Throughball Privacy Policy
Operator: Throughball Labs LLC, a Colorado limited liability company ("Throughball", "we", "us").
1. Who this covers
Throughball is a college-soccer recruiting tool used by a parent or guardian (the Account Holder) and their high-school student-athlete (an Authorized User). This policy covers both, a parent who asks for early access, a visitor to our public pages and demo, and the coaches and program staff in our shared catalog (§8). Six pages we keep current carry the detail: who helps us run Throughball (trythroughball.com/privacy/providers), how we measure (/privacy/measurement), how we file the mail you forward (/privacy/mail), how long we keep things and what a deletion does not reach (/privacy/retention), what changed (/privacy/changes), and our page for site owners and coaches (/site-owners).
2. What we collect
From the Account Holder: your name and email address, your player's first name, if you give us one (whichever name we have names your family's account; your family's private inbound address is built either from your player's first name or from a neutral word, never from your own name), and your confirmation that each athlete is in 9th grade or later (a rising 9th grader counts from 1 July). Sign-in is by a one-time code emailed to you; we store no password.
About the athlete, entered by your family: identity and team details (such as name, sport, position, graduation year, club and time zone); athletic and academic information (such as statistics, test scores, grades, awards and highlight-video links); recruiting preferences, goals and schedule; and any other recruiting information your family chooses to give us, including the notes you give while using the tool. We do not ask for the athlete's date of birth, government identifiers, precise location, photos or biometric data.
Documents you upload (a résumé, transcript, score reports or other files) are stored as uploaded until you delete them or the account closes. A résumé or score report is read by our AI model provider (§4) to fill the profile fields above, and only those fields are extracted; any other document is stored only.
Email you forward or copy to us. Your family gets a private inbound address, and mail reaches us only when your family sends it there or someone replies to a message that copied it. We keep mail from coaches, schools and recruiting platforms, chosen by who sent it and which conversation it belongs to, never by what it says; everything else is discarded without being stored, and messages you do not copy to us never reach us. The exact rules, and the few things that can be recorded about a discarded message (timestamps and diagnostic lines, never its sender, subject or content), are at /privacy/mail. Our software reads stored mail to keep each school's conversation current for your family, which sends the message content to our AI model provider (§4). We do not read any mailbox you have not connected.
Texts you log. You can paste a text a coach sent your player, or one your player sent a coach, onto that school's page, saying which coach, which direction and when; a chat export is split into its messages the same way. We keep the words as you pasted them, as a contact you logged, with the coach, the direction and the time you gave. We do not ask for a phone number: a sender's number in a chat export only tells the lines apart and is not stored, and a number inside the words you paste stays in them, as it would in a pasted email. Our software reads a logged text as it reads stored mail, to keep the school's conversation current for your family, which sends the text's words to our AI model provider (§4); a text you log as sent is also read for a promise to the coach, the way a sent email is (Recruiting activity, below).
A connected Gmail account (one family only). One family has connected a Gmail account. For that family our software reads, in full, the messages that carry a "Recruiting" label and stores them with the family's other mail; it applies that label to messages from or to a coach in our catalog by their addresses, not their content. It uses Google's gmail.modify permission but never sends, trashes or deletes mail, and disconnecting deletes our access and asks Google to revoke it. No other family can connect Gmail, and that connection ends when we retire it.
Messages you send us. When you write to us (a reply to an email from us, a question to hello@, or a request about your rights), we keep your message and our reply in our own email (§4); who holds it and for how long is at /privacy/providers.
Recruiting activity: the schools, programs and coaches you track and how you rank and organize them; what you record about each school (such as offers, status updates, milestones, notes, questions, contacts you log and to-do items, your own and the ones our software keeps for your family); your calendar and camps; what you write and prepare with the tool (such as drafts, templates, campaigns and call- or camp-preparation documents) and the email addresses you send from; corrections you propose to the shared catalog; how you sort your messages; and any other recruiting activity you record with the tool. When our software creates a to-do from what an email or a text you sent promised a coach, it keeps the kind of promise, the school and the coach's name, never the message's words.
Automatically. Standard server logs (IP address, browser, pages, timestamps) at our hosting and database providers, and our own software's diagnostic lines about its runs and the mail it handles, which identify your family by an opaque code — never a name or an email address — and never carry a message's content, sender or subject, a document, or anything you typed. We also count how much AI processing your family's requests and mail use — counts only, never the text — to see and control what the service costs and to measure once a week how much each family uses the product (what we count is at /privacy/measurement). That measure is read by us alone, never shown to a family, never shared and never given to an advertising platform; it may shape what we tell the Account Holder about Throughball (§3).
Before you have an account. On our public pages we count visits with a cookieless tool from our hosting provider; our own code sends it a short list of events about how a visit moves through our public pages (such as which step of the demo, or of asking for early access, it reached) — never a name, an email address, a school or anything you typed. The kinds of events are described at /privacy/measurement. On signed-in pages we may measure how the product is used (such as which pages and features are used, how often and for how long, and where something goes wrong), with our own code or an analytics provider listed at /privacy/providers; what we measure is described at /privacy/measurement. That measurement is used only to run and improve Throughball. It never records what you type or the content of your messages, documents or mail, never feeds advertising, and is never sold. The demo saves nothing about your player on our servers; if you ask for early access from the demo, your browser keeps the position, club team and school preferences you gave, with a one-way code made from the email address you asked with, so that setting up your account on the same device can start from them (/privacy/measurement). What you pick is used to read our catalog in front of you and is not saved, except in our server logs, which can record the choices you picked, or how many of each, beside counts of what our catalog returned — never a name and never anything you typed — and a one-way hash of your network address, which limits how often one connection can read our catalog and is deleted after about a day (the exact rule is at /privacy/measurement). Asking for early access collects your contact details and basic facts about your player's recruiting (such as your name, your email address and your player's graduating class and program) — not your player's name — which we use to reply, to tell you about early access while you wait, and, if we invite your family, to set up your account; a request sent before this policy described those updates gets none unless you agree.
Cookies and browser storage. Signing in, and a signed-in session, use cookies and similar browser storage only for sign-in, security and measuring how the product is used, never for advertising; our own code sets no cookie on our public pages for a visitor who is not signed in, though our hosting provider's security tooling may set its own. Our pages keep a few entries in your browser's session storage for the life of the tab, and one in its local storage, which we stop using 30 days after you ask for early access from the demo, described at /privacy/measurement. An advertising platform's tag on our public pages (§3, Advertising to parents) may set that platform's own cookies; your opt-out and your browser's Global Privacy Control signal turn it off, and where the law requires your consent first, we will ask for it.
3. How we use it
To run Throughball for your family: store your profile, track programs, draft outreach, prepare you for conversations, keep your calendar and to-dos, and read the documents, mail and logged texts you give us.
To answer the messages you send us and to handle a request about your rights (§9).
To generate recommendations (the recommendation feature): we send relevant parts of your family's data and catalog data to a third-party AI model provider (§4) to produce school-fit suggestions, drafts and call preparation, shown only to your family.
To send transactional email: the early-access confirmation, sign-in codes, the notice before an inactive account is closed (§7), the email announcing a change to this policy or our terms (§11), and service notices. We do not send marketing email to athletes.
To tell an Account Holder, or a parent who asked for early access, about Throughball — early access while you wait, and Throughball's features and any plans we offer, chosen by how your family uses the product — by email or in the app. Any such email carries a way to stop it, which we honour within 10 business days, and our postal address (§12). Today we send none.
To keep the service secure, investigate abuse, and count visits and measure product use as §2 describes — never to decide anything about an athlete, and never for an advertising platform beyond what Advertising to parents below describes.
We do not: sell personal information; give any athlete's information — their name, email address, class, schools, messages or anything else we hold about them — to an advertising platform, or use it for targeted advertising; put an advertising or retargeting tag on any page that requires signing in; use personal information to profile any person for decisions with legal or similarly significant effects; use system design features intended to increase or prolong a minor's use of the service; or use your family's data to train AI models. Our model provider's commercial terms prohibit it from training on what we send.
Advertising to parents. We may advertise Throughball to parents on major advertising platforms (such as Instagram, Facebook, TikTok and Google); the ones we use are listed at /privacy/providers. Before we give a platform anything or put its tag on a page, you will be able to opt out in one click, at the top of this page or, for an Account Holder, in Settings, and we treat your browser's Global Privacy Control signal as an opt-out. We may give an advertising platform an Account Holder's email address in coded (hashed) form so it can show Throughball ads to that parent or to people like them, tell it when a parent asks for early access or opens an account, and put its tag on our public pages — never an athlete's information, a demo answer or anything you typed, and never a tag on a page that requires signing in. If your family's account was opened before this policy described these uses, we will not use your family's information for news about Throughball or for advertising to parents unless the Account Holder agrees.
4. Who we share it with (service providers)
We share personal information only with service providers that process it to run Throughball under their standard commercial terms: hosting and server logs, with the public-page visit counter; measuring how the product is used; our database, sign-in and file storage; receiving the email you forward or copy to us; delivering the email we send; our own email, which holds the messages you send us and our replies; sending our operator a phone alert when an early-access request arrives; the AI model provider, whose terms prohibit it from training on what we send; the search provider our software uses to find and read public program pages; and, for one family only, Google, for its connected Gmail account. Who fills each role today, what each holds, where, and for how long are at /privacy/providers, which we keep current.
Because the search provider may use queries to improve its service, our software composes every query itself and a check before each one refuses any that carries your family's names, addresses, scores or other profile details; a query may carry only the athlete's graduating class year and, for a call, the published name of the coach. Our use of Gmail data is limited to showing and organising that one family's own recruiting mail; no person at Throughball reads it except to investigate a security problem or a bug. Throughball's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The map on your Schools page loads its images straight from a public map-tile service named on our providers page, and a link to a school's own site or a recruiting platform takes you off Throughball. We share personal information with no other third party except an advertising platform as §3 describes, with your direction (you send your own email), to comply with law, to protect safety or our rights, or in a business transfer, with notice.
5. Other families
Your family's data is visible only to users on your family account. The shared catalog (schools, programs, coaches, camps, recruiting links) is common to all families. Nothing your family enters about the athlete is shown to another family, and neither is your mail, with one exception: when our software finds a camp in a coach's email, it may propose that camp for the shared camp calendar, carrying the camp's own details and never anything that identifies your family. Corrections you propose to the catalog are reviewed by us before they change what other families see, and are shown without attribution; a camp proposal you accept, with any edits you make, changes only your family's own calendar.
6. Minors
Athletes on Throughball are high-school students, 9th grade or later (a rising 9th grader counts from 1 July before their first high-school year). The Account Holder confirms this when the account is opened, in writing to us or in the app before the athlete's profile is created. We do not offer accounts for younger athletes. If we learn that an athlete is younger than that, we remove the athlete's profile at once and the athlete's uploaded files and preparation documents within 30 days (§9 says what stays). We do not knowingly collect information from children under 13; if we learn that we have, we delete it.
For athletes under 18: we collect only what is needed to run the recruiting tool for your family; we do not sell it, give it to an advertising platform, use it for targeted advertising, or profile the athlete for decisions with legal or similarly significant effects; we keep it only as long as reasonably necessary (§7); and we design the service to avoid features that increase or prolong a minor's use. The Account Holder can see, correct and delete the athlete's information at any time (§9).
7. How long we keep it
Family account data is kept while the account is open and deleted within 30 days of closure. A few records of our own conduct outlive it, under an identifier that no longer leads to your family, and some copies our providers hold expire on their own schedules; each is listed at trythroughball.com/privacy/retention, which we keep current, with how long it lasts where we set a period: our providers' logs and daily database backups no longer than 90 days, prompts at our AI provider within 30 days (up to two years if it flags the content), a message we delete from our own email within 180 days at our email provider, mail held for routing that was never filed to your family after 7 days, and the invitation record 12 months after the account.
Closing the account from Settings takes effect 7 days after the Account Holder asks; signing in before then cancels it, as does the cancel control in Settings. A deletion we carry out on your written request runs on the same schedule and is cancelled by that control or a word to us.
Mail is kept like account data; mail we cannot route to a family is held for 7 days and then deleted, and a person at Throughball may see its sender, recipients and subject line to route it. A message you delete is removed at once; we keep up to three technical identifiers of it, never its content, so it is never stored again, and a school's summary, last-contact date, a to-do made from the message and any school or camp entry it produced stay, without their link to it.
Usage counts (no content) are kept with your account: a separate count for each use for 13 months, and after that only monthly totals for each feature and AI model. Counts for research on a school stay against the school in our shared catalog, and we also keep usage records for the service as a whole that name no family, for as long as they are useful to us. Early-access requests we have not invited are deleted after 6 months; the public-page visit hash is discarded after 24 hours.
Inactive accounts: we may close an account with no sign-in for 24 months. Before we do, we email the Account Holder and wait at least 7 days; signing in keeps the account open, and if the email cannot be delivered, we do not close the account.
Records we must preserve for a legal matter pause these removals until it ends.
8. Coaches and program staff
Our shared catalog lists coaches and program staff by name, role and the work email address their institution publishes on its official athletics website, so that families can find the right person to contact. We collect this from the public staff pages of college soccer programs, and from coaches a family or our staff add, which our staff review first; from a program's public pages we also keep its recruiting-questionnaire and camp links, a camp's details, and, where a program publishes one, the email address it gives recruits for the program as a whole rather than for one coach (its recruiting inbox), with the page it appears on, and nothing else about any person — no student-athletes, personal addresses, phone numbers, photographs or biographies. The text of a page we read is sent to our AI model provider (§4) to extract what we keep, or to build that extraction, and our search provider is sent a school's and program's names, nothing about any family. Which pages we read and how often, how our crawler identifies itself and honours robots.txt, the internal records that can carry a staff member's name, and how an institution excludes its site are at trythroughball.com/site-owners, which we keep current.
A family's first email to a program may be addressed to that program's recruiting inbox rather than to one coach, and a later email may be too, where we hold no coach's email address for that program; where we list a coach's email address, the family can write to that coach instead. Our software writes a draft, which the family can read and change, and the family sends each email itself, from its own email or recruiting-platform account. Throughball never sends it, to the program or to anyone else.
Who sees the catalog, including what our public demo shows of it, and your rights if you are listed — to have your entry corrected, your email address removed or your entry removed, which we act on within 10 business days, and the record we keep so that a removal lasts — are on that page too.
9. Your choices and rights
Any Account Holder can, by emailing legal@trythroughball.com: see the data we hold about the family; correct it; delete the athlete's data or the whole account; have your family's inbox address removed; and withdraw a connected Gmail account. Deleting the whole account is also offered in Settings, as the 7-day scheduled closure in §7; if you want a copy of your data, ask for it before you schedule a deletion, because a copy takes us up to 30 days. We honour these requests for every family regardless of where they live and whether a particular state law requires it. We act on a request from the Account Holder's email address on the account; a request from any other address, and every emailed deletion, is first confirmed with the Account Holder at that address. We respond within 30 days, and we do not discriminate against you for exercising these rights. If you disagree with how we answered a request, reply to our answer and say so; we review it again and answer within 30 days.
Removing your inbox address stops us filing mail sent to it (turn off forwarding in your own email settings too); removing one athlete removes that athlete's profile, uploaded files and preparation documents within 30 days. In both cases mail already stored, the family's own correspondence, stays unless you ask us to delete it too.
10. Security
We use encrypted connections, access controls scoped to your family, and providers with independent security certifications. No system is perfectly secure. If a breach affects your family's data, we will notify the Account Holder without unreasonable delay and no later than 30 days after we determine a breach occurred (the time Colorado law requires, C.R.S. 6-1-716), or sooner and in the form the law of the state you live in requires.
11. Changes
We change this policy in batches. When we announce a change, we list it, with the date it takes effect, at trythroughball.com/privacy/changes, and we email every Account Holder at least 3 days before that date; on that date we post the changed policy here, with the date at the top, and continued use of Throughball after it is acceptance of the change. The pages this policy points to can change without a change to this policy, as long as they stay within what this policy itself says; anything beyond that is a change to this policy, announced and emailed as above.
12. Contact
legal@trythroughball.com · Throughball Labs LLC, 1500 N Grant St Ste N, Denver, CO 80203 (the registered agent's address, which is the company's principal office of record).