Privacy Policy

Last updated: October 22, 2026

This Privacy Policy explains how Mitchell Martins-Collum, a sole proprietor doing business as "TeamDryland" ("TeamDryland", "we", "us", "our"), located in Connecticut, United States, collects, uses, and protects information when you use the TeamDryland website, apps, and off-ice hockey training program (together, the "Service"). It works alongside our Terms of Service.

1. Information we collect

• Account & profile: name, email, player position (forward/defense/goalie), graduation/class year.
• Sign-in details: email + password via Supabase Auth, or Sign in with Apple. Sign in with Apple may give us an Apple-anonymized relay email instead of your real address; we use it only to identify your account.
• Training data: which workouts you completed and when, baseline and retest results, any optional notes or scores you enter.
• Payment metadata: for a purchase on teamdryland.com, limited billing info from Stripe (that a charge succeeded, card last-4, purchase date). For an In-App Purchase, the Apple transaction identifiers, the pass purchased, and the purchase date. Never your full card number. (See Payments.)
• Push token: if you enable notifications on the iOS app, a device push token (see Push notifications).
• Session data: standard session tokens to keep you logged in.
• Product interaction (app usage): records of which parts of the app are used — for example that a screen was opened, which signup path was chosen, which step a signup stopped at, that a workout was started or finished, or that an offer was shown or dismissed. Each record carries an app-generated device identifier, the app version, and the platform. Once you're signed in, these records are also associated with your account. They never include anything you type: no names, email addresses, passwords, team names, invite codes, or scores.

We do not collect your location, contacts, photos, camera, microphone, or any health or biometric data. We don't use advertising identifiers, and we don't use third-party analytics or ad SDKs — the usage records described above are first-party: they're written to our own database, no outside analytics company receives them, and they are never combined with data from other companies or used to build a marketing profile.

2. How we use your information

We use the information above to:

• create and secure your account;
• deliver the training program and show your progress;
• show coaches team-wide progress on a Team plan;
• grant access after a purchase and handle refunds;
• understand which parts of the app people actually use, so we can fix the ones that don't work — for example seeing where signups stop, or whether athletes get started on the program after paying;
• send training reminders and notifications if you opt in;
• respond to your support requests;
• keep the Service working and secure.

We do not use your information for advertising or profiling.

3. Our legal basis

We process data to perform our contract with you (running the program you signed up for), with your consent (for example, push notifications), and for our legitimate interests in keeping the Service secure and functional. For minors, processing relies on the consent of the supervising parent, guardian, or coach (see Children's privacy).

4. Children's privacy

We comply with the Children's Online Privacy Protection Act (COPPA) and collect personal information from children under 13 only with the involvement and consent of a parent, guardian, or authorized adult. For any athlete under 13, the coach, parent, or guardian who sets up access confirms that they are authorized to consent to the collection of that child's information for training, and — where the person enrolling the child is not the child's parent — that they have obtained the parent's or guardian's consent. We rely on that confirmation as the basis for collecting the limited training information described below.

• Players on a roster may be under 18, and some may be under 13. A minor gets access only through a coach-issued or purchase-linked invite code/link, which means an adult (coach or parent/guardian) has set up and consented to that access on the child's behalf.
• What we collect about a young player is limited to the account/profile, training, and app-usage data described above — no location, no photos, no contacts, no ads, no advertising identifiers, and no tracking across other apps or websites. The usage records contain no free text and nothing the player types.
• A parent, guardian, or coach can review, correct, or delete a minor's information at any time by emailing [email protected], and we'll honor deletion requests as described under Data retention & deletion.
• If we learn we've collected a child's information without the required adult involvement, we'll delete it.

5. Payments

How your payment is processed depends on where you buy.

• On teamdryland.com — payment is processed by Stripe. We never receive or store your full card number; Stripe handles card data under its own security standards. We receive only limited billing metadata (that a charge succeeded, card last-4, purchase date) to grant access and process refunds.
• In the iOS app — passes are sold as Apple In-App Purchases, and payment is processed by Apple. We never see your card details or your Apple Account payment information. Apple sends us a signed receipt, from which we store the Apple transaction identifiers, which pass was bought, and the purchase date — enough to unlock your access and to know if Apple later refunds it.

See our Refund Policy and Terms, Stripe's privacy policy, and Apple's privacy policy.

6. Push notifications

If you turn on notifications in the iOS app, we register a device push token (an Expo push token / Apple APNs token) and store it to send training reminders and program notifications. The app may request provisional notification authorization. We use the token only to deliver TeamDryland notifications — never for advertising. To opt out, turn off notifications for TeamDryland in your device Settings at any time; you can also ask us to remove your stored token by emailing [email protected].

7. Who we share data with

We don't sell your data (see next section); we share it only with a small set of trusted service providers that help us run the Service:

• Supabase — database, authentication, and hosting of your data (US). — https://supabase.com/privacy
• Stripe — payment processing. — https://stripe.com/privacy
• Apple — app distribution, In-App Purchase processing for purchases made in the iOS app, Sign in with Apple, and push delivery via APNs. — https://www.apple.com/legal/privacy/
• Expo — push-notification token infrastructure. — https://expo.dev/privacy
• Cloudflare — hosting for our marketing website (teamdryland.com) via Cloudflare Pages. — https://www.cloudflare.com/privacypolicy/

We may also disclose information if required by law or to protect the safety and rights of users.

8. We do not sell or share your information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We have not sold or shared personal information (including any minor's information) in the preceding 12 months, and we never will. Sharing with the service providers listed above is only so they can perform services for us — that is not "selling."

9. How we protect your data

Your data is encrypted in transit using TLS/HTTPS. Our database uses Supabase row-level security (RLS) so accounts can only reach data they're permitted to see (a player sees their own logs; a coach sees their own roster). Passwords are handled by Supabase Auth and are never stored in plain text. Honestly, no method of transmission or storage is 100% secure, but we work to protect your information and limit access to what's necessary.

10. Data retention & deletion

We keep your information for as long as your account is active and you use the Service. You, a coach, or a parent/guardian can request deletion at any time by emailing [email protected], and we'll delete the associated personal data within about 30 days, except anything we're required to keep for legal, accounting, or fraud-prevention reasons. We retain each category of information only as long as needed for the purposes described above or as required by law; for example, records that a payment occurred may be kept for up to 7 years for tax and accounting. Deleting an account removes the training data associated with it. We do not use or disclose sensitive personal information (including information about children) beyond the business purposes described in this policy.

11. Your privacy rights

Whatever your location, you can email [email protected] to access, correct, or delete your information, or ask a question.

California (CCPA/CPRA): you have the rights to know, delete, and correct; the right not to be discriminated against for exercising them; and — as stated above — we do not sell or share your personal information. Exercise any of these by emailing us.

Connecticut & other US state residents: depending on your state, you may have rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, sale, or profiling (we do none of these). To exercise them, email us. If we deny your request, you may appeal by replying to our decision; if we deny the appeal, Connecticut residents may contact the Connecticut Attorney General.

EU / UK (GDPR): if you're in the EEA or UK, you also have rights to access, rectify, erase, restrict, or port your data and to object to certain processing; you may lodge a complaint with your local data-protection authority. We'll respond to verified requests.

We may need to verify your identity (or an adult's authority over a minor's account) before acting on a request.

12. Where your data is stored

Your data is stored in the United States on Supabase's infrastructure, and is processed by the service providers listed above. If you use the Service from outside the US, you understand your information is processed in the US, which may have different data-protection laws than your country.

13. Changes to this policy

We may update this policy as the Service evolves. When we make material changes, we'll update the "Last updated" date above and, where appropriate, notify users. Continuing to use the Service after changes take effect means you accept the updated policy.

14. Contact

Questions about your privacy or this policy, or want to access or delete your data? Email [email protected].

← Back to TeamDryland