Version 1.1 · November 2, 2026

Privacy Policy

Install Football LLC

Last Updated: November 2, 2026

1. Introduction

Install Football LLC ("Install Football," "we," "us" or "our") is a Pennsylvania limited liability company that provides private, web-based playbook training and scout card tools to football programs. This Privacy Policy describes how we collect, use, disclose and protect information in connection with installfootball.com, each team site hosted on a subdomain of installfootball.com (for example, yourteam.installfootball.com), and the related services we provide (collectively, the "Service").

We provide the Service to schools, colleges and their athletic programs, not to individuals. If your Program has entered into a written agreement with us, including any student data privacy agreement, the terms of that agreement will control to the extent they conflict with this Privacy Policy.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Definitions

"Program" means the school, college, district or athletic program that has an account with us, and on whose behalf Authorized Users access the Service.

"Authorized User" means a coach, staff member or player whom a Program has invited to use the Service.

"Team Content" means the plays, formations, terminology, signals, scout cards, quizzes and other materials that a Program provides or creates through the Service.

"Student Data" means information about a student that we receive or create through the Service and that is an education record under the Family Educational Rights and Privacy Act ("FERPA") or is otherwise protected by applicable student privacy law.

3. Information We Collect

We collect only the information needed to provide the Service. We do not ask Authorized Users for their names, dates of birth, home addresses, telephone numbers or photographs, and we do not collect photographs of players.

3.1 Account Information. When a coach invites a user, we receive that user's email address, team, role (coach or player), side of the ball (offense or defense) and the dates of invitation and account activation.

3.2 Quiz and Activity Information. When players use assigned quizzes, we collect the quizzes assigned, the answers submitted, scores and the time of submission.

3.3 Team Content. We store the Team Content that a Program's coaches provide or create, or that we prepare at the Program's direction when setting up its site. Team Content may include images a Program supplies as teaching material, such as photographs of a coach demonstrating hand signals.

3.4 Sign-In Security Information. To operate two-step sign-in, we keep when a user's session started and was last seen, how many sign-in codes were sent to that user that day, and scrambled (hashed) versions of sign-in codes and remembered-device tokens, with their expiry dates. We do not record device names or models in these records.

3.5 Billing Information. We collect the Program's name, billing contact and invoice records. If a Program pays by card, the card details are submitted directly to our payment processor; we do not receive or store full card numbers.

3.6 Information Collected Automatically. When you use the Service, our hosting provider automatically receives technical information such as your IP address, browser type, the date and time of each request, and error logs.

3.7 Information Stored on Your Device. Practice progress, such as flashcard streaks and personal best scores, and certain display settings are stored in your browser's local storage on your own device and are not transmitted to us.

3.8 Information We Do Not Collect. We do not collect Social Security numbers, grades, transcripts, health or injury information, precise geolocation, or device contacts.

4. How We Use Information

We use the information described above solely to provide the Service to the Program that supplied it, including to:

(a) create and authenticate accounts and send invitation, password-reset and sign-in verification emails;

(b) display each Program's Team Content to its Authorized Users;

(d) set up, maintain, support and troubleshoot the Program's site;

(e) invoice the Program and maintain business records;

(f) protect the security and integrity of the Service and prevent misuse; and

(g) comply with applicable law.

We do not sell personal information or Student Data. We do not display advertising, engage in targeted advertising, build profiles of students for any purpose other than providing the Service, or use one Program's Team Content or results to benefit another Program.

5. How We Share Information

5.1 Within the Program. Players can see their own team's Team Content and their own quizzes and results. Coaches can see their own team's Team Content, scout cards, roster email addresses and their own players' quiz results. No Program can see another Program's information.

5.2 Service Providers. We share information with the service providers listed below, who process it on our behalf solely to provide their services to us and are not permitted to use it for any other purpose.

Provider	Purpose	Information processed
Supabase, Inc.	Sign-in and accounts. It also still holds a locked, unused copy of older roster and quiz records from before they moved to Cloudflare on October 29, 2026; that copy has not yet been deleted	Email address, password hash, team, role and sign-in records. In the older copy: email address, team, role, side, quiz assignments and results
Cloudflare, Inc.	Hosting and security; each school's own database (D1); nightly backups in private storage (R2)	Team content; roster, quiz assignments, results and sign-in security records; technical data such as IP address
Resend, Inc.	Sends invite, password-reset and sign-in code emails	Email address and the content of those emails, including the sign-in code
GitHub, Inc.	Private code repository, which also holds playbook content used to publish each school's site	Team playbook content, including signal photos. Never roster, email or quiz records
Anthropic, PBC (Claude)	AI coding assistant used to build and support the software; "Help improve Claude" is turned off	Playbook and signal materials used to build a school's site. Never Student Data

Of these providers, only Supabase, Cloudflare and Resend process Student Data. We will update this list, and notify Programs, before engaging a new service provider that will process Student Data.

5.3 At the Program's Direction. We will share information when the Program directs us to do so.

5.4 Legal Requirements. We may disclose information if required to do so by law, such as in response to a valid subpoena or court order. Where Student Data is concerned, we will notify the Program before responding unless we are legally prohibited from doing so.

5.5 Business Transfers. If Install Football is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, provided that the recipient agrees to honor the commitments in this Privacy Policy. We will notify Programs before any such transfer.

6. Cookies and Similar Technologies

We use only strictly necessary cookies. Two cookies keep Authorized Users signed in and expire after 30 days or when the user signs out. One short-lived cookie holds a sign-in while the user enters a code (10 minutes), one remembers a device if the user asks (90 days), and one holds a password reset (15 minutes). All of them are marked HttpOnly (they cannot be read by scripts on the page) and Secure (they are sent only over encrypted connections). We do not use advertising cookies, analytics services, tracking pixels or social media plug-ins. If we introduce analytics in the future, we will update this Privacy Policy before doing so.

7. Data Security

We maintain administrative, technical and physical safeguards designed to protect information against unauthorized access, use or disclosure. These include encryption of all data in transit using HTTPS; encryption at rest provided by our hosting and database providers; invitation-only accounts with no public registration; two-step sign-in for every Authorized User, using a password and a 6-digit code sent by email; short-lived sign-in tokens (approximately 15 minutes, renewed automatically); server-side verification of each request against the user's team and roster; a separate database for each Program's roster and quiz data; nightly backups to private storage; database access restricted to the Service's own servers; and two-factor authentication on the Google (email), Cloudflare, GitHub, Supabase and Resend administrative accounts that operate the Service.

No method of transmission or storage is completely secure. If we confirm a security incident involving a Program's information, we will notify the Program within 72 hours of confirmation, or sooner if required by the Program's agreement or applicable law.

8. Data Retention and Deletion

We retain a Program's information for as long as the Program maintains an account with us, unless the Program asks us to delete it sooner.

8.1 Removal of a User. When a coach removes an Authorized User, that user's access ends immediately. The user's quiz results remain part of the Program's records until a coach deletes them or the Program's account ends.

8.2 Deletion Requests. We will delete information a Program asks us to delete within 30 days and confirm the deletion in writing.

8.3 End of Service. When a Program's account ends, the Program may request a copy of its information within 30 days. We will then delete the Program's site, data and accounts and confirm the deletion in writing.

8.4 Backups. Nightly backup copies are retained for 90 days and are then deleted automatically, except that the backup job always keeps each Program's newest seven copies so that a failure cannot erase the last good copy. When a Program's account ends, we delete those remaining copies as well, within 90 days. Backups are used only to restore the same Program's site.

8.5 Older Copy of Records. Before roster and quiz records moved to each Program's own database on October 29, 2026, they were held in data tables at Supabase. A locked copy of those older records, which the Service no longer reads and browsers cannot reach, remains there and has not yet been deleted. It is covered by the deletion commitments in this Section 8.

We may retain billing records for as long as required by tax and accounting law.

9. Student Data and FERPA

When a school or college uses the Service, Install Football acts as a "school official" with a "legitimate educational interest" under FERPA (34 C.F.R. § 99.31(a)(1)(i)(B)), and the school retains direct control over its Student Data. With respect to Student Data, we (a) use it only to provide the Service to that school; (b) follow the school's reasonable written directions regarding its use, retention and deletion; (c) do not re-disclose it except to the service providers identified above, under obligations at least as protective, or as required by law; (d) do not sell it or use it for advertising or marketing; and (e) make it available to the school on request so the school can respond to requests from students and parents.

Students and parents should direct requests to inspect, correct or delete education records to their school. If we receive such a request directly, we will refer it to the school and assist the school in responding.

10. Children's Privacy

The Service is intended for high school and college athletes and their coaches. It is not directed to children under 13, and Programs may not invite anyone under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly and notify the Program.

11. K–12 Programs and State Student Privacy Laws

For high schools and other K–12 schools, our agreement is with the school, district or an organization acting on the school's behalf, and never with individual students or parents. Players cannot create their own accounts. We will comply with applicable state student privacy laws, which prohibit, among other things, targeted advertising to students, the creation of student profiles for non-educational purposes and the sale of student information, and which require reasonable security measures. We will also sign a school's student data privacy agreement, such as the Student Data Privacy Consortium's National Data Privacy Agreement or a state version, on request. The school is responsible for providing any notices to parents or obtaining any consents that its own policies require.

12. Your Rights and Choices

Players may ask their coach to correct or remove their account, or contact us directly. Programs may request a copy of, or the deletion of, their information at any time by contacting us. Any individual may ask us what personal information we hold about them; where the information is Student Data, we will respond through the individual's school. Depending on where you live, you may have additional rights under applicable privacy law, and we will honor those rights as required.

13. Links to Other Sites

Some Team Content links to systems we do not operate. For example, a Program's signal videos may be hosted on the Program's own SharePoint or similar service. We do not store that content, and the Program's own settings and policies govern who can open it.

14. Where Information Is Processed

The Service is intended for use in the United States. Our service providers may process information in the United States and in other countries where they maintain facilities, subject to their contractual commitments to us.

15. Do Not Track

Because we do not track users across third-party websites or use information for advertising, we do not respond differently to "Do Not Track" browser signals.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify each Program's coaches by email at least 30 days before the change takes effect and will update the "Last Updated" date above. We will not use Student Data in a materially different manner without the school's prior consent.

17. Contact Us

If you have questions about this Privacy Policy or our practices, please contact Install Football LLC at InstallFootballOfficial@gmail.com.