Privacy Policy

Last updated: June 2026

Sope Creek MTB ("we", "us", "our") operates the Sope Creek MTB Dashboard (the "Platform"). This policy explains what information we collect, how we use it, and your rights regarding that information.

1. Information We Collect

• Account information: Name, email address, username, team, and ride group.
• Medical information: Allergies, conditions, and medications voluntarily provided to help coaches respond appropriately during practices. This information is optional.
• Emergency contact information: Name and phone number of a parent or guardian, provided for safety purposes.
• Phone number: Collected only if you opt in to receive text message notifications about practice schedule changes.
• Attendance records: Check-in and check-out times for practice days you attend.
• Profile picture: Optionally uploaded by you, or imported from your Google account if you sign in with Google.
• Location data: If you grant location permission, your approximate GPS coordinates are sent to OpenWeatherMap to retrieve local weather conditions. Location is not stored on our servers.

2. How We Use Your Information

• To provide access to the Sope Creek MTB platform and track attendance at practices.
• To allow coaches to contact you or your emergency contact in case of injury or emergency.
• To send practice schedule updates if you opt in to text or email notifications.
• To import and maintain team rosters from spreadsheets managed by team directors.

3. Who Can See Your Information

• Coaches (Role 2+): Can view your name, team, ride group, check-in history, and medical information during practices.
• Checkin Managers (Role 3+): Can view and manage check-in records.
• Team Directors (Role 4+): Can view full roster and manage suspensions.
• Admins (Role 5): Have full access to all platform data.
• Other athletes: Cannot see your information.

4. Third-Party Services

• Google (OAuth): If you sign in with Google, we receive your email address, name, and profile picture from Google. We do not receive your Google password.
• Google Sheets: Athlete roster data may be exported to a team-managed Google Sheet for administrative purposes.
• Slack: Practice notifications and attendance summaries may be sent to a team Slack workspace. No medical or sensitive personal data is included in Slack messages.
• OpenWeatherMap: Your location (if granted) is sent to OpenWeatherMap to retrieve local weather forecasts for practice days. See their privacy policy at openweathermap.org.

5. Data Retention

• Check-in and attendance records are retained for three years, then deleted.
• Inactive accounts (no activity for one year) may be flagged for deletion with notice.
• Medical information is deleted immediately upon account deletion.
• Expired password reset tokens are cleared weekly.

6. Your Rights

• Access: You can view your account information at any time through your account settings.
• Correction: You can update your account information through your account settings.
• Deletion: You can request account deletion through the "Request Account Deletion" option in your account settings. Sensitive information (medical, emergency contact, phone) is cleared immediately; your account will be fully deleted within 30 days.
• Data for minors: A parent or guardian may contact us to request access to, correction of, or deletion of their child's data.

7. Security

Passwords are stored using bcrypt hashing and are never stored in plaintext. Session cookies use secure, HttpOnly, and SameSite=Strict flags. All access to sensitive data requires authentication and appropriate role-level authorization.

8. Contact

For questions about this privacy policy or to make a data request, contact the Sope Creek MTB team at: info@sopecreekmtb.org

← Back to Login