Privacy Policy
Who we are and who this is for
Brava builds verified soccer recruiting profiles for youth athletes. Accounts are held and managed by a parent or legal guardian. Brava is intended only for users in the United States and only for parents/guardians age 18+. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. We ask for date of birth at the start of intake solely to determine age; anyone under 13 is refused before any other information is saved.
What we collect
From the parent/guardian account holder: name, email (via Google sign-in), and account/authentication records. About the athlete (entered by the parent): name, date of birth (used only for age-gating and never displayed publicly), playing position, club, graduation year, jersey number, physical measurables, academic information including GPA, photos, and game video. From club coaches who verify stats: name and email. We also keep first-party, anonymous profile-view counts and per-coach link attribution (the tracked party is the adult coach).
What we collect when you browse
Our pages load zero third-party scripts — even our fonts are served from our own domain. We measure site usage ourselves, minimally:
- No cookies and no browser storage are used for measurement.
- We count visits with a one-day code derived from your network address that is deleted-by-design every night — after midnight Pacific, yesterday's codes cannot be reconstructed by anyone, including us. We cannot follow an anonymous visitor from one day to the next, on purpose.
- Your network address itself is never stored and never logged by our analytics. We keep only your state/region and country, your device type (phone/desktop), the page you viewed, and which site referred you.
- We record a small set of named actions (page view, button click, form started, form abandoned, signup completed). If you abandon the signup form, we record only the name of the last field you touched — never anything you typed.
- We do not use session replay, heatmaps, mouse tracking, or keystroke capture. Anywhere.
The cookies we do use
Narrow, first-party uses — none of them analytics:
- Signing in. Session cookies keep your family's hub signed in (including Google sign-in and emailed sign-in links).
- Coach links. If your family creates a tracked share link for a specific coach, a first-party cookie lets us show you that this coach (and only that link) viewed the profile. You create these links; we never set them for anonymous visitors.
What we do NOT do
We do not sell or rent personal data. We do not share data for targeted advertising. We use no third-party advertising or tracking cookies. We do not perform facial recognition and do not create faceprints, facial-geometry templates, or any biometric identifier. Our photo pipeline uses automated face detection (a bounding box, discarded after processing) solely to classify and crop photos for display; it never identifies anyone and no facial data is retained.
Public profiles
A profile is private by default. For any athlete under 18, a profile becomes public only when the signed-in account holder affirmatively opts in. GPA and other academic data are not shown publicly unless the account holder separately opts in to display them. Date of birth is never shown.
How we use information
To build, verify, host, and display the recruiting profile the family requests; to authenticate sign-in; to communicate about the account; and to keep the service secure.
Service providers
We use Cloudflare (hosting/storage, US), Supabase (database, AWS us-west-2, US), and Resend (email). These vendors process data only to provide their services to us.
Retention and deletion
We keep profile data while the account is active. On a deletion request or account closure, we purge the athlete's data across our database, media storage, and email logs within 14 days. Authentication/audit-log records are kept for 18 months for security and then deleted. See the retention schedule below.
Your choices
You may review, correct, make public/private, or delete the athlete's profile from within your account, or by emailing privacy@bravamade.com. You may withdraw the public-profile opt-in at any time.
Children under 13
We block under-13 registration. If you believe we have inadvertently collected information from a child under 13, contact privacy@bravamade.com and we will delete it promptly.
Schools and FERPA
Brava is not a school and not an agent or contractor of a school. We do not receive education records from schools; academic information is supplied directly by the parent/guardian account holder.
International users
Brava is a US-only service and does not offer GDPR or UK-GDPR data-subject request mechanisms.
Commercial email
College and club coaches may receive commercial email from Brava. Every such message includes our postal address and a working unsubscribe link, and opt-outs are honored immediately.
Contact
privacy@bravamade.com — Siverly Brothers, LLC, 123 Hobart Avenue, San Mateo, CA 94402.
Data retention schedule (incorporated)
| Data | Purpose | Retention |
|---|---|---|
| Athlete profile data (name, position, club, grad year, jersey, measurables, photos/video) | Build/host recruiting profile | Life of account; purged ≤14 days after deletion request |
| Date of birth | Age-gate only | Stored for age verification; purged with account |
| Academic data (GPA) | Display only if opted in | Life of account; purged ≤14 days after deletion |
| Parent account/auth data | Account management, sign-in | Life of account; purged ≤14 days after deletion |
| Coach name/email | Stat verification, link attribution | Life of relationship; purged on request |
| Authentication / audit log | Security, integrity, fraud prevention | 18 months, then deleted |
| Under-13 refusal log | Evidence of age-gate enforcement | Non-identifying event record; 18 months, then deleted |