PRIVACY POLICY

Who we are

This site and the related Texas Venom mobile apps are run by the North Texas Venom Foundation, a Texas 501(c)(3) nonprofit (EIN 42-2513509) at 914 Wellington Dr., Duncanville, TX 75137. We also go by Texas Venom. Questions about this policy, or a request to see or update information we hold, go to privacy@texasvenom.org.

The short version

We collect what we need to run a youth baseball program, this website, and the member apps — accounts for adults, player profiles, family paperwork, team photos, live scores, and the documents families already expect a team to keep. We do not sell personal information. We do not run advertising or analytics trackers. Player photos and full names stay private unless a parent grants media consent. Some features send limited data to the cloud services listed below so the product can function (sign-in, payments, email, push, live scoring, chat assist). We keep records while a player is with us and for a reasonable time after, then we prune what we no longer need.

Accounts are for adults

Website and app accounts are for parents, guardians, coaches, volunteers, and other adults. Players themselves should not create an account. We do not knowingly let anyone under 13 sign up. If you think a child created an account, email us and we will close it.

We do keep information about players — they are kids, and baseball requires it. That information comes from parents, guardians, and coaches, not from kids making their own logins. See Terms of Service for the account rules.

Information we collect

Your account. Name, email, and a password stored by Amazon Cognito (we don’t keep a copy of the password we can read). If you sign in with Google, we access only the name and email address Google shares (OpenID, profile, and email). We use that solely to create or sign you into your Venom account and store it with the account. We do not access Gmail, Drive, contacts, or other Google services, and we do not sell or share Google user data for advertising. If you use Sign in with Apple, we receive only the name and email Apple shares for that login (you may choose Apple's Hide My Email relay). We use that the same way — to create or sign into your Venom account — and do not sell Apple identity data for advertising. Staff who use Google Workspace go through a separate work login.

Player profiles. Name, nickname, birthday, jersey number, positions, bio, walk-up song, parent emails, and a photo if one is uploaded. Coaches and linked parents can see more than the public can.

Board profiles. Board members who publish a Board Profile choose a display name, title, bio, and photo for the public About Us page. Their account email is shown there as a contact link and is not private.

Private family paperwork. Things like a birth certificate, media-consent choice, code of conduct / waiver acknowledgements, phone numbers, and health notes (allergies, conditions, extra support). Those files are stored privately and are not published on public rosters.

Photos and gallery uploads. Team and event photos members upload (often of minors), plus tags such as team, game, and category. Published gallery photos may appear on the public Photos page and in the apps. Originals used for board review are access-gated.

How you use the site and apps. Session cookies so you stay signed in on the web, preference cookies (theme, sidebar, language), optional iOS device tokens and Live Activity tokens if you turn on push in our iOS app, optional Android FCM registration tokens if you turn on push in our Android app, notification preferences, Inbox / Feedback messages you send, and Glenn chat questions if you use that feature.

If you donate online. Stripe processes the payment. We keep what we need for receipts and nonprofit bookkeeping (donor name, email, amount, fees, season). Card numbers go to Stripe, not into our database.

Abuse-prevention signals. For a few high-risk public actions (for example reporting a photo or a video issue), we may store a short-lived rate-limit counter keyed partly on visitor IP address so one client cannot flood the system. Those counters are not used for advertising.

How we use it

We use this information to:

• Run accounts, rosters, eligibility, and team pages
• Let coaches and linked parents do their jobs
• Keep insurance, safety, and paperwork records the program needs
• Email you about your account, your player, or Foundation business (Amazon SES)
• Send optional push notifications if you opted in on the iOS app (Apple APNs) or Android app (Firebase Cloud Messaging), and Live Activity score updates on iOS
• Post coach-chosen team messages to a team’s GroupMe channel when that team has a bot configured
• Show live scores, schedules, and optional YouTube game streams
• Power Glenn (rules / FAQ chat) and optional coach draft translation
• Look up game-day weather and venue maps from public weather / geocode services using field coordinates
• Process donations and tax receipts
• Improve the site and keep it secure

We do not use this information to sell ads.

Photos, names, and social media

New player profiles default to private: public visitors see a last initial and no photo. A parent’s media-consent choice (or a coach / admin privacy setting) controls whether a full name and photo can appear on the site.

If media consent is granted, that consent also covers our official channels — currently the Texas Venom Facebook members group, the public Facebook page, and YouTube. Opting out means we will not post that player on the website or those official channels. Other families at a public game may still take photos; we can only speak for what we publish.

Live scoreboards and game recaps can show player names and jersey numbers that arrive from our scoring / live-game systems. Parents who withhold media consent should talk with their coach so staff know how to handle public naming for that child.

AI features (runtime)

Separately from using AI tools to build the website (see AI Transparency), a few product features call cloud AI or machine-translation services while you use the site:

• Glenn — signed-in members can ask baseball-rules and org FAQ questions. Questions and recent chat turns are sent to Amazon Bedrock in us-east-1 (Claude Haiku) with retrieved excerpts from our rules library. Embeddings use Amazon Titan Text Embeddings V2. Conversations are stored in our database under your account so you can reopen recent threads; board/admins who can access the application database can see that data. We do not use Glenn chats for advertising.
• Draft translation — coaches, board, and web admins can optionally send short draft texts to Amazon Translate (EN ↔ ES) to help fill bilingual fields. Output is editable before save; we do not auto-publish machine translation without a human save.
• Game AI summaries — optional recap text may arrive from our live-scoring partner (Backstop TV) or be extracted from a YouTube video description when an admin-configured marker is present. That text can appear on the site and in notifications. It is not generated by Glenn.

Do not paste birth certificates, medical details, passwords, or other sensitive family documents into Glenn. Prefer the normal paperwork upload paths for those.

Who else sees it (processors)

We share information with the services that actually run the product. We do not sell personal information, and we do not share it for advertising. Current processors:

• Amazon Web Services — hosting (CloudFront / Lambda), DynamoDB, S3 file storage, SES email, and related infrastructure
• Amazon Cognito — account sign-up, sign-in, and tokens (native email/password, consumer Google, Sign in with Apple when enabled, and Google Workspace SAML for staff)
• Google — sign-in identity (name/email only as described above); Workspace for staff SAML; Google Fonts may load Inter / Bebas Neue in visitors’ browsers when viewing the website
• Apple — Sign in with Apple identity (name/email only as described above) when that option is enabled; Apple Pay for donations is processed by Stripe, not by storing card numbers on our servers
• Stripe — donation and store payments (including Apple Pay wallets when enabled); card data is handled by Stripe
• Apple Push Notification service (APNs) — optional iOS alert and Live Activity delivery; device tokens are stored with your account; notification bodies are shortened and obvious emails/phone numbers are redacted, but titles/bodies can still name teams, games, or players
• Firebase Cloud Messaging (FCM) — optional Android alert delivery; FCM registration tokens are stored with your account; same shortened / redacted notification body rules as APNs
• GroupMe — when a team configures a bot, we may post announcement, RSVP, sign-up, or live-game text into that team’s GroupMe channel (can include player or family-visible names in coach-authored copy)
• Backstop TV (BSTV / backstop.tv) — live-game ingest, team linking, and optional org catalog sync of player names, nicknames, jersey numbers, and lineup slots when a coach/admin enables sync for a linked team (defaults off at the org level)
• YouTube — embedded or in-app playback of game streams and channel content; visiting a page with a YouTube player can cause your browser or app WebView to contact Google/YouTube
• Amazon Bedrock / Amazon Translate — Glenn chat and optional draft translation as described above
• National Weather Service (api.weather.gov) and ACIS climate data — game weather lookups using venue latitude/longitude
• OpenStreetMap Nominatim — optional venue geocoding from address text (coordinates / place names, not account passwords)

Coaches, board members, and web admins see what they need for their roles. We may also share information if the law requires it, or to protect a player’s safety.

Facebook appears above as an official publishing channel when media consent is granted. We do not embed a Facebook tracking pixel or sell data to Meta.

Cookies and similar tech

On the website we use cookies to keep you signed in (HttpOnly session tokens tv_at, tv_rt, tv_idt), complete Google / Workspace sign-in (short-lived PKCE / return-to cookies), remember display preferences (for example theme and sidebar), and remember language (tv_locale).

We also set a non-HttpOnly tv_profile cookie (about 30 days) so the browser UI can show your name, email, and role flags without an extra round trip. It is not used as the server’s security check — API routes re-verify your session — but any script running in your browser can read it while you are signed in. We do not run advertising or analytics trackers. If you block all cookies, web sign-in will not work.

Native iOS and Android apps store access / refresh / ID tokens in the platform secure store (Keychain / encrypted preferences), not in web cookies. Room / SwiftData caches on device are a local performance cache; the Texas Venom API remains the source of truth.

How long we keep it

Player records stay while that player is on a roster, and for a reasonable time after they leave — long enough for eligibility, insurance, and program history. After that we prune what we no longer need. Some records (for example tax and donation bookkeeping, or a safety incident) may be kept longer because the law or common sense says we should.

Closed accounts and leftover login mappings are removed when they are no longer useful. Glenn conversation history is kept so you can reopen recent threads; email us if you want it cleared. Rate-limit counters are short-lived. Backups expire on their own schedule.

Your choices

Email privacy@texasvenom.org to ask what we have, to correct it, or to ask us to delete a player record or close an account. We will do what we reasonably can. We may keep a narrow copy when we have to (tax, insurance, a safety issue) or when deleting it would break a roster another family still relies on — and we will say so if that’s the case.

Signed-in members can delete their own portal account from My Profile → Personal → Delete account (website) or Settings → Delete account (Android app). That removes the login, profile, push devices, and role assignments immediately. Parents can change media consent from the player profile. You can also sign out, turn off notification categories in profile / Settings, and turn off push notifications in the iOS system settings.

Security

We use signed-in access, private file storage for documents like birth certificates, encrypted token storage in the native apps, and industry-standard hosting. No website or app is perfectly safe. Please use a password you don’t recycle, and tell us if something looks wrong.

Changes

If this policy changes in a way that matters, we will update this page and the date at the top. The Terms of Service are a separate, shorter document about using the site. AI Transparency covers how we use AI to build the site; runtime AI is summarized above.