Privacy Policy

GameFlow is operated by GameFlow LLC, a Hawaii limited liability company (“GameFlow”, “we”, “us”). We are the data controller for the personal data described in this policy.

Mailing address: 643 Ilalo St, Suite 1000, Honolulu, HI 96813. Privacy contact: privacy@gameflow.lol. This policy applies to the GameFlow website, web app, and iOS app (together, the “Service”).

Account data.When you create an account we collect your email address, a display name, a password (stored only as a salted hash by our authentication provider), your age attestation (18+, or 13–17 with a parent or guardian’s permission), and the time you accepted our Terms.

Team and roster data entered by coaches, league staff, and parents. This is the core of the Service and it includes information about other people, including children: player names, jersey numbers, positions, graduation year, dates of birth (when a guardian or coach chooses to enter one), guardian relationships, team and league affiliations, and game statistics (points, fouls, minutes, and similar per-game and season totals). Game statistics are derived from an append-only event log recorded by the scorekeeper during a game.

Purchases. If you subscribe, payment is handled by Stripe (web) or Apple (iOS in-app purchase). We receive subscription status, plan, dates, and a customer or transaction identifier. We never receive or store your full card number.

Device and usage data. Server logs (IP address, browser or device type, request timestamps, and the pages or endpoints you use), crash reports, and the audit trail of actions taken on rosters, games, and accounts. We do not currently run third-party advertising or analytics trackers.

Communications. Messages you send us, feedback you submit in the app, and notification preferences.

• To provide the Service: authenticate you, run and display games, compute statistics, manage rosters, teams, leagues, and tournaments.
• To send transactional email (verification codes, invitations, guardianship notices, receipts). We do not send marketing email to minors.
• To bill subscriptions and detect fraud or abuse (rate limits, duplicate-account checks).
• To power optional AI features described in section 6, always with a human confirming before anything is published.
• To keep the Service secure, debug problems, and maintain an audit trail as required for youth-athlete data.
• To comply with law and enforce our Terms.

We do not sell personal data, and we do not use children’s data for advertising or profiling of any kind.

Accounts are for adults and supervised teens only.GameFlow accounts may be created by people who are 18 or older, or who are 13 to 17 and have their parent or guardian’s permission. We do not knowingly allow anyone under 13 to create a login, and sign-up requires an age attestation. If we learn that a child under 13 has created an account, we will delete it.

Child athletes are data, not users.A child’s athlete profile (name, jersey number, position, date of birth, and game statistics) is entered and controlled by a verified adult — a parent or guardian, or a coach or league staff member acting for their organization. The child does not log in. A date of birth is visible only to the athlete’s guardians and platform administrators; it is never shown to spectators, other parents, or the media role, and every read of it is logged.

Public visibility is limited by default.Public game pages and box scores show a player’s name and jersey number only when the organization has chosen a public visibility setting. Guardians can ask a coach or organization administrator to restrict their child’s profile at any time.

Parents and guardians can review and delete. A parent or guardian may review the information we hold about their child, correct it, ask us to stop using it, or have it deleted by emailing privacy@gameflow.lolfrom the email on their GameFlow account. We will verify that you are the child’s guardian before acting, and respond within 30 days. Deleting a child’s profile removes their name and identifying details; past game events are retained in anonymized form so team and league scores stay accurate.

Schools.If a school or district provides rosters to GameFlow, we act on the school’s instructions for that data and do not use it for any other purpose.

We share personal data only with providers that help us run the Service, under contracts that limit their use of it:

• Supabase— database, authentication, file storage, and serverless functions. Data is stored in the United States.
• Vercel— hosting and delivery of the website and web app.
• Stripe— payment processing and subscription billing for web purchases.
• Apple— App Store distribution, TestFlight, and in-app purchases on iOS.
• Resend— transactional email delivery (verification codes, invitations, notifications).
• Anthropic— the AI model provider behind optional features described in section 6.

We may also disclose data when required by law, to protect the safety of a child or any person, or as part of a merger or acquisition (in which case this policy continues to apply to the data transferred). We do not share personal data with advertisers or data brokers.

Some features use large language models provided by Anthropic: post-game summaries, the coach assistant, and the league composer that helps organizers set up schedules and brackets. When you use these features, the game, roster, and league text they need (for example team names, player names and jersey numbers, scores, and play-by-play events, and the messages you type) is sent to Anthropic’s API to generate a response.

• A human always confirms before anything AI-generated is published or saved. AI cannot change official scores, statistics, rosters, or records on its own.
• AI output can be wrong. Treat summaries and suggestions as drafts and check them against the official record.
• We do not send dates of birth or contact details to the AI provider, and we do not use your data to train AI models.
• AI features are optional. If you never use them, none of your data is sent to Anthropic.

The game record is append-only. GameFlow stores every scoring action as an event in an audit log that is never edited or deleted, so official results can always be reconstructed. Because of this design, deleting an account does not erase historical game events; instead it anonymizes them.

Account deletion. When you delete your account (or ask us to), we remove your email, name, avatar, notification settings, and other personal details, cancel any active subscription, and replace your identity in the event and audit logs with an anonymous placeholder. Athlete profiles that you control as a guardian are anonymized the same way unless another active guardian holds them. Backups are overwritten within 30 days.

How to request it. Email privacy@gameflow.lolfrom the address on your account with the subject “Delete my account” (or “Delete my child’s profile”). We will confirm your identity and complete the request within 30 days. Records we must keep for tax, fraud-prevention, or legal reasons (for example Stripe transaction records) are retained only as long as the law requires.

Inactive accounts. We may delete accounts that have been inactive for more than 24 months after notifying the email on file.

Every database table is protected by row-level security so that users can only reach data their role allows. Data is encrypted in transit (TLS) and at rest by our providers. Sensitive fields such as dates of birth are stored separately with the narrowest access rules in the system, and every read of them is recorded. Staff access to production data is limited to the founders and is itself audited. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and, where required, regulators without undue delay.

Wherever you live, you can ask us to access the personal data we hold about you or your child, receive an export of it in a portable format, correct it, delete it, or restrict how we use it. Residents of California, the EU/UK, and other jurisdictions with privacy laws also have the right to know what we collect and to not be discriminated against for exercising these rights.

To exercise any of these rights, email privacy@gameflow.lol. We answer every request within 30 days. We will never require you to pay a fee for a reasonable request. If you are not satisfied with our response you may contact your local data-protection authority.

GameFlow is operated from the United States and our providers store data there. If you use the Service from outside the U.S., you understand that your data is transferred to and processed in the U.S., which may not provide the same level of data protection as your home jurisdiction.

We may update this policy as the Service evolves. If the changes are material — especially any change to how we handle children’s data — we will email account holders and show a notice in the app before the change takes effect. The “Effective” date at the top of this page tells you when it was last revised.

GameFlow LLC
643 Ilalo St, Suite 1000, Honolulu, HI 96813
privacy@gameflow.lol

Effective August 25, 2026.