Privacy Policy

1Who we are, and who this is for

Playbook 23 is a mobile application published by Playbook 23 Holdings, Inc., a Delaware corporation ("Playbook 23", "we", "us"). It helps a student build a Student Development Record across four pillars — Academics, Athletics, Character and Growth — and see an explainable Score that reflects their momentum over time.

This Privacy Policy applies to the Playbook 23 mobile application for iOS and Android, and to this website at playbook23.com. It applies to nothing else.

Playbook 23 is for students aged 13 and over. It is not available to anyone under 13, and we do not knowingly collect personal information from anyone under 13 by any route, including through a parent.

If you are 13 to 17, you can register on your own and use Playbook 23 to keep your own record. Some features are switched off until a parent or guardian joins and agrees to them. If you are 18 or over, you register directly and everything is available.

This policy is written to be read by a student, because a student is the one deciding. It applies wherever in the United States you use Playbook 23.

2This website

This part is about playbook23.com — the pages you are reading now. The rest of this policy is about the app.

Our web servers keep short-lived technical logs so that the site stays online and secure — the request, the time, and a truncated network address, held for no more than 30 days and used for nothing but keeping the site running. They are not linked to any app account and they are not used to identify you.

Links from this site to the Apple App Store and Google Play take you to those companies' own services, which have their own privacy policies. We do not control them and this policy does not cover them.

3In short

If you are a student

• You have to be 13 to use Playbook 23. We ask your date of birth once, and we ask it straight — we do not nudge you toward an answer.
• On your own, your record is yours alone. Nobody else can see it. Not your school, not your coach, not another student, not the public.
• You can add your school, and choose to let your activity count toward your school's totals. Your school never sees you individually — only the group, and only once the group is big enough that no one in it can be picked out.
• Some things need a parent: adding photo or location proof, being recognised by someone else, and connecting to a team or organization. Those all involve another person seeing you.
• Saying no costs you nothing. Your Score, your streak and your milestones are not affected by declining anything.
• There is no chat and no photo sharing. Other students cannot contact you here.
• If a parent is linked to your account, we tell you, and we show you what they can see. Oversight is never invisible to you.
• You can see everything we hold, fix it, take a copy, or delete it — including your whole account.

If you are a parent or guardian

• Your child must be 13 or over. There is no route for a younger child.
• Your child may already have registered on their own with a minimal experience. You can claim that account, which links you to it and gives you the oversight tools.
• The full experience needs you to register, be verified as an adult, and agree to specific features one at a time.
• We show no advertising, sell nothing, and charge nothing. There is no payment anywhere in Playbook 23.
• Your child is told when you are linked and what you can see. We do not offer covert monitoring.
• You can see, correct, export and delete your child's record, and withdraw any consent, at any time.

4Age, and who can use Playbook 23

We ask for a date of birth before we collect anything else. The question is neutral: there is no pre-filled age, no default, and nothing in the wording or design that suggests which answer gets you further. We ask once and we do not invite a second attempt.

Age signals from the app store

Where the app store has already established your age category and, if you are under 18, obtained your parent's consent to the download, we receive that signal and act on it rather than making you prove the same thing twice. For our part, we give the app stores accurate age-rating, content and functionality information about Playbook 23, we keep it current, and we notify them when we make a change that would affect it. Playbook 23 is declared as a 13+ application in every store where it is offered.

We do not treat a self-reported date of birth as age assurance on its own where a stronger signal is available. Where age is uncertain, we apply the treatment for the youngest plausible category until it is resolved. Uncertainty resolves in the student's favour, not ours.

A note on consistency

If the class year or grade you record does not match the age you gave, we will ask you to correct it before you continue, and we will not let the inconsistency stand. We would rather stop you at that point than hold a record we should not have.

5The two tiers, and exactly what is in each

An Independent Student is a student aged 13 to 17 using Playbook 23 without a linked parent. A Supported Student has a linked, verified parent or guardian who has consented. A student aged 18 or over has everything, with no parent involved.

The dividing line is not arbitrary. Everything in the minimal tier concerns only the student and information they have typed themselves. Everything gated involves another person, an image, a location, or information leaving the app to a third party.

The minimal tier is a complete product, not a trial. A student who never involves a parent keeps a full Development Record and a working Score for as long as they want one. We do not degrade it over time, gate it behind a countdown, or nag.

6Consent — who gives it, and for what

Your own consent, if you are 13 to 17

Before we process anything about you that is not strictly necessary to give you the service you asked for, we ask you, and you decide. We ask separately rather than bundling it into signing up. We tell you plainly that the processing is not strictly necessary. Declining is exactly as easy and as prominent as agreeing. You can change your mind at any time, by a route no harder to find than the one you used to say yes, and we do not treat you differently for saying no.

Strictly necessary means the things without which Playbook 23 would not work at all: keeping your account, storing the record you asked us to store, calculating your Score, keeping the service secure, preventing fraud, and complying with the law. Everything else is a choice.

Letting your activity count toward your school's aggregate totals is one of those choices. It is not strictly necessary, so we ask you separately, it stays off until you say yes, and you can turn it off whenever you like.

How we design the asking

Every setting starts at its most protective position. We do not use design that pushes you toward sharing more — no pre-ticked boxes, no accept button made louder than the decline, no repeated prompting after you have said no, and no burying a choice where you would not think to look. If we get this wrong, tell us at the address in section 21 and we will fix it.

Parental consent, for the full tier

A parent or guardian creates their own account, is verified as an adult, and links to the student. Verification uses a method reasonably calculated to establish both that the person is an adult and that they are the student's parent or guardian. We do not receive or store the identity documents or payment details used for that verification; our provider returns a result, not a file.

Consent is given feature by feature, not once for everything. A parent can agree to verification evidence and decline connections, or the reverse. Consent to us collecting and using information is separate from consent to disclosing it to anyone else — agreeing to one is never treated as agreeing to the other. Each consent is recorded with the method used, the identity verified, the exact scope, the version of this policy shown, and a timestamp. Each is separately revocable.

Where a student is 13 to 17, parental consent does not replace the student's own consent. Both are required, and either can be withdrawn.

At the app store

For a student under 18, the app store establishes the age category and, where the law requires it, obtains parental consent before download. We consume that result. It is a separate step from the consents described above and it does not substitute for them.

7What we collect, why, and for how long

This is the complete list. If something is not here, we do not collect it. The retention periods in the fourth column, together with section 13, are our written data retention policy.

We do not require any of this to be complete. A student can use Playbook 23 with a partial profile, and no feature demands more information than that feature actually needs. Where we can serve the purpose with less, we collect less.

8What we do not collect and do not do

The honest version of a privacy policy says what does not happen. Each line is a commitment, and several are architectural — the capability does not exist in the system.

• We do not allow anyone under 13 to use Playbook 23, and we do not knowingly collect personal information from anyone under 13.
• We do not show advertising to anyone, and we do not use anyone's information to target, serve or measure advertisements. This is true at every age and in every tier.
• We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not disclose it to advertising networks, data brokers, social media platforms or publishers for their own purposes. We have never done so.
• We do not profile anyone in furtherance of decisions that produce legal or similarly significant effects.
• We do not charge a student anything. There are no purchases, in-app purchases, virtual currency, entry fees or prizes anywhere in Playbook 23 at any tier.
• We do not make any profile public. There is no public-facing profile and no search-engine visibility.
• We do not operate a recruiting marketplace, and we do not disclose student information to recruiters or scouts.
• We do not use personal information to train artificial intelligence models — not activity records, not verification evidence, not photographs, not support conversations — and we do not disclose it to anyone else for that purpose.
• We do not collect any biometric identifier. We do not create, capture or store a voiceprint, faceprint, facial template, fingerprint, retina or iris pattern, or any other biometric identifier or biometric information, and we do not run facial or voice recognition anywhere in the service. We do not sell, lease, trade or otherwise profit from biometric data, because we hold none.
• We do not store precise geolocation and we do not track anyone's location continuously. The capability does not exist.
• We do not offer messaging, chat or photo sharing between users. Students cannot contact one another through Playbook 23.
• We do not collect health or medical information, wearable or physiological data, birth certificates, vaccination or insurance records, government identification, or academic transcripts.
• We do not livestream, host video, or operate ticketing, fundraising or merchandise.
• We do not return an identifiable student to an institution account. Anything an organization sees about a group is aggregate.
• We do not use deceptive design to obtain or keep a consent, and we do not treat continued use of the app as agreement to a change.
• We do not penalise a student for declining consent or for exercising a privacy right. Declining leaves the minimal experience fully working — it never reduces a Score, removes a milestone, or breaks a streak.

9How your Score works

Your Score is produced by an algorithm, so you are entitled to know how it behaves. It is not used to recommend content to you, to decide what you see, or to make any decision about your opportunities.

• It is deterministic. The same record produces the same Score. There is no randomness and no hidden personalised weighting.
• Its inputs are only the entries in your own Development Record — the pillar, the activity type, the date, and whether the entry carries supporting evidence. Nothing about your device, your location, your browsing, or anyone else's record goes into it.
• It is explainable. Every change shows the entries that caused it.
• It is versioned and recomputable. If the calculation changes, the version is recorded and earlier periods stay interpretable.
• Scores reset monthly and prior periods are kept, so progress stays visible.
• Unverified activity earns partial rather than full credit. It never earns a negative, and a disproven claim removes that entry from the calculation rather than penalising the student.
• An Independent Student's Score is built entirely from self-reported entries. It is not worth less for that, and we do not display it as provisional or lesser.
• Automated checks detect implausible patterns and fraud. They affect the integrity of a Score. They do not produce legal or similarly significant effects about a student, and no automated decision is made about a student's opportunities. Where a check changes your Score, you can ask a person to look at it.

10Photographs and location used to support an activity

This section applies to Supported Students only. An Independent Student cannot submit evidence of any kind, and we would not accept it.

Where a parent has consented, a student may choose to support an activity with a screenshot, a photograph, or evidence of where they were. It is always optional; an activity without evidence still counts and simply carries a different provenance label. Submitting evidence is never a condition of using Playbook 23.

• The evidence is assessed, an outcome is recorded, and the evidence itself is destroyed. We keep a result, not a file.
• Cropping or obscuring happens on the device. Unprocessed images are never sent to a cloud vision service.
• We do not run face detection or facial recognition on a server, ever — not even briefly and not even for immediate deletion. No facial template or other biometric identifier is created at any point.
• Location evidence establishes one outcome for the one activity it was submitted for. We do not store coordinates, we do not track continuously, and we never disclose a student's location — or anything from which it could be inferred — to another user.
• Deletion is logged with a timestamp, so the commitment is auditable rather than merely stated.
• Voice confirmation is not part of Playbook 23. We do not record, process or store voice for any purpose. If we ever propose to, it will be a material change under section 20 — announced in advance, with fresh consent — and not something switched on quietly.

11Who we share information with

The list is short and it is exhaustive.

Before any provider handles a student's information we take reasonable steps to satisfy ourselves that they can keep it confidential, secure and intact, and we obtain written assurances to that effect. We review those providers at least annually.

Your school is deliberately not on this list. Where you have chosen to let your activity count toward your school's totals, your school receives no personal information about you at all — only a figure describing a group, and only where that group is large enough to hide everyone in it. Section 12 explains how that works.

12Your school, and connections with teams and organizations

These are two different things and they work differently. One is available to every student. The other needs a parent.

Your school — available to every student, including Independent Students

You can name your school and choose to let your activity count toward that school's totals, so your school has a picture of how active its students are and where it stands against others. This is the part of Playbook 23 that makes a school-level view possible, and a student aged 13 to 17 can switch it on without a parent.

It is safe to do that because it only ever travels one way and only ever in aggregate:

• Your school receives nothing that identifies you. It cannot see your record, see your Score, see your name in any list, contact you through Playbook 23, or export anything about you.
• An aggregate is only shown once the group behind it is large enough that no individual can be picked out of it. Below 10 participating students we suppress the figure rather than display it. This applies per group — a school with enough students overall but only a handful in one sport will not show that sport.
• We also suppress whatever else would give a suppressed figure away. If hiding one group would still let someone work it out by subtracting the groups around it, we hide those too, and we do not publish a figure that changes in a way that reveals a single student joining or leaving.
• It is your choice, it is off until you turn it on, and you can turn it off at any time. Turning it off never costs you a Score, a milestone or a streak.
• There is no route by which this becomes individual. A school cannot request, purchase or unlock a named student, and there is no setting an administrator can change to make one appear.

If Playbook 23 ever offered a school a view of a named student, that would be a disclosure of a student's personal information and it would sit behind parental consent like everything else in the next part. It would also be a change to this policy — announced in advance, with fresh consent — not a configuration change someone could make quietly.

Teams and organizations — Supported Students only

A connection with a team or an organization is different, because it means that organization can see the student individually. It is available only to a Supported Student, and only where a parent approves that specific connection, having seen the organization, the purpose, and exactly what is being requested. Connections are revocable, and revoking ends the access.

An organization never receives an identifiable student record automatically, and never merely because the student attends that school or plays for that team. It receives what a parent approved, for as long as the approval lasts.

Coaches, teachers and school system integrations are not part of Playbook 23. There is no coach account and no educator login, and corroboration of an entry can come only from a linked parent or guardian.

13How long we keep information, and when we delete it

This is our written data retention policy. We do not retain personal information indefinitely, and we keep each category only for as long as is reasonably necessary for the purpose it was collected for. The period for each category is in the table at section 7. Beyond those:

• Inactivity. No activity for 24 months — we notify the account holder, and the linked parent where there is one, give 30 days to respond, then delete everything.
• Account closure. Deleted within 30 days, and purged from backups within 90 days, except consent and privacy-request records, kept 3 years solely to evidence that consent was properly obtained and that requests were honoured.
• Deletion on request. Honoured within 30 days, cascading to backups within 90 days.
• Failed age screen. No personal information is kept. A device-level flag preventing an immediate retry is held 12 months and contains no personal information.
• Security and audit logs. 12 months. Identifiers and actions, never the content of a student's record.
• Verification evidence. Destroyed as soon as the check is complete, and in every case within 7 days of submission.
• Website server logs. 30 days.
• Legal hold. Where we are legally required to preserve something, or need it to establish or defend a legal claim, we isolate it, use it for nothing else, and delete it when the requirement ends. We will tell you if this affects a deletion you asked for.

We review these periods at least annually, weighing the amount, nature and sensitivity of the information, the harm misuse could cause, whether the purpose can be met another way, and any legal requirement to retain. Where a derived result serves the purpose we do not keep the source — which is why verification evidence has the shortest life of anything we hold.

14Your rights and controls

If you are a student

These are yours whether or not a parent is linked. A linked parent does not take them away.

If you are a parent or guardian

Claiming an account your child already made

Because a student aged 13 to 17 can register without you, there is a route for you to claim that account afterwards. We confirm the request with the student, verify you as an adult and as their parent or guardian, and link the accounts. Until that link exists we have no way to know who a student's parent is, and no way to give you the oversight tools — which is exactly why the route exists.

If a student disputes a claim, we do not link on the strength of an assertion alone. We pause the claim, we tell both people what we need, and we ask for documentary proof of the parental relationship — a court order, a school record naming the guardian, or an equivalent official document. If it is not resolved, the account stays as it is, unlinked, and the student keeps the minimal experience. We do not take sides in a family dispute, and we do not treat delay as agreement.

15Your privacy rights under state law

Depending on where you live, state privacy law gives you rights in addition to the controls described in section 14. We extend the following to everyone in the United States, whether or not your state requires it, because operating one standard is simpler and fairer than operating fifteen.

• Know and access. Confirm whether we process information about you, and get a copy of it, including the categories we collect, the purposes, the categories of recipients, and how long we keep it.
• Correct inaccurate information.
• Delete information about you.
• Portability. Receive your information in a portable, readily usable format.
• Opt out of targeted advertising, of the sale of personal information, and of profiling in furtherance of decisions producing legal or similarly significant effects. We do not do any of these things to anyone, at any age, so there is nothing to opt out of — but the right is yours if that ever changes, and a change would require fresh consent under section 20.
• Limit the use of sensitive personal information. Information about a person we know to be under 18 is treated as sensitive. We use it only to provide the service described in this policy.
• Non-discrimination. We will not deny you the service, charge you a different price, or give you a lower quality of service because you exercised a right. There are no financial incentives for your information, because we do not want it for anything else.

How to make a request. Use the privacy controls in the app, or write to us at the address in section 21. We will verify that the request comes from you or from someone entitled to make it, using information we already hold rather than asking for anything new where we can avoid it. An authorised agent may act for you with your written permission and proof of their authority; a parent or guardian may act for a linked student.

How long we take. We respond within 45 days. Where a request is complex or you have made several, we may extend once by a further 45 days and will tell you why within the first 45.

If we say no. We will tell you why, and you may appeal by replying to our decision or writing to the address in section 21. We will decide the appeal within 45 days and explain the outcome in writing. If we turn the appeal down, we will give you a way to complain to your state Attorney General.

If you live in California. We have not sold or shared personal information for cross-context behavioural advertising in the preceding twelve months, and we have not done so knowingly in respect of anyone under 16 at any time. We do not use or disclose sensitive personal information for any purpose beyond those permitted without a right to limit.

16Turning 18

When a student turns 18 they become an adult. The account converts to an Adult Student account, any parental link ends, the parent's access and oversight tools stop completely and nothing is retained for them, and consents that a parent gave on the student's behalf are re-presented to the student to confirm or withdraw for themselves. Anything the student does not confirm switches off.

We tell both the student and the linked parent 30 days before the conversion, and again when it happens. The record itself belongs to the student and stays with them.

17If we learn that a user is under 13

If we discover that an account belongs to someone under 13 — whether because they tell us, because a parent tells us, because their class year does not match, or because we find it another way — we stop collecting immediately, close the account within 3 business days, and delete the personal information within 30 days, purging it from backups within 90 days. We tell the student, and the parent if we have a contact for one.

If you believe someone under 13 holds an account, tell us at the address in section 21 and we will act.

Until the account is closed, any personal information already collected is treated under the standard that applies to a child under 13 rather than the standard that applies to a 13-to-17 user. Discovering the age does not retroactively make the earlier collection acceptable, and we do not treat it as if it does.

18How we protect information

We maintain a written information security programme with a named owner, covering the people responsible, an assessment of the risks to the confidentiality, security and integrity of the information we hold, the safeguards we use against those risks, regular testing of whether those safeguards work, and an evaluation and update of the programme at least annually.

• Encrypted in transit and at rest. Media artefacts use separate key management.
• Personal information does not appear in application logs. We log identifiers, not content.
• Access to a record is role-based and logged with the actor, purpose and timestamp. There is no universal administrative login.
• Amending a record or adjusting a Score requires a case reference and a second approver. It is never a routine support action.
• Every provider that touches a student's information is assessed before it does, and reassessed at least annually.

No system is perfectly secure and we will not claim otherwise. What we commit to is that these controls exist, are tested, and are not aspirational.

19Where information is held

All information is stored and processed in the United States, by us and by every provider we use. No default may move it elsewhere. We do not transfer personal information internationally, and we do not permit remote access to it from outside the United States.

Playbook 23 is offered only in the United States. If you are reading this from elsewhere, the app is not available to you.

20Changes, and if something goes wrong

We notify material changes before they take effect, not after. A change to what we collect or how we use it requires fresh consent — from the student, and from a linked parent where the change touches a consented feature — rather than relying on continued use as agreement. Every version is numbered and dated and earlier versions stay available.

We maintain a written incident response plan with a named decision-maker and a defined notification path. Any suspected exposure is escalated immediately. Where an incident affects your information we will tell you what happened, what information was involved, what we are doing about it, and what you can do — without unreasonable delay, and in no case later than 30 days after we determine that a breach has occurred, unless law enforcement asks us in writing to wait. Where a linked parent exists, we tell them too.

21Contact

Questions, requests and complaints: privacy@playbook23.com, or through the privacy screen in the app.

Playbook 23 Holdings, Inc. · [registered office address to be inserted before publication]

If you are not satisfied with our response, you may contact the Attorney General of your state or the Federal Trade Commission.