Legal

Privacy Policy

Basketball Atlas — mobile app for Android (package com.bballaiscoutmobile) and iOS (bundle com.bballaiscoutmobile)
Effective date: 22 September 2026  ·  Last updated: 15 October 2026  ·  Version 2.1 (app version 2.3.5)

This Privacy Policy explains what personal information the Basketball Atlas app collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have over it. It applies in the same way on Android and iOS; where the two differ — mainly in how you sign in and how you pay — we say so. Please read it before creating an account.

1. Who we are

Basketball Atlas (the “App” or the “Service”) is a basketball scouting and analytics platform. It provides an athlete, team, league, coach and agent database, AI-generated scouting and comparison reports, MyAgent (an AI career assistant for players), player profiles with video, and Network features that let users connect, message each other and form groups.

The App is operated by BasketBall Atlas (“we”, “us”, “our”), of 5706 Surrey St. Chevy Chase, MD 20815 USA.

For the purposes of the EU and UK General Data Protection Regulation, we are the data controller of the personal information described in this policy. For the purposes of U.S. state privacy laws, we are the business that determines the purposes and means of processing.

2. Scope of this policy

This policy applies to:

• the Basketball Atlas mobile app for Android (distributed through Google Play) and iOS (distributed through the Apple App Store);
• our backend APIs, databases and media storage that support the App; and
• email and support correspondence you have with us.

Your Basketball Atlas account also works on our website. The website uses some technologies the App does not, such as browser cookies and website analytics, and those are described in the privacy notice published on the website. Information you give us through either one is held in the same account and is handled as this policy describes.

This policy does not apply to third-party services you reach from the App — for example Apple's purchase and subscription screens, Google's sign-in page, or Stripe's payment pages. Those services have their own privacy policies (see section 19).

3. Age requirement, minors and parental consent

3.1 Users under 13

The Service is not directed to children under 13 and we do not knowingly collect personal information from them. If we learn that we hold information provided by a person under 13, we will delete that information and close the account promptly. If you believe a child under 13 has given us personal information, contact us at dean.mazlish@basketballatlas.com and we will act without undue delay.

3.2 Users aged 13 to 17

Players in this age range are a core audience for the Service. If you are between 13 and 17:

• you must have the permission of a parent or legal guardian to use the Service, and by registering you confirm that a parent or legal guardian has reviewed this Privacy Policy and our Terms and agrees to them on your behalf;
• in countries where the law requires the consent or authorisation of a holder of parental responsibility for a person of your age — including under Article 8 of the GDPR, where the applicable age is between 13 and 16 depending on the country — your account must be created or approved by that parent or guardian, and we process your information on the basis of their consent;
• a parent or guardian may contact us at any time to review, correct or delete your information, to withdraw consent, or to ask us to stop any further collection.

3.3 Additional protections for minors

We apply the following protections to accounts belonging to users under 18:

• No advertising or tracking. The App contains no advertising, does not use advertising identifiers, and does not track anyone across other companies' apps or websites. We do not sell or share the personal information of minors.
• Contact details are never published. A phone number, contact email address or representative's details entered by a player are never displayed on a player profile or anywhere else in the App to other users. See section 4.5. The email address you sign in with is not displayed either, but another signed-in user who already knows it can use it to find your account in people search — see section 10.1.
• Messages only from people you accept. Direct messages can only be exchanged between users who have accepted a connection request from each other, and group messages are seen only by members of that group. You decide whom to connect with and which groups to join, and you can remove a connection or leave a group at any time.
• Video and self-description content is restricted. Interview clips, game film and the extended profile answers are visible in the App only to signed-in users on a paid plan — not to signed-out visitors and not to users on the free plan — unless the player chooses to include them in a share link (section 4.6). See section 10.1.
• Minimised collection. The App asks a minor for no more information than is needed to operate a scouting profile. It does not request government identity documents, financial account details or location.
• Deletion on request. A minor can delete their account from inside the App, and a parent or guardian can have the account and its content deleted by the process in section 17.

3.4 Rights of parents and guardians

If you are the parent or legal guardian of a user under 18, you may contact us at dean.mazlish@basketballatlas.com to:

• review the personal information we hold about your child;
• have it corrected or updated;
• have it deleted, and the account closed;
• withdraw a consent you previously gave, and require us to stop collecting or using your child's information; or
• ask us to remove a specific item, such as a video or a written answer, without closing the account.

We may ask you for information reasonably necessary to confirm that you are the parent or guardian of the account holder before we act, so that we do not disclose a young person's information to someone who is not entitled to it. We will respond within the timeframes set out in section 15 and section 16.

4. Information we collect

What we collect depends on how you use the Service. Browsing the database without an account requires far less information than creating a player profile with video or messaging other users.

4.1 Account information

Collected when you register and maintain an account:

• first name and last name;
• email address;
• password, if you register with email — transmitted to us to create your account and stored only in hashed form. We do not retain your password in readable form. A one-time code is sent to your email to confirm it;
• account type — for example player, coach, scout, agent or fan — and, where relevant, your role and playing level;
• promotional or invite code, if you use one at signup, and how you found us (for example that you signed up in the mobile app);
• organisation or program name, where you provide it;
• affiliated team or high school, where you link one;
• phone number and Instagram handle, where you choose to provide them;
• a separate contact email address, where you choose to provide one;
• an optional profile photograph.

4.2 Signing in with Apple or Google

You can create an account or sign in with a third-party account instead of a password:

• Sign in with Apple (iOS). Apple gives us a unique identifier for your Apple account, your email address and, the first time only, your name. If you choose Apple's Hide My Email, we receive a private relay address that forwards to you, never your real email. The App keeps a copy of the name Apple provides on your device so it can finish setting up your account if the first attempt is interrupted.
• Sign in with Google (Android and iOS). Google's sign-in page opens inside the App. With your permission, Google gives us a unique identifier for your Google account, your email address and your name. We do not receive your Google password, and we do not store your Google profile photo. Google may store cookies inside the App's sign-in view, as it does in a browser, so that you stay signed in to Google.

We do not get access to anything else in your Apple or Google account. You can stop using Sign in with Apple for our App at any time in your Apple account settings, and remove our access in your Google account's security settings; this does not delete your Basketball Atlas account — see section 17 for that.

4.3 Date of birth and profile verification

When you claim an existing athlete profile in our database — that is, when you assert that a profile in the database is you — we ask you to provide your date of birth. This is a required field for the claim process.

We use your date of birth solely to:

• confirm that you are the person described by the profile you are claiming, by matching it against the record we hold;
• confirm that you meet the minimum age requirement in section 3, and identify accounts belonging to users under 18 so that the additional protections in section 3.3 are applied to them; and
• reduce fraudulent claims over athlete profiles.

We do not use your date of birth for credit checks, background checks, advertising, or profiling unrelated to profile verification. The App does not ask for identity documents. If you claim several profiles at once, our staff review the request before merging them.

Coaches and agents can also claim or create a directory profile. For that we collect the professional details you choose to publish — such as your name, nationality, biography, achievements, current team and career history for a coach, or your agency, licence number, country, website and business contact details for an agent.

4.4 Athletic and profile information

If you build a player profile, you may provide sporting and self-descriptive information, including:

• height and weight;
• playing style, primary and secondary player archetypes, and pace preference;
• season statistics you enter yourself, together with your class, position, team, league, hometown, date of birth, recruiting ranking or draft position, where you choose to add them;
• free-text answers about yourself — how you describe your game, what you are working to improve, your pitch to programs, the coaching style and team culture you prefer, and the factors that matter to you in a program;
• a custom biography, and links to game film or showcase pages hosted elsewhere.

The extended free-text answers and uploaded video that make up the second part of the player profile are treated as restricted content: they are shown only to signed-in users on a paid subscription, as described in section 10.1. Providing them is optional, and you can edit or remove them at any time.

If you use the Service as a coach, scout, agent or fan, you may provide information about your program and preferences, including program descriptions, the traits you look for in a player, traits you consider red flags, offensive and defensive style preferences, and comparison players.

4.5 Contact and representation information

Players may save contact information to their account. This may include a phone number, a contact email address, and the name, phone number and email address of an agent or representative.

We hold this information only so that:

• we can reach you about your account, your profile or a claim you have submitted;
• if you agreed to it when you signed up on our website, we can send reminders about your free trial to your phone number by text message or WhatsApp (section 18);
• we can pass an enquiry to you, or connect you with an interested party, where you have asked us to or agreed to it; and
• we have a record of who represents you, where you have told us.

If you provide an agent's or representative's details, you confirm you are entitled to share them with us. You can view, change or clear any of these fields at any time in the App.

Coaches and agents are different. The business contact details a coach or agent adds to their directory profile — for example an agency phone number, email address or website — are shown on that profile, because a published professional listing is the purpose of that profile. Do not add details you do not want listed.

4.6 Video and media content

The App lets you add video to your profile in two ways:

• Recording in the App — using your device camera and microphone to record an interview clip or game footage; and
• Selecting an existing file — choosing a video already stored on your device through the system media picker.

Videos you confirm are uploaded to our media storage provider. They may contain your image, your voice, other people who appear in the footage, and details of the setting visible in the recording. We may convert the speech in an interview clip into text so that it can be used in your profile and by MyAgent; this transcription runs on our own servers (see section 9).

Keeping your own copy. After recording a video you can tap Save to Device to save it to your device's photo library, whether or not you go on to upload it. A copy saved to your device belongs to you and sits outside the Service — we cannot access it, and deleting your account does not remove it from your device.

If you instead provide a link to video hosted elsewhere — for example a highlight reel — that platform's privacy policy governs the linked content, and anyone with the link may be able to view it regardless of the restrictions we apply inside the App.

4.7 Photos and photo library access

You can add a profile photo, and a group photo for a group you manage, by taking a picture with your camera or choosing one from your photo library. The App crops and resizes the photo on your device before uploading it. Your profile photo is shown wherever your account appears in the App; a group photo is shown to people who can see the group.

When you choose a photo or video, the system picker gives the App only the item you select. We do not scan, index or upload your photo library, and we do not access media you have not chosen.

4.8 Network: connections, messages and groups

If you are signed in, you can use the Network features. They create the following information:

• Connections — the connection requests you send and receive, any short note you attach to a request, and whether each request was accepted, declined or withdrawn;
• Messages — the text of the direct messages and group messages you send, when they were sent, and how far you have read in each conversation. Messages are text only. They are stored on our servers so that the conversation is available to its participants on any device;
• Groups — groups you create or join, including a group's name, description, photo, visibility setting and membership, members' roles, and requests to join;
• Suggestions — the App suggests people you may know. We work these out on our servers from mutual connections and shared team or league history. You can dismiss a suggestion.

Messages you send are visible to the people you send them to, and group messages to every member of the group, including people who join the group later. Your messages cannot currently be edited or deleted individually once sent; they are deleted when your account is deleted (see section 17).

4.9 Information you give us about other people

Some features ask you for information about someone else:

• Email invitations. You can invite someone to Basketball Atlas, to connect with you or to join a group, by entering their email address and an optional personal message. We store the address, message and invitation status and send an invitation email in your name; you can resend it or cancel it while it is pending. We record whether the invitation email was opened. If the address already belongs to an account, we send that person a connection request in the App instead, and email them that you sent it, with your name, organisation and message. If they join, you may receive free credits as a referral reward.
• Sharing a profile or report. You can email a link to a player profile or report to up to ten addresses at a time, with an optional message, or send it to your connections, who receive it by email at their account address. The email shows your name, and replies go to the email address you sign in with.
• Agent or representative details, as described in section 4.5.

Only give us someone's details if you are entitled to and you believe they would expect to hear from you. We use these details only to deliver the invitation or share you asked for, and to link them to an account if the person signs up; we do not add them to any mailing list. Anyone who receives an invitation and does not want it can ask us to delete their address.

4.10 Purchases and subscriptions

How you pay depends on the device you use:

• On iOS, subscriptions and credit packs are sold through Apple In-App Purchase. Apple takes the payment; we never see your card or Apple payment details. We receive from Apple the transaction identifiers, the product you bought, the purchase and expiry dates, whether it was a test purchase, and any refund or cancellation, and we link them to your account using a random identifier we issue for this purpose. Restore Purchases re-checks your past App Store purchases with us. Apple subscriptions are managed and cancelled in your Apple account settings, not by us.
• On Android, subscriptions and credit purchases are processed by Stripe. Checkout is shown on a Stripe-hosted page inside the App, and billing is managed on Stripe's billing portal.

We do receive and store, or generate ourselves:

• a Stripe customer identifier linking your account to a billing record — we create one for every account, including accounts on iOS, so a plan can follow you between devices;
• your plan or tier, which store it was bought through, subscription status, billing period and renewal or cancellation state;
• free-trial status and any promotional code used;
• your AI credit balance and the history of credits added and spent.

Buying a single report without an account (Android). On Android, if you are not signed in, you can buy one report you generated. The purchase goes through Stripe's checkout, where you give the email address the report is sent to. We store that email address with the purchase and the report it unlocks, and use it only to send you the report (a link and a PDF copy) and to help you if something goes wrong with that purchase. We do not use it for marketing. The purchase is linked to your guest identifier (section 4.13). On iOS, purchases are made from a signed-in account.

Apple and Stripe process your payment data as independent controllers under their own privacy policies: apple.com/legal/privacy and stripe.com/privacy.

4.11 MyAgent conversations and memory

MyAgent is our AI assistant. It is available to every account type — a career assistant for players, and a scouting and research assistant for coaches, scouts, agents and fans — and to every member of an organization (section 4.18). When you use it we store:

• your conversations — the messages you send, MyAgent's replies, and a title and short summary of each conversation, so you can return to it on any device; and
• memory — short facts MyAgent picks up from your conversations, such as your goals or the kind of program you are looking for, which it uses to personalise later advice.

You can rename or delete a conversation, clear all your conversations, and view and delete memory items from your profile settings. A deleted memory item is no longer used by MyAgent; all memory is erased when your account is deleted. Please do not tell MyAgent anything you would not want recorded. See section 9 for how AI processing works.

4.12 Usage and service data

Generated as you use the Service:

• reports you generate, including the players they relate to and the report text;
• AI credits consumed, reports generated, and monthly and total usage history;
• players and groups of players you save to favourites, and searches you save;
• the results you open from the App's search — the search text, the item opened, how often and when — kept as your recent searches, separately for your personal account and each organization;
• profile claims and profile-review or add-team requests you submit;
• read and unread status of your reports;
• feedback and support messages you send us.

4.13 Using the App without an account

You can browse the database and generate a small number of free reports without signing in. To make that work, our servers issue your installation a random guest identifier. The App stores it on your device and sends it with requests while you are signed out. We use it only to count your free reports and to keep the reports you generated available to you; if you later create an account or sign in on that device, those reports move to it. Until then, the guest identifier is not linked to your name; once the reports move, they stay marked with the identifier they were generated under. It is not linked to your device hardware, and is not used for advertising or tracking. It is removed from your device when you uninstall the App. If you buy a report without an account on Android, the email address you give for its delivery is stored with that purchase and linked to your guest identifier, as described in section 4.10.

4.14 Technical and device information

When the App communicates with our servers, our infrastructure processes standard technical information, including your IP address, the date and time of the request, the endpoint requested, the response status, the platform the App runs on (Android or iOS) and general information sent by the network client. This is used to deliver the Service, for security and abuse prevention, and to keep the Service reliable. If you submit feedback, we record the IP address it came from to prevent spam.

When something goes wrong on our servers, details of the error are sent to our error-monitoring provider so that we can fix it. These reports are configured not to include personal information by default, but an error report can occasionally include an identifier such as an email address.

4.15 Information stored on your device

The App keeps a small amount of data on your device:

• your sign-in token, so you stay signed in — removed when you sign out;
• the guest identifier described in section 4.13;
• your name as provided by Sign in with Apple, if you used it (section 4.2);
• your light or dark theme preference, and whether you dismissed a promotional message;
• which workspace you are using — your personal account or an organization (section 4.18);
• an organization invite link you opened, until you finish accepting it;
• while a guest report purchase is being confirmed (Android), a note of the report being bought, so the App can finish unlocking it if it is closed part-way.

All of this is removed when you uninstall the App. On Android the App opts out of automatic cloud backup, so this data is not copied to your Google backup.

4.16 Location information — we do not collect it

Some information in the Service refers to places — a team's city, a league's country, or a hometown you enter on your own profile. That is descriptive information about a team or a playing career. It is not derived from your device and it does not tell us where you are. Our servers receive the IP address a request comes from, as described in section 4.14; we do not convert IP addresses into location data or use them to work out where you are.

4.17 Other sensitive information we do not collect

The App does not ask for your Social Security Number, national identification number, government identity document, financial account number, precise location, biometric identifier, health record, or information about your race, religion, political opinions, sexual orientation, trade-union membership or criminal history. Please do not enter any of these into free-text fields, messages, MyAgent, video, or support messages.

4.18 Organizations (team workspaces)

An organization is a shared workspace for a club, program or agency. Its members share a pool of credits and a report library. You join one by accepting an invitation, by opening an invite link, or by sending a join request that a manager approves. The App does not create organizations; they are set up with our team. When you use an organization, we store:

• The organization — its name, logo and settings, and, if its owner links one, the team or agency it is attached to;
• Membership — who belongs to it, each member's role (owner, admin or member), and when they joined;
• Invitations and join requests — the email address and role of each person invited, who invited them, and the invitation's status; and for a join request, who asked and any note they added. Invitations are covered by section 4.9;
• Credits and usage — the organization's credit balance, which member spent credits, when, and on what kind of report, and any monthly credit limit a manager set for a member;
• Reports — reports generated inside the organization, who generated them, and whether each one is private to its author or shared with the organization. Reports generated inside the organization stay with it when their author leaves or deletes their account;
• Moved personal items — if you choose to move your personal credits or reports into an organization. Moved credits become the organization's and cannot be moved back; moved reports return to you if you leave;
• Your last workspace — the organization you last used, so the App can reopen it.

Contact sales. If you ask about an organization plan or a change to one, the form sends us the company name, your first and last name, work email, phone number and any message you add. We use these only to answer your enquiry.

The organization's owner and admins can see its members, invitations and join requests, the usage of each member, and the reports shared with it. Members see the organization's shared reports and its member list. Your personal account, reports and credits are not visible to an organization unless you move them into it.

5. Device permissions

The App asks for a permission only when you use the feature that needs it, and you may decline. Declining disables only that feature. You can change permissions at any time in your device settings (Android: Settings → Apps → Basketball Atlas → Permissions; iOS: Settings → Basketball Atlas).

6. Information about athletes from public and third-party sources

The Service includes a basketball database containing information about players, teams, leagues, coaches, agencies and agents. Some of this information relates to people who have never used the App. It is compiled from sources such as publicly published team, league, conference and competition statistics and rosters, official and public sports data sources, and licensed or partner data feeds.

Typical database fields include name, team, league, position, class or role, season statistics and derived analytics, and general biographical details such as height and stated nationality or hometown where those are publicly published as part of a roster. Agent and agency listings may include publicly published business contact details.

We process this information for the legitimate interests of operating a sports analytics service and to provide the analysis our users rely on. Statistical and performance information about competitive athletes is published by the organisers of the competitions in which they play.

7. How we use your information

We use personal information to:

• create, authenticate and maintain your account, including through Sign in with Apple or Google;
• provide the core features — the database, search, favourites, saved searches, profiles and report generation;
• generate AI scouting and comparison reports you request, and MyAgent replies;
• verify claims over athlete, coach and agent profiles and reduce fraudulent claims;
• store, process and deliver video and photos you upload;
• display your profile to other users, with the extended answers and video restricted to paid subscribers and players' contact details shown to nobody, as set out in section 10.1;
• operate the Network features — deliver connection requests, messages, group activity and invitations, and suggest people you may know;
• run organizations — manage membership, invitations and join requests, pool and account for credits, share reports among members, and answer Contact sales enquiries;
• let a limited number of reports be generated without an account, and carry them over if you sign up;
• process subscriptions, credit purchases, free trials and refunds through Apple or Stripe, and track plan entitlements and credit balances;
• show you your own usage and spending history;
• respond to your support requests, feedback and reports of abuse;
• send service emails and, to users on the free plan, reminders about our paid plans (see section 18);
• monitor, debug, secure and improve the Service, including detecting and preventing abuse, fraud and misuse;
• comply with our legal obligations and enforce our terms.

We do not use your personal information for third-party advertising, and we do not sell it. See section 11.

8. Legal bases for processing (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object to that processing — see section 15.

9. AI processing and automated decisions

The Service uses artificial intelligence to generate scouting and comparison reports and to power MyAgent.

Depending on the feature, the following may be processed to produce a result:

• the statistical and biographical data of the player or players concerned;
• contextual information from our database, such as team, league and competition data;
• for MyAgent: your messages, your MyAgent memory, and the profile and preference information you have added, so the advice fits your situation;
• the transcript of an interview clip you uploaded, where it is used in your profile or by MyAgent. The speech-to-text step runs on our own servers; an AI provider may then tidy the transcript.

To produce these results we use third-party AI model providers acting as our processors — currently Anthropic, with OpenAI available as an alternative. They process the content of a request only to return the model's output to us. Our agreements require them to keep the data confidential, use it only on our instructions, and not use it to train their own general-purpose models. We do not send your password or payment details to AI providers.

If you believe a report about you is materially inaccurate, contact us at dean.mazlish@basketballatlas.com and we will review it.

10. How we share information

We share personal information only as described below.

10.1 With other users of the App

A scouting profile is meant to be seen — but not everything on it is seen by everyone:

Parts of a report or a team, league or country page may likewise be restricted to paid plans. Where content is restricted, users on the free plan see only that a section exists, not its contents.

You control what goes into your profile and whom you connect with. You can edit or delete profile content, remove a connection, or leave a group at any time. Bear in mind that a person who could legitimately see your content before you removed it may already have read, copied or saved it — we cannot retrieve or control a copy someone has made outside the Service.

10.2 With service providers (processors)

We use a small number of vendors to run the Service. They act on our instructions under contracts that require appropriate confidentiality and security, and they may not use your information for their own purposes.

10.3 With platform and payment providers

Apple (Sign in with Apple, App Store purchases), Google (Sign in with Google) and Stripe (payments on Android, and the billing record every account has, which contains your email address) receive and process information as independent controllers when you use their services, under their own privacy policies. We share with them only what is needed — for example the transaction identifier when we confirm an App Store purchase with Apple.

10.4 For legal and safety reasons

We may disclose information where we believe in good faith that it is necessary to:

• comply with applicable law, a court order, subpoena or other valid legal process;
• respond to a lawful request from a public or governmental authority;
• enforce our terms of service or investigate potential breaches;
• detect, prevent or address fraud, security or technical issues; or
• protect the rights, property or safety of our users, the public or us.

Where we are legally permitted to do so, we will notify you of a legal demand for your information before disclosing it.

10.5 Business transfers

If we are involved in a merger, acquisition, financing, reorganisation, insolvency or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honour this policy, and we will notify you — in the App or by email — before your information becomes subject to a materially different privacy policy.

10.6 With your direction

We share information in any other way you specifically ask or authorise us to — for example when you send an invitation, email a shared link, or share a profile through your device's share sheet.

11. No sale of personal information

12. International data transfers

We operate internationally. Your personal information is stored and processed in the United States, where our servers and several of our service providers are located, and may be processed in other countries where our providers operate. Data-protection laws in those countries may differ from those in your own.

Where we transfer personal information out of the EEA, the United Kingdom or Switzerland, we rely on an appropriate safeguard recognised under applicable law, which will normally be:

• the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies;
• an adequacy decision covering the destination country or the recipient's certification; or
• another lawful transfer mechanism, supported by additional technical and organisational measures where our assessment shows they are needed.

You may request a copy of the safeguards we rely on by writing to dean.mazlish@basketballatlas.com.

13. How long we keep information

We keep personal information only as long as we need it for the purposes described in this policy, and then delete it or remove its link to you.

We may retain information for longer where necessary to comply with a legal obligation, resolve a dispute, or establish, exercise or defend legal claims.

14. How we protect information

We use technical and organisational measures appropriate to the risk, including:

• encryption in transit using HTTPS/TLS for all communication between the App and our servers;
• encryption at rest for stored data and uploaded media held by our infrastructure providers;
• storage of passwords using a one-way salted hash, never in readable form;
• token-based authentication, with sessions that expire;
• time-limited, signed links for uploading and viewing video and photos, so media is not publicly addressable;
• server-side verification of every App Store purchase with Apple, rather than trusting the device;
• access controls limiting staff access to personal information on a need-to-know basis;
• card processing handled entirely by Apple or Stripe, so card data never reaches our systems;
• logging, error monitoring and rate limits to detect abuse, intrusion and anomalous activity.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password and keep it confidential. If you believe your account has been compromised, or if you discover a security vulnerability, contact us immediately at dean.mazlish@basketballatlas.com.

Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected individuals, within the timeframes set by applicable law.

15. Your rights (EEA, UK and Switzerland)

If the GDPR or UK GDPR applies to you, you have the right to:

• Access — obtain confirmation of whether we process your personal information and receive a copy of it;
• Rectification — have inaccurate information corrected and incomplete information completed;
• Erasure — have your personal information deleted where one of the grounds in Article 17 applies;
• Restriction — have processing limited in the circumstances set out in Article 18;
• Portability — receive the information you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible;
• Object — object at any time to processing based on our legitimate interests, including profiling, on grounds relating to your particular situation, and object at any time, without giving a reason, to receiving reminders about our paid plans;
• Withdraw consent — withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Complain — lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.

To exercise any of these rights, email dean.mazlish@basketballatlas.com. We will respond within one month. That period may be extended by a further two months for complex or numerous requests, in which case we will tell you within the first month and explain why. We do not charge a fee unless a request is manifestly unfounded or excessive.

We may need to verify your identity before acting on a request, so that we do not disclose your information to someone else. We will normally do this through the email address registered to your account.

16. Your rights (California and other U.S. states)

If you are a resident of California, or of another U.S. state with a comprehensive privacy law — including Virginia, Colorado, Connecticut, Utah and Texas, among others — you have the right to:

• Know what personal information we have collected about you, the categories of sources, the business purposes for collecting it, and the categories of third parties we disclose it to;
• Access a copy of the specific pieces of personal information we hold;
• Correct inaccurate personal information;
• Delete personal information we have collected from you, subject to statutory exceptions such as completing a transaction, security, or complying with a legal obligation;
• Opt out of the sale or sharing of personal information, and of targeted advertising and certain profiling. The App does not engage in any of these activities, so there is nothing to opt out of;
• Limit the use of sensitive personal information. We use the limited information described in this policy only for the purposes stated, which are within the permitted business purposes, and never to infer characteristics about you;
• Non-discrimination — we will not deny you service, charge you a different price, or provide a different level of quality because you exercised a privacy right;
• Appeal a refusal of your request, where your state's law provides an appeal right. Reply to our decision and we will review it and respond as required by law.

Submit a request by emailing dean.mazlish@basketballatlas.com. We will acknowledge receipt within 10 business days and respond substantively within 45 days, extendable by a further 45 days where reasonably necessary, in which case we will tell you.

An authorised agent may submit a request on your behalf with proof of your written permission; we may also ask you to confirm the agent's authority directly.

Categories collected. In the preceding twelve months we have collected the following categories of personal information as defined by the CCPA: identifiers; personal information categories listed in the California Customer Records statute; characteristics of protected classifications (age, through date of birth); commercial information; internet or other electronic network activity information; audio, electronic and visual information; professional or employment-related information; and inferences drawn to generate the reports, MyAgent replies and connection suggestions you receive. The sources, purposes and disclosures for each are described throughout this policy.

17. Deleting your account and data

What happens when an account is deleted:

1. Your account, profile, preferences, self-reported statistics, profile claims, favourites, saved searches, connections, the messages you sent, your group memberships, the invitations you sent, your MyAgent conversations and memory, and your credits are deleted immediately. You are signed out, and this cannot be undone.
2. Groups you own are deleted too, together with their message history, for all of their members. If you want a group to continue, leave it before you delete your account — when an owner leaves, ownership passes to another member.
3. If you own an organization, you must first transfer ownership to one of its admins, from the organization's Settings, or ask us to close the organization; the App tells you this before you confirm. If you are a member, your membership ends when your account is deleted.
4. Your uploaded videos and photos stop being available through the Service immediately, and the stored files are purged from our storage provider within 30 days.
5. Reports you generated are kept without a link to your account (reports you first generated as a guest stay marked with that guest identifier), and feedback you sent is kept with the details you entered in it, but without the link to your account.
6. Residual copies in encrypted backups are purged on our standard backup rotation, normally within 90 days, and are never restored into active systems.
7. We keep only what the law requires — principally payment, App Store transaction, invoice and tax records — and information needed to establish, exercise or defend legal claims. This is not used for any other purpose.

You can also delete specific information without closing your account — for example remove a video, clear your phone number, delete a MyAgent conversation or memory item, remove a connection or leave a group. Ask us if there is something you cannot remove yourself.

If you used Sign in with Apple or Google, you can also remove Basketball Atlas from the apps connected to your Apple or Google account. Deleting your account does not remove a publicly sourced athlete, coach or agent record from the database if one exists independently of your account; tell us if you want that record reviewed as well, and we will handle it under section 6.

18. Email and communications

We send the following email:

• Service email — one-time sign-in codes, password resets, a welcome message, receipts and billing notices, free-trial and plan changes, credit changes, security alerts, responses to your requests, and changes to our terms or this policy. These are needed to run your account, so you cannot opt out of them while you hold one.
• Reminders about our paid plans — if your account moves to the free plan after a trial or subscription ends, we send a few reminders about upgrading: shortly after the change and then about once a week while you remain on the free plan. You can stop these at any time by emailing dean.mazlish@basketballatlas.com with the subject line “Unsubscribe”; this does not affect service email.
• Network notifications — an email when someone sends you a connection request, with their name, organisation and message.
• Free-trial reminders by text message or WhatsApp — only if you agreed to them when you signed up on our website, sent to the phone number on your account. You can withdraw that agreement at any time by emailing us, or by replying STOP to a text message.
• Messages another user asks us to send — an invitation or a shared link, as described in section 4.9. They are sent in that user's name; an invitation can be resent while it is pending. We do not add the recipient to any list.

We do not send newsletters, we do not share or sell your email address for marketing, and we do not send email on behalf of any other company. Some of our emails contain a link that tells us when it has been opened, so we can see whether messages are being delivered.

The App does not send push notifications. It may show in-app messages about your plan, credits, connections and messages; these are part of the Service.

19. Third-party services and links

Some screens in the App are provided by other companies: Apple's purchase and subscription sheets on iOS, Google's sign-in page, and Stripe's checkout page on Android (the last two shown inside the App). The App also sends news text to Google Translate for translation, directly from your device, and may open links to third-party sites, such as a player's Instagram profile, a linked highlight video, or a news article. Once you interact with a third-party service, that service's own privacy policy and terms apply, and we are not responsible for its practices.

20. App Store and Google Play disclosures

The privacy details on our App Store listing and our Google Play Data Safety declaration are consistent with this policy. In summary:

• Data collected and linked to your account: contact information (name, email address, and phone number if you add it); user content (profile answers, photos, videos, messages, MyAgent conversations and other content you create); identifiers (your account ID); organization membership and usage, where you belong to one; purchases; usage of the App's features; search history (your recent searches in the App); and date of birth for profile verification.
• Data shared with other users: the profile, Network and group information described in section 10.1.
• Not collected: location (precise or approximate), contacts, browsing history, health, financial account or card details, and advertising identifiers.
• No tracking, no ads: the App does not track you across other companies' apps or websites, contains no advertising, and includes no third-party analytics or advertising SDKs.
• Security and deletion: data is encrypted in transit, and you can delete your account in the App or request deletion as described in section 17.

The App is intended for users aged 13 and over, including minors, and contains no adult content. If you notice any difference between this policy and our store listings, please tell us at dean.mazlish@basketballatlas.com so we can correct it.

21. Changes to this policy

We may update this Privacy Policy to reflect changes to the Service, our practices, or legal requirements. When we do, we will revise the "Last updated" date at the top of this page and publish the new version at this address.

If a change is material — for example a new purpose for using your information, a new category of recipient, or a change that reduces your rights — we will give you prominent notice in the App or by email before it takes effect, and where the law requires it, we will ask for your consent. Continuing to use the Service after a change takes effect means you accept the updated policy.

22. How to contact us