BidScout Privacy Policy

Who we are

BidScout is an independent compliance and bid-tracking tool for competitive cheer/dance programs. It is not affiliated with any event producer or housing company. For privacy requests, contact your team's coordinator or [support email — fill in before launch].

What we collect

• Coordinator/gym-owner account info (email, password — handled by Supabase Auth).
• Guardian phone and/or email, encrypted at rest (AES-256-GCM), collected by the coordinator with the guardian's consent.
• Athlete first name + last initial (or an internal roster ID) — never a full legal name — plus room-booking status.
• Bid-target data (federation, event, progress) entered or verified by the coordinator.

Whose data this is

BidScout stores limited data about minor athletes. That data is entered by an adult coordinator, not collected from the child, and this app is not directed at children. Only adults create accounts and log in.

Why we collect it

Stay-to-Play housing compliance tracking, bid tracking, and consented reminders — nothing else. We do not use this data for ad targeting, and we do not sell it.

Consent

Every guardian contact starts with consent ungranted. A coordinator records consent after a guardian has actually said yes, per channel (SMS or email). Email consent can be revoked anytime with the one-click unsubscribe link in every reminder email; SMS consent is revoked by the coordinator on request.

Retention & deletion

Data is retained as long as the team's account is active. A coordinator can permanently delete their account and all associated team data (roster, guardian contacts, consent records, housing, bids) at any time from the Account page in the app — this works whether you're using the web app or (once available) the native app, since both share the same account system.

Security

Data is encrypted in transit (HTTPS) and guardian contact fields are encrypted at rest before storage (AES-256-GCM), so they are unreadable in a database backup or export. Access is restricted by row-level security to confirmed-adult members of the relevant team only. No security measure is absolute: the application itself must be able to read those fields to send a reminder you consented to, so at-rest encryption protects your contact details from disclosure of the stored data, not from a compromise of BidScout itself.

Third-party services

Supabase (database, authentication). Resend (transactional email for reminders, when configured). No third-party analytics or ad SDKs process this data.

Children's data

BidScout is not directed to children and is intended for users 18 and older. It stores minimal data about minors, entered by adults, solely for compliance and travel-coordination purposes.

Changes & contact

We'll note material changes to this policy on this page. For questions or a deletion request outside the app, contact [support email — fill in before launch].