Privacy Notice

This notice says what Dangle Labs collects, who can see it, how long we keep it, and how to ask us to delete it. It is written for the parent who got a text from a coach and is wondering what happens to video of their child.

The short version: we hold your email address and a few account details, your child's roster details, the team's game video, the notes coaches make on it, and service logs. Your coaching staff and your organization's administrators can see their teams. Every family on a team sees the team's games and its goals and assists; the rest of your child's numbers are for your family and the coaches. We don't sell personal data, we show no advertising, and we run no third-party tracking.

Who holds an account

Accounts belong to adults. We don't offer child accounts; invitations must go to a parent or guardian, and the service has no way to create an account for a child. That is deliberate, and it is why we never ask a child for anything directly.

What we collect

• About you: the email address a coach or administrator entered to invite you, a hashed copy of your password if you set one, the time you last signed in, and your email preferences. Nothing else about you unless you tell us.
• Your child's details as the coach entered them: first and last name, jersey number, position, birth year, which team and season, and whether the child is on the roster.
• Game video of the team's games, and everything derived from it: detected player boxes, tracks, shift boundaries, scoreboard readings, clips and summaries. The video also shows players from other teams; we hold no names for them.
• Annotations coaches make: goals, assists, shots, shifts, notes about plays.
• When an organization starts, which of its administrators confirmed that it has its families' permission to film and to add players, and when.
• A copy of each email we send, with sign-in links removed, so we know whether it arrived.
• Service logs: which page or endpoint was called, when, by which account, whether it succeeded, and the internet address the request came from. Refusals are logged too, which is how we notice somebody probing for another family's data. We don't store your internet address with your account or use logs to profile anyone.

We do not collect payment details from parents at all. We do not ask for a phone number, a home address or a date of birth beyond the birth year a coach may enter for a roster.

Who can see what

Access follows the role your organization gave you, and it is enforced on our servers on every request, not by hiding links in a page.

• Every family on a team sees the team's games and film, and its goals and assists with the players' first names and numbers.
• A parent sees their own children's ice time, shifts and plus-minus. Those numbers for any other child are not shown to a parent.
• A coach sees the teams their organization named in the grant, and the players on those teams, including every player's ice time, shifts and plus-minus.
• An organization administrator sees that organization.
• Nobody sees another organization. Not its teams, not its rosters, not its film.
• Justin Lee, who runs the service, can reach the data in order to operate it: restore a backup, diagnose a failed upload, fix a wrong scoreboard reading. Changes the operator makes inside an organization through the service are logged.
• The service's own support staff can act as an administrator of any organization, to set it up or to help it: create its seasons and teams, correct a roster, invite its coaches and families. They are not the organization's staff and are not listed as such. Everything they change is logged under their own account, and the organization sees it marked as done by Dangle Labs admin.

Film is stored privately and served over links that are signed and short-lived, so a copied video address stops working.

How we use game video

Game video is used to run the service for the team that it belongs to. Game video, including the players from other teams who appear in it, may also be used to improve our analysis. It is not shared or sold.

Service providers, and where data is kept

We use a small number of service providers, for cloud hosting and content delivery, email delivery, and secure storage for our own development, who process data only to run the service for us, under confidentiality and security obligations. We don't sell personal data. Mail sent to the privacy address reaches the operator.

Data is stored in the United States. To play smoothly, video may be cached briefly at delivery locations in North America, Europe and Israel.

We use no advertising network, no analytics product and no data broker.

Cookies, and what your browser keeps

The service sets four cookies, all of them necessary for it to work at all, and no others:

• session, which keeps you signed in. It cannot be read by page scripts.
• magic_next, which remembers which page a sign-in link should land on. It lives fifteen minutes and holds a path on this site, never an address or a token.
• signin_request, which remembers for fifteen minutes that this browser asked for a sign-in code; it holds a random reference, never an address or the code.
• a theme cookie, which remembers whether you chose the dark or the light look.

Your browser also stores a few settings and unfinished work on your device, such as unsent coach marks or an upload that was interrupted. Those stay on the device and are never sent anywhere else.

There is no advertising cookie, no analytics cookie and no third-party cookie, which is why there is no cookie banner asking you to consent to any.

Emails we send

We email sign-in links, invitations, and notices that a game is ready or failed to process. The optional ones can be turned off on your account page. Sign-in links cannot be turned off, because they are how you get in. When a coach shares games with families, that email shows the coach's name and team, and a reply goes to the coach's own email address.

How long we keep things

• Game video and everything derived from it: until it is deleted. We will tell an organization before we would ever purge its film.
• Account records, rosters, annotations and invitations: while the organization is using the service, and until somebody asks us to delete them.
• Service logs, including internet addresses: for a limited time, for security and troubleshooting, after which they are deleted automatically.
• The copies of emails we sent: while the organization is using the service.
• The record that you accepted these documents: kept for as long as the account exists and for six years after it closes. It is the evidence of what you agreed to and when, so it is not removed by a deletion request; it holds your account, the version you accepted and the time, and no other personal detail.
• Removed data ages out of backups within 30 days.

The full rule, including what somebody does when a request arrives, is written down in the service's own operating documentation. Ask us for it and we will send it.

Deleting your account, or your child's record

You can delete your own parent account from your account page. That deletes your email address, your password, your sign-in sessions and links, your email preferences and your access to your child's film, and it removes your address and the text from the copies of emails we sent you. What stays is what the record of the service needs, with nothing left that identifies you: the record that an account accepted these documents, and the log of what was allowed and refused, which holds only internal numbers. A staff account is deleted by writing to us, so that a team is not left without its coach or administrator.

A parent may also ask us to make their child's record anonymous. Write to privacy@danglelabs.com from the address your invitation went to, and say which child. We will answer within 30 days. The child's name and birth year are removed and the record becomes an anonymous player known only by jersey number, for example Player #87, in every roster and every game's statistics. The name is also removed from coaches' notes and from our copies of the invitation emails about that child, and family access to that record ends. The game video is kept: anyone may film at a rink, and the film belongs to the organization whose games it shows.

An organization administrator may ask us to delete the organization, which deletes its film, rosters, annotations and invitations.

You may also write to the same address to ask what we hold about you.

Children

The service is about children, and it is built so that no child uses it. We don't offer child accounts, players under 13 never have one, we ask children for nothing, and the adult who holds the account decides what a child sees. If you believe a child has somehow been given an account, write to privacy@danglelabs.com and we will remove it.

How it is protected

Passwords are stored as bcrypt hashes and never in readable form. Sign-in links are stored only as a hash, work once, and expire. Every request re-reads what the account is allowed to see, so removing somebody's access takes effect on their next click rather than when a session happens to end. Video lives in private storage behind signed links. Refusals are logged and reviewed.

No service is perfectly safe. If we ever discover that your data was taken, we will tell you what happened, what was taken and what to do about it.

Changes to this notice

Every version of this page is kept, numbered and dated, and the version you accepted is recorded against your account. A new version is shown to you the next time you sign in, and the version you accepted stays readable.

Contact

privacy@danglelabs.com