Privacy Policy

Effective: April 21, 2026  ·  Last Updated: April 21, 2026

This Privacy Policy describes how Bifrost Sports LLC, a Texas limited liability company ("Bifrost," "we," "us," or "our"), collects, uses, shares, and protects personal information in connection with the Bifrost Sports website, mobile applications, and related services (collectively, the "Service"). This Policy forms part of, and should be read together with, our Terms of Service.

Quick Summary

We want you to understand what we do with your information. The short version:

• We collect the information you give us when you sign up and use the Service (name, email, team data, stats, messages), plus basic technical information about the device and network you use to access the Service.
• We use this information to run the Service, communicate with you, improve the product, keep things secure, and comply with law. We process payments through Stripe and never store your card or bank account numbers.
• We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• You can access, export, correct, and delete your information. California residents have additional rights under the CCPA/CPRA, described in Section 9.
• The Service is intended for adults in the United States. We do not knowingly collect information from anyone under 18.

The rest of this Policy fills in the details.

1. Who We Are and How to Contact Us

Bifrost Sports LLC is a Texas limited liability company with its registered office at [Registered Address on File with the Texas Secretary of State]. For privacy matters, contact us at:

• Email: support@bifrostsports.com
• Postal Mail: Bifrost Sports LLC, Attn: Privacy, [Registered Address on File with the Texas Secretary of State]

2. Scope

This Policy applies to personal information we collect:

• through the Bifrost Sports website at bifrostsports.com and its subdomains;
• through our iOS and macOS applications and any other client applications we publish;
• through our application programming interfaces (APIs), when accessed in connection with the Service; and
• through our email, support, and other communications with you in connection with the Service.

This Policy does not apply to third-party websites, applications, or services, even if linked from the Service. Those third parties have their own privacy policies, and we encourage you to read them.

3. Information We Collect

We collect the categories of personal information described below. "Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with you or your household.

3.1 Account and Profile Information

• Identifiers: name, display name, email address, optional phone number, password (stored as a cryptographic hash), and a unique user identifier we generate;
• Authentication identifiers: where you sign in with Apple, Google, or Facebook, the opaque user identifier provided by that service, plus any name and email the service passes to us at sign-in;
• Profile details: avatar image, biography, hometown, nationality, date of birth (when you choose to add it), social media links, and skill-level information you provide;
• Athletic profile: jersey number, position, height, weight, handedness, equipment (gear) you choose to list, and team and organizational affiliations; and
• Organizational role: the teams, leagues, and facilities you are associated with and your role on each (player, captain, coach, parent, admin, and so on).

3.2 Team and Game Content

• Rosters and schedules: the rosters, schedules, divisions, and seasons created or accessed through the Service;
• Game records: scores, statistics (goals, assists, penalties, saves, shots), game events, attendance (RSVP) records, game rosters and lineups, and play tracking logs;
• Team operations: fees, payment records, expenses, budgets, announcements, chat messages sent through the Service, and waivers or rental agreements you electronically sign; and
• User-uploaded media: team logos, team photos, profile pictures, game photos, and other images you upload.

3.3 Payment Information

Payments processed through the Service are handled by Stripe, Inc. Bifrost does not collect or store your card number, CVV, expiration date, or bank account number. We store only non-sensitive metadata, such as a Stripe customer identifier, a Stripe payment method identifier, the amount, currency, status, and timestamp of each transaction, and the last four digits and brand of a card or bank account as returned by Stripe for display to you.

3.4 Device, Log, and Usage Information

When you access the Service, we and our service providers automatically collect:

• Device information: device type, operating system, operating system version, application version, device identifiers, language, and time zone;
• Log information: IP address, access times, pages or screens viewed, referring and exiting pages, and crash logs;
• Usage information: feature interactions, session duration, and aggregated event data;
• Push notification tokens: the device token Apple or Google issues so we can send you push notifications; and
• Cookies and local storage: small data files stored on your device to keep you signed in and remember your preferences (see Section 11).

3.5 Location Information

We do not collect continuous or background location data. If you choose to enable it, we may collect the coarse or precise location of a device in order to surface nearby facilities or auto-detect a game venue. You can disable this at any time in your device settings.

3.6 Communications

• Support and feedback: the content of emails, support tickets, in-app feedback, and any attachments you send us;
• In-product messaging: messages, reactions, polls, image attachments, and other content you send through our chat features; and
• Email subscriptions: your email address and your opt-in status for any transactional or marketing emails we send.

3.7 Information from Third Parties

• Authentication providers: where you sign in with Apple, Google, or Facebook, we receive the information described in Section 3.1.
• Stripe: payment metadata described in Section 3.3.
• Apple and Google app stores: transaction identifiers and receipt metadata for in-app purchases (if any).
• Facility scoring systems and public league sources: we ingest schedules, rosters, scores, game events, and player statistics from facility scoring systems (for example, TimeToScore, HockeyShift, and EZFacility) that a facility has authorized or made publicly available. See Section 10A for your rights if your information appears in this data and you do not have a Bifrost account.

4. How We Use Personal Information

We use personal information for the following purposes:

• Provide and operate the Service, including authenticating you, provisioning your account, displaying team and game data, processing payments, delivering messages and notifications, and syncing data across your devices;
• Support, including responding to your questions, diagnosing problems, and investigating incidents;
• Improve and develop the Service, including analyzing usage, fixing bugs, and developing new features;
• Personalize the Service, including showing you relevant content based on the teams, players, and facilities you follow;
• Communicate with you, including sending transactional emails and push notifications (game reminders, attendance requests, payment receipts, chat messages, account alerts, and similar) and, if you have opted in, occasional product-update emails;
• Enforce our Terms and protect the Service, including detecting, preventing, and investigating fraud, abuse, security incidents, and violations of our Terms of Service or applicable law; and
• Comply with legal obligations, including responding to lawful requests from government authorities and preserving information where required by law.

Legal Bases (for Reference)

Although Bifrost is based in the United States and the Service is offered only to U.S. users during the closed beta, we generally rely on the following bases for processing:

• Performance of a contract with you (for example, to operate the Service you've signed up for);
• Our legitimate interests (for example, to keep the Service secure, prevent fraud, and improve the product), provided those interests are not overridden by your rights;
• Your consent (for example, for optional location access or marketing emails); and
• Compliance with legal obligations (for example, tax and accounting record retention).

5. How We Share Personal Information

We share personal information only as described in this Section. Specifically:

5.1 Within the Service

Your profile, team affiliations, and team activity are visible to other users based on the context in which you share them. For example:

• Your display name, avatar, jersey number, and position are visible to your teammates and to anyone who can view your team's roster.
• Game statistics, attendance records, and roster appearances are visible to the other members of the teams involved in the game and, where applicable, to the facility.
• Messages you send in team chat are visible to the members of that chat. Messages you send in a direct message are visible to the recipient.

You can adjust certain visibility settings in your profile (for example, DM privacy and gear visibility).

5.2 Service Providers (Processors)

We share personal information with vendors that process data on our behalf and under written contract, including:

• Stripe, Inc. — payment processing. See Stripe's Privacy Policy.
• Render Services, Inc. — application hosting (United States).
• Neon, Inc. — PostgreSQL database hosting (United States).
• Cloudflare, Inc. — storage of images and static assets via Cloudflare R2.
• Anthropic PBC — certain on-server content processing features that use Anthropic's API, including (a) optical character recognition of waiver or rental-agreement templates you upload, and (b) extraction of goals, penalties, and rosters from photos or PDFs of hockey scoresheets that captains, team managers, or facility administrators upload to fill in event data for a completed game. We send only the specific content needed for the feature, and the processing is subject to Anthropic's commercial terms.
• Resend, Inc. — transactional email delivery.
• Apple Inc. and Google LLC — Sign in with Apple, Apple Push Notification service, Google OAuth, and (where applicable) app store distribution.
• Meta Platforms, Inc. — Facebook Login, where you choose to use it.
• Sentry (Functional Software, Inc.) — application error and performance monitoring.

We may add or change service providers over time. We will update this list to reflect material changes.

5.3 Other Users and Organizations

If you act on behalf of a team, league, or facility, information about your actions (for example, roster edits you make or announcements you send) may be visible to other members of that organization, including its administrators.

5.4 Legal and Safety

We may disclose personal information to law enforcement, courts, government authorities, or other third parties when we reasonably believe disclosure is necessary to (a) comply with a lawful subpoena, court order, or similar legal process; (b) protect the rights, property, or safety of Bifrost, our users, or the public; (c) investigate or address fraud, security, or technical issues; or (d) enforce our Terms of Service.

5.5 Business Transactions

If Bifrost is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections and applicable law. We will provide notice (by email or in-app notice) of any such transfer, and your personal information will remain subject to the commitments in a privacy policy in effect at the time of transfer, unless you consent otherwise.

5.6 With Your Consent

We may share personal information for any other purpose with your consent.

5.7 Statements Required by California Law

• We do not sell your personal information. We have not sold personal information in the preceding 12 months.
• We do not share your personal information for cross-context behavioral advertising. We have not shared personal information for cross-context behavioral advertising in the preceding 12 months.
• We do not use or disclose sensitive personal information (as defined under the CCPA/CPRA) for purposes other than those permitted without a right to limit under California Civil Code § 1798.121(a).

6. How Long We Keep Personal Information

We retain personal information only as long as reasonably necessary for the purposes described in this Policy or as required by law. Our general retention schedule is:

Category	Retention
Account profile data	While your account is active; deleted within 90 days after account deletion, subject to the exceptions below
Team and game content	While the owning organization remains active; historical game records and statistics may be retained in anonymized or aggregated form to preserve league history
Payment records	Seven (7) years (for tax, accounting, and legal-retention requirements)
Chat messages	Archived after 30 days (or 90 days for premium teams) and hard-deleted after twice that window, subject to in-product retention settings
Support communications	Three (3) years from last contact
Device logs, crash reports, and analytics	Up to 24 months
Waivers and signed agreements	Seven (7) years after the agreement ends or the underlying booking occurs
Audit logs	Two (2) years

We may retain information longer than the periods listed above (a) to comply with legal or regulatory obligations, (b) to resolve disputes, (c) to enforce our agreements, or (d) when retention is required for security or fraud prevention. When we no longer need personal information, we delete or de-identify it.

7. How We Protect Personal Information

We maintain administrative, technical, and physical safeguards that are reasonably designed to protect personal information, including:

• encryption of data in transit using TLS;
• encryption at rest for data stored in our primary database and object storage;
• role-based access controls and least-privilege access to production systems;
• authentication controls, including support for biometric unlock and mandatory password-hash storage;
• logging, monitoring, and alerting for security-relevant events; and
• an incident response process for suspected unauthorized access.

No system is perfectly secure, and we cannot guarantee the security of personal information. You are responsible for keeping your account credentials confidential and for notifying us promptly at support@bifrostsports.com if you suspect unauthorized use of your account.

8. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you without undue delay following discovery and verification, consistent with California Civil Code § 1798.82 and other applicable state and federal data-breach notification laws. Notice will be sent to the email address on file for your account (or, where required by law, by an alternate method).

9. Your Rights — California Residents (CCPA/CPRA)

California residents have the following rights regarding their personal information under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"):

• Right to Know. You may request that we disclose (a) the categories and specific pieces of personal information we have collected about you; (b) the categories of sources from which we collected that information; (c) the business or commercial purposes for collecting, using, or sharing it; and (d) the categories of third parties with whom we share it.
• Right of Access / Portability. You may request a copy of the personal information we hold about you in a portable, readily usable format.
• Right to Correct. You may request that we correct inaccurate personal information.
• Right to Delete. You may request that we delete personal information we collected from you, subject to legal exceptions (for example, retention required to complete a transaction, detect fraud, comply with a legal obligation, or exercise a right protected by law).
• Right to Opt Out of Sale or Sharing. We do not sell personal information and do not share it for cross-context behavioral advertising. If this changes, we will update this Policy and provide a compliant opt-out mechanism.
• Right to Limit Use of Sensitive Personal Information. We do not use or disclose sensitive personal information for any purpose that would trigger a right to limit under CCPA/CPRA.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.

9.1 How to Exercise Your Rights

To exercise any of the rights above, please email us at support@bifrostsports.com with the subject line "California Privacy Request," or use the privacy settings in the application.

9.2 Verification

We will verify your request by matching the email address of your request against the email on file for your account. For sensitive requests (such as a request to delete), we may ask for additional information to verify your identity. We will not use information you provide for verification for any other purpose.

9.3 Authorized Agents

You may designate an authorized agent to submit a request on your behalf. Your agent must provide us with a signed, written authorization from you, and we may require you to verify your identity directly with us.

9.4 Response Time

We will confirm receipt of your request within 10 business days and respond substantively within 45 days. If we need more time, we will notify you and may extend the response period by an additional 45 days.

9.5 Shine the Light

California Civil Code § 1798.83 permits California residents to request certain information about our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

10. Your Rights — Other U.S. States

Residents of certain other states may have similar rights to access, correct, delete, and port their personal information, including under:

• the Texas Data Privacy and Security Act (effective 2024);
• the Virginia Consumer Data Protection Act;
• the Colorado Privacy Act;
• the Connecticut Data Privacy Act;
• the Utah Consumer Privacy Act; and
• other state privacy laws that apply to your residence.

To exercise any rights that may apply to you, please contact us at support@bifrostsports.com with a description of the right you wish to exercise and your state of residence. We will honor verified requests to the extent required by applicable law, using the same verification and response-time procedures described in Section 9.

10A. Third-Party Facility Data and Profile Claiming

10A.1 Where It Comes From

A subset of the data displayed in the Service — including game schedules, final scores, scoresheet entries, rosters, jersey numbers, positions, and game statistics — originates from ice hockey facilities and their scoring systems. We ingest this information from sources the facility has authorized or made publicly available, and we display it so that players, teammates, parents, and fans can follow the game.

10A.2 Ownership and Accuracy

As between Bifrost and each facility, the facility owns the league data it generates. Bifrost does not verify, audit, or guarantee the accuracy, completeness, timeliness, or reliability of any facility-sourced data, and the Service is not an official record of any game, stat, or standing. Official league records are maintained by the facilities and governing bodies that created them.

10A.3 Your Rights If Your Information Appears Without an Account

If your name, jersey number, position, stats, or other information appears in the Service because a facility you play at provided that data to their scoring system, and you do not have a Bifrost account, you may:

• Claim your profile. Create a Bifrost account and use the in-app "Claim" flow to associate the existing facility profile with your new account. After claiming, you control privacy, visibility, and profile settings.
• Request removal. Send an email to support@bifrostsports.com with your full name, the facility or league you play at, and (if available) a jersey number or team. We will anonymize your personal information within 30 days of verification, while preserving aggregate game statistics (team totals, final scores, and similar records).
• Request correction. Send an email to support@bifrostsports.com with the specific correction. We will either make the correction or refer you to the facility scorekeeper who maintains the underlying record.

These rights are in addition to the rights described in Sections 9 (California) and 10 (other U.S. states).

10B. On-Device AI Features

Bifrost includes optional AI-powered features, such as game recap drafts, scouting report drafts, smart chat replies, and equipment (gear) suggestions. These features are powered by Apple's on-device Foundation Models and the Natural Language framework and run locally on your device. When you use these features, the relevant game data, chat text, or profile data is processed on your device and is not sent to Bifrost's servers or to any third-party AI provider.

Separately, two server-side OCR features run on the Anthropic API and are governed by Anthropic's commercial terms:

• Waiver template OCR — used only by facility administrators uploading a waiver or rental-agreement PDF, photo, or DOCX. The contents of the uploaded template are sent to Anthropic; no player or member data is included.
• Scoresheet OCR — used by team captains, team managers, and facility administrators to fill in event data for a finished game. When the captain or admin uploads a photo or PDF of the official scoresheet, that scoresheet (which contains the players' names, jersey numbers, goals, and penalties) is sent to Anthropic so the events can be extracted and saved to the game. The captain or admin reviews the extracted data on-device before anything is saved.

Both flows show an explicit consent prompt before the first upload. You can withhold consent and the feature will not run.

You can turn on-device AI features on or off individually in the Service's settings.

11. Cookies and Similar Technologies

11.1 Web

Our website uses cookies and similar technologies (such as local storage and session storage) to keep you signed in, remember your preferences, and measure basic usage. We use:

• Strictly necessary cookies to operate the website and keep you authenticated. These cannot be disabled without breaking core functionality.
• Functional cookies to remember your preferences (for example, selected filters).
• Analytics / performance cookies to understand how users interact with the website so we can improve it.

We do not use advertising cookies or third-party advertising tags on the website.

11.2 Mobile Applications

Our iOS and macOS applications do not use web cookies. They use device-native storage (Keychain for security tokens, UserDefaults and app containers for preferences) to store authentication and preference data.

The applications also maintain a local image cache in the app's Caches directory, where copies of images you have already viewed in the app (such as profile avatars, team logos, facility photos, and chat photo attachments) are stored on your device so they can be displayed without re-downloading on subsequent views. This cache is bounded in size, evicted automatically when the device runs low on storage or memory, fully cleared when you sign out or use the in-app "Clear cache" action, and can also be cleared by deleting and reinstalling the app. The cache contains only images already delivered to your device through normal use of the Service; it does not collect new information.

11.3 Do Not Track

Our website does not respond to "Do Not Track" browser signals, because there is no consistent industry standard for interpreting them. We do honor the CCPA/CPRA-required privacy-control signals described in Section 9 to the extent they apply.

12. Marketing Communications

We send transactional messages (such as game reminders, attendance requests, chat notifications, and payment receipts) as part of operating the Service. If you have opted in to marketing or product-update emails, you can opt out at any time by using the "unsubscribe" link in any such email or by emailing support@bifrostsports.com. Opting out of marketing email does not stop transactional emails, which are necessary to operate the Service.

13. Push Notifications

With your permission, we send push notifications to your device for game reminders, attendance requests, announcements, chat messages, payment reminders, and similar events. You can disable some or all notification categories in your device settings or in the Service's notification preferences. Disabling notifications does not affect other features of the Service.

14. Children

The Service is not directed to, and is not intended for use by, anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from an individual under 18 without verified parental consent, we will delete the information promptly. If you believe a person under 18 has provided personal information to us, please contact support@bifrostsports.com and we will investigate and take appropriate action.

If we later extend the Service to users under 18, this Policy will be updated to describe how we comply with the Children's Online Privacy Protection Act ("COPPA") and applicable state laws.

15. International Users and Data Transfers

The Service is operated from the United States, and personal information we collect is processed and stored on servers located in the United States. We do not currently offer the Service in the European Economic Area, United Kingdom, or other jurisdictions with comprehensive cross-border data-transfer restrictions. If you access the Service from outside the United States, you understand and consent to the transfer of your information to the United States, which may have data-protection laws that differ from those of your country.

16. Third-Party Links and Services

The Service may contain links to third-party websites and services (for example, Stripe Checkout pages, EliteProspects profiles, facility websites, and Google Calendar links). We are not responsible for the privacy practices of those third parties. When you leave the Service by clicking a link, please read the privacy policy of the destination site.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change, we will provide at least 30 days' advance notice before the change takes effect by updating the "Last Updated" date at the top of this Policy and notifying you by email (using the address on file for your account) or through an in-app notification. Non-material changes (such as clarifications, formatting, or updates to service-provider lists) take effect when posted. Your continued use of the Service after the effective date of the change constitutes your acceptance of the revised Policy.

18. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

• Email: support@bifrostsports.com
• Postal Mail: Bifrost Sports LLC, Attn: Privacy, [Registered Address on File with the Texas Secretary of State]

We will do our best to respond promptly. If you are not satisfied with our response, you may have the right to lodge a complaint with the attorney general of your state.