Privacy Policy

PRYZE™ is operated by 25 Alpha LLC, a Delaware limited liability company (EIN: 41-3955601) operating in Nashville, Tennessee. PRYZE™ is an AI-native student-athlete intelligence platform serving athletes from Pre-K through college graduation. Our contact for privacy inquiries is info@25alpha.ai.

From athletes 13 and older: Name, school email address (optional, for verified badge), personal email address (required for verification code), birth month and birth year, school name, up to four sports, graduation year, and U.S. state. We do not collect full date of birth or roster size. We also collect subdomain preference and referral code if applicable.

From athletes under 13 (COPPA): We collect a minimal set of information — name, sport, school, and graduation year — only after obtaining verifiable parental consent via our email-based VPC (Verifiable Parental Consent) flow. No personal information from children under 13 is retained unless and until parental consent is confirmed.

Academic data: We collect academic information only from parent-uploaded documents (transcripts, report cards). We do not integrate with school databases, student information systems, or any educational API. This is an architectural decision, not a preference, and is locked permanently for FERPA compliance.

Automatically collected: IP addresses (hashed, not raw), browser type, device type, and page interaction data via PostHog analytics. No advertising trackers. No third-party pixels. No data sold to advertisers — ever.

We use collected information to: provision your athlete profile and subdomain, send transactional emails (registration confirmation, COPPA consent), power our AI recruiting intelligence (school-fit scores, eligibility calculations, gap analysis), and operate the Plank Owner campaign. We do not use your data for advertising. We do not sell your data. We do not share your data with third parties except as described in Section 5.

PRYZE™ complies with the Children's Online Privacy Protection Act (COPPA) and the FTC's 2025 COPPA Rule amendments. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

Our COPPA VPC process: When an athlete indicates they are under 13, we immediately collect a parent or guardian email. We send a consent request to that email containing a description of our service and a single-click approval link. No data is retained or used until the parent clicks approve. Consent tokens expire after 72 hours. If expired, the athlete may re-register.

We collect birth month and year only — not the full date of birth. This is sufficient to determine COPPA eligibility (age under 13) while minimizing data collection per the FTC's data minimization principle.

Parent rights: Parents may review, delete, or restrict information collected about their child by emailing info@25alpha.ai at any time. We will respond within 5 business days. Account deletion requests are honored within 30 days. Academic data is deleted upon request, regardless of account status.

Data retention for minors:Explorer tier data is retained for 7 years from last parent login or until deletion request, whichever comes first. Academic data is deleted on the athlete's 25th birthday unless parent re-consents.

We use the following third-party processors, each bound by a Data Processing Agreement:

Supabase: Database and authentication (PostgreSQL, hosted on AWS).

Vercel: Hosting and content delivery network.

Resend / SendGrid: Transactional email delivery.

Stripe: Payment processing (college-tier subscribers only; minors cannot make purchases).

PostHog: Product analytics (anonymized, no cross-site tracking).

Cloudflare Stream / Bunny Stream: Video hosting for athlete highlight videos.

Anthropic (Claude API): AI intelligence engine (X.R.A.Y.) — processes athlete data only to generate recruiting analysis. Data is not used to train Anthropic models.

Depending on your jurisdiction, you may have rights to: access your personal data, correct inaccurate data, delete your account and all associated data, restrict processing, and data portability. To exercise any right, email info@25alpha.ai. We do not discriminate against users who exercise their privacy rights.

California residents: You have additional rights under CCPA. We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

We implement row-level security (RLS) on all database tables, ensuring users can only access their own data. All data is encrypted in transit (TLS 1.3) and at rest (AES-256). API keys and service credentials are stored as environment secrets, never in source code. We conduct security reviews before each major release.

Privacy Officer: 25 Alpha LLC · info@25alpha.ai
Address: 8 The Green STE A, Dover, DE 19901
We respond to privacy inquiries within 5 business days.