Privacy Policy

Last updated: August 18, 2026

This Privacy Policy explains how Mitchell Martins-Collum, a sole proprietor doing business as "TeamDryland" ("TeamDryland", "we", "us", "our"), located in Connecticut, United States, collects, uses, and protects information when you use the TeamDryland website, apps, and off-ice hockey training program (together, the "Service"). It works alongside our Terms of Service.

1. Information we collect

• Account & profile: name, email, player position (forward/defense/goalie), graduation/class year.
• Sign-in details: email + password via Supabase Auth, or Sign in with Apple. Sign in with Apple may give us an Apple-anonymized relay email instead of your real address; we use it only to identify your account.
• Training data: which workouts you completed and when, baseline and retest results, any optional notes or scores you enter.
• Payment metadata: limited billing info from Stripe (that a charge succeeded, card last-4, purchase date) — never your full card number. (See Payments.)
• Push token: if you enable notifications on the iOS app, a device push token (see Push notifications).
• Session data: standard session tokens to keep you logged in.

We do not collect your location, contacts, photos, camera, microphone, or any health or biometric data. We don't use advertising identifiers, and we don't use third-party analytics or ad SDKs.

2. How we use your information

We use the information above to:

• create and secure your account;
• deliver the training program and show your progress;
• show coaches team-wide progress on a Team plan;
• grant access after a purchase and handle refunds;
• send training reminders and notifications if you opt in;
• respond to your support requests;
• keep the Service working and secure.

We do not use your information for advertising or profiling.

3. Our legal basis

We process data to perform our contract with you (running the program you signed up for), with your consent (for example, push notifications), and for our legitimate interests in keeping the Service secure and functional. For minors, processing relies on the consent of the supervising parent, guardian, or coach (see Children's privacy).

4. Children's privacy

We comply with the Children's Online Privacy Protection Act (COPPA) and collect personal information from children under 13 only with the involvement and consent of a parent, guardian, or authorized adult. For any athlete under 13, the coach, parent, or guardian who sets up access confirms that they are authorized to consent to the collection of that child's information for training, and — where the person enrolling the child is not the child's parent — that they have obtained the parent's or guardian's consent. We rely on that confirmation as the basis for collecting the limited training information described below.

• Players on a roster may be under 18, and some may be under 13. A minor gets access only through a coach-issued or purchase-linked invite code/link, which means an adult (coach or parent/guardian) has set up and consented to that access on the child's behalf.
• What we collect about a young player is limited to the account/profile and training data described above — no location, no photos, no contacts, no ads, no cross-app tracking.
• A parent, guardian, or coach can review, correct, or delete a minor's information at any time by emailing [email protected], and we'll honor deletion requests as described under Data retention & deletion.
• If we learn we've collected a child's information without the required adult involvement, we'll delete it.

5. Payments

Payments are processed on the web by Stripe — not through Apple's in-app purchase system. We never receive or store your full card number; Stripe handles card data under its own security standards. We receive only limited billing metadata (that a charge succeeded, card last-4, purchase date) to grant access and process refunds. See our Refund Policy and Terms, and Stripe's privacy policy.

6. Push notifications

If you turn on notifications in the iOS app, we register a device push token (an Expo push token / Apple APNs token) and store it to send training reminders and program notifications. The app may request provisional notification authorization. We use the token only to deliver TeamDryland notifications — never for advertising. To opt out, turn off notifications for TeamDryland in your device Settings at any time; you can also ask us to remove your stored token by emailing [email protected].

7. Who we share data with

We don't sell your data (see next section); we share it only with a small set of trusted service providers that help us run the Service:

• Supabase — database, authentication, and hosting of your data (US). — https://supabase.com/privacy
• Stripe — payment processing. — https://stripe.com/privacy
• Apple — app distribution, Sign in with Apple, and push delivery via APNs. — https://www.apple.com/legal/privacy/
• Expo — push-notification token infrastructure. — https://expo.dev/privacy
• Cloudflare — hosting for our marketing website (teamdryland.com) via Cloudflare Pages. — https://www.cloudflare.com/privacypolicy/

We may also disclose information if required by law or to protect the safety and rights of users.

8. We do not sell or share your information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We have not sold or shared personal information (including any minor's information) in the preceding 12 months, and we never will. Sharing with the service providers listed above is only so they can perform services for us — that is not "selling."

9. How we protect your data

Your data is encrypted in transit using TLS/HTTPS. Our database uses Supabase row-level security (RLS) so accounts can only reach data they're permitted to see (a player sees their own logs; a coach sees their own roster). Passwords are handled by Supabase Auth and are never stored in plain text. Honestly, no method of transmission or storage is 100% secure, but we work to protect your information and limit access to what's necessary.

10. Data retention & deletion

We keep your information for as long as your account is active and you use the Service. You, a coach, or a parent/guardian can request deletion at any time by emailing [email protected], and we'll delete the associated personal data within about 30 days, except anything we're required to keep for legal, accounting, or fraud-prevention reasons. We retain each category of information only as long as needed for the purposes described above or as required by law; for example, records that a payment occurred may be kept for up to 7 years for tax and accounting. Deleting an account removes the training data associated with it. We do not use or disclose sensitive personal information (including information about children) beyond the business purposes described in this policy.

11. Your privacy rights

Whatever your location, you can email [email protected] to access, correct, or delete your information, or ask a question.

California (CCPA/CPRA): you have the rights to know, delete, and correct; the right not to be discriminated against for exercising them; and — as stated above — we do not sell or share your personal information. Exercise any of these by emailing us.

Connecticut & other US state residents: depending on your state, you may have rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, sale, or profiling (we do none of these). To exercise them, email us. If we deny your request, you may appeal by replying to our decision; if we deny the appeal, Connecticut residents may contact the Connecticut Attorney General.

EU / UK (GDPR): if you're in the EEA or UK, you also have rights to access, rectify, erase, restrict, or port your data and to object to certain processing; you may lodge a complaint with your local data-protection authority. We'll respond to verified requests.

We may need to verify your identity (or an adult's authority over a minor's account) before acting on a request.

12. Where your data is stored

Your data is stored in the United States on Supabase's infrastructure, and is processed by the service providers listed above. If you use the Service from outside the US, you understand your information is processed in the US, which may have different data-protection laws than your country.

13. Changes to this policy

We may update this policy as the Service evolves. When we make material changes, we'll update the "Last updated" date above and, where appropriate, notify users. Continuing to use the Service after changes take effect means you accept the updated policy.

14. Contact

Questions about your privacy or this policy, or want to access or delete your data? Email [email protected].

← Back to TeamDryland