Children’s Privacy Addendum

Who this covers

This notice applies when a parent or legal guardian creates a Stonepile player account for a child under 13. A child’s own taps do not create this consent. STAK Athletics LLC is a Virginia company. Questions: admin@stonepile.com.

What we collect, and why

We collect only what is needed for a private player profile: the child’s display name, birth date or age band, a parent-created sign-in, and the training notes, measurements, films, and other portfolio items the family chooses to add. We do not sell children’s information. We do not use it for third-party ads. We do not use children’s uploads to train AI models.

What stays off

Under-13 accounts do not get Marketplace, Stonepile AI, comments, public folders, social discovery, public Runs, or outbound web embeds (including YouTube). Coach–minor peer connections stay off. Height: we store the confirmed measurement in inches and do not keep the source photo in Storage.

How we share

We do not disclose under-13 personal information to third parties for those parties’ own purposes. Supabase hosts the database and private storage on our instructions as a processor. There is no separate identity-verification vendor (no Privo). Legal or safety disclosures — including reports to the National Center for Missing & Exploited Children (NCMEC) when required by federal law — may still apply.

How a parent consents (COPPA)

The parent must already be signed in on an adult account. We then confirm with a code and a re-typed legal name, and we record the parent, the child, this notice version (v1.3-coppa-draft), the date, and the method.

Architecture / TestFlight UAT records method in_app_delayed_code (a delayed code shown in the app — not email). Before real children’s accounts, we will send a one-time code to the parent’s sign-in email (method email_otp_confirm) and confirm it in the app. We will not collect real child personal information until that email method is live and general under-13 onboarding is turned on in a store binary.

Two separate actions

Privacy consent (this notice) is not a contract. Accepting Stonepile’s Terms as an adult parent is a second, distinct action. The parent Terms addendum is at stonepile.com/parent-terms.

Your rights

In the app (Profile → Family → Child’s data) you may review titles and counts, revoke consent (the child’s account is paused; we stop new collection), or delete the child’s account. You may also email admin@stonepile.com. We verify the request comes from the parent on file.

If setup is not finished

If a parent starts a child account but does not complete this consent, we delete that incomplete account within 14 days. Someone who self-declares under 13 without a parent and this consent is not kept — that signup is removed.

How long we keep it

We keep a child’s information while the account is active and the family has not deleted it. A verified deletion removes the account from active systems; backup copies expire on a normal rotation. Inactive minor accounts are in line for deletion after a long period of no use, with notice to the parent. Consent records may be kept as required to show we obtained permission.

Contact