Privacy Policy

1. Introduction

STAK Athletics LLC (“we,” “us,” or “our”) is a Virginia limited liability company that operates the Stonepile mobile application (the “App”). We help basketball players track development, review training video, and connect with teammates, parents, and coaches within safety controls appropriate to age.

This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and the choices available to you. By creating an account or using the App, you agree to the practices described here.

2. Who This Policy Covers

This Policy covers users of the App who are at least 13 years old, including teen players (13–17), adult players (18+), parents/guardians, and coaches, during the current invite-only TestFlight phase. We do not knowingly collect personal information from children under 13 in the generally available product, and the App blocks under-13 self-signup through an in-app age gate. Parents may create parent accounts and use Family linking with a teen player account; that linking is a product safety feature and is not the same as COPPA consent for children under 13. A separate children’s privacy addendum describes parent-created under-13 accounts used only in founder-controlled architecture tests. General under-13 onboarding is off.

3. Information We Collect

3.1 Account Information

Name, username, email address, password (stored using industry-standard hashing, never in plain text), and account role (player, coach, or parent).

3.2 Player Profile Information and Age Assurance

Team, position, and other profile details you choose to add. During onboarding, you self-declare an age band (for example, teen 13–15, teen 16–17, or adult 18+). We use that declaration to apply safety rules (such as audience limits for minors). We do not currently use Apple’s Declared Age Range API. We may also store optional age or date-of-birth fields you choose to provide on your profile.

3.3 Physical Development Metrics

A historical log of body measurements (e.g., height, wingspan, vertical leap) that you choose to record, including measurements derived from the height-estimation feature described in Section 6.

3.4 Photos and Video

Self-filmed training and gameplay video (including Mirror, Shot, and Film), award/milestone images (Recognition), and photographs taken for the height-estimation feature (photographed under a regulation rim to allow geometric height calculation). See Section 6 for retention and sharing rules specific to height-estimation photos.

3.5 Social and Communication Data

Connections and relationship links (including peer connections and parent Family linking), content shares, and comments, likes, and ratings on training content. Discovery and visibility are limited by product settings and age-based audience rules.

3.6 Usage and Device Data

Device type, operating system, app version, crash logs, and basic interaction data used to operate and troubleshoot the App.

3.7 Reflection and Development Data

Free-text reflections, mood/emotion selections, and self-ratings you record through the Mindset feature, along with other structured development data you enter yourself (skill challenges, game statistics, college-interest notes, and self-assessment entries). This content is private to your account — see Section 6.2.

3.8 Safety, Consent, and Moderation Records

Age-assurance acknowledgements, policy and AI-feature consents, reports you submit, blocks you create, and related moderation and safety audit records needed to operate report/block flows and protect users.

We do not knowingly collect information beyond what is described above or reasonably necessary to operate the features disclosed in this Policy.

4. How We Use Information

We use the information described in Section 3 to: operate core App features (player profiles, progress tracking, video review, height estimation, connections and shares within Stonepile); apply age-based safety and audience controls; maintain account and content security; respond to support requests; review reports and moderate content; comply with legal obligations; and improve the App using aggregated, de-identified usage patterns (see Section 9.4 for what “de-identified” means in this Policy).

Stonepile AI currently includes a rules-based portfolio gap coach that analyzes structured signals from your Stonepile portfolio (for example, which modules have content) to suggest next steps. That feature requires an in-app processing consent before use. Voice/speech features are off by default. We do not currently send your portfolio or media to a third-party large language model (LLM) coach. Future AI features that would use third-party AI providers will be disclosed here before they become active. See Section 7.3.

We do not sell personal information. We do not use player data, including physical development metrics or media, for third-party advertising.

5. Legal Framework

STAK Athletics LLC is a Virginia-based company, so the Virginia Consumer Data Protection Act (VCDPA) applies to our processing of Virginia residents’ data — including an opt-in consent requirement before processing “sensitive data,” which includes biometric data used to identify a person and may include the physical-metrics/height data described in Section 6. Depending on where a tester is located, other state consumer-privacy laws may also apply; Section 12 addresses this. The App is directed at users ages 13 and older. COPPA applies to children under 13. The generally available App does not offer under-13 signup. A children’s privacy addendum (v1.3-coppa-draft) is published for founder-controlled architecture tests; it is not a public under-13 offer (see Section 13).

6. Height-Estimation Photos and Physical Metrics

Because the height-estimation feature and physical-metrics log involve a photograph of your body — a more sensitive category than an ordinary profile field — this Policy addresses them separately from general “photos and video.”

6.1 What This Feature Does and What We Retain

The height-estimation feature calculates your height from a photograph taken under a regulation rim of known height, using geometry rather than facial-recognition or biometric-identification technology. We currently retains the source photograph, not only the calculated height, because our product principle is that physical-development metrics should be backed by visual evidence you can review to verify accuracy. This is a deliberate design choice with real privacy tradeoffs, described in Section 6.3, and we may revisit it as the product matures — for example, by offering a setting to discard the source photo once a measurement is verified.

6.2 Sharing Controls

Height-estimation photos, physical-metrics records, Mindset reflections, and related development modules (Body, Challenge, Stats, Recognition, Colleges, Path) are visible only to you. Unlike Library and Mirror (Section 8.1), none of this content is currently shareable with a coach, a connection, or any other user — there is no “approve a coach” or “grant broader access” mechanism for it today, regardless of account role. A future version may add optional sharing controls for some of these features, and we will update this Policy before any such capability is enabled.

6.3 Notices for Certain States

A minority of states (currently Illinois, Texas, and Washington) regulate “biometric identifiers” or “biometric information” under dedicated statutes, and Illinois law provides a private right of action for violations. Stonepile’s height-estimation feature is designed to use geometric calculation rather than biometric identification (e.g., it does not create a facial-recognition template), but because it processes an image of your body, we address it under these statutes as a precaution: we obtain your consent before collecting height-estimation photos (through account creation and use of the feature), maintains the retention and deletion schedule in Section 11, and does not sell or license biometric information.

6.4 Retention

Height-estimation photos and physical-metrics records are retained under the schedule in Section 11 while your account is active, and are deleted upon a verified deletion request per that schedule.

7. Photos, Video, and Other Uploaded Content (General)

7.1 How It’s Stored

Training video, height-estimation photos, and other uploaded media are stored in access-controlled, private cloud storage. Content is visible only according to the sharing settings you select, subject to the additional restriction in Section 6.2 for physical-metrics media and the audience rules in Section 8.1 for minors.

7.2 Content Moderation and Legal Reporting Obligations

We review reported content for policy violations and, where content appears to depict apparent child sexual abuse material, will preserve and report that content to the National Center for Missing & Exploited Children (NCMEC) as required by federal law (18 U.S.C. § 2258A), and will cooperate with law enforcement.

7.3 AI Processing, Product Improvement, and Marketing

As of the date of this Policy, we do not send uploaded media or portfolio content to any third-party AI / LLM service. The live Stonepile AI gap coach is rules-based and runs against structured portfolio signals inside our own systems after you grant in-app consent. We may later offer AI-assisted features that use third-party AI service providers (potentially including OpenAI and/or Anthropic). When any such feature becomes active, we will update this Policy to name the specific provider(s) involved and confirm the data-handling terms that apply. We intend for any such provider to operate under standard commercial API terms, under which the provider does not use the content you submit to train its own models — as distinct from a consumer-facing chat product, where that is not always guaranteed.

We do not use uploaded content for marketing or promotional purposes, and we do not permit a third party to use your content to train that third party’s own models for that third party’s own purposes, except with a separate, affirmative opt-in described at the time it’s offered.

8. Social Features and Communications

8.1 Connections, Shares, Comments, Ratings, and Likes

Users can connect with others, share Library and Mirror content according to sharing settings, and interact through comments, ratings, and likes. Minors and users without a confirmed adult age band cannot create public folders; audience defaults favor private or connection-based sharing. Open social discovery and unrelated coach-to-minor connection features may remain disabled by product flags during testing.

8.2 Reporting and Safety Tools

You can report a comment, media item, or user, and you can block another user, directly in the App. We review reports and may remove content, restrict features, or suspend an account consistent with the Terms of Service. Authorized moderators can review a moderation queue inside the App.

8.3 Parents and Coaches

A parent account may use Family linking to associate with a teen player account. That does not automatically grant access to private development modules listed in Section 6.2. A coach account does not grant extra visibility beyond what a player explicitly shares through Library/Mirror sharing and connection settings. Unrelated adult coach connections to minors are restricted by current product settings. Coaches have no access today to a player’s private development data (physical metrics, height-estimation photos, Mindset reflections, or the other features listed in Section 6.2), unless a future version introduces that capability — which we will describe here before it launches.

8.4 Runs and Marketplace

Runs presents a curated venue directory (static pins / venue information). It does not collect live user GPS location for youth social meetups in this build. Marketplace shows curated product links that open a merchant website in the browser; checkout happens outside Stonepile.

9. How We Share Information

9.1 We Do Not Sell Personal Information

We do not sell, rent, or trade personal information, and we do not use it for third-party advertising.

9.2 Service Providers (Subprocessors)

We share information with the following service providers, who act on our instructions under confidentiality and data-protection obligations, and who may not use the information for their own purposes:

9.3 Legal and Safety Disclosures

We may disclose information if required by law, subpoena, or valid legal process; to report apparent child exploitation as described in Section 7.2; or to protect the safety, rights, or property of STAK Athletics LLC, our users, or the public. Nothing in this Policy limits your ability to contact the FTC, a state Attorney General, a privacy regulator, or law enforcement directly.

9.4 Aggregated and De-Identified Data

Where we describe using “aggregate” or “de-identified” data, we mean information from which we have removed or altered identifiers such that it cannot reasonably be linked back to a specific person, device, or small identifiable group, using technical safeguards, and that we publicly commit not to attempt to re-identify. Pseudonymized data that could still be linked back to an individual with reasonably available means is not treated as “de-identified” under this Policy.

9.5 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of all or a portion of our assets, personal information may be transferred as part of that transaction, subject to this Policy or a policy at least as protective of your information. We will provide notice of any such change in ownership or control of your personal information as required by law.

10. Data Security

We use industry-standard safeguards, including access controls, encryption in transit and at rest for stored media, and role-based access limiting internal staff access to personal information to what their role requires. No method of transmission or storage is 100% secure. If we become aware of and confirm a breach affecting your information, we will notify affected users and, where required, regulators, without unreasonable delay and in no event later than 30 days after that confirmation, except where law enforcement requests a delay.

11. Data Retention and Deletion

We retain personal information only as long as reasonably necessary for the purpose it was collected, and then delete or genuinely de-identify it.

We may retain a narrow, access-restricted subset of information beyond these periods where necessary to comply with law, resolve a dispute, investigate fraud or abuse, or document consent and compliance — never as an open-ended “business purposes” exception.

12. Your Rights and Choices

12.1 All Users

You may request access to, correction of, or deletion of your personal information at any time by contacting admin@stonepile.com, or by using in-app account deletion (Profile → Privacy & Safety → Delete account).

12.2 Virginia Residents — VCDPA Rights

If you are a Virginia resident, you have the right to: confirm whether we process your personal data and access it; correct inaccuracies; request deletion; obtain a portable copy of data you provided; and opt out of the processing of your data for targeted advertising, the sale of personal data, or certain profiling. Because physical-development metrics may constitute “sensitive data” under the VCDPA, we obtain your opt-in consent before processing that data. If we deny a rights request, you may appeal the denial by contacting admin@stonepile.com within a reasonable time; we will respond to the appeal within 60 days, and if the appeal is denied, we will provide a method to contact the Virginia Attorney General’s Office of Consumer Protection.

12.3 Residents of Other States

If you live in a state with its own comprehensive privacy law, you may have additional or different rights. Contact us and we will address your request under the law that applies to you.

13. Children Under 13

The generally available TestFlight / App Store product remains 13+. Self-declared under-13 signups are blocked and not retained. We have published a children’s privacy addendum at stonepile.com/privacy-children (version v1.3-coppa-draft) describing parent-created under-13 accounts. That architecture is not a public signup path. General under-13 onboarding stays off until a later App Store release that matches this notice.

14. Changes to This Policy

We may update this Privacy Policy as our product evolves, including before any expansion to children under 13 as described in Section 13. We will update the “Last updated” date above when changes are made, and for material changes we will provide reasonably prominent notice. We encourage you to review this page periodically.

15. Contact Us