Privacy Policy

1. Overview

Derived Athletics, LLC ("we," "us," or "our") operates FencR. This Privacy Policy explains how we collect, use, store, and share information about you when you use our platform. By using FencR, you agree to the practices described here. If you are a parent or guardian creating or managing an account on behalf of a minor athlete, this policy applies to the information you provide on their behalf as well.

We do not sell or share your personal information, we do not use it for targeted advertising, and we do not permit our vendors to use it for their own purposes. See Section 5.

2. Information We Collect

Information you provide directly:

• Account information: full name, email address, password.
• Profile information: date of birth, profile photo, weapon specializations, city/state/ZIP, and (if provided) your USA Fencing member ID for use in club records and tournament eligibility checks. The USA Fencing member ID is stored as text only and is not currently transmitted to or validated against any USA Fencing system; if FencR later introduces direct validation against a USA Fencing API, we will update this Policy and disclose the data exchange before enabling it.
• Payment information: billing details processed and stored by Stripe (we do not store raw card numbers or bank account numbers). For clubs that accept Zelle, we store only the Zelle handle (email or phone number) you choose to register for receiving payments — we do not access your bank account.
• Club and organization data entered by administrators: schedules, member records, invoices, subscription plans (recurring plans with optional per-cycle typed or unlimited quotas, and one-time pre-paid packs), member groups, training locations, and club settings.
• Parent–child relationship data when a parent links a minor athlete's account to their own, including a parent's ability to manage multiple plan assignments on behalf of a child.
• Camp registrations: the athlete being registered, the selected rate, any note you include with a signup request, and the registration and payment status.
• Club store purchases: the items and options you buy, your order history, and pickup confirmation records.
• Waiver signatures: the signer's name, the signature, and the date and time of signing. We do not record the IP address a waiver is signed from.
• Communications you send us (support requests, feedback), including an optional screenshot you may attach to a support request.
• Notification preferences set in your account settings.
• Your acceptance of these policies: the date and time you accepted, and the version of the Terms of Service and Privacy Policy you were shown.
• Parental consent records: when a parent creates a child profile, we record the date and time of consent and the version of our Children's Privacy Notice they saw. We do not record the IP address or device information of the consenting parent.

Information collected automatically:

• Log data: IP address, browser type, pages visited, timestamps.
• Device information: operating system, device identifiers.
• Usage data: features accessed, actions taken within the platform.
• Aggregated, privacy-preserving page-view metrics collected by Vercel Analytics. These metrics are recorded without third-party cookies and without persistent cross-site identifiers; Vercel hashes IP and user-agent on the edge to derive an anonymous, daily-rotating visitor token that we cannot reverse-engineer to identify you.
• Session authentication tokens (stored in secure HTTP-only cookies).
• Calendar sync tokens if you enable iCal or Google Calendar integration.

Information from third parties:

• If you sign in with Google or Apple, we receive your name and email address from those providers.
• If you verify your email via a one-time passcode during onboarding, we receive delivery and verification status from our email provider.
• Payment transaction data and payout information from Stripe.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account and authenticate you securely.
• Provide the FencR platform and all its features, including scheduling, invoicing, payment processing, and analytics.
• Route invoices and payment responsibility to the correct parent or guardian when a minor athlete is the subject of an invoice.
• Send transactional emails and in-app notifications (invoice delivery, booking confirmations, payment receipts, account alerts).
• If you have given consent, send occasional marketing emails about product updates, new features, and tips. You can withdraw consent at any time from your account settings.
• Respond to demo requests and new-club enquiries, and follow up with you about them.
• Generate club-level analytics and reporting for administrators (aggregated and org-scoped).
• Respond to support requests and communicate with you about your account.
• Detect, investigate, and prevent fraud, abuse, or security incidents.
• Comply with legal obligations, including financial record-keeping requirements.
• Improve the platform based on aggregated usage patterns.

We do not sell your personal data, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or to build advertising profiles.

Legal bases (for users in the EEA and UK):

• Performance of a contract — operating your account, scheduling, bookings, invoicing, and payments.
• Legitimate interests — securing the platform, preventing fraud and abuse, responding to support requests, and improving the product using aggregated usage data.
• Consent — marketing emails, optional integrations you connect, and a parent's consent to create a child profile. You may withdraw consent at any time.
• Legal obligation — retaining financial records for tax and accounting purposes.

4. How We Share Your Information

We may share your information with:

• Your club or organization: Club administrators and coaches can view member profiles, booking history, invoice status, and payment records for members of their organization. Parents can view invoices and payment history for their linked minor athletes.
• Clubs hosting a camp: When you register yourself or your child for a camp, the hosting club's administrators and coaches can view the registration — including the athlete's name, age, weapon, and payment status — even if you are not a member of that club.
• Zelle recipients: When an invoice is set to be paid via Zelle, the payer is shown the recipient Zelle handle (email or phone number) registered by the club or coach. The actual Zelle transfer occurs between the payer's bank and the recipient's bank — FencR does not transmit funds, credentials, or banking details.
• Law enforcement or legal process: If required by law, court order, or to protect the rights, property, or safety of FencR, its users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, in which case user data may be transferred as a business asset. Affected users will be notified in advance.

Service providers we use

These vendors process personal information on our behalf, under contract, and are prohibited from using it for their own purposes:

Notion and Slack receive information only when you contact us — a demo request, a new club signup, or a support ticket. They never receive athlete rosters, booking history, invoices, or payment records.

5. We Do Not Sell or Share Your Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the twelve months preceding the effective date of this Policy, and we do not do so with the personal information of minors under 16 under any circumstances. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" opt-out — there is nothing to opt out of. If that ever changes, we will update this Policy and provide the required opt-out mechanism before the change takes effect.

We also do not use or disclose sensitive personal information for any purpose other than providing the platform to you, and never for inferring characteristics about you.

6. Your California Privacy Rights (CCPA/CPRA)

This section applies to California residents and describes the categories of personal information we collect, as those categories are defined by the California Consumer Privacy Act. It supplements, and does not replace, the rest of this Policy. Residents of other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and Texas) have substantially similar rights and may exercise them the same way.

Notice at collection

We collect this information from you directly, from your club's administrators, and from the third parties listed in Section 2. We disclose it for business purposes only, to the service providers named in Section 4 and to your club. We retain it as described in Section 8.

Your rights

• Know and access the specific pieces and categories of personal information we hold about you.
• Delete personal information we hold about you, subject to legal retention obligations.
• Correct inaccurate personal information.
• Portability — receive a copy in a portable, machine-readable format.
• Limit the use of sensitive personal information — we already limit it to providing the platform, so no action is needed.
• Opt out of sale or sharing — not applicable; we do neither (Section 5).
• Non-discrimination — we will never deny service, charge a different price, or provide a lesser quality of service because you exercised a privacy right. FencR is free for clubs and users regardless.

To exercise any of these rights, use your account settings or email support@derivedathletics.com. We verify requests by confirming control of the account email address, and for sensitive requests may ask for additional information matching what we already hold. An authorized agent may submit a request on your behalf with written permission signed by you; we may also ask you to confirm the agent's authority directly. We respond within 45 days and may extend once by a further 45 days with notice. If we deny a request, you may appeal by replying to our decision, and we will respond to the appeal within 60 days.

7. Children's Privacy

FencR is designed to support clubs that manage minor athletes. A FencR account holder must be at least 13 years old. Fencers under 13 participate through a child profile created and supervised by a parent or legal guardian, which is the flow in which we obtain verifiable parental consent. If someone tells us during signup that they are under 13, we stop the signup and delete the account rather than complete it.

Parents and guardians retain control over their minor's data within the platform, including the ability to update profile information or request deletion by contacting us. Invoices for minor athletes are routed to the linked parent or guardian's account, not to the minor's account.

For full details on what we collect from children, how we use it, who we share it with, the verifiable parental consent mechanism we use, and how you can review or revoke consent, please see our Children's Privacy Notice. Parents see and confirm this notice at the moment they create a child profile, and we record the date, time, and notice version of each consent.

If you believe we have inadvertently collected information from a child under 13 without proper consent, contact us at support@derivedathletics.com and we will delete it promptly.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service, then according to the following schedule:

What deletion actually does. When you delete your account, we scrub your personal information — email address, phone number, date of birth, profile photo, address, and USA Fencing ID — permanently ban the login, cancel your subscriptions and upcoming bookings, and set your club memberships to inactive. Your name is deliberately retained on the historical club records you appear in (past bookings, attendance, and invoices), where you are shown to club staff with a "Deleted account" label. We keep it because those records are the club's books, and stripping a name out of them would corrupt the club's own attendance and financial history. If you want your name removed from a club's records as well, contact us and we will work with the club, subject to their record-keeping obligations.

9. Cookies and Session Tokens

FencR uses secure HTTP-only cookies to maintain your authenticated session. These are strictly necessary for the platform to function and cannot be disabled. We do not use third-party advertising cookies, cross-site tracking pixels, or session replay tools.

We use Vercel Analytics to measure aggregate page views and navigation patterns. It operates without third-party cookies. To distinguish unique daily visitors without tracking identities, Vercel hashes a combination of your IP address and user-agent on the server with a daily-rotating salt; the result is an anonymous token that cannot be linked back to you or correlated across days. Raw IPs are not stored by Vercel Analytics. You can read Vercel's privacy documentation at vercel.com/docs/analytics/privacy-policy.

Because we do not track you across sites, we have nothing to change in response to a Global Privacy Control or "Do Not Track" signal — there is no sale, sharing, or cross-site advertising activity for such a signal to switch off.

If you connect a calendar integration (iCal), we generate a unique feed token stored in your account. You can regenerate or revoke this token at any time from your settings, which will invalidate any existing calendar subscriptions.

10. Data Security

We implement industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest, row-level security policies on our database (ensuring users can only access data within their authorized organizations), and strict access controls. API routes verify authentication and role authorization on every request. Service-role database access is restricted to server-side code only and never exposed to the client.

No method of transmission over the internet is 100% secure. Please notify us immediately at support@derivedathletics.com if you suspect unauthorized access to your account.

Breach notification. If we determine that a security incident has resulted in the unauthorized access, disclosure, alteration, or loss of personal information, we will notify affected users and, where applicable, the affected club administrators acting as data controllers, without undue delay and in any event within 72 hours of becoming aware of the incident — except where law enforcement requests a delay or where notification within that window would materially increase risk to affected users. Notifications will describe, to the extent then known, the nature of the incident, the categories of data involved, the steps we are taking to contain and remediate it, and the steps you can take to protect yourself. Club administrators are responsible for any further downstream notification their members or jurisdictions require.

11. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information (via account settings).
• Delete your account and associated personal data (via account settings → Danger Zone). See Section 8 for exactly what deletion does and does not remove.
• Portability — request a copy of your data in a structured format. Personal and club data exports are available from your settings pages.
• Opt out of non-essential email notifications (via account settings → Email Notifications toggle, or the unsubscribe link in any broadcast email).
• Withdraw marketing consent at any time (via account settings → Marketing Emails toggle). Withdrawal does not affect transactional emails.
• Withdraw consent where processing is based on consent.
• Object to or restrict processing based on our legitimate interests (EEA/UK).
• Lodge a complaint with your local supervisory authority (EEA/UK) or state attorney general (US).

To exercise these rights or make a data request, go to your account settings or contact us at support@derivedathletics.com. We will respond within 30 days, or within the period required by the law that applies to you if it is different.

If your club entered your information into FencR, your club is the controller of that information and we act as its processor. We will forward such requests to your club and assist them in responding.

12. International Users and Transfers

FencR is operated in the United States, and our services are directed to clubs and users in the United States and Canada. All personal information is stored and processed in the United States. If you access the platform from outside those countries, you are doing so on your own initiative and your data will be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.

For clubs and users in the EEA, UK, or Switzerland. Where we process personal data on behalf of a club, that club is the controller and we are its processor. We will enter into a written data processing agreement incorporating the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) on request — email support@derivedathletics.com and we will provide one. We have not appointed an Article 27 representative in the EU or UK, because we do not currently target those markets; if that changes, we will appoint one and update this Policy before doing so.

13. Third-Party Links

FencR may contain links to third-party websites or services (for example, Stripe's payment portal or your club's external website). We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies before providing any personal information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Each version carries a version identifier and effective date at the top of this page, and we record which version you accepted when you created your account. We will notify you of material changes by email or in-app notice before they take effect, and will post the updated policy here. Continued use of FencR after a change takes effect constitutes your acceptance of the revised policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: