Privacy Policy

1. Who we are

MatPad is operated by MatPad (132 University Avenue, Ithaca, NY 14850). We provide software that lets wrestling camp organizers publish camps and accept registrations and payments online.

For registration data, we act as a service provider to the camp organizer. The organizer decides what to collect on their registration form and how to use it. If you registered for a camp and want your information corrected or deleted, contact the organizer first - but you can always contact us at matpadapp@gmail.com and we will help.

2. Information we collect

From camp organizers

• Name, email address, and password (stored only as a salted hash, never in plain text).
• Camp details you publish: name, description, dates, location, pricing, capacity.
• Stripe account identifier once you connect a payout account. We never receive or store your bank account or card numbers.

From families registering an athlete

• Athlete first and last name, date of birth, school or club, weight class, age group.
• Medical notes, if the parent or guardian chooses to provide them, so the organizer can keep the athlete safe on the mat.
• Parent or guardian name, email address, and phone number.
• Emergency contact name and phone number.
• A record that the liability waiver was agreed to, and when.
• Check-in status at the camp.

Payment information

Payments are processed by Stripe. Card numbers and bank details are entered directly into Stripe's systems and never touch our servers. We store only a Stripe payment identifier so we can match a payment to a registration and prevent duplicate charges. Stripe's handling of your data is governed by the Stripe Privacy Policy.

Technical information

• IP address and standard request metadata, used for security, abuse prevention, and rate limiting.
• Server logs recording errors and key events (for example, that a registration was recorded). These are retained for a limited period for debugging.
• A referral code, if you arrive via a referral or campaign link, so we can credit the person or campaign that sent you.

3. Information about children

Camp registrations are for youth athletes, so this service necessarily handles information about minors. We have designed the flow around one rule: we do not knowingly collect personal information directly from children.

• Registration forms are completed by a parent or legal guardian, who supplies the athlete's information and agrees to the waiver on the athlete's behalf.
• Children do not create accounts. Accounts exist only for camp organizers, who must be 18 or older.
• We do not use athlete information for advertising, profiling, or any purpose beyond running the camp the athlete registered for.
• We do not sell or share athlete information for cross-context behavioral advertising.

If you believe a child provided us information without a parent's involvement, email matpadapp@gmail.com and we will delete it promptly.

4. How we use information

• To create and operate camp organizer accounts.
• To process registrations and route payments to the organizer.
• To send transactional email - registration confirmations, and messages the organizer sends to families registered for their camp.
• To give the organizer their roster, capacity counts, and check-in tools.
• To secure the service: rate limiting, fraud and abuse prevention, and debugging.
• To meet legal, tax, and accounting obligations.

We do not sell personal information. We do not use registration data to advertise to families.

5. Who we share information with

• The camp organizer whose camp you registered for. They receive the full registration, including medical notes and emergency contacts, because they need it to run the camp safely.
• Stripe - payment processing and payouts.
• Supabase - database and authentication hosting.
• Google - only if you choose to sign in with Google. Google tells us your name, email address, and profile picture; we never receive your Google password. You can revoke this at any time from your Google account settings.
• Vercel - application hosting and delivery.
• Resend - transactional email delivery.
• Sentry - error monitoring, so we find out when something breaks. Reports are stripped of personal information before they are sent: no request bodies, no cookies, and no athlete or parent details.
• Mapbox - maps and address lookup on camp listings. Mapbox receives the search terms typed into the address field and coarse map interactions.

We may also disclose information if required by law, to enforce our Terms, or to protect the safety of a person. If the business is sold or merged, information may transfer as part of that transaction; we will give notice before your information becomes subject to a materially different policy.

6. Cookies and tracking

We use cookies that are necessary for the service to function - chiefly the authentication cookie that keeps an organizer signed in, and a short-lived cookie that remembers a referral code so credit is attributed correctly.

We do not currently run third-party advertising or analytics trackers on this site. If that changes, we will update this policy and provide any consent controls the law requires before those trackers load.

7. How long we keep information

• Registrations are retained while the organizer's account is active, so they keep their historical rosters. Organizers can delete a camp and its registrations from their dashboard.
• Organizer accounts are retained until deletion is requested.
• Payment records are retained as long as required for tax and accounting purposes, typically seven years.
• Server logs are retained for a short period for security and debugging.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information, and to object to or restrict certain processing. Parents and guardians may exercise these rights on behalf of their child.

To make a request, email matpadapp@gmail.com from the address associated with the account or registration. We will respond within the time frame required by applicable law. We will not discriminate against you for exercising these rights.

Because the camp organizer is an independent controller of registration data, we may need to route part of your request to them.

9. Security

Data is encrypted in transit with TLS and encrypted at rest by our hosting providers. Access to registration data is enforced at the database level: an organizer can read only the registrations belonging to camps they own. Payment credentials are handled entirely by Stripe, which is PCI-DSS Level 1 certified.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

10. Where information is processed

MatPad is operated from the United States, and information is processed and stored in the United States. If you access the service from elsewhere, you are transferring information to the United States, which may have different data protection laws than your country.

11. Changes to this policy

We will update the effective date above when this policy changes. For material changes we will give prominent notice - by email to organizers, or a notice in the app - before the change takes effect.

12. Contact us

MatPad
132 University Avenue, Ithaca, NY 14850
matpadapp@gmail.com

For questions about the service itself, see our Terms of Service or email matpadapp@gmail.com.