Homegrown

Privacy Policy

Effective Date: April 15, 2026 · Last Updated: April 15, 2026

1. Introduction

Homegrown App LLC (“Homegrown,” “we,” “us,” or “our”) is committed to protecting the privacy of all users, especially children. This Privacy Policy describes how we collect, use, disclose, and protect personal information through the Homegrown platform (the “Platform”). This Policy complies with the Children’s Online Privacy Protection Act (COPPA), the Virginia Consumer Data Protection Act (VCDPA), and other applicable privacy laws.

2. Information We Collect

2.1 Information You Provide

Account registration: name, email address, password, date of birth, phone number
Profile information: positions played, team name, competitive level, profile photo
Training data: session attendance, check-in records, performance scores, quiz responses
Communications: messages sent through the Platform, feedback, support requests
Payment information: processed and stored by our third-party payment processor (Stripe); we do not store full credit card numbers

2.2 Information Collected Automatically

Device information: browser type, operating system, device identifiers
Usage data: pages visited, features used, session duration, interaction patterns
Cookies: session cookies for authentication; we do not use advertising or tracking cookies
IP address: collected for security, rate limiting, and fraud prevention

2.3 Information from Third Parties

Program enrollment data provided by your Program
Referral information when you join through a coach referral link

3. Children’s Privacy (COPPA Compliance)

We take children’s privacy seriously and comply fully with COPPA.

3.1 Users Under 13

We do not knowingly collect personal information from children under 13 without verifiable parental consent. When a parent creates a linked player account for a child under 13, the parent provides consent on behalf of the child.

3.2 Parental Rights

Parents of children under 13 have the right to:

Review the personal information we have collected from their child
Request deletion of their child’s personal information
Refuse further collection of their child’s information
Withdraw consent at any time by contacting info@homegrown-app.com

3.3 Data Minimization for Minors

We collect only the minimum information necessary to provide the Platform services for minor users. We do not use children’s data for targeted advertising. We do not sell children’s personal information. Leaderboard displays for users under 16 show first name and last initial only.

3.4 COPPA 2026 Compliance

In accordance with the FTC’s April 2026 COPPA rule amendments, we obtain separate consent for any data sharing beyond core service delivery. We do not use children’s data for AI model training. We do not collect biometric data from minors. We enforce data retention limits and delete children’s data when no longer needed for the service.

4. How We Use Information

We use collected information to:

Provide, maintain, and improve the Platform
Process registrations, bookings, and sessions
Send transactional communications (session reminders, booking confirmations, plan updates)
Display leaderboards and performance tracking within your Program
Facilitate communication between coaches, players, and parents
Ensure Platform security, prevent fraud, and enforce our Terms
Comply with legal obligations

We do NOT use your information to:

Serve targeted advertising
Sell personal data to third parties
Build behavioral profiles for advertising purposes
Train AI or machine learning models

5. How We Share Information

5.1 Within Your Program

Coaches and Program Admins within your enrolled Program(s) can view your profile information, training data, session attendance, and performance metrics as necessary to provide training services.

5.2 Service Providers

We share information with trusted third-party service providers who assist in operating the Platform:

Supabase (database hosting and authentication)
Vercel (application hosting)
Resend (transactional email)
Stripe (payment processing, when applicable)

These providers are contractually obligated to protect your data and use it only for the services they provide to us.

5.3 Legal Requirements

We may disclose information when required by law, subpoena, court order, or to protect the safety of any person.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred to the acquiring entity with advance notice.

5.5 No Sale of Data

We do not sell, rent, or trade personal information to third parties for marketing or advertising purposes.

6. Virginia Consumer Data Protection Act (VCDPA)

If you are a Virginia resident, you have the following rights:

Right to access your personal data
Right to correct inaccurate personal data
Right to delete your personal data
Right to obtain a portable copy of your data
Right to opt out of processing for targeted advertising (we do not engage in this), sale of data (we do not sell data), or profiling for automated decisions

To exercise these rights, contact us at info@homegrown-app.com. We will respond within 45 days.

7. Data Security

We implement industry-standard security measures to protect your data:

All data transmitted over HTTPS with TLS encryption
HSTS (HTTP Strict Transport Security) with preload
Content Security Policy (CSP) headers
Row-Level Security (RLS) on all database tables ensuring users can only access their own data
Role-based access controls for admin, coach, player, and parent accounts
Rate limiting on API endpoints and authentication attempts
Secure httpOnly cookies for session management
Regular security audits of authentication and authorization systems
Password hashing managed by Supabase Auth (bcrypt)

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but will notify affected users promptly in the event of a data breach as required by Virginia law (Va. Code 18.2-186.6).

8. Data Retention

We retain personal data only as long as necessary to perform services:

Active accounts: data retained for the duration of account activity
Deactivated accounts: data retained for 90 days, then permanently deleted
Email logs: retained for 90 days
Session attendance records: retained for 2 years for training history
Payment records: retained as required by applicable tax and financial laws
Children’s data: deleted promptly upon parent request or account deletion

9. Cookies

We use strictly necessary cookies for:

Authentication and session management
User preferences and active profile switching

We do NOT use advertising cookies, analytics cookies, or third-party tracking cookies. Our Platform is ad-free.

10. Third-Party Links

The Platform may contain links to third-party websites (e.g., Zoom for virtual sessions, DocSend for program documents). We are not responsible for the privacy practices of these external sites.

11. Changes to This Policy

We will notify you of material changes to this Privacy Policy through in-app notification or email at least 30 days before the changes take effect. If changes affect children’s data, we will obtain new parental consent where required.

12. Contact Us

Homegrown App LLC

Privacy inquiries: info@homegrown-app.com
General support: info@homegrown-app.com
COPPA requests (parents of children under 13): info@homegrown-app.com
VCDPA data rights requests: info@homegrown-app.com