Privacy Policy

1. Introduction

Welcome to SpiralXO. We respect your privacy and are committed to protecting the personal information you share with us.

This Privacy Policy explains:

• What information we collect
• How we use that information
• How we protect it
• Your rights and choices

By using SpiralXO, you acknowledge this Privacy Policy. Where we rely on consent for specific processing activities (such as optional cookies where required by law), you may withdraw consent at any time.

This Privacy Policy also applies to donors, sponsors, and other people who make a payment to an Organization through SpiralXO without holding an account. Sections 3.J and 22 describe what we collect from you and how it is used.

SpiralXO is operated by FieldIQ Holdings LLC, a Wyoming limited liability company. If you have questions about this Privacy Policy, contact us at privacy@spiralxo.com.

Definitions

Throughout this document, the following terms have specific meanings:

“Organization” refers to the entity (such as a high school, football program, club, or other sports organization) that purchases and controls access to SpiralXO. Organizations are our customers and are responsible for managing user accounts, setting permissions, and ensuring compliance with applicable laws.

“User” refers to any individual who accesses or uses SpiralXO, including coaches, staff members, players, and administrators. Users access the platform through accounts created or authorized by an Organization.

“Minor” refers to any individual under the age of 18, regardless of location. Additional parental consent requirements may apply in certain jurisdictions for users under the age of 16 or 18, as specified by applicable state or regional laws.

“Parent/Guardian Account” refers to a limited-access account granted exclusively to a parent or legal guardian through an organization-issued invitation. By default, a Parent/Guardian Account provides read-only access to designated Organization Events, coach-published Announcements, and compiled Resources. An Organization may, at its discretion, grant a Parent/Guardian Account holder additional capabilities as a Parent Admin or Treasurer, and may allow the account holder to use fundraising features. Parent/Guardian Accounts do not provide access to any football operations features and are entirely optional at the organization’s discretion.

“Parent Admin” refers to a Parent/Guardian Account holder whom a coach admin has authorized to post announcements and links to the organization’s parent group, communicate with the coaching staff through the platform, and create volunteer sign-up opportunities. A Parent Admin has no access to financial information unless separately designated as a Treasurer.

“Treasurer” refers to a Parent/Guardian Account holder whom a coach admin has designated to manage the Organization’s finances through the Finance & Fundraising Module. A Treasurer has the same capabilities as a Parent Admin and, in addition, full access to the Organization’s financial information as described in Section 3.K.

“Organization Event” refers to a calendar event designated by a coach admin or organization administrator as visible to all organization members including Parent/Guardian Account holders, as distinct from Team-only, Group-only, or Individual-specific events.

“Availability Status” refers to the features within SpiralXO that allow Organizations to track whether a player is available for practices, games, training sessions, or other team activities. Availability Status is intended solely for scheduling, attendance, and planning purposes and must indicate only general availability (such as “Available,” “Unavailable,” or “Limited,” or, in the Strength & Conditioning Module, “Here,” “Limited,” or “Out”). It must not include medical diagnoses, health conditions, treatment details, or other protected health information.

“Recruiting Page” refers to an optional, public-facing web page created and controlled by an Organization (or by a coach admin acting on the Organization’s behalf) to showcase selected players for college recruiting and exposure purposes. A Recruiting Page is publicly accessible and is not subject to the role-based access controls that govern other areas of the platform.

“Recruiting Profile” refers to the individual player profile displayed on a Recruiting Page, containing only the information the Organization elects to publish about that player.

“Recruiting Information” refers to the categories of player information an Organization may choose to publish in a Recruiting Profile, including athletic information (such as height, weight, and performance metrics like bench, squat, and 40-yard time), academic information (such as GPA, standardized test scores, accomplishments, and awards), biographical information, current college offers, a linked social media profile, up to three (3) images, and up to three (3) linked YouTube video URLs.

“Strength & Conditioning Module” refers to the optional SpiralXO features, available to Elite-tier Organizations, that allow coaches to build and schedule training programs, run live training sessions, record player performance, and display records and leaderboards.

“Performance Data” refers to athletic performance information recorded through the Strength & Conditioning Module, such as exercises performed, repetitions, weights lifted, times, distances, jump heights, personal records, and testing results. Performance Data is athletic information, not medical or health information.

“Station Device” refers to a shared tablet, phone, or similar device that an Organization connects to a live training session so that players can record their sets. “Display Device” refers to a television or screen that an Organization connects to show live session information, records, and leaderboards. Neither is a User account.

“Finance & Fundraising Module” refers to the optional SpiralXO features that allow an Organization to collect donations, sponsorships, and Player Dues, publish Give Pages, and keep financial records.

“Give Page” refers to the optional, public-facing web page an Organization may publish through the Finance & Fundraising Module to collect donations and sponsorships, including any associated campaign pages, Player Fundraising Pages, sponsor walls, and supporter message walls. A Give Page is publicly accessible and is not subject to the role-based access controls that govern other areas of the platform.

“Player Fundraising Page” refers to the public page created for an individual player when an Organization publishes a fundraising campaign, showing an abbreviated form of the player’s name, the player’s fundraising goal and progress, an optional personal note, and, where permitted, a photo.

“Connected Stripe Account” refers to the account an Organization opens with Stripe, Inc. (“Stripe”) in its own name and connects to SpiralXO in order to receive payments.

“Player Dues” refers to fees that an Organization creates and assigns to players through the Finance & Fundraising Module.

“Payer” refers to any person who makes a payment through the Finance & Fundraising Module, including donors, sponsors, and persons paying Player Dues. Payers are not required to hold a SpiralXO account.

2. Who We Serve

SpiralXO provides software to football organizations (such as high schools, programs, and clubs) to help them manage teams, planning, training, finances, and coordination.

Important distinctions:

• Our customers are organizations, not individual users
• Organizations control access and determine who can use the platform
• All users must be 13 years of age or older
• We do not knowingly collect information from children under 13
• Organizations may optionally extend limited platform access to parents and guardians for communication and logistics purposes through Parent/Guardian Accounts; this feature is entirely optional and all parent/guardian access is controlled exclusively by the organization
• Donors, sponsors, and other Payers interact with an Organization’s public Give Page or a private payment link without creating an account; we process their information on the Organization’s behalf

Organizations are responsible for verifying user eligibility, including age requirements, before granting access to the platform.

3. Information We Collect

A. Organization & Account Information

When an organization creates an account, we collect:

• Organization name
• Organization email address
• Account credentials (encrypted and securely stored)
• Administrative contact information
• Billing information (if applicable)
• If the Organization uses the Finance & Fundraising Module: the status of its Connected Stripe Account, its Stripe account identifier, payout status, and the Platform Fee rates that apply to it

B. Coach & Staff Information

When coaches or staff members are added to the platform, we collect:

• Name
• Email address
• Login credentials (encrypted and securely stored)
• Team and role assignments
• Platform activity data

C. Player Information (Ages 13+)

When players join the platform, we collect:

• Name
• Email address
• Login credentials (encrypted and securely stored)
• Team affiliation
• Role or position (if applicable)
• Jersey number and class year (if applicable)
• Platform usage data (time spent, features accessed, content viewed)

Player Availability Status: Organizations may enter player availability status (such as “Available,” “Unavailable,” or “Limited”) for scheduling and participation purposes only, and a player may record a session check-in (“Here,” “Limited,” or “Out”) in the Strength & Conditioning Module for attendance purposes only. Availability is intended for scheduling and attendance purposes only and should not include medical details. We do not collect diagnoses, treatment details, medical records, or health notes.

• SpiralXO is not a HIPAA-covered entity and does not provide medical services.
• Organizations must not upload Protected Health Information (PHI), clinical medical records, detailed diagnoses, treatment notes, or medical documentation into the platform.
• Availability status should not include specific medical conditions or health details (e.g., diagnoses, protocols, or treatment plans). A “Limited” or “Out” status carries no reason.
• We do not request, require, or process medical records or health data.
• If SpiralXO determines that prohibited health or medical information has been uploaded, we reserve the right to remove such data, restrict features, suspend accounts, or require corrective action.

Player records without accounts: An Organization on a coach-only tier may create a player record by name solely to assign and collect Player Dues. For such a record we store only the name the Organization enters, the team, and the associated Player Dues information. The player has no account, receives no communications, and is never displayed publicly.

D. Parent/Guardian Account Information (Optional)

When an organization chooses to enable Parent/Guardian Accounts and invites parents or guardians to the platform, we collect:

• Name
• Email address
• Login credentials (encrypted and securely stored)
• Organization affiliation
• Any Parent Admin or Treasurer designation made by the organization
• Usage data limited to: login timestamps, Announcements viewed, Resources accessed, Organization Events viewed, and reactions submitted
• For Parent Admins: announcements, links, and volunteer sign-up opportunities they post to the parent group, and messages they send to the coaching staff
• For Treasurers: the financial actions they take in the Finance & Fundraising Module, recorded in the Organization’s audit log
• If the parent chooses to use fundraising features: the player code(s) the parent enters, the resulting association with those players, and share activity (such as how many times the parent’s share links were used)

Important clarifications regarding Parent/Guardian Account data:

• The Parent/Guardian Account feature is entirely optional. Organizations are not required to enable or use it.
• We do not collect health or medical information from Parent/Guardian Account holders.
• Parent/Guardian Accounts are not linked to any player account. A parent may voluntarily associate with a player for fundraising purposes by entering a code the player provides, and may remove that association at any time; this is the only connection SpiralXO records between a parent and a player.
• Parent/Guardian Account holders are not purchasers of SpiralXO and no subscription payment information is collected from them. A parent who pays Player Dues or makes a donation does so as a Payer through a payment link or Give Page, and that payment is not linked to their Parent/Guardian Account (see Section 3.J).
• Parent/Guardian Account data is used solely to provide access to the parent-facing features the organization has enabled.
• We do not use Parent/Guardian Account data for marketing or advertising.

E. Football Program Data

Organizations upload and manage their own content, including:

• Playbooks and practice plans
• Strategy materials
• Depth charts and personnel groupings
• Team schedules
• Internal communications
• Training programs, exercise libraries, and exercise demonstration videos

Your organization retains full ownership of this content.

F. Usage & Technical Data

We automatically collect certain information when you use SpiralXO:

• Login timestamps and session duration
• Features accessed and interaction patterns
• Time spent on different areas of the platform
• Device information (type, operating system, browser)
• IP address and general location data
• Error logs and diagnostic information
• For visitors to a public Give Page or payment link: a hashed form of the visitor’s IP address, kept briefly to prevent abuse of checkout and uploads

This data helps us:

• Operate and maintain the platform
• Monitor performance and security
• Improve functionality
• Troubleshoot technical issues

G. Recruiting Profile Information (Optional)

If an Organization enables the optional Recruiting Page feature and elects to publish a player, we process the Recruiting Information the Organization chooses to publish for that player. This may include:

• Athletic information (height, weight, and performance metrics such as bench, squat, and 40-yard time)
• Academic information (GPA, standardized test scores, accomplishments, and awards)
• Biographical information and current college offers
• A linked social media profile, up to three (3) images, and up to three (3) linked YouTube video URLs

Important clarifications regarding Recruiting Information:

• The Recruiting Page feature is entirely optional and is controlled exclusively by the Organization. The Organization decides whether to enable it, which players appear, and what information is entered; any field left blank is not displayed.
• Athletic performance metrics are not medical information. We do not collect, and you must not enter, diagnoses, injuries, treatment details, or other protected health information.
• Where an Organization uses the Strength & Conditioning Module, a player’s verified Performance Data may be shown as a suggestion in the Recruiting Profile editor. It is added to the Recruiting Profile only if a coach or (where self-editing is enabled) the player chooses to use it.
• Information published to a Recruiting Page is public. See “Public Recruiting Pages and Give Pages” in Section 5 and the dedicated “Recruiting Page Privacy” section below.

H. Strength & Conditioning Information (Optional, Elite Tier)

If an Organization uses the Strength & Conditioning Module, we collect:

• Performance Data: each set a player performs (exercise, repetitions, weight or time, the time it was recorded, and which Station Device recorded it); each player’s personal records and testing results (such as bench, squat, clean, 40-yard dash, vertical jump, and broad jump) with their full history, the source of each entry (coach entry, testing, live session, calculated estimate, or import), and whether it has been verified
• Session check-in: “Here,” “Limited,” or “Out” for each player in each session, which is copied into the Organization’s attendance records when the session ends
• Training assignments: which training group a player belongs to and the player’s team at the time
• Organization content: training programs, exercises, exercise demonstration videos, and coach notes
• Device records: for each Station Device and Display Device, a label chosen by the Organization, a hashed access token, PIN, and expiry
• Audit log: every void or correction of a record, with who made it, when, and the stated reason
• Leaderboards: rankings the Organization builds from Performance Data, filtered by team, unit, position, class year, or season

What the Strength & Conditioning Module deliberately does not collect: injury information, pain or soreness reports, sleep, readiness or wellness scores, body composition, or any medical screening. “Limited” and “Out” are attendance words only, with no reason attached. The module may record a player’s body weight as a training metric where the Organization chooses to track it; body weight is athletic information in the same way as the height and weight fields in a Recruiting Profile. Product analytics for the module record only identifiers, counts, and settings, never player names, jersey numbers, or lift values.

Imports: An Organization may import historical Performance Data from a spreadsheet or another system. We process imported data in the same way as data recorded on the platform.

I. Give Page and Campaign Information (Optional)

If an Organization uses the Finance & Fundraising Module, we process the content it publishes to its Give Page, including the coach’s message, campaign names, goals, deadlines, and incentive prizes, supporter levels, spending summaries, and the sections the Organization chooses to display.

When an Organization publishes a campaign, we also process, for each rostered player:

• An abbreviated form of the player’s name
• The player’s fundraising goal, gifts received, progress, rank, and any prizes earned
• An optional personal note
• A photo, only if the photo is the player’s Recruiting Profile headshot and is already public, or a coach has confirmed that the player’s parent or guardian has approved its use; players’ in-app profile photos are never used
• A player code that the player may give to a parent, and the player’s individual donation link

J. Donor, Sponsor, and Payer Information

Payers do not hold SpiralXO accounts. When a person makes a donation, sponsorship, or Player Dues payment, we collect on behalf of the Organization:

• Donors: name, email address, payment amount, the display name the donor chooses to show publicly (full name, first name only, a custom name, or “Anonymous”), an optional public message, an optional “in honor or memory of” dedication, an optional designation (such as “Equipment”), whether the donor played for the program and their class year, and whether the donor opted in to receive updates from the Organization
• Recurring supporters: the same information as donors, plus the status of their recurring payment
• Sponsors: business name, contact name, email address, phone number, website, banner text, and logo, and whether they paid by card or requested an invoice
• Player Dues payers (usually parents): name, email address, payment history, installment or recurring plan status, and a Stripe customer identifier
• All Payers: the amount paid, the date, whether the Payer chose to cover fees, and any receipt sent

Card and bank details are entered directly with Stripe and are never received, seen, or stored by SpiralXO. Stripe processes them under its own privacy policy.

Where a donor opts in to receive updates, that opt-in is given to the Organization, not to SpiralXO. SpiralXO does not currently send donor updates on an Organization’s behalf and does not use Payer information for its own marketing.

K. Financial Records

For Organizations that use the Finance & Fundraising Module, we process:

• Player Dues bills: the player’s name, team, amount owed, any discount or waiver and the coach’s or Treasurer’s note on why, and paid status
• An income ledger of all donations, sponsorships, Player Dues payments, and cash and check entries, with the Payer and (where applicable) the player each entry relates to
• Expenses, with receipt images or PDFs uploaded by a coach admin or Treasurer, stored privately and opened only through short-lived links
• Printable reports and spreadsheet exports
• An audit log recording every refund, cancellation, waiver, void, deleted expense, and season close or reopen, with who performed it, when, and why

Coach admins and Treasurers can see all of this information, including the real names and email addresses of donors who chose to appear anonymously on public pages.

4. How We Use Your Information

We use the information we collect to:

Provide and Operate the Service

• Create and manage organization and user accounts
• Enable team coordination and planning features
• Facilitate communication within organizations
• Process and display football program content
• Provide customer support
• Provide Parent/Guardian Account holders with access to Organization Events, coach-published Announcements, and compiled Resources designated by the organization, and, where enabled, Parent Admin, Treasurer, and fundraising features
• Run live training sessions, record Performance Data, calculate estimated records, build leaderboards, and display session information and records on Display Devices
• Publish Give Pages and Player Fundraising Pages, process payments through the Organization’s Connected Stripe Account, collect SpiralXO’s Platform Fee through Stripe, send payment confirmations, and keep the Organization’s financial records
• Send push notifications that the Organization chooses to send to players and Parent/Guardian Account holders about fundraising activity, such as gifts received and goals reached

Security and Platform Integrity

• Verify user identity and prevent unauthorized access
• Detect and prevent fraud or misuse, including fraudulent or abusive payment activity
• Monitor for security threats
• Enforce our Terms of Service

Improve SpiralXO

• Analyze usage patterns and trends
• Develop new features and functionality
• Fix bugs and optimize performance
• Conduct research using aggregated, anonymized data

Legal and Compliance

• Comply with applicable laws and regulations
• Respond to legal requests and prevent harm
• Protect our rights and property
• Enforce our agreements

Communications

• Send account-related notifications
• Provide customer support responses
• Send important updates about the platform or our Terms

We do not use your information for:

• Marketing or advertising to players
• Selling personal data to third parties
• Purposes unrelated to operating the platform
• Marketing or advertising to Parent/Guardian Account holders
• Marketing or advertising to donors, sponsors, or other Payers

5. How We Share Your Information

We do not sell your personal information. We share information only in the following limited circumstances:

Within Your Organization

Information is shared with other authorized users in your organization according to the access controls and permissions your organization sets.

Parent/Guardian Account holders can only see content the organization has explicitly designated for parent visibility. Specifically: only Organization Events are visible (not Team-only, Group-only, or Individual-specific events); only coach admin-published Announcements (and, where enabled, Parent Admin-published parent-group announcements) are visible; and only Resources compiled from those Announcements are visible. No football operations data, and no Performance Data, is accessible to or shared with Parent/Guardian Account holders under any circumstances.

A Treasurer designated by the Organization can see the Organization’s full financial information, including donor, sponsor, and Payer names and email addresses, every player’s Player Dues balance and discounts, expenses, and reports. Head coaches and assistant coaches cannot see any financial information.

Within the Strength & Conditioning Module, coaches can see all Performance Data for every player in the Organization. A player can see only their own workouts, set history, and records, plus the Organization’s leaderboards, which show each ranked player’s name, jersey number, and result.

Public Recruiting Pages and Give Pages

If your Organization enables the optional Recruiting Page feature, the Recruiting Information it elects to publish about a player is displayed on a public-facing web page. If your Organization enables the optional Finance & Fundraising Module and publishes a Give Page, the content it elects to publish (including the coach’s message, campaign details, the sponsor wall, the supporter message wall, leaderboards, spending summaries, and, for each rostered player on a published campaign, a Player Fundraising Page showing an abbreviated form of the player’s name, goal, progress, note, and any approved photo) is also displayed on public-facing web pages. Recruiting Pages and Give Pages are the only categories of platform data that are intentionally made public. Unlike all other information on SpiralXO—which is restricted by role-based access controls and is not shared across organizations—information published to a Recruiting Page or Give Page is accessible to anyone on the internet and may be viewed, copied, downloaded, cached, indexed by search engines, or shared by third parties, including college recruiters, media, and the general public.

On a Give Page, donors appear by the display name they chose (which may be “Anonymous”), supporter messages appear on the message wall, sponsors appear by business name, logo, and banner text, players appear only by an abbreviated form of their name, and members of any recurring supporter program are shown only as a count. Player Dues pages and checkout pages are not public pages: they are reachable only by a private link and are marked so that search engines do not index them.

A coach admin or Treasurer may hide a player’s Player Fundraising Page from the public campaign at any time. A player whose page is hidden may still share their individual donation link with people they choose, and a person who opens that link will see the player’s abbreviated name.

Once information has been made public, we cannot control how third parties use it and cannot guarantee its removal from third-party systems, search engine caches, or archives, even after it is unpublished or deleted from the platform. The Organization controls what is published and is solely responsible for obtaining all consents required to publish a player’s information, including verifiable parental or guardian consent for any player who is a Minor.

Display Devices and Station Devices

A Display Device shows, to anyone who can see the screen, the current exercise and prescribed weight for each player in a live session, recently recorded sets, saved leaderboards, and, when a player sets a personal record, a card showing the player’s jersey number, name, exercise, new record, and previous record. A Station Device shows the names and check-in status of the players in the session it is connected to. The Organization decides where these devices are placed and who can see them.

Exercise Demonstration Videos

Exercise demonstration videos uploaded by a coach are stored as links that can be viewed by anyone who has the link. Organizations should not upload videos that identify a Minor by name and must have consent from any identifiable person who appears.

Stripe

When an Organization uses the Finance & Fundraising Module, Payer information needed to process a payment (such as name, email address, and amount) is shared with Stripe, which processes the payment on the Organization’s Connected Stripe Account, sends receipts, and operates the customer portal through which Payers manage recurring payments. Stripe also shares the Organization’s account status, payout information, and transaction records with SpiralXO so that we can operate the module and collect our Platform Fee. Stripe handles payment information under its own terms and privacy policy, available at stripe.com.

Service Providers

We work with trusted third-party service providers who help us operate SpiralXO. These currently include:

• Stripe (payment processing for the Finance & Fundraising Module, including card and bank data, receipts, payouts, and the customer portal)
• Supabase (database, file storage, and server functions)
• Amazon Web Services (cloud infrastructure underlying our hosting and database services)
• Vercel (website and application hosting)
• PostHog (product analytics and session recording; loads for all visitors and users, including before any cookie choice is made; sensitive input fields are masked; for the Strength & Conditioning and Finance & Fundraising Modules, configured to receive identifiers, counts, and settings only, not player names, jersey numbers, lift values, or payer details)
• Google Analytics (website usage analytics)
• Apple and Google (push notification delivery to the iOS and Android apps)
• GoHighLevel (SpiralXO’s own subscription billing to Organizations and customer communications; not used for program funds)
• Calendly (demo and meeting scheduling)

These providers:

• Access information only as needed to perform their functions
• Are contractually obligated to protect your data
• Cannot use your information for their own purposes

Legal Obligations

We may disclose information when required by law or in response to:

• Valid legal process (subpoenas, court orders, warrants)
• Governmental or regulatory requests
• Emergency situations involving safety or security
• Protection of our rights, property, or users

Business Transfers

If SpiralXO is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you and provide choices before your information is transferred or becomes subject to a different privacy policy.

With Your Consent

We may share information for other purposes with your explicit consent.

6. Support Access and Account Impersonation

To provide effective customer support, troubleshoot technical issues, and resolve platform problems, our support team may need to access user accounts using administrative privileges. This practice is commonly known as “support impersonation” or “login-as-user.”

When Support Impersonation Occurs

We may use support impersonation to:

• Diagnose and resolve technical issues that cannot be addressed remotely
• Investigate reported bugs or platform errors
• Verify reported problems in real-time
• Assist with account recovery or configuration issues
• Provide hands-on customer support when necessary

Support impersonation is used only:

• When necessary to resolve a support request or technical issue
• With appropriate authorization from organization administrators (when feasible)
• By authorized support staff who have undergone security and privacy training in accordance with our internal security policies and access controls

Support impersonation applies to all account types on the platform, including Parent/Guardian Accounts, on the same terms described in this section.

SpiralXO Administrative Access to Finance & Fundraising

In addition to support impersonation, authorized SpiralXO staff can see each Organization’s fundraising and dues totals, Platform Fees, Connected Stripe Account status, and payment status in order to operate the module, set Platform Fee rates, and respond to fraud or legal risk. SpiralXO staff may suspend an Organization’s payments or take a Give Page offline where our Terms permit. SpiralXO staff never see card or bank details, which are held only by Stripe.

Logging and Accountability

We maintain detailed logs of all support impersonation activities, including:

• The support staff member who accessed the account
• The date and time of access
• The duration of the session
• The reason for access

These logs are:

• Retained for security, compliance, and audit purposes
• Reviewed regularly to ensure proper use
• Protected with the same security measures as other sensitive data

Your Rights

You may request a record of support impersonation events related to your account by contacting us at privacy@spiralxo.com. Organization administrators can also review access logs through their administrative dashboard (where available).

By using SpiralXO, organizations authorize support impersonation as described in this section for legitimate support and security purposes.

We are committed to using support impersonation responsibly and only when necessary to serve you better.

7. Data Retention

We retain your information for as long as necessary to:

• Provide the service to your organization
• Comply with legal obligations
• Resolve disputes and enforce our agreements

When your organization terminates its account:

• Active user access is immediately disabled
• Your Give Page is taken offline and no further payments can be accepted
• We retain data for up to 90 days to allow for account recovery, renewal, or data export. (‘Grace Period’)
• After this period, we delete or anonymize personal information, except for financial records as described below
• Some information may be retained longer for legal, security, or legitimate business purposes
• Certain sensitive data related to minors (such as player availability logs) may be deleted earlier, typically within thirty (30) days, to reduce privacy risk.
• Aggregated, anonymized data may be retained indefinitely

After the Grace Period:

• Personal information is deleted or anonymized, except for financial records as described below
• Aggregated, anonymized data may be retained indefinitely
• Security, audit, and access logs may be retained beyond the Grace Period as required for compliance, security, or legal purposes.

Parent/Guardian Account access is automatically disabled upon lapse or termination of the organization’s subscription. When an individual Parent/Guardian Account is removed by the organization, that account’s personal data is flagged for deletion on the same 90-day Grace Period timeline, except for any financial records in which the person appears as a Payer or as a Treasurer who performed a recorded action. Organizations may also request earlier deletion of specific Parent/Guardian Account data by contacting us at privacy@spiralxo.com.

Recruiting Page and Give Page content: When an Organization unpublishes a Recruiting Page or Give Page, hides or removes a player, or deletes a field, that content is removed from the SpiralXO-hosted page. However, because these pages are public, copies that third parties have already viewed, downloaded, cached, or indexed (including by search engines or web archives) are outside our control, and we cannot guarantee their removal.

Strength & Conditioning records: While a player’s account is active, Performance Data and records are kept with their full history; coaches may void an entry but cannot delete it, and every void is logged. When a player’s User account is deleted, that player’s Performance Data, records, session check-ins, and training-group history are deleted. Organization-level content (programs, exercises, and demonstration videos) follows the Grace Period timeline above.

Financial records are retained indefinitely. Because an Organization’s financial records must remain complete and accurate, we retain the income ledger, Player Dues bills, expenses and receipts, Payer information, and the financial audit log (including refunds, cancellations, waivers, voids, and deleted expenses, with who performed them, when, and why) for as long as SpiralXO operates, including after the Organization’s account is terminated and after any User account is deleted. When a player’s account is deleted, the player’s name is retained on historical bills and fundraising records; the player’s Player Fundraising Page is taken offline but retained so that past records still show which player a gift was for. A request to delete personal data that appears in a financial record will be honored to the extent it does not compromise the completeness of the Organization’s financial records or conflict with legal, tax, or accounting retention requirements; where it does, we will restrict the data rather than delete it.

You can request deletion of specific data at any time by contacting us at privacy@spiralxo.com.

8. Data Security

We implement reasonable technical and organizational security measures to protect your information, including:

• Industry-standard encryption for data in transit and at rest
• Secure password hashing (we never store plain-text passwords)
• Access controls and authentication mechanisms, enforced at the database level so that no Organization can see another’s data
• Regular security monitoring and audits
• Employee training on data protection
• Detailed logging of administrative access and support impersonation activities
• Hashed, expiring access tokens for Station Devices and Display Devices, limited to the session or display they were created for
• Private, short-lived links for expense receipts and private payment links for Player Dues
• Card and bank details handled only by Stripe, never by SpiralXO

However, no system is completely secure. While we work hard to protect your information, we cannot guarantee absolute security against all threats. You also play a role by:

• Using strong, unique passwords
• Keeping login credentials, join codes, PINs, display links, and private payment links confidential
• Reporting suspicious activity immediately

9. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

Access and Portability

You can request a copy of the personal information we hold about you.

Correction

You can update or correct inaccurate information through your account settings or by contacting us.

Deletion

You can request deletion of your personal information, subject to legal and operational requirements, including the retention of financial records described in Section 7.

Restriction

You can request that we limit how we use your information in certain circumstances.

Objection

You can object to certain processing of your information.

Withdrawal of Consent

Where we rely on consent, you can withdraw it at any time.

To exercise these rights, contact us at privacy@spiralxo.com. If you are a donor, sponsor, or other Payer, you may also contact the Organization you paid, which is responsible for your information under applicable privacy law; we will assist the Organization in responding to your request.

Organization Controls

Remember that your organization controls access to SpiralXO. Organization administrators can:

• Manage user accounts and permissions
• Update organization information
• Export or delete data
• Terminate the organizational account
• Add or remove Parent/Guardian Account holders, Parent Admins, and Treasurers at any time
• Hide any player’s Player Fundraising Page, unpublish a Give Page, and choose which sections of a Give Page are public
• Revoke any Station Device or Display Device

10. Children’s Privacy

SpiralXO is designed for users 13 years of age and older. We do not knowingly collect personal information from children under 13.

Age Verification Responsibility

Organizations are responsible for verifying that all users meet minimum age requirements before adding them to the platform. SpiralXO relies on organizations to confirm eligibility during user onboarding.

We may require organizations to confirm age compliance as part of account setup or renewal.

If we discover that we have collected information from a child under 13:

• We will delete that information as quickly as possible
• We will notify the relevant organization
• We may suspend or terminate the account

If you believe a child under 13 has created an account, please contact us immediately at privacy@spiralxo.com.

Organizations are responsible for:

• Verifying that all users meet age requirements
• Obtaining required parental or guardian consents
• Ensuring compliance with applicable child protection laws
• Supervising and safeguarding minor users (ages 13-17)

The Parent/Guardian Account feature does not alter or reduce the organization’s responsibility for COPPA compliance, parental consent obligations, or any applicable state law requirements. SpiralXO does not verify the relationship between a Parent/Guardian Account holder and any player in the organization. Organizations are solely responsible for ensuring that individuals invited as Parent/Guardian Account holders have a legitimate relationship to the program, and for managing that access in compliance with any applicable custody arrangements, court orders, or legal restrictions on communication. SpiralXO takes no position on and has no liability for disputes arising from parental rights, custody arrangements, or disagreements over who is entitled to receive organizational communications.

Recruiting Pages and Minors. The optional Recruiting Page feature can make a Minor’s information publicly available on the internet. Publishing any Minor’s information on a Recruiting Page requires verifiable consent from the player’s parent or legal guardian, which the Organization is solely responsible for obtaining and retaining. SpiralXO does not verify consent, age, or parental or guardian relationships, and does not independently publish or restore any Recruiting Profile. The Recruiting Page feature does not shift any COPPA, FERPA, or child-protection compliance responsibility to SpiralXO, and Organizations remain solely responsible for compliance with all applicable laws governing the public display of minors’ information and student-athlete name, image, and likeness (NIL), which vary by state.

Give Pages, Player Fundraising Pages, and Minors. The optional Finance & Fundraising Module can make a Minor’s abbreviated name, fundraising goal and progress, personal note, and (where approved) photo publicly available on the internet, and can send fundraising notifications to Minors and give Minors share links and suggested messages to send to their own contacts. Publishing any Minor’s information on a Player Fundraising Page requires verifiable consent from the player’s parent or legal guardian, which the Organization is solely responsible for obtaining and retaining and for honoring by hiding the player’s page where consent is absent or withdrawn. The Organization is responsible for supervising any Minor who participates in fundraising. SpiralXO does not verify consent, age, or parental or guardian relationships. The feature does not shift any COPPA, FERPA, or child-protection compliance responsibility to SpiralXO.

Strength & Conditioning and Minors. The optional Strength & Conditioning Module records Minors’ Performance Data and displays Minors’ names, jersey numbers, and results on leaderboards visible to the Organization’s coaches and players and on Display Devices visible to anyone in the room. The Organization is solely responsible for deciding whether to use these features, for where it places Display Devices, and for obtaining any consents it determines are required under its own policies or applicable law. Parents and guardians cannot view their child’s Performance Data through SpiralXO; requests for that information should be directed to the Organization.

11. Your Responsibilities

If You’re an Organization

You are responsible for:

• Ensuring you have lawful authority to collect and share user data with us
• Complying with applicable privacy and data protection laws (including FERPA, COPPA, GDPR, etc.)
• Informing your users about how their data will be used
• Obtaining necessary consents from users or their guardians
• Managing user access and permissions appropriately
• Ensuring that all Parent/Guardian Account invitations are issued to individuals with a legitimate relationship to the program
• Promptly removing Parent/Guardian Account access when that relationship ends
• Determining which events are designated as Organization Events and taking responsibility for the appropriateness of that designation for external parent/guardian visibility
• Managing Parent/Guardian Account access in compliance with any applicable custody arrangements or legal restrictions on communication
• Selecting, vetting, and supervising any Parent Admin or Treasurer you designate, and arranging any confidentiality or volunteer agreements you require of them
• Acting as the party responsible under applicable privacy law for the personal information of donors, sponsors, and Payers collected on your behalf, including honoring their requests and any update opt-in they give you
• Deciding where Display Devices are placed and who can see them, and keeping Station Device and Display Device codes confidential
• Obtaining all consents required before publishing any player’s information on a Give Page or Player Fundraising Page, and hiding a player’s page where consent is absent or withdrawn

If You’re a User

You are responsible for:

• Providing accurate information
• Keeping your login credentials secure
• Using the platform in accordance with our Terms of Service
• Respecting other users’ privacy
• If you are a Treasurer, using the financial and personal information you can see only to manage the Organization’s finances and keeping it confidential

12. State and Regional Privacy Rights

California Residents (CCPA/CPRA)

SpiralXO acts as a Service Provider and does not sell or share personal information for cross-context behavioral advertising.

If you’re a California resident, you have specific rights under the California Consumer Privacy Act:

• Right to Know: What personal information we collect, use, and share
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise these rights, contact us at privacy@spiralxo.com.

European Economic Area, UK, and Switzerland (GDPR)

Data Processing Role

Where applicable, SpiralXO acts as a Data Processor on behalf of organizations, which act as Data Controllers. This includes the personal data of donors, sponsors, and Payers, which the Organization collects through SpiralXO for its own fundraising purposes. SpiralXO acts as an independent Data Controller for the limited data it processes for its own purposes, such as collecting its Platform Fee, security, and fraud prevention. See our EU Privacy Policy Addendum for details.

If you’re in the EEA, UK, or Switzerland, you have rights under the General Data Protection Regulation, including:

• Access, correction, and deletion rights
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent
• Right to lodge a complaint with your local supervisory authority

Legal Basis for Processing: We process your information based on:

• Contract performance: To provide the service you’ve requested
• Legitimate interests: To improve and secure our platform
• Legal obligations: To comply with applicable laws
• Consent: Where we’ve obtained your explicit consent

Other Regions

We comply with applicable privacy laws wherever we operate. If you have questions about your rights, contact us at privacy@spiralxo.com.

13. International Data Transfers

SpiralXO is based in the United States. If you access our platform from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

These countries may have different data protection laws than your country. When we transfer data internationally, we implement appropriate safeguards, such as:

• Standard contractual clauses
• Adequacy decisions by relevant authorities
• Other legally recognized transfer mechanisms

14. Cookies and Tracking Technologies

SpiralXO uses cookies and similar technologies to:

• Keep you logged in
• Remember your preferences
• Analyze platform usage
• Improve performance and security

Types of Technologies We Use

Essential Cookies: Required for the platform to function (authentication, security)

Analytics Cookies: Help us understand how users interact with SpiralXO. PostHog analytics loads automatically when you visit or use SpiralXO; Google Analytics loads only where you have consented, where consent is required.

Functional Cookies: Remember your settings and preferences

Information Stored on Your Device

In addition to cookies, SpiralXO may store the following on your device:

• On a Give Page or payment page: a draft of your checkout information for up to two hours, so that you can resume if you are interrupted
• On a Display Device: a sign-in that keeps the display connected for up to one year unless the Organization revokes it
• On a Station Device: sets recorded while the device is offline, kept until they upload when the connection returns

Your Choices

Most browsers allow you to control cookies through settings. However, disabling essential cookies may affect your ability to use SpiralXO.

15. Third-Party Links

SpiralXO may contain links to third-party websites or services, including linked YouTube videos, social media profiles, and sponsor websites published on Recruiting Pages and Give Pages. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before sharing information with them.

We are not responsible for the privacy practices or content of third-party sites.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in our practices
• Legal or regulatory requirements
• New features or functionality

When we make changes:

• We’ll post the updated Privacy Policy with a new “Last Updated” date
• For material changes, we’ll notify you via email or platform notice
• Your continued use of SpiralXO after changes take effect means you accept the updated Privacy Policy

We encourage you to review this Privacy Policy periodically.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices:

FieldIQ Holdings LLC
30 N. Gould St.
Sheridan, WY 82801
Email: privacy@spiralxo.com

18. Additional Information for Specific Contexts

FERPA Compliance (Educational Records)

For purposes of the Family Educational Rights and Privacy Act (FERPA), SpiralXO acts as a ‘school official’ with legitimate educational interests when designated as such by an organization through a written agreement or Data Processing Addendum.

If your organization is subject to the Family Educational Rights and Privacy Act (FERPA), you are responsible for ensuring compliance. SpiralXO can function as a “school official” with legitimate educational interests when properly designated, but you remain responsible for:

• Maintaining appropriate agreements
• Ensuring proper use of educational records
• Protecting student privacy rights
• We do not sell, rent, or use student data for marketing or advertising
• Upon contract termination, we will return or delete student data in accordance with our retention policy and any applicable Data Processing Addendum (DPA), subject to the retention of financial records described in Section 7

Recruiting Pages and education records: Academic information that an Organization elects to publish on a Recruiting Page (such as GPA and standardized test scores) may constitute an education record under FERPA. Public display of such information may require parental or eligible-student consent or appropriate directory-information handling. Organizations are solely responsible for ensuring that any public display of academic information complies with FERPA and applicable law.

Performance Data and Player Dues records: Depending on how a school uses them, Performance Data recorded in the Strength & Conditioning Module and Player Dues records may also be treated as education records under FERPA. Organizations that are schools are responsible for determining whether FERPA applies and for handling these records accordingly.

Data Processing Addendum (DPA)

School districts may request a DPA outlining data use limitations, security measures, and data return or deletion obligations.

Youth Sports Organizations

Organizations working with minors (ages 13–17) should:

• Have appropriate child safeguarding policies
• Obtain necessary parental consents
• Ensure proper supervision
• Comply with applicable youth protection laws

19. Data Flow Transparency

Data Segmentation & Access Controls

SpiralXO uses role-based access controls, enforced in the database, to ensure that:

• Organization data is logically separated from other organizations
• Users can access only the data permitted by their role
• Coaches, staff, and players see only team-relevant information
• Parent/Guardian Account holders can access only Organization Events, coach-published Announcements, compiled Resources, and (where enabled) the parent-group, volunteer, and fundraising features explicitly designated for parent visibility by the organization; no football operations data and no Performance Data is accessible to Parent/Guardian Account holders
• Financial information is accessible only to coach admins and Treasurers, never to head coaches, assistant coaches, players, or other parents
• Station Devices can only add sets to the one session they joined and read that session’s roster names, check-ins, and celebrations; Display Devices have read-only access to the Organization’s live sessions, records, and leaderboards; both expire and can be revoked
• Payers can see only the public Give Page and, for Player Dues, only the bill whose private link they hold
• Recruiting Information that an Organization elects to publish on a Recruiting Page, and content that an Organization elects to publish on a Give Page, are, by design, made publicly available and are the sole exceptions to the access controls described above; no other organizational data is exposed through these features

Except for Recruiting Information and Give Page content that an Organization chooses to publish, data is processed solely to provide platform functionality and is not shared across organizations or made public.

20. Parent/Guardian Account Privacy

This section summarizes the key privacy information specific to Parent/Guardian Accounts in plain language.

What we collect: If your organization invites you as a Parent/Guardian Account holder, we collect your name, email address, login credentials, any Parent Admin or Treasurer designation the organization makes, and limited usage data reflecting your interactions with Organization Events, Announcements, and Resources. If you post to the parent group as a Parent Admin, we store what you post. If you act as a Treasurer, your financial actions are recorded in the organization’s audit log. If you enter a player’s code to help with fundraising, we record that association and how often your share links are used.

What we do not collect: We do not collect health or medical information or payment information from Parent/Guardian Account holders. If you pay Player Dues or make a donation, you do so through a payment link or Give Page as a Payer, and that payment is not linked to your Parent/Guardian Account.

How your data is used: Your data is used solely to provide you with access to the parent-facing features your organization has enabled: the Organization Events calendar, coach-published Announcements, compiled Resources, and, where enabled, the parent group, volunteer sign-ups, fundraising share tools, and (for Treasurers) the Finance & Fundraising Module.

Who controls your access: Your access to SpiralXO is controlled entirely by the organization that invited you. The organization may revoke your access, or your Parent Admin or Treasurer designation, at any time, for any reason, without notice. SpiralXO does not independently grant, modify, or restore Parent/Guardian Account access.

What you can see: You can only see content the organization has explicitly designated for parent visibility. You cannot access playbooks, depth charts, practice plans, player data, scouting information, Performance Data (including your own child’s), or any other football operations content. If you are a Treasurer, you can additionally see the organization’s full financial information, including other families’ Player Dues balances and the names and contact details of donors and sponsors; you must use that information only to manage the organization’s finances and keep it confidential.

COPPA and child protection compliance: The Parent/Guardian Account feature does not shift any COPPA, FERPA, or child protection compliance responsibility to SpiralXO. Organizations remain solely responsible for these obligations.

Custody and parental rights: SpiralXO does not verify the relationship between a Parent/Guardian Account holder and any player in the organization, and takes no position on custody arrangements or parental rights disputes. Organizations are solely responsible for determining who is entitled to receive organizational communications.

Support access: Our support team may access Parent/Guardian Accounts using the same support impersonation process described in Section 6 of this Privacy Policy.

Data deletion: You may request deletion of your personal data at any time by contacting privacy@spiralxo.com. Your data will also be deleted or anonymized within 90 days of your account being removed or the organization’s subscription lapsing, except for any financial records in which you appear as a Payer or as a Treasurer who performed a recorded action, which are retained as described in Section 7.

21. Recruiting Page Privacy

This section summarizes the key privacy information specific to the optional Recruiting Page feature in plain language.

What it is: A Recruiting Page is an optional, public-facing web page that an Organization can create to showcase selected players for college recruiting. It is controlled entirely by the Organization.

What we publish: Only the Recruiting Information the Organization elects to publish for a selected player. This may include athletic information (height, weight, and metrics such as bench, squat, and 40-yard time), academic information (GPA, standardized test scores, accomplishments, and awards), a bio, current offers, a linked social media profile, up to three images, and up to three linked YouTube videos.

It is public: Information on a Recruiting Page is accessible to anyone on the internet and may be viewed, copied, cached, indexed by search engines, or shared by third parties. Recruiting Pages and Give Pages are the only parts of SpiralXO that are intentionally public. Once information is public, we cannot guarantee its removal from third-party systems even after it is unpublished or deleted.

What we do not collect or publish: We do not collect or publish health or medical information. Athletic performance metrics are not medical information, and diagnoses, injuries, and treatment details must never be entered anywhere on the platform.

Who controls it: The Organization decides whether to enable the feature, which players appear, and what information is entered (any field left blank is not displayed). The Organization (or a coach admin acting on its behalf) may also choose to let players edit their own profiles—this is off by default—but the Organization remains responsible for all published content. SpiralXO does not independently publish, modify, or restore any Recruiting Profile.

Performance Data suggestions: If the Organization uses the Strength & Conditioning Module, a player’s verified records may be suggested in the profile editor. Nothing is published unless a coach or (where self-editing is enabled) the player chooses to use the suggestion.

Consent and minors: Publishing a Minor’s information requires verifiable parental or guardian consent, which the Organization is solely responsible for obtaining. SpiralXO does not verify consent, age, or parental or guardian relationships. The feature does not shift COPPA, FERPA, or child-protection responsibilities to SpiralXO.

Third-party links: Linked YouTube videos and social media profiles are hosted by third parties and governed by their own terms and privacy policies, which are outside our control.

Data deletion: An Organization can unpublish a Recruiting Page or remove a player or field at any time. You may also request deletion of your personal data by contacting privacy@spiralxo.com. Removal from the platform does not guarantee removal of copies already cached or saved by third parties.

22. Finance & Fundraising Privacy

This section summarizes the key privacy information specific to the optional Finance & Fundraising Module in plain language, for Organizations and for the donors, sponsors, parents, and other Payers who interact with it.

What it is: The Finance & Fundraising Module lets an Organization collect donations, sponsorships, and Player Dues through a public Give Page and private payment links, and keep its books. Each Organization connects its own Stripe account; every payment goes directly to that account, and SpiralXO never holds the money. SpiralXO collects a Platform Fee on each payment through Stripe.

If you donate or sponsor: You do not need an account. We collect, on the Organization’s behalf, your name, email address, amount, and the optional details you choose to give (public display name, message, dedication, designation, alumni status and class year, and whether you want updates from the Organization). Sponsors also give a business name, contact details, website, banner text, and logo. Your card or bank details go directly to Stripe and are never seen or stored by SpiralXO. A receipt is shown on your confirmation screen, and Stripe may email one to you.

If you pay Player Dues: You pay through a private link the Organization sends you. We collect your name, email address, and payment history, and Stripe assigns you a customer identifier. You can manage or cancel a recurring payment through the Stripe customer portal linked from your payment. Your payment is not linked to any Parent/Guardian Account you may hold.

What is public: The Give Page, campaign pages, sponsor wall, supporter message wall, leaderboards and spending summaries (if the Organization turns them on), and each Player Fundraising Page. Donors appear by the display name they chose, including “Anonymous.” Sponsors appear by business name, logo, and banner text. Players appear only by an abbreviated form of their name, with a photo only where it is already public on the Recruiting Page or a parent has approved it. Monthly supporters are shown only as a count. Player Dues pages and checkout pages are private and hidden from search engines.

Who sees your information inside the Organization: Coach admins and Treasurers (parents the Organization has designated to manage its finances) can see the names, email addresses, and payment histories of every donor, sponsor, and Payer, including donors who chose to appear anonymously on the public page, as well as every player’s dues balance. Head coaches, assistant coaches, players, and other parents cannot.

Who is responsible for your information: The Organization you paid collects your information through SpiralXO for its own fundraising purposes and is responsible for it under applicable privacy law. If you opted in to updates, the Organization—not SpiralXO—may contact you. SpiralXO does not market to donors, sponsors, or Payers.

Tax: SpiralXO is not a charity, does not verify any Organization’s tax status, and does not issue tax receipts. Whether your payment is tax-deductible is a matter between you and the Organization.

Players and minors: Publishing a campaign creates a Player Fundraising Page for each rostered player. The Organization is responsible for obtaining parental consent before a Minor’s information is shown and may hide any player’s page at any time; a player whose page is hidden can still share their own donation link directly. Players receive push notifications, chosen by the Organization, about gifts and goals. SpiralXO does not send text messages; any message a player or parent sends to their own contacts is sent from their own device.

Data retention: Financial records, including your name, email address, and payment history as a Payer, are retained indefinitely as part of the Organization’s permanent financial records, even after the Organization leaves SpiralXO. Refunds and cancellations are recorded, not erased. If you ask us to delete your information, we will do so to the extent it does not compromise the completeness of the Organization’s financial records; otherwise we will restrict it.

SpiralXO’s role: SpiralXO operates the module, sets and collects its Platform Fee, can see each Organization’s totals and payment status, and may suspend an Organization’s payments or take a Give Page offline where our Terms permit. SpiralXO staff never see card or bank details.

Your rights: You may contact privacy@spiralxo.com or the Organization you paid to access, correct, or request deletion of your information.

23. Strength & Conditioning Privacy

This section summarizes the key privacy information specific to the optional Strength & Conditioning Module in plain language.

What it is: The Strength & Conditioning Module lets coaches at Elite-tier Organizations build training programs, run live lifting sessions in which players record their sets on shared devices, keep each player’s records, build leaderboards, and show live session information and records on a television in the weight room.

What we collect about players: Each set recorded (exercise, reps, weight or time, when, and on which device); personal records and testing results with their history, source, and verified status; a “Here,” “Limited,” or “Out” check-in for each session; training-group membership; and leaderboard rankings. The module may record body weight as a training metric where the Organization chooses to track it.

What we do not collect: Injuries, pain or soreness, sleep, readiness or wellness scores, body composition, or any medical information. “Limited” and “Out” are attendance words with no reason attached. Analytics about the module never include player names, jersey numbers, or results.

Who can see it: Coaches see everything for every player in the Organization. Players see only their own workouts, history, and records, plus the Organization’s leaderboards, which show each ranked player’s name, jersey number, and result. Parents and guardians, including Parent Admins and Treasurers, cannot see any of it, including their own child’s. Nothing from the module appears on any public web page.

Shared devices and the weight room TV: Anyone who holds a session’s join code and PIN, or scans the code on the TV, can open a station device and see the names and check-in status of the players in that session. The TV shows each player’s current exercise and prescribed weight, recent sets, saved leaderboards, and, when a player sets a personal record, a card with the player’s jersey number, name, exercise, new record, and previous record, to anyone in the room. The Organization decides where the TV is placed and who can see it.

Leaderboards and celebrations: There is no setting to exclude an individual player from leaderboards or celebrations. The Organization is responsible for deciding whether to use these features and for any consents it determines are required.

Recruiting: A player’s verified records may be suggested in the Recruiting Profile editor, but nothing is published to a Recruiting Page unless a coach or (where self-editing is enabled) the player chooses to use it.

Demonstration videos: Exercise videos a coach uploads are stored as links that anyone with the link can view. Organizations should not upload videos that identify a Minor by name.

Data retention: Records are kept with their full history while a player’s account is active; coaches can void an entry but not delete it, and every void is logged. When a player’s account is deleted, their Performance Data is deleted.

Your rights: Players and parents may contact privacy@spiralxo.com or the Organization to access, correct, or request deletion of a player’s information.