What we know about your family, and why

This policy applies to soccertrainerhq.com, every trainer site we host on a subdomain of it (for example marcos.soccertrainerhq.com), and any custom domain a trainer has pointed at us. It covers three groups of people:

• Parents and guardians who book training for a young athlete, with or without an account.
• Athletes, who are usually minors. They do not have accounts and do not use this platform. Everything we hold about an athlete was typed in by their parent or guardian.
• Trainers — independent coaches who use SoccerTrainerHQ to run their own booking, and who have their own account.

“We” is SoccerTrainerHQ LLC, a California limited liability company, and the data controller for everything described here. Privacy questions and any request about your data go to privacy@soccertrainerhq.com, which reaches a person rather than a queue.

Booking does not require an account. You pick a time on your trainer’s site, fill in one form, and pay. This is everything that form writes, field by field.

Camp registrations are the same shape and are stored the same way, on camp_registrations: parent contact details, athlete name and birth year, emergency contact, medical notes, and the waiver record.

You never need an account to book. An account is offered after a booking is paid for, and its only purpose is that the second booking is two taps instead of a form. Signing in is a one-time link sent to the email address that already paid — we do not ask for or store a password.

If you save a player, that becomes a row on athletes, owned by you:

Some trainers run pre-order windows for kit, collected at training. If you order, we store your name, email and phone on apparel_orders, along with the player’s name, the amounts, and Stripe’s reference numbers — plus policy_version, policy_accepted_at, policy_ip and policy_user_agent, which record that the non-refundable pre-order terms were shown to you and accepted before payment.

If you personalise an item, the name and number you asked to have put on it are stored on the order line as custom_name and custom_number. That is usually a child’s name, printed on a garment, so it is treated as athlete information like the rest.

There is no shipping address, because there is no shipping — kit is handed over at training.

A trainer’s public page carries what they chose to put on it: name, photo, bio, Instagram handle, session prices and times. Their account also holds an email address and phone number, a Stripe account identifier for payouts, and any documents they have given us about background checks, SafeSport certification or insurance — background_check_status, background_check_expires_at, safesport_cert_url, insurance_expires_at.

It is easier to trust a list of fields when you can also see what is absent. As of 4 August 2026, we do not collect:

• Card numbers, expiry dates or security codes. Those are typed on Stripe’s own checkout page and never touch our servers.
• Dates of birth. Only the athlete’s birth year, because that is what youth soccer age groups are actually built on.
• Home addresses. There is no address field anywhere in the booking flow, and no shipping.
• Government identifiers — no social security numbers, no driver’s licences, no passport details. Trainers taking payouts provide identity information directly to Stripe; it does not come to us.
• Precise location. We never ask the browser for your location. The only addresses on the platform are the training fields the trainer typed in.
• Photographs you upload. There is no photo upload for parents or athletes anywhere on the platform.
• Anything from an advertising network, data broker or social login. There are none connected.

Almost every athlete on this platform is a minor, and we hold their name, birth year and — if you write them — notes about their health. That deserves a direct answer rather than a paragraph of hedging.

The platform is not directed at children

SoccerTrainerHQ is built for the adult who books and pays. There is no athlete login, no athlete profile a child can create, no messaging, no social feed, no content aimed at children, and no advertising anywhere on the platform. Accounts may only be held by adults aged 18 or over. We do not knowingly collect personal information directly from a child under 13.

The parent supplies the athlete’s information

Everything we hold about an athlete was entered by their parent or guardian, in the course of that adult booking a service for their own child. When you book, you are confirming that you are the athlete’s parent or legal guardian, or that you have their permission to make the booking and to provide this information.

What we do with it, and what we never do

• Athlete information is used to run the session that was booked: the roster, the age-group fit warning, and the emergency contact if something happens on the field.
• It is never used for advertising or profiling, never sold, never shared with a data broker, and never disclosed to anyone outside the trainer you booked with and the infrastructure providers named below.
• We ask for the minimum that makes the feature work — the birth year rather than a date of birth is the clearest example of that choice being made deliberately.

This matters more here than on most platforms, because the person you are booking with does not work for us.

• Trainers are independent contractors. They set their own prices, times and locations, run their own sessions, and are paid out to their own bank accounts. They are not our employees or agents.
• The trainer you book with can see their own roster. That means your name, email, phone, the athlete’s name and birth year, your emergency contact and the medical notes you wrote — for their own sessions, and no one else’s. That is not a leak; it is the point. A coach who cannot see that a player carries an inhaler cannot keep that player safe.
• No trainer can see another trainer’s bookings. This is enforced in the database itself rather than in application code, by row-level security policies scoped to the owning trainer.

Legally, we and your trainer each decide how the information is used — we for running the platform, they for delivering the coaching. Each of us is responsible for our own handling of it. What your trainer does with your details outside SoccerTrainerHQ — a group chat, a team spreadsheet, their own phone — is between you and them, and we cannot control it.

Payments run through Stripe. When you pay, you are on a checkout page hosted by Stripe on Stripe’s own domain. Your card details go to Stripe, not to us. We never see, receive or store a card number, and there is nowhere in our database for one to go.

What comes back to us is Stripe’s reference for the payment, the amount, and whether it succeeded. That is enough to send a receipt, show your booking, and issue a refund.

Today the charge is created on SoccerTrainerHQ’s Stripe account and the trainer’s share is transferred to theirs, which is why SOCCERTRAINERHQ — not the trainer’s name — is what appears on your card statement. If that changes so that the trainer becomes the merchant of record, this page will be updated before it does.

Stripe handles your payment information under its own privacy policy, as an independent controller of it: stripe.com/privacy.

Four companies. That is the whole list, and each one is here because the product cannot run without it.

We may also disclose information if the law requires it — a subpoena, a court order, a lawful request from an authority — or where it is necessary to investigate fraud, to protect someone’s safety, or to establish or defend a legal claim. If the business is ever sold or merged, records would transfer with it, and this policy would continue to apply to them until it is replaced by one you are told about.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no advertising on this platform.

There is no cookie banner on this site, for the simple reason that there is nothing to consent to. We run no advertising pixels, no session recording, no A/B testing tools and no third-party scripts of any kind. Even the typefaces are served from our own domain rather than fetched from Google, so loading a page does not tell anyone else that you did.

We do count, and we would rather say so plainly. Our own server keeps a tally of things that happen — a directory search, a booking started, a payment completed — because otherwise we cannot tell whether the product works. That tally is described in full below. It uses no cookie, sets nothing on your device, contacts no third party, and carries nothing that identifies you.

These are the cookies that exist:

During checkout you are on Stripe’s domain, where Stripe sets its own cookies for fraud prevention under its own policy. We have no access to them.

What we count, and why it is not tracking

When something happens that tells us whether the product is working — somebody searched the directory, a search found nobody, a booking was started, a payment went through, a trainer published a month — our server writes one row to a table called funnel_events. It is written by us, on our own machine, after the fact. Nothing runs in your browser to make it happen.

Because none of this is tracking, there is no separate cookie policy page and no consent tool to configure — the two cookies above are the complete inventory. If that ever changes, this section changes with it and it will not be a quiet edit.

You can message your trainer inside the product. If you do, we ask your name once — it is stored as parent_profiles.display_name, and it is what the trainer sees on the conversation. The messages themselves live in conversation_messages, visible only to you and that trainer. A trainer can also open a session group for a session your athlete has a confirmed booking on; messages there (group_thread_messages) are visible to the trainer and to every family with a confirmed booking on that same session — the screen says so where you type. Each new message triggers one email notification to the other side.

Messages are deleted automatically after 30 days. A conversation here is for arranging this month’s sessions, not a permanent transcript, and nothing in the product can edit or delete a message earlier — not us, not the trainer. If you need a record of something agreed in a message, keep the email notification.

Transactional email always sends. A booking confirmation, a reminder before the session, and a notice if the trainer moves the time or the field are part of the service you paid for, not marketing, and there is no opt-out for them short of cancelling the booking.

Marketing email is off unless you turn it on. marketing_opt_in defaults to false and is only true if you ticked the box.

We do not send text messages. The checkout records whether you agreed to receive them — sms_consent and sms_consent_at — but no messaging provider is connected and no SMS has ever been sent from this platform. Saying so plainly seems better than implying a service that does not exist.

photo_release is a separate question with its own checkbox, it defaults to no, and it is deliberately never bundled into the liability waiver. Agreeing to the waiver does not agree to photographs.

If you do opt in, you are giving the trainer permission to use images of your athlete from their sessions in their own promotion. The permission runs to your trainer. To withdraw it, tell your trainer and email privacy@soccertrainerhq.com so the flag is turned off; note that a photo already published somewhere else is not something we can reach.

After a paid session has happened, you can rate it and write a few sentences. A review is public: it appears on the trainer's site and on their marketplace card, immediately, with no approval step, and anyone can read it.

A review taken down for abuse is hidden, not deleted — the record survives (with the reason) but stops being shown. Reviews are never taken down for being unflattering; a trainer cannot pay or ask to have honest criticism removed. If you want your own review removed or corrected, email privacy@soccertrainerhq.com from the address you booked with — your own words are yours, and we hide them on your request.

When you accept the liability waiver at checkout, four things are written down: the name you typed (waiver_signed_name), the moment you accepted (waiver_accepted_at), the IP address it came from (waiver_ip), and — the important one — which version of the wording you agreed to (waiver_version).

The version string exists so that “what did this family actually agree to?” has exactly one answer years later. The waiver text is published on this site with its version number, and when the wording changes the version changes rather than the old text being edited. A record that points at wording nobody can produce is not a record.

Because it is evidence, the waiver record is kept even when the booking it belongs to is cancelled or refunded, and it is not deleted on request while a claim connected to that session could still be brought.

Honestly: almost nothing is deleted automatically. As of August 2026 exactly one retention rule runs on a schedule — messages, below — and for everything else, no such job has been written. Saying “we keep data for 24 months” would be describing software that does not exist. Here is what is actually true, and what governs it.

• Messages between you and a trainer are deleted after 30 days — the one scheduled deletion that exists. A daily job removes every in-app message (1:1 and session-group alike) older than 30 days, and it is deliberately the only thing in the system able to delete one.
• Bookings, camp registrations and apparel orders are kept indefinitely for now. They are financial records. They are needed for tax filings, for responding to a card dispute or chargeback, and for resolving an argument about what was booked and what was refunded. A cancellation does not erase them — a refunded booking is a transaction that has to remain accounted for.
• Waiver records are kept longer than the booking would otherwise need. A claim relating to an injury to a minor can be brought long after the session, so the evidence of what was agreed has to outlive the session by a wide margin.
• Medical notes ride along with the booking they were written on. This is the field we would most like to age out automatically, and a retention rule for it is on the list.
• A saved player is deleted when you delete it. That is the one deletion the product performs itself, and it is immediate.
• The event counters are kept indefinitely, and there is nothing in them to delete. The funnel_events rows described under “Cookies and local storage” identify nobody, so ageing them out would protect no one — it would only destroy the record of whether this business works. If a row ever carried anything about a person, it would need a retention rule, and it would need this sentence rewritten.
• Trainer records are kept while the account is open and afterwards to the extent the bookings taken through it require.

What is genuinely in place:

• Bookings are never written or read from a browser. Every write goes through server code holding a privileged key; the public key a browser carries has no permission to read a bookings row at all.
• Access rules live in the database, not in the app.Row-level security policies mean a trainer’s query for someone else’s roster returns nothing — even if application code asked for it.
• Money columns cannot be edited from a browser by anyone, including the trainer whose row it is.
• No passwords. Signing in is a one-time link to an email address, so there is no password of yours for us to store or leak.
• No card data anywhere in our systems, by design.
• Everything is served over HTTPS.

What is not in place: we have no SOC 2 report, no penetration test, no bug bounty, and no formal incident response plan written down. We are a small early-stage business and pretending otherwise would be the first untrue sentence on this page. If a breach affecting your information occurs, we will notify you and the authorities as required by California law.

Things you can do yourself, right now:

• See your bookings — sign in at soccertrainerhq.com/parents with the email address that paid.
• Cancel a booking within the cancellation window, and get your money back in full — or, with a deposit trainer, get the exact amount shown when you booked. The rules are in the terms.
• Edit or delete a saved player, including their medical notes, from your account.
• Leave the marketing box unticked, which is the default.

Things that are not built, and how they are handled instead:

• There is no self-serve data export. Email us and we will put together what we hold about you.
• There is no self-serve account deletion. Email us and we will do it, subject to the records we are required to keep.
• There is no way to correct a booking after payment. Email us or your trainer.

Every request goes to privacy@soccertrainerhq.com. We will confirm receipt within 10 days and respond within 45 days, extendable once by a further 45 days if a request is complicated, which is the California standard and the one we apply to everybody.

The business is based in California, and most of the families using it are too. Under the California Consumer Privacy Act as amended by the CPRA, you have the right to know what is collected and why, to get a copy of it, to correct it, to delete it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be treated worse for exercising any of that.

The categories, in the statute’s language

Sale, sharing, and sensitive information

• We have not sold personal information in the preceding twelve months, and we do not sell it now.
• We have not shared personal information for cross-context behavioural advertising in the preceding twelve months, and we do not now. There is no advertising technology on this platform, which is why there is no “Do Not Sell or Share My Personal Information” link — there is nothing for it to switch off.
• We do not use or disclose sensitive personal information for any purpose beyond performing the service you asked for, so the right to limit its use does not currently restrict anything we do.
• We do not knowingly sell or share the personal information of consumers under 16.
• We offer no financial incentives in exchange for personal information.

How to exercise a right

Email privacy@soccertrainerhq.com from the address you booked with, or tell us which address the booking used. We verify a request by confirming control of that email address, and for a deletion request we may ask for one additional detail that matches the booking. An authorised agent may act for you with written permission that we can check with you directly. Making a request costs nothing and changes nothing about the service you receive.

Requests about an athlete are made by their parent or guardian — the adult who holds the booking — which is the same person the account belongs to.

The service is aimed at families in the United States and the data is stored in the United States. Several other states now give residents similar rights, and rather than run a different process for each one, we handle every request we receive the same way — the one described above.

We are not currently set up for the European Union or the United Kingdom, and this policy does not attempt to describe GDPR compliance. If you are booking from outside the US, understand that your information will be stored and handled in the US.

When this page changes, the date and version at the top change with it. If a change materially affects what we collect or who sees it, we will say so by email to the address on your most recent booking rather than quietly editing the page. The waiver is versioned separately and works the same way — see the waiver.

Anything at all about this page, about what we hold, or about a request to see, correct or delete it: privacy@soccertrainerhq.com.

For a question about a specific session — what to bring, where the field is, whether it is cancelled for rain — your trainer is the faster answer, and their details are on the confirmation email.

The registered business name and mailing address will be printed here before launch.