Privacy Policy

Give it a Try, LLC, a Maryland limited liability company that operates the pathways.id platform and the Pathways iOS app ("Pathways", "we", "us"), provides rugby player evaluation and development tools. This policy explains how we collect, use, and protect information when you use our platform.

PathwaysPlay (pathwaysplay.com), our tournament and registration product, has its own Privacy Notice at pathwaysplay.com/privacy.

Information organizations enter:

• Organization data: organization name, type, age groups, game format preferences, team structures.
• Player data: names, dates of birth, gender (optional), positions, email addresses, profile photos, jersey numbers, home club, union membership number, physical measurements and test results entered by coaches, and development goals.
• Guardian and family contact data: names, email addresses and phone numbers, used for consent records and for the family communications an organization chooses to send.
• Documents an organization uploads to a player's record, which can include medical, consent, academic and transfer documents. An administrator can share one through a link that expires within 30 days.
• Evaluation data: pillar scores, sub-attribute scores, coach notes, evaluation dates.
• Event and match data: event names, dates, squads, match results, lineup assignments, and substitution records, which can include an injury-related reason (injury, blood bin, head injury assessment).
• Training data: session plans, drill selections, block configurations, and attendance (for each training session, whether a player trained, was away or was limited, as the coach recorded it).
• Play data: play definitions, movement paths, phase sequences.

Information we collect directly:

• Account information: name, email address, password (hashed, never stored in plain text).
• Player self-evaluations: when a coach sends a self-evaluation link, the player submits their own scores through it. We do not send self-evaluation links to players aged 13 or under.
• My Pathway (adult players only): when a coach publishes an evaluation to a player, the player can open it from a revocable link and may add a short reflection, propose a goal, request an evaluation, or leave a note for the coach. Coaches can read what a player writes there.
• Terms acceptance records: when you accept our Terms of Service, the version accepted, the time, and the network address and browser you accepted from.
• Mobile app and device data: if you install the Pathways iOS app and turn on notifications, we store a push notification token for your device. We do not collect device location.
• Billing data: organization subscriptions are processed by Stripe. We do not store card numbers.
• Integrity data: cryptographic hashes, chain links and sealed timestamps derived from evaluation data to maintain tamper-evident records.
• A bot check at sign-up (Cloudflare Turnstile): a challenge token and the signals Cloudflare uses to tell a person from a bot.

We use collected information to:

• Provide and maintain the Pathways platform
• Authenticate your identity and manage your session
• Display evaluations, player profiles, and development data within your organization
• Generate Pathways Ratings and development insights
• Send notifications about activity within your organization
• Compute cryptographic integrity hashes to create tamper-evident evaluation records
• Generate development reports from a player's evaluation history with an AI model (Anthropic) when a coach requests one, and draft a coach's message to a player on My Pathway for the coach to edit

We do not sell your data to third parties. We do not use your data for advertising. We do not share player evaluation data between organizations without explicit consent.

Sharing of evaluations between organizations is switched off. Coach notes and AI-generated insights are never shared across organizations.

Your data is stored in a PostgreSQL database hosted by Supabase on AWS infrastructure in the US East (Virginia) region. Player profile photos and the documents organizations upload are stored in Supabase Storage.

We use these service providers, each of which processes data only to provide its service to us: Vercel (hosting, and page views and feature use on the website measured without cookies), Supabase on AWS (database and file storage, US East), Resend (email), Stripe (subscription billing, and card data never touches our servers), Sentry (error monitoring, with a replay of the screen activity that led to an error, text masked and images blocked), Upstash (abuse protection, counters held for at most an hour), Cloudflare (the sign-up bot check), Anthropic (AI reports and drafts from evaluation data, when requested), Expo and Apple (push notifications), and Spline (the animated scene on our home page, served from their servers).

We protect your data with:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encrypted storage at rest (AES-256)
• Session-based authentication with secure, httpOnly cookies
• Organization-scoped access controls: an organization sees its own roster and records. A player who is on two organizations' rosters has one profile record that both organizations can see and edit. Evaluations are not shared between organizations.
• Rate limiting on authentication endpoints
• SHA-256 cryptographic integrity chain on all submitted evaluations
• An automated security audit runs before every commit and before every production deploy, and either is blocked on a failure.

Pathways sets cookies to sign you in and keep you signed in, to remember which organization and team you are working in and how you like your schedule shown, and, for an adult player who has opened their My Pathway link, to remember that the link was verified on that device. We do not use advertising, tracking or analytics cookies. On the website we also measure page views and which features get used, without cookies and without recording who you are.

• __Secure-better-auth.session_token: keeps you signed in (httpOnly, secure)
• pathways-active-org: remembers which organization you are working in
• pathways-active-team: remembers which team you are working in
• pathways-schedule-view: remembers which schedule view you last picked (month, agenda or list)
• pd_ok: for an adult player, remembers that this device passed the date-of-birth check on their My Pathway link, for 180 days and only on that link
• pathways-impersonate-org: used only when our support staff open an organization's account to help it, and expires within four hours

We retain your data for as long as your account is active. Player data is retained as long as at least one organization has an active roster entry for that player. Archived players, and players an organization deletes from its roster, remain in the database, hidden from active views, until the organization asks us to delete them.

Submitted evaluations are part of a cryptographic integrity chain and are retained. Scores are not altered after submission. An adult player can add a reflection to an evaluation a coach has published to them on My Pathway. A deletion request for a player's data is carried out through an administrative process that removes that player's records. Each player's chain is independent, so deleting one player's records does not affect another's.

If you wish to delete your account and all associated data, contact us at privacy@pathways.id.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Object to processing of your data

Submitted pillar scores are not altered after submission, as they are part of a cryptographic integrity chain. A deletion request is handled as described in section 6. For minors, parents retain the right to contact us regarding their child's data.

To exercise any of these rights, email privacy@pathways.id. We will respond within 30 days.

The majority of Pathways users are youth athletes. We take the protection of children's data seriously.

• Most players on Pathways are under 18. Organizations enter their players' data and hold the relationship with families. Organizations are responsible for obtaining a parent's or guardian's consent, and for giving the notices the law requires, before entering a minor's data, and confirm that they have done so each time they add a player.
• We collect directly from a minor only through the self-evaluation link a coach sends. We do not send self-evaluation links to players aged 13 or under.
• My Pathway, where a player can see evaluations a coach publishes to them, is available to adult players only.
• Sharing of a player's evaluations between organizations is switched off.
• Parents and guardians can contact privacy@pathways.id at any time to access, review or manage their child's data. A deletion request for a child's data is carried out through an administrative process that removes the child's records.

We may update this policy from time to time. Material changes will be communicated via the platform or by email. Continued use of Pathways after changes constitutes acceptance of the updated policy.

For privacy-related questions or requests, contact us at: privacy@pathways.id

Give it a Try, LLC