Youth FIRST Athletics, LLC · Brevard County, Florida
Youth FIRST Athletics — Privacy Policy
Effective date: August 17, 2026
Youth FIRST Athletics, LLC ("Youth FIRST," "we," "us") is a youth rugby and athletic-training business in Brevard County, Florida, run by Coach Jon Shimer. This Privacy Policy explains what information our app collects, why, who can see it, and the controls families have. It applies to everyone who uses the Youth FIRST Athletics app: parents and guardians, athletes, and the coach.
We wrote this to be read by parents, not lawyers. If anything is unclear, ask us — contact details are at the end.
The short version: We collect only what a youth training relationship needs. Families see only their own family's data. There are no ads, no sale of data, no third-party trackers, no AI features, no biometrics, and no audio recording. Children under 13 never have a login and we never collect information directly from them — parents manage everything.
1. Who this covers, and how accounts work
Athletes under 13 have no login. A parent or guardian creates and manages the athlete's profile entirely. We do not collect any information directly from a child under 13. (See our separate COPPA Direct Notice to Parents for the full children's-privacy notice.)
Athletes 13–17 may have their own login, but the account cannot join the team until a parent account explicitly approves the link. Parents retain visibility and control described throughout this policy.
Turning 13: when a parent-managed athlete turns 13, there is an upgrade path to their own (parent-approved) login. Nothing changes without the parent's action.
Parents/guardians hold the primary accounts and make all consent decisions.
The coach (Jon Shimer) is the administrator and sees athlete training information as described below.
2. Information we collect
Account and enrollment information (provided by the parent)
Athlete name, date of birth, sport, and school (school is visible only to the coach and the athlete's own family)
Parent/guardian name, email, phone, and relationship to the athlete
Home address, city, and ZIP code
Physician name and phone; emergency contact
Medical notes and allergy information; injury reports (including any reported at signup)
Signed liability waiver (electronic signature, stored with the version signed)
Photo/video release election (an explicit yes or no; changeable only by the guardian)
Daily wellness check-ins: mood, soreness (including a tap-where-it-hurts body map), sleep, nutrition, hydration, headspace, and motivation, on 1–10 scales
XP and rank derived automatically from activity — this gamification is opt-in, and a family can opt out at any time
Injury and return-to-play logs, including doctor's-note uploads (stored in a private storage bucket)
Nutrition information (FIRST Fuel)
FIRST Fuel provides fueling ranges, never a diet, based on a parent intake form.
Under 10: parent-only — the athlete sees nothing
Ages 10–13: the athlete gets a read-only view with no numbers, and no nutrition data is collected from them
Ages 14–17: full view
Optional food and water logging
The coach never sees any individual's nutrition data. The only thing the coach can see is an opt-in every 2 weeks "fueling pulse" summary.
Photos and video
Family-uploaded highlight photos and videos, stored in a private storage bucket served via signed URLs
A photo or video appears in the public squad reel only if the family has opted in and the coach approves each item; the family can withdraw at any time
Coach-uploaded exercise demonstration media
Team social features (within the team only)
Squad feed posts (athletes appear as first name + last initial only)
Team chat (three channels; the athletes-only channel requires guardian permission that is re-confirmed every time it is enabled; a profanity filter runs; the coach moderates; parents can read the athletes' channel)
Kudos reactions
Leaderboards (first name + last initial)
Monthly squad totals (aggregate only — no names)
Testimonials (submitted by families, published by the coach)
Optional public recruit page — created only by the family, shared by a family-controlled token link, revocable at any time
Communications data
Web push notification subscriptions (the subscription endpoint is stored)
Email, sent through Resend: confirmations, digests (including the Sunday parent digest), reminder nudges, and deletion notices
We do not send SMS.
Payment information
The app stores payment status and session counts only. Payments happen entirely outside the app (Venmo, Cash App, Zelle, PayPal, or cash). We never collect or store card numbers or bank details.
Technical information
Timezone and a last-seen timestamp, used for reminder timing
Client-side error logs, to fix bugs
Local storage / offline cache on your device, which expires and is cleared on logout
An audit trail whenever sensitive information is revealed in the app
3. What we do NOT collect or do
Parents reading privacy notices often look for these, so we say them plainly:
No AI features. No information is processed by or fed to artificial-intelligence systems.
No biometrics. No fingerprints, face data, or similar identifiers.
No audio recording.
No ads and no ad networks.
No sale or rental of data — ever.
No third-party analytics or trackers.
No SMS.
Embedded YouTube links use YouTube's reduced-tracking player.
Links that leave the app (our Discord policy page — Discord is separate, 13+, and parent-visible by policy; Calendly; social profiles) are labeled as external links.
4. How we use information
Deliver coaching: workout plans, check-ins, benchmarks, goals, and progress tracking
Run FIRST Fuel fueling guidance under the age rules above
Operate team features (feed, chat, kudos, leaderboards) under the visibility rules above
Send the communications you've enabled (push, digest, reminders)
Track payment status and session counts (no payment processing)
Maintain security, audit sensitive-data access, and fix errors
Meet legal obligations (e.g., retaining the signed waiver)
We use information for the training relationship — nothing else.
5. Who can see what
Row-level security in our database isolates each family. One family can never see another family's data. This is enforced at the database layer, not just in the app's screens.
The coach sees roster, training, wellness, medical/emergency, and injury information needed to coach safely — but never individual nutrition data (only the opt-in fueling pulse).
Other team families see only what the team features intentionally show: first name + last initial in the feed and leaderboards, and nameless monthly squad totals — and each of these can be turned off per athlete (see Section 8).
The public sees nothing unless a family chooses it: the opt-in, coach-approved squad reel; a family-published testimonial; or a family-created recruit page behind a revocable token link.
6. Service providers
We use a small number of infrastructure providers to run the app. They process data on our behalf and are not permitted to use it for their own purposes:
Supabase — database (Postgres) and private file storage, hosted in the United States, with row-level security
Cloudflare Pages — hosting for the app's static files
Resend — email delivery
We do not disclose personal information to anyone else, except if required by law (for example, a valid legal request) or to protect the safety of an athlete.
7. Data security
Row-level security isolating every family at the database layer
Photos, videos, and doctor's notes in private buckets accessed only by expiring signed URLs
An audit log of sensitive-information reveals
Versioned consent records (waiver, releases, chat permission) with a downloadable audit log
On-device cache that expires and is cleared on logout
No system is perfectly secure, but we design so that the sensitive data of minors is never openly addressable and never visible across family boundaries.
8. Your choices and controls (already built into the app)
Per-athlete visibility controls: turn the squad feed, leaderboards, testimonials, and monthly-totals inclusion on or off for each athlete
Photo/video release: explicit yes/no, changeable only by the guardian; public-reel opt-in withdrawable anytime
Chat permission: the athletes-only channel requires guardian consent re-confirmed at every enable
XP/rank: opt-in; a family can opt out
Fueling pulse: opt-in
Notification controls: manage push and email preferences
Data retention choice per athlete: keep until you request deletion, a rolling 12 months, or keep until age 17 with 30 days' notice before removal
Deletion: immediate, triple-confirmed, self-serve deletion in the app, plus a data-removal request queue with status tracking (see our Data Retention & Deletion document)
Notice changes: this policy is versioned; every material change requires re-acceptance before continued use
9. Children's privacy (COPPA)
We comply with the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506; 16 C.F.R. Part 312). Children under 13 have no login and we collect no information directly from them; parents provide and control all under-13 information. Our full children's-privacy notice — including the itemized list of children's information, how it is used and disclosed, and parents' rights to review, delete, and refuse further collection — is in the COPPA Direct Notice to Parents, which is part of this policy.
10. Two programs under one company — the youth app and the adult app
Youth FIRST Athletics, LLC runs two separate services, and we want families to know that up front:
Youth FIRST Athletics — the service this policy covers. It is directed to children, including athletes under 13, and it is subject to COPPA (Section 9 above and our COPPA Direct Notice to Parents). Under-13 athletes have no login, and a parent provides consent and controls everything.
Brevard NEXT — a separate general-audience training program for adults 18 and older. It has its own app experience, its own privacy policy, and its own consent documents. Because every member is an adult, COPPA does not apply to it — adults consent for themselves.
Age screening at signup routes each person to the right service. We ask for date of birth when an account is created. A minor is enrolled in the youth program with the parental-consent process described in this policy; the adult program refuses under-18 dates of birth. Nobody is quietly moved from one to the other.
The two are kept apart. They are operated as separate programs with separate accounts and separately stored data. Your athlete's information is not visible in the adult program, is not combined with adult members' data, and is not used for the adult program in any way. If a parent also trains with Brevard NEXT, that is a second, independent account — the two are not linked, and the youth protections in this policy are never relaxed because of it.
Nothing here weakens the youth protections. Every commitment in this policy — no ads, no data sales, no trackers, family-level isolation, COPPA compliance — applies to your athlete regardless of what the adult program does.
11. Florida law
Florida Parents' Bill of Rights (Fla. Stat. § 1014.04): we recognize parents' fundamental rights to direct the upbringing and care of their minor children, including access to and control over their child's records with us. Parental consent gates every significant collection and feature decision in this app.
FDUTPA (Fla. Stat. § 501.201 et seq.): Florida's Deceptive and Unfair Trade Practices Act requires that what we say here be true. Every statement in this policy describes what the app actually does; we will not make privacy claims we don't keep.
Florida Digital Bill of Rights (Fla. Stat. § 501.701 et seq.): its main obligations apply to very large businesses (e.g., $1 billion+ in revenue) and likely do not apply to a small LLC like ours. We nevertheless follow its spirit for minors' data: no ads, no sale, no profiling, and careful handling throughout.
12. Changes to this policy
We may update this policy. The version and effective date appear at the top, and any material change requires you to review and re-accept the notice in the app before continuing. Prior versions and your acceptance history are kept in the consent audit log.
13. Contact
Youth FIRST Athletics, LLC Brevard County, Florida Coach Jon Shimer Email: Youthfirstathletics@gmail.com Phone: (321) 726-7677