Privacy Policy

Last updated November 7, 2026

1. Who this policy covers

This policy explains how Nextgradus ("Nextgradus," "we," "us") handles personal information on nextgradus.com, on the athlete pages we host (including pages on a family's own domain), and in the emails we send. It covers three groups of people:

• Account holders: the adult who signs up and pays. If the athlete is under 18, this is their parent or guardian.
• Athletes: the person each page is about.
• Visitors: anyone who views a page, including coaches, and anyone who sends a message through a page.

The Terms of Service also apply.

2. Information we collect

When you sign up

• The account holder's name and email address, and the athlete's first and last name.
• A record of your agreement: which boxes you checked, which version of the terms you agreed to, the date and time, and the internet (IP) address you signed up from.
• Payment. Stripe collects your card details and billing ZIP code on its own secure page. We never see or store your full card number. From Stripe, we get a customer number, your plan's status and renewal date, and whether payments succeeded.

What you put on the page

Families decide what to add. That can include:

• profile details, such as position, graduation year, school, club, jersey numbers, height, hometown, and academic details like GPA or test scores;
• a photo, game film and video links;
• schedules and team calendar links, along with the events they bring in (dates, times, opponents and locations);
• stats and game results;
• contact details for the athlete and parents;
• coach references' names, titles, emails and phone numbers;
• social media handles;
• names and notes for personal links.

When you sign in

• Your password, which is stored only in scrambled (hashed) form, so we can't read it.
• A sign-in cookie.
• The date, time and IP address of each sign-in, so you and we can spot access you didn't expect.

If you connect YouTube (optional)

We store the access that Google gives us, read-only, so we can list the channel's public videos and show you their view counts. We don't post to the channel. You can disconnect at any time, both from the page's admin and from your Google account settings. Our use of Google data follows the Google API Services User Data Policy, including its Limited Use requirements.

When someone visits a page

To build each family's visit reports, we record:

• which pages were viewed and when;
• clicks on videos, contact links and other links on the page;
• whether the device was a phone or tablet, or a computer;
• the website that sent the visitor, if any;
• approximate location (country, region and city). Our network provider, Cloudflare, estimates this from the IP address;
• the visitor's IP address, and the name of the network it belongs to, such as an internet provider, company or school. We look that name up in a database stored on our own server, so the IP address isn't sent anywhere else to do it;
• a random visitor ID stored in a cookie, so repeat visits can be counted;
• which personal link was used, if the visitor arrived through one.

We don't record visits by the family's own signed-in devices, and we try to leave out search engines and other automated traffic.

When a visitor sends a message

A message includes the sender's name, school or program, email address, message, and the time it was sent. It goes to the athlete's family.

When you email us or use our contact form

We keep your name, email address, message and our reply so we can help you.

Technical logs

Our server keeps short-term logs, which can include IP addresses, so we can fix errors and stop abuse.

3. Cookies and similar tools

Cookies are small files that websites store in your browser. We use only our own cookies, and only for running the service and counting visits. We don't use advertising cookies or outside analytics services.

Other companies may also receive information when your browser contacts them:

• YouTube: videos play through YouTube's privacy-enhanced mode. YouTube may set its own cookies once a video is played.
• Google Fonts: your browser loads fonts from Google, which receives your IP address.
• Stripe: Stripe's checkout and billing pages set Stripe's own cookies.

You can block or delete cookies in your browser settings. The pages will still work, but visits may be counted more than once. Because we don't track people across other websites, we don't respond to "Do Not Track" signals differently.

4. How we use information

• To host and show athlete pages, and keep them up to date. This includes pulling in videos and calendar events, and making the printable profile.
• To show families visit reports and deliver coach messages to them. This includes email alerts that families turn on, such as an alert when a personal link is opened or when a visit comes from a school's network.
• To create accounts, send activation links and password resets, process payments, and send receipts, renewal reminders and notices about failed payments.
• To answer your questions and requests.
• To keep the service secure, stop spam and abuse, and enforce our terms.
• To fix problems and understand how the service is used overall, so we can improve it.
• To follow the law, and to protect the rights and safety of athletes, visitors, us and others.

We don't sell personal information. We don't share it for targeted advertising, and we don't use it to make automated decisions that have legal or similar effects on anyone. We don't use the content of pages or messages to train AI models.

5. Who can see or receive information

• The public. Once a family publishes a page, everything on it can be seen by anyone with the link. The page may also show up in search engines. Families can keep a page private until it's ready.
• The athlete's family. The account holder, and anyone they share their login with, sees the page's visit reports and the messages sent through it. Visit reports show the information listed in section 2 for each visit, including approximate location and network name.
• Companies that help us run the service. They only get what they need to do their job for us:
  • Stripe: payments and billing.
  • Google: sending our emails through Gmail, web fonts, YouTube video playback, and YouTube channel access if you connect it.
  • Cloudflare: carries all traffic to our pages and protects against attacks.
  • Team calendar providers you link, such as PlayMetrics: we fetch your calendar from them, but don't send them your personal information.
• When the law requires it, or when we believe in good faith that sharing is needed to protect someone's safety, to investigate fraud or abuse, or to enforce our terms. This includes reports to the National Center for Missing & Exploited Children where the law requires.
• If the business changes hands. If Nextgradus is sold, merged or reorganized, information may transfer to the new owner. That owner must keep following this policy, and we'll tell account holders by email.
• With your permission, in any other case.

6. Children and teens

• Nextgradus isn't for children under 13. We don't knowingly collect personal information about them or allow pages about them. If we learn that we have, we'll take the page down and delete the information. If you believe a page is about a child under 13, please tell us at [email protected].
• Athletes 13 to 17. A parent or legal guardian must sign up, hold the account, and control the page. The parent or guardian decides what's published and can see, change or delete anything on the page at any time.
• Safety. We encourage families to share only what helps coaches. Leave off home addresses and the athlete's personal phone number, and remember that the schedule publicly shows game times and places.

7. Keeping information secure

We use reasonable safeguards for a service of our size:

• encrypted connections (HTTPS) for every page;
• passwords stored only in hashed form;
• card details handled entirely by Stripe;
• single-use links that expire, for activation and password resets;
• limits on repeated sign-in and form attempts;
• owner-only access to the server and its data.

No system is perfectly secure, so we can't guarantee security. If a breach affects your personal information, we'll notify you as the law requires.

8. How long we keep information

Copies in backups, if any, are deleted when those backups are replaced.

9. Your choices and rights

Everyone has these choices, wherever they live. Some state laws, including Minnesota's and California's, also give residents specific privacy rights. We honor the requests below for everyone, whether or not a law requires it.

• See or get a copy of the personal information we have about you.
• Correct it. Most page details can be edited directly in the page's admin.
• Delete it. This includes deleting a whole page and its account. Deleting a page with an active plan cancels the plan.
• Visitors and coaches can ask us to delete their visit records or messages for a page. Tell us the page address and roughly when you visited or wrote. Keep in mind that an email alert the family already received can't be taken back.
• People named on a page, such as a coach reference, can ask us to remove their details.
• Emails. We only send service emails: activation, billing, renewal reminders, coach messages, and alerts that families choose. We don't send marketing emails.

To make a request, email [email protected]. We may need to confirm who you are, for example by replying from the account's email address. We'll respond within 45 days. We won't treat you differently for using these rights. If we turn down a request, you can appeal by replying to our answer, and we'll respond to the appeal within 45 days. If you're unhappy with how we handled it, you can contact your state attorney general.

An authorized agent can make a request for you if they can show they have your permission.

10. Where information is stored

Nextgradus is run from the United States. Our servers are in Minnesota. The companies listed in section 5 may process information in the United States and elsewhere. The service is meant for people in the United States.

11. Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll email account holders before it takes effect. We won't use information already collected in a significantly different way without asking first.

12. Contact us

Nextgradus
Email: [email protected]