Wait-list | Your express consent, which you can withdraw at any time |
| Answer access, correction and deletion requests; keep records the law requires | Any | Legal obligation |
| Improve the service using counts and aggregates | Technical information, de-identified usage | Our legitimate business purpose; no child is identifiable in it |
We do not use personal information for advertising, do not sell or rent it, and do not use children's information to train or improve any automated system.
5. Children: what is different
A child cannot meaningfully consent to how a coach evaluates them, so the law looks to the adults responsible for them. Here is how that works in Athlete Atlas:
- Before a parent joins. Once the association has told families that it uses Athlete Atlas, and the date its notice gives families to say whether they will take part has passed, a coach may evaluate a player on their team before any parent has an account, as part of the association's program. Every family is invited to join and see the record.
- Becoming a guardian. A parent or guardian creates an account, asks for their child by name and date of birth, and confirms, by ticking a statement, that they are that child's parent or legal guardian. The head coach confirms the request. Nothing about the child is shown until then. Every request is confirmed by the team's head coach (or by Athlete Atlas on the association's behalf). From the December release, once a child has a confirmed guardian, any further guardian is confirmed by an existing guardian or the association, so a child's record cannot be handed to another adult by a coach alone. If a court order or a safety concern means a particular adult must not see a child's record, the family can tell the association privately. The association tells the head coach not to confirm that adult, and on its request Athlete Atlas removes any access that adult already has and deactivates their account. A head coach confirms a request on the name and email the person gives; the service does not check identity documents.
- What a guardian sees in the app. Their own child's record only: scores, feedback and next steps written for the family, and goals. Not other children's records, and not staff-only material (planning notes when available, the placement recommendation); a family can ask for a copy of the full record (section 14).
- Opting out. A guardian can decline to take part: the coach then keeps the family's feedback to in-person conversations, and the association decides what is recorded. A guardian can end their own access at any time by asking the head coach or us (self-service from the December release).
- Deleting. A guardian can ask for their child's record to be deleted. The association decides, because the record is its program's record; we carry out what it decides and tell you the outcome within 30 days.
6. Player accounts, age of majority
Today players do not have their own accounts. When player accounts are introduced: a player must be at least [13] years old; an active guardian approves the account and provides the player's own email; the player proves that address; and the player sees their own record read-only. A minor's account is never asked to accept these terms; the guardian's approval covers it. A guardian can suspend or revoke the account at any time.
When player accounts are introduced, on the day a player reaches the age of majority (18 in Ontario; 19 where the player's province says so) the player becomes the person accountable for their own record: guardians' access pauses until the player allows it, and the player can accept these terms, change their email, file their own requests and end guardian access. Today players have no accounts. If a player reaches the age of majority during a season, the association and Athlete Atlas pause guardian access on that day and ask the player whether it should continue.
7. Who can see what
Who sees each part of the record:
| Part of the record | Family | Coaching staff | Association administrator (December release) | Athlete Atlas |
|---|---|---|---|---|
| Player record, scores, feedback, goals | Own child | Own team | Counts and dates only, not content | Support staff, only to resolve your request or a security problem; opening one child's record is logged |
| Private staff notes (when available) | Not in the app (can ask, section 14) | Own team | Not in the app | Only to answer a request under section 14 or a security incident |
| Who evaluated, and when | Own child | Own team | All teams | Support staff, as above |
| Account details | Own | Names, roles and email addresses of the coaches on their team; the head coach also sees the name and email of a parent who asks to be linked to a child | Names and roles | Support staff, only to resolve a request or a security problem |
An association administrator (a role that arrives with the December release) sees whether teams are evaluating and how often, not what was written about a child. The coach's placement recommendation is a staff-only field: coaching staff see it, families do not see it in the app but can ask for it with a copy of the record (section 14). An Athlete Atlas support person can open a child's record only to resolve a request from you or the association, or to deal with a security incident; when they open one child's record in the app, the read is logged (who, which child, when) and we give the association that log on request; whole-database exports are logged as events. Support staff's lists (all players, a team's roster, all evaluations and guardian requests) are not yet logged. If a player is archived (for example, leaves the team), the family no longer sees the record in the app but can still ask for a copy or deletion; the association's staff and Athlete Atlas can still see it until it is deleted.
8. Who else receives it
Service providers. We use Google Cloud (Firebase) for hosting, database and logs; a transactional email provider for notifications once email is switched on [Postmark or Resend, to be named]; the company that hosts our mailbox, info@athleteatlas.com, which holds the messages you send us [owner to name it: memo U9]; and Google Fonts on the public website, which means your IP address and browser type reach Google when you visit athleteatlas.io (not the app). Each provider that handles account or player information is bound by contract to use it only to provide its service to us and is listed in the Data Processing Addendum your association signs; Google Fonts holds no account information and is governed by Google's privacy policy. We will name any new provider here before it receives personal information.
Your association. The people the association authorises (coaches, administrators) see what section 7 describes. When a player moves teams within the association, the record moves with them. Sharing a record with another association, a private trainer or an evaluation centre is a future feature, happens only when a guardian or an adult player chooses it, and will be described here before it is available.
No one else, unless the law requires it (a court order, a lawful demand, or to protect a child's safety), or if Athlete Atlas is sold or merged, in which case the information stays under this policy and we tell you first.
9. Where the information is stored
Athlete Atlas runs on Google Cloud. The application runs in the United States (Iowa) and the database is in Google's United States multi-region. This means your information and your child's information are stored and processed outside Canada and may be subject to the laws of the United States, including lawful access by its authorities. We chose Google Cloud for its security; we apply the same safeguards wherever the information is; and we will tell you here if the location changes. Athlete Atlas does not store information in Canada today. If your association requires Canadian storage, tell us before you join.
10. How long we keep it
How long each kind of information is kept. These are the periods we apply; today deletion and anonymisation are done by hand when a request comes in or at season end, and automatic deletion arrives with the December release:
| Information | Kept until |
|---|---|
| Player records, evaluations, goals | The association's instruction, or a deletion request it approves. Your association's retention schedule governs; ask it or us for the period that applies. The coach who wrote an evaluation, or Athlete Atlas on the association's instruction, may delete it |
| Accounts | Your request: the account is deactivated at once, then anonymised (your name and email removed; evaluations you wrote stay as the association's record, labelled by role) |
| Consent records | The life of the account, then 24 months |
| Audit log | 24 months |
| In-app notifications | 180 days |
| Email delivery log | 90 days |
| Server logs | [30 days; owner to confirm the log retention setting] |
| Backup copies (from when backups are enabled) | Information deleted from the service stays in our backups for up to 30 days. Once no backup holds it, Google erases it from its systems within a further 180 days at most. Backups are used only to recover from an incident. Copies kept as evidence of a security incident are deleted when the incident is closed, unless the law requires us to keep them longer. |
| Wait-list | Until you ask, or 24 months after the pilot closes |
11. How we protect it
Encryption in transit (TLS) and at rest; role-based access so that each person sees only what section 7 allows, enforced on every request by the server; sign-in sessions that expire; rate limits on sign-in and registration; secrets held in a managed vault, not in code; staff access to production limited to named people, with each single child's record a support person opens in the app logged; and a written plan for security incidents. We do not currently offer multi-factor sign-in and have not undergone an external security certification; we say so rather than imply otherwise. No system is perfectly secure; if we ever believe your information has been exposed in a way that creates a real risk of significant harm, we will tell your association within 48 hours of confirming it, and you and the Privacy Commissioner will be told, by us or by your association as our agreement with it provides, as soon as feasible and in any case within 72 hours of confirming it, with what happened and what to do. Our written plan for security incidents sets out how.
12. Email and messages
We send transactional messages (your child's evaluation is published, a guardian was added, a password reset, a change to this policy). They are part of the service; once email is switched on you will be able to turn off the optional ones in your account (December release). We send marketing messages only to people who asked (the wait-list) and every such message has an unsubscribe link, and we act on it within 10 business days, as Canada's anti-spam law requires. Until our email provider is in place, the service sends no email at all and your coach tells you in the team chat when something changes.
13. Automated tools and AI
Athlete Atlas does not use artificial intelligence today. If we introduce an AI tool that helps a coach draft feedback, it will work only where the association has turned it on, a coach will approve every word before a family sees it, the tool will not be given a child's name, other children's information or staff notes, the provider will be bound by contract not to train on what it receives and to delete it promptly [owner: the period in the contract], and families will be told 14 days before first use and can decline for their child. Any such tool will be described in this policy before it is available.
14. Your rights
- Access. Ask for a copy of the personal information we hold about you or your child. We provide it within 30 days, in a readable file. The copy includes everything held about your child, including the coach's placement recommendation, unless the association decides that the law allows part of it to be withheld; it then tells you in writing what was withheld, why, and how to complain. Staff-only notes, when available, are handled the same way: ask for them, and the association will answer as the law requires.
- Correction. Ask us to correct a fact (a name, a date of birth). Evaluation scores and feedback are the coach's professional opinion; you can ask for your disagreement to be recorded with them.
- Deletion. Ask for your account to be deleted at any time. Ask for a child's record to be deleted; the association decides, and we tell you the outcome.
- Withdraw consent. Remove your guardian link, decline a future AI feature for your child, or leave the wait-list, at any time.
- Complain. Write to our privacy officer first; we answer within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3, 1-800-282-1376, priv.gc.ca.
Today these requests are made by email to mattmayer@hotmail.com; a request page inside your account is coming in the December release.
15. Changes
When we change this policy in a way that affects you, we post the new version here with its date, show you what changed in the app (and tell you by email once we send email), and ask you to accept it again before you continue. The version you accepted is recorded with your account.
16. Contact
[Legal entity name] · [postal address] · mattmayer@hotmail.com · Privacy officer: [name]