Privacy Policy

How ScratchWeight collects, uses, protects — and refuses to sell — personal information

Section 1. Who We Are; What This Policy Covers

1.1 This Privacy Policy describes how ScratchWeight LLC, a Texas limited liability company (“ScratchWeight,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information in connection with the ScratchWeight platform — the website at scratchweight.com, the web application, any mobile applications, Kiosk Mode, and related services (together, the “Service”). It applies to coaches and staff who hold accounts (“Coaches”), student-athletes entered on team rosters (“Athlete Participants”), parents and guardians, and site visitors.

1.2 This Policy does not cover third-party systems, including the official weight-management system designated by your state athletic association (currently the NWCA Optimal Performance Calculator accessed through Trackwrestling, a service of FloSports, Inc.). Those systems have their own privacy policies, and ScratchWeight does not access, connect to, or retrieve data from them. Capitalized terms not defined here have the meanings in our Terms of Service.

Section 2. Information We Collect — and What We Deliberately Do Not Collect

We collect the following categories of information. Nearly all athlete information is entered by the team's coaching staff, not by the athlete.

2.1 What We Deliberately Do Not Collect. The Service is designed to operate without — and Coaches are contractually prohibited from entering — athlete dates of birth, Social Security or other government identifiers, home addresses, medical records, diagnoses, medications, photographs of athletes, biometric identifiers (no fingerprint or facial recognition anywhere in the Service), precise geolocation, or advertising identifiers. If prohibited information is entered into a free-text field, we may delete it without notice.

2.2 No Advertising Technology. The Service contains no third-party advertising SDKs, ad pixels, or cross-site trackers, and we do not permit analytics tools to receive athlete names or health-related fields.

Section 3. How We Use Information

We use personal information only to:

• Provide, operate, secure, and support the Service — including computing descent-tracking estimates, status flags, attendance, and exports from data your team enters;

• Synchronize offline entries, maintain backups, and prevent fraud, abuse, and unauthorized access;

• Communicate with you about the Service (invitations, alerts you enable, security notices, receipts, renewal reminders, and — for Coaches who opt in — product news you can unsubscribe from at any time);

• Process payments, maintain business records, and comply with law;

• Improve the Service using de-identified or aggregated information that no longer identifies any individual, team, or school. We do not attempt to re-identify de-identified data, and we do not use identifiable personal information to train artificial-intelligence models.

We do not use personal information for: advertising of any kind directed at athletes or their families; building marketing profiles of students; automated decisions with legal or similarly significant effects; or any purpose incompatible with providing a team-administration tool. Athlete information is never used for marketing.

Section 4. How Information Is Shared

4.1 Within Your Team and School. Team Data is visible to the team's Coaches and authorized staff, and to the School where the School directs or sponsors use of the Service. Athlete Participants can see their own entries at the team kiosk; teams control what athletes see. Nothing in the Service publishes athlete information publicly.

4.2 Service Providers. We share information with a small set of service providers that process it on our documented instructions, under contracts that restrict use to providing services to us and require confidentiality and security: cloud hosting and storage; email and text-message delivery; payment processing; error monitoring and privacy-respecting product analytics (configured to exclude athlete names and health-related fields). A current list of subprocessors is available on request at [email protected].

4.3 Schools and Legal Obligations. We disclose Student Data to the School it belongs to, at the School's direction, or as required to comply with law, subpoena, or court order. Where the School is the data owner and we receive legal process, we will, unless legally prohibited, notify the School promptly so it may seek protective treatment. We may disclose information to protect the safety of an athlete or the security of the Service, consistent with law.

4.4 What We Never Do. We never share personal information with data brokers, advertising networks, or social-media platforms; never disclose athlete information for targeted advertising; and never permit third parties to use Service data for their own purposes.

Section 5. No Sale of Personal Information; Change of Control With Notice

5.1 NO SALE. WE DO NOT SELL, RENT, TRADE, OR LICENSE PERSONAL INFORMATION OF ANY USER OR ATHLETE, AND WE DO NOT SHARE PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING. THIS COMMITMENT COVERS EVERY CATEGORY OF INFORMATION WE HOLD, INCLUDING COACH CONTACT INFORMATION AND ALL ATHLETE DATA.

5.2 The Single Exception — a Sale of the Company, With Notice. If ScratchWeight LLC sells, merges, or transfers all or substantially all of its business or assets, personal information may be transferred to the successor solely as part of that transaction, on these conditions: (a) the successor must assume, in writing, our Terms of Service, this Privacy Policy, and any school data-privacy agreements as to the transferred data, or provide protections at least as restrictive; (b) we will notify every account email, with prominent in-Service notice, at least thirty (30) days before personal information becomes subject to the successor's control, where lawfully permitted; and (c) schools and users retain their export and deletion rights throughout. Student Data transferred in such a transaction remains subject to the prohibition on sale, advertising use, and profiling described in this Policy and in Texas Education Code § 32.152.

Section 6. Students, Schools, and FERPA

6.1 Our Role. When a public or private school uses the Service for its wrestling program, athlete records in the Service may be “education records” under the Family Educational Rights and Privacy Act (FERPA). In that setting, ScratchWeight operates as a “school official” with a legitimate educational interest: we perform an institutional service the school would otherwise perform with its own staff; we remain under the school's direct control with respect to the use and maintenance of those records; and we use them solely to provide the Service, never for advertising, profiling, or resale, consistent with 34 C.F.R. § 99.31(a)(1) and, in Texas, with Texas Education Code chapter 32, subchapter D.

6.2 Parent Access Through the School. Parents and eligible students may inspect, request correction of, and request deletion of education records through the School. We support Schools in fulfilling those requests, and we honor requests routed to us directly by coordinating with the School.

6.3 District Agreements. We sign student-data-privacy agreements with districts on request, including the Texas TX-NDPA through the Texas Student Privacy Alliance and the Student Data Privacy Consortium's National DPA for Oklahoma districts. On a district's written request, we delete covered student information within sixty (60) days, as required by Texas Education Code § 32.156, unless the parent or eligible student consents to retention.

Section 7. Children Under 13

7.1 The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Coaches are prohibited from entering under-13 participants. If you believe a child under 13's information has been entered, contact [email protected]; upon verification, we will delete it promptly and confirm deletion. If we ever choose to support middle-school programs that include children under 13, we will first implement the verifiable parental consent, notice, retention, and security requirements of the Children's Online Privacy Protection Act (COPPA) rule, 16 C.F.R. Part 312, as amended.

Section 8. Teen Athletes (13–17)

8.1 Design Choices for Minors. Because most Athlete Participants are minors, the Service: collects only the data reasonably necessary for the team-administration purposes described in this Policy; contains no public profiles, social feeds, direct messaging, or content sharing; serves no advertising; collects no precise geolocation; and never sells or discloses minors' personal information except as described in Sections 4 through 6. Parents and guardians have the review, deletion, and revocation rights described in Sections 6.2 and 10, and Coaches must obtain required parental consents before adding an athlete to a roster.

Section 9. Health-Related Information

9.1 Sensitive Treatment. Weight, body-composition, and hydration-certification values are health-adjacent. We treat them as sensitive information: access is limited to the team and school that entered them and to personnel and processors that need them to operate the Service; they are excluded from analytics; they are never used for advertising or sold; and they are encrypted in transit and at rest.

9.2 Not a Medical Record; Not HIPAA. The Service is not a medical record system, and we are not a HIPAA covered entity or business associate. Coaches must not enter medical records into the Service. Where the FTC Health Breach Notification Rule (16 C.F.R. Part 318) applies to health-related information we hold, we will provide the notifications described in Section 13.

Section 10. Your Rights and Choices

10.1 Rights We Honor for Everyone. Regardless of where you live, you (and, for an Athlete Participant, a parent or guardian) may: request access to and a copy of your personal information; request correction of inaccurate information; request deletion; and request an export of Team Data (for Team Administrators). We honor these rights voluntarily even where no statute requires it. Requests: [email protected]. We verify requests using the account email or through the School, respond within forty-five (45) days, and never discriminate against anyone for exercising rights. If we deny a request, you may appeal by replying to our decision, and we will answer the appeal within sixty (60) days.

10.2 Communications Choices. Unsubscribe links appear in every marketing email; reply STOP to end text alerts; push notifications are controlled in your device settings. Transactional messages (security notices, receipts) are sent as long as you hold an account.

10.3 School-Owned Records. Where records belong to a School, we may need to route your request through the School, as described in Section 6.2. We will tell you if so and help complete the request.

Section 11. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, under a written retention schedule. Current default periods:

Verified deletion requests are honored within 60 days (sooner where a statute requires). Legal holds, billing disputes, and safety investigations can extend retention for the affected records only.

Section 12. Security

12.1 We maintain a written information-security program appropriate to our size and the sensitivity of the data we hold, with a designated security coordinator, at least annual risk assessments, and safeguards including: encryption of data in transit (TLS) and at rest; role-based access controls and least-privilege administration; multi-factor authentication for administrative access; logging and monitoring; secure software-development practices; vendor review and data-protection terms with each subprocessor; workforce confidentiality obligations; and a documented incident-response plan. No security program is perfect, and we cannot guarantee absolute security.

Section 13. Breach Notification

13.1 If a breach of security affects personal information, we will: notify affected users and, where applicable, affected Schools without unreasonable delay consistent with law and any district agreement (our target is within 72 hours of confirming a reportable incident for School notice); notify individuals no later than the deadlines in applicable law, including Texas Business & Commerce Code § 521.053 (no later than 60 days), the Oklahoma Security Breach Notification Act, and, where it applies, the FTC Health Breach Notification Rule (individuals within 60 days; the FTC at the same time as individual notice when 500 or more individuals are affected, plus media notice at that threshold); notify the Texas Attorney General within 30 days if 250 or more Texas residents are affected, and other regulators as required; and describe what happened, what information was involved, and what we are doing about it, with at least two ways to contact us.

Section 14. Cookies and Similar Technologies

14.1 The Service uses only essential cookies and similar technologies: session authentication, security (fraud and abuse prevention), load balancing, and remembering your settings, plus privacy-respecting, cookieless-where-possible product analytics under our control. We use no third-party advertising cookies and no cross-site tracking. Because we do not sell or share personal information for advertising, there is nothing to opt out of; we treat Global Privacy Control signals as a request to confirm that status. “Do Not Track” signals receive the same treatment.

Section 15. Third-Party Services and Links

15.1 The Service may link to third-party sites and services — including Trackwrestling, the NWCA OPC, and Governing Body sites — that we do not control and whose privacy practices are their own. App-store platforms (Apple, Google) process their own account, age-category, and purchase information under their policies, including age signals under the Texas App Store Accountability Act, which we honor as described in the Terms of Service.

Section 16. State-Specific Disclosures

16.1 Texas. ScratchWeight currently qualifies as a small business under U.S. Small Business Administration size standards, and is therefore exempt from most provisions of the Texas Data Privacy and Security Act (TDPSA); we nonetheless honor the access, correction, deletion, and portability rights in Section 10 voluntarily. As required of small businesses by Tex. Bus. & Com. Code § 541.107, we will not sell sensitive personal data — and, as stated in Section 5, we do not sell personal data at all. We do not engage in targeted advertising or profiling. If the company grows beyond the small-business exemption, we will comply with the TDPSA's full obligations, including data-protection assessments and universal opt-out signal recognition.

16.2 Oklahoma. The Oklahoma Consumer Data Privacy Act takes effect January 1, 2027 and applies above processing thresholds ScratchWeight does not currently meet; personal data governed by FERPA is exempt. We will honor its consumer rights through the process in Section 10 as it becomes applicable, and we treat personal data collected from a known child as sensitive data requiring consent.

16.3 Other States. If we make the Service available to teams in additional states, we will honor those states' consumer privacy rights through the process in Section 10 and update this Policy as needed (including any required consumer-health-data disclosures, such as under Washington's My Health My Data Act, before serving those states).

Section 17. Changes to This Policy

17.1 We will post any updated Policy at scratchweight.com/privacy with a new “Last Updated” date. For material changes, we will give at least thirty (30) days' advance notice by email and in-Service notice before the change takes effect, and we will not apply material changes retroactively to previously collected Student Data without the School's (or parent's, where applicable) consent. We will never weaken Section 5 (No Sale) for previously collected information.

Section 18. Contact Us

18.1 Privacy questions, requests, and complaints: [email protected], or ScratchWeight LLC, Attn: Privacy, at the mailing address published at scratchweight.com/contact. If you are not satisfied with our response, Texas residents may contact the Texas Attorney General's Consumer Protection Division; parents of students may also contact their School or, for FERPA matters, the U.S. Department of Education's Student Privacy Policy Office.