Privacy Policy

1. Scope

This policy covers all services operated by Scholar Basketball Pte Ltd under the league.scholarbasketball.com domain and the SBA League mobile app on the Apple App Store and Google Play. It does not cover scholarbasketball.com (our public marketing site) or join.scholarbasketball.com (our enrolment site), which are governed separately.

2. What we collect

Admin and coach accounts

• Email address and a name you provide when an admin invites you to the platform.
• A password you choose during invite setup. Passwords are stored using scrypt with a per-password salt — we never see or store your password in plain text.
• Active session records: an opaque session id (HMAC-signed in your browser/app cookie), creation time, expiry, user-agent string, and IP address. Used to detect and revoke compromised sessions.
• Last-login timestamp.

Player & team data

• Player name, year of birth, optional photo, and league assignments. We collect year of birth only — not full date of birth — because age-band eligibility is yearly. Photo upload is optional.
• For external academy registrations: contact details (parent/guardian email and phone), team names, jersey numbers, and player rosters submitted via the registration form.
• For SBA-enrolled players: an opaque Mindbody client id we use to keep player records in sync with our enrolment system.

Match data

• Per-match scoring events (baskets, fouls, timeouts, period transitions), team and player jersey numbers, final scores, and stat lines.
• On the mobile app and web scoring screen, an in-progress match is also cached locally on your device (browser localStorage / app AsyncStorage) so a tab close mid-game doesn't lose the running score. This local cache is cleared once the match is finalised.

Email delivery

• When we send transactional emails (invites, password resets, registration confirmations), the recipient address and message are processed by our email provider, Resend, who delivers the message on our behalf. Resend retains delivery metadata per their own policy.

Server logs

• Our hosting provider, Railway, records request-level information (IP address, request path, response status, timing). Used for debugging and abuse prevention; not joined to user identity beyond what's already in our session table.

3. What we don't collect

• No third-party analytics or tracking. We do not use Google Analytics, Facebook Pixel, Mixpanel, or any other analytics SDK. The platform has no advertising.
• No location, camera, microphone, or contacts access from the mobile app. We do not request these permissions.
• No selling or sharing of personal information for advertising or marketing purposes, ever.

4. How we use it

We use the information above to operate the league: to authenticate coaches and admins, record the results of matches, manage rosters and registrations, and communicate operational messages such as account invites and password resets. We do not use it for any purpose unrelated to running the league.

5. Sharing & processors

We share information only with the service providers necessary to run the platform:

• Railway (US-based) — hosting and Postgres database for our application.
• Resend (US-based) — outgoing transactional email delivery.
• Mindbody — read-only sync of SBA-enrolled client records (no personal data is sent from us to Mindbody; we only consume what Mindbody already holds for the family).

We do not share personal information with any other third party except where required by law.

6. Retention

• Account data is kept until the account is disabled or deleted by an admin. Disabling immediately invalidates all active sessions; deletion removes the account row.
• Sessions expire after 7 days and are then eligible for cleanup. Logging out revokes the session immediately.
• Match results and stats are kept indefinitely as the league's operational history. If a player's record needs correction, contact us at the address below.
• Registration submissions are kept while the season is active and archived afterwards.

7. Children's data

Scholar Basketball is a youth basketball league; the majority of players in our records are under 13 years of age. We treat this data with extra care:

• Player records are created and managed by parents, guardians, or coaches — not by children directly. The mobile app and admin console are not intended for use by children.
• We collect only the data needed to run the league: name, year of birth, optional photo, jersey number, and team assignment.
• Player records, photos, and stats are visible only to authenticated league admins, coaches, and (for a player's own record) the registering parent or guardian. They are not exposed publicly except where the league publishes match results, standings, or MVP recognition.
• If you are a parent or guardian and want to review or remove your child's information, contact us at the address below.

8. Security

We protect your information with industry-standard measures: HTTPS for all traffic, scrypt-hashed passwords with per-user salts, HMAC-signed session cookies, DB-backed session revocation, and per-user audit on access-controlled endpoints. Despite our best efforts, no service can promise absolute security; if you suspect a breach affecting your account, contact us immediately.

9. Your rights

You may at any time:

• Request access to the personal information we hold about you or your child.
• Ask us to correct inaccurate information.
• Ask us to delete your account or your child's player record, subject to retention of operational records (e.g. historical match results) where deletion would distort the league's history.
• Withdraw consent for any optional data we hold (e.g. photo).

Contact us at enquiries@scholarbasketball.com and we will respond within a reasonable time.

10. Changes

We may update this policy as our practices evolve. The “Last updated” date at the top reflects the most recent change. Material changes will be communicated by email to active accounts before they take effect.

11. Contact

Scholar Basketball Pte Ltd
enquiries@scholarbasketball.com