Legal
Privacy Policy
Effective April 22, 2026. Last updated April 22, 2026.
The short version
College Bound Swim Club (“CBSC,” “we,” “us”) is a subscription service that helps high-school swimmers find college swim programs where they are likely to be a competitive recruit. This policy explains what we collect, why, how we protect it, and what choices you have.
In plain English:
- We only take accounts from parents. Swimmers under 13 are not allowed. Parents must consent before a swimmer is visible to college coaches.
- We don’t sell your information and we don’t share it for cross-context advertising.
- You can download everything we have about your family at any time, and you can delete your account yourself.
- We’re the ones responsible for protecting your data, and we answer within 10 days when you ask us anything about it.
This is a summary of our full policy. Keep reading for the complete details.
1. What we collect
The categories below describe every kind of personal data CBSC handles at MVP. Anything not listed here, we don’t collect.
| Category | Source | Use |
|---|---|---|
| Account identifiers | Parent signs up | Log in, send account email (verification, password reset, receipts). |
| Swimmer profile | Parent enters on behalf of swimmer | Name, grad year, gender, high school, club team, date of birth (for age gate only). Drives the match engine. |
| Performance times | Parent or swimmer enters | Best times by event. Compared against conference cutoffs to rank colleges. |
| Academic record | Parent or swimmer enters | GPA, SAT/ACT, intended major. Used for academic-fit scoring. Not exposed to college coaches. |
| Household financial bracket | Parent enters a bracket (not actual income) | Net-price estimates. We store the bracket only, never a dollar amount. |
| Home ZIP / approximate geolocation | Parent enters | Radius-based school filtering. We do not collect precise device location. |
| Shortlist + dismissals | You save / hide schools | Remember your working list across devices. |
| Coach visibility preferences | Parent sets; every change is logged | Controls whether college coaches can see the swimmer in the directory. |
| Billing | Stripe (we never see card numbers) | Manage subscriptions. We receive only the billing email and Stripe customer ID. |
| Audit and consent logs | Automatically recorded | Timestamps, IP, user agent when a parent consents to or revokes coach visibility (provenance of minor consent). |
| Operational logs + error traces | Automatic | Keep the service running. PII is scrubbed at ingest; see §9. |
2. Why we collect it (purposes and lawful basis)
Every use of your data maps to one of four bases. If we ever want to use data for something new, we ask you first.
- Contract. Creating your account, charging the subscription, generating recommendations, and sending transactional email. We need the data to deliver the service you paid for.
- Explicit consent. Listing a swimmer in the college coach directory; sending marketing email. Both are opt-in, both are one-click to withdraw, and both log the consent event with a timestamp and IP.
- Legitimate interest. Analytics and error monitoring (to keep the product working). Keeping profile data for 13 months after cancellation so re-subscribing is painless. Both have defined time limits — see the retention table.
- Legal obligation. Tax and financial law requires us to keep billing records for seven years. Deletion requests for the rest of your account do not override this narrow obligation.
3. Who we share it with
CBSC uses a small number of sub-processors to run the service. Each executes a standard Data Processing Addendum with Standard Contractual Clauses before it can touch customer data. The complete list lives at /privacy/sub-processors, and a machine-readable copy is at /api/legal/sub-processors. When we add one, we post a 30-day notice.
Coaches.If, and only if, a parent turns on Discoverable or Open coach visibility for a specific swimmer, that swimmer’s preferred name, grad year, high school, club, and best times become visible to verified college coaches inside the CBSC coach directory. Open mode additionally reveals the family’s billing email. Academic data is never exposed to coaches even on Open, unless you individually toggle it.
Service providers beyond that list. None. We do not sell data to data brokers, ad networks, or analytics platforms that would recombine it for non-CBSC purposes.
4. We don’t sell or share personal information
For purposes of the California Consumer Privacy Act and its amendments (CCPA / CPRA), and under the equivalent provisions of the other US state privacy laws that use the terms “sell” and “share for cross-context behavioral advertising”:
CBSC does not sell your personal information, and CBSC does not share your personal information for cross-context behavioral advertising.
You do not need to opt out, because opting out is the default. This plain statement is the entire “Do Not Sell or Share My Personal Information” mechanism we are required to offer.
5. How long we keep it
Data is kept only as long as the purpose for collecting it, or a legal obligation, requires. Deletion requests override this table except for billing records we’re legally required to keep.
| Data category | Retained | Basis |
|---|---|---|
| Family + swimmer profile, times, academic data, shortlists | While subscription active + 13 months post-cancel | Legitimate interest (re-subscription convenience), time-limited |
| Coach profile | While account active | Contract |
| Coach search audit, CSV export audit | 24 months | Accountability / security |
| Parental consent events | Life of family account + 7 years | Provenance of minor consent |
| Stripe billing records | 7 years from last transaction | Tax / financial law |
| Server logs | 90 days | Operational |
| Error traces (PII scrubbed) | 90 days | Operational |
| Database backups | 30 days rolling | Disaster recovery |
When you exercise your right to delete, your profile data is removed immediately from live systems and purged from backups on the next 30-day rotation.
6. Children’s data
CBSC is designed around a structural choice: the account belongs to the parent, not the child.
- Under 13: not permitted. We reject any swimmer date-of-birth that would make them under 13 at account creation. There is no admin override. If you believe a child under 13 has somehow reached us, email privacy@collegeboundswimclub.com and we will delete the data.
- 13 – 17:the parent owns the account and supplies the swimmer’s information. Coach visibility and marketing email require the parent to be the logged-in user and to explicitly confirm each change.
- Age 18:a daily job unlocks the swimmer’s permissions; the swimmer may take ownership of their own account. The parent is notified.
Academic information is not exposed to college coaches by default, even when coach visibility is turned on. We treat academic records with the same posture a school would — inspection rights, limited disclosure, audit.
7. Your rights and how to use them
Most rights are a click away from inside your account. Everything else goes to privacy@collegeboundswimclub.com. We acknowledge requests within 10 days and fulfill them within 30.
Right to access (Export)
Download everything we have about your family as JSON from your Privacy controls. The export is scoped to your family and streams directly to your device.
Right to delete
Permanently delete your family account, all swimmer profiles, times, matches, and shortlists at your Privacy controls → Delete. Billing records are retained for seven years per tax law.
Right to correct
Every profile field is editable inside the app. Nothing to file.
Right to opt out / withdraw consent
Turn coach visibility back to Off on the Privacy tab of any swimmer profile. Unsubscribe from marketing email via the link at the bottom of any marketing email. Both are one click and take effect immediately.
Right to portability
The JSON export is the portable format. If you need it in a different format for a specific processor, email the privacy inbox and we’ll generate one within 30 days.
Right to non-discrimination
Your CBSC experience is identical whether or not you exercise any of these rights. We never charge different prices, degrade the match engine, or withhold features for users who opt out of anything.
8. State-specific rights
Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Jersey, New Hampshire, Kentucky, Minnesota, Rhode Island, and Maryland have statutory rights under their state privacy laws. The core rights listed above satisfy those statutes; the mechanisms above apply to all residents.
California (CCPA / CPRA): the right to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and non-discrimination. As noted in §4, we do not sell or share.
Colorado / Connecticut / Virginia / Utah / other state laws: we honor access, deletion, correction, and opt-out rights through the same controls.
Appeals. If we deny a request, you can appeal by replying to our decision email. We respond to appeals within 60 days.
Authorized agents.Residents may designate an agent to make requests on their behalf. We will verify the agent’s authority before acting.
9. Security
CBSC enforces Row-Level Security at the database layer so that even an application bug cannot leak another family’s data; scrubs personal information out of error traces at ingest; keeps a 90-day log of administrative access to family data; and rotates credentials on a documented schedule. Our breach response playbook is published in the operations runbook.
10. Changes to this policy
We update the last-updated date at the top of this page whenever we change the policy. For material changes that affect how we use data you have already given us, we notify you by email before the change takes effect.
11. Contact us
Excellwell, Inc. d/b/a College Bound Swim Club
200 W 6th St, Fort Wayne, IN 46804
Privacy questions: privacy@collegeboundswimclub.com
General: hello@collegeboundswimclub.com