Privacy Policy — WinningTeam Sync

Effective date: November 12, 2026 Who we are: WinningTeam Sync is made by Charlie Storm Apps LLC ("we", "us"), a Virginia limited liability company. Contact: support@charliestormapps.com.

WinningTeam Sync is a team app for youth sports clubs. Coaches record observations about their athletes and share them with their coaching staff; clubs run their schedule, attendance, messages, memberships, dues and camp registrations; families follow their own children, pay, and register. It is an iPhone and iPad app, an Android app, a web app, and public club pages for camp and clinic registration.

This policy describes what the service actually does as of the effective date. If a feature changes how data is handled, this policy changes with it, first.

The short version

• Athletes are minors, and we treat everything about them as sensitive. Children never have accounts of their own; the adults around them (coaches, club staff, parents) do.
• Coaches' observations about athletes are visible only to that team's coaching staff — never to families, other teams, or the public.
• Parents see the team schedule, the roster's names, team messages, and their own child's attendance, payments and registrations.
• Parents can keep private notes about their own child that only they can read.
• Voice recordings stay on the device that made them; transcripts sync.
• Payments are made to the club through Stripe. We never see or store card or bank numbers.
• We never sell personal information and never use it for advertising. There are no ads, no third-party analytics, no tracking across other apps or sites.
• You can delete your account in the app at any time.

What we collect, and why

Account information (adults only). Your name and email address, so you can sign in and your team knows who you are. If you use Sign in with Apple or Google, we receive the name and email that provider shares (Apple may give us a private relay address). We use Amazon Cognito to manage sign-in; your password is never stored in readable form.

Phone numbers — only if shared. A family may choose to share a phone number with its team's other families (for rides and logistics), and a club may record a guardian's phone number as a family contact. Both are optional.

Roster information, entered by the club. Athletes' names, the sport grouping (for wrestling, a weight class), level, and — optionally — a birthdate, a school grade, and a membership number with the sport's governing body (for wrestling, a USA Wrestling card number). The head coach and club administrators see the birthdate and can download it with the rest of the roster, for tournament entries; other coaches see only an age. The membership number is seen by the club's coaches and administrators. An athlete's own parents or guardians see that athlete's birthdate and membership number too, and can correct them, the grouping and the grade themselves. Families' devices never receive another child's birthdate or membership number, only an age.

Coaching observations. Transcripts of coaches' voice memos, typed notes, team notes, AI-generated trend summaries, and progress reports. The audio of a voice memo is stored only on the recording device and deleted automatically after 30 days; it is not uploaded.

Parents' private notes. Notes a parent writes or dictates about their own child. The text syncs so it is on each device the parent signs in on, and is returned only to that parent. A recording made for a note is discarded once it is transcribed.

Schedule and attendance. Events (practices, competitions, camps), RSVPs, attendance and check-ins (including from a club's check-in tablet or phone at the door), and practice-partner groupings.

Messages. Announcements from coaches, team chat (coaches and families), and staff chat (coaches only). If you report a message, your email app sends us its details.

Memberships and payments. The club's plans and fees, which athletes are enrolled, what each family owes and has paid, refunds, and whether a family has turned on automatic payment. Payments are processed by Stripe on the club's own Stripe account: card and bank details are entered on Stripe's pages and stored by Stripe, never by us. We keep Stripe's reference numbers so we can show payment status.

Registrations from a club's public page. When someone registers an athlete for a camp or clinic — with or without an account — we collect the athlete's first and last name, the guardian's name, email and phone, any notes the registrant writes, whether they accepted the club's waiver (and which version), and how they chose to pay. Please don't put medical information in the notes unless the club asks for it; if you do, it is shared with that club's staff.

Waivers. A club may publish its own waiver. We record who accepted which version and when. The waiver's wording is the club's, not ours.

Calendar subscriptions. If you subscribe to a team calendar, we create a private link; anyone who has that link can see the team's schedule, so treat it like a password (you can replace it in the app).

AI apps you connect (coaches and club staff). A coach or club administrator can connect an AI app, such as Claude or ChatGPT, to their own account (see Use WinningTeam Sync with an AI app). We keep a record of the connection (which app, when it was connected and last used) and the sign-in it uses. We also keep a record of each change saved through it: who saved it, with which app, and a one-line summary such as "Added 9 athletes". A change the app proposes is kept for an hour, until the person confirms it.

Technical information. Our servers keep standard logs (for example, that a request was made and whether it succeeded) to operate and secure the service. These logs are deleted after 30 days. When someone signs up on a club's public page without an account, we keep the internet (IP) address the sign-up came from for up to two days, only to count sign-ups from each address and stop automated ones. The club never sees it. We use no analytics or advertising SDKs, no advertising identifiers, and no cookies for tracking. The web app keeps your sign-in in your browser tab's session storage, which is cleared when you close the tab.

Which ad or flyer brought a new club. Our ads, flyers and cards link to our website with a short label saying which one it was. If you start a club during that visit, we save that label with the club, so we know which ones work. We keep nothing else from the link (not Facebook's click identifier) and share it with no one.

Feedback you send us. Feedback in the web app and in the apps' account menu emails your note to us at support@charliestormapps.com, with your name, email address, the club and team you were looking at and your role there (or, if you weren't looking at one, the teams you're on), the screen you were on, and which app or browser you used, so we can answer you. We treat it like any other email to support, and use it only to reply and to improve the app.

How AI is used

• On your device: voice memos are transcribed by your device's own on-device speech recognition (Apple's on iPhone and iPad, Android's on Android phones). The audio does not leave the device for this.
• On our servers: AI summaries (an athlete's trends, a summary of the staff's team notes, and a parent's summary of their own private notes) and progress-report drafts are written by Amazon Bedrock (an AWS service). The notes being summarized are sent to it and the text comes back; neither is kept by Bedrock or logged by us. AWS does not use this content to train models, and neither do we. When a coach or club administrator imports a roster spreadsheet on the web, the file's contents (athletes' names and groups, and parents' names, emails and phones) are sent to Amazon Bedrock in the same way so it can be read into the roster; the coach reviews the result before anything is saved. Columns about a child's health or behaviour are removed before the file is sent, and the uploaded file is deleted as soon as it has been read (within a day at most). A schedule file imported the same way (a team's events, their dates, times and places) is sent to Amazon Bedrock to be read into the schedule, and deleted in the same way. To stop the feature being abused, we count how many of these requests each team makes in a month and each account makes in a day. The counts are numbers only, never the notes, and an account's are deleted with the account.
• When you're offline, an iPhone or iPad with Apple Intelligence writes the summary on the device instead and says so, and that content does not leave the device. A cloud summary replaces it the next time you open it online.
• Parents' private notes go to Amazon Bedrock only to write that parent's own summary, which only that parent sees. Coaches never see the notes or the summary, and they are never part of any team or coach summary.
• An AI app you connect (coaches and club staff only) acts as you. It sees only what you can see in WinningTeam Sync, and it changes something only after showing you the change and getting your yes. It can't move money, message families, or change who's on your staff. What it reads, for example your roster and schedule, goes to that app's company and is handled under that company's privacy policy and terms, not ours. We don't send your club's data to it otherwise, and you can disconnect it at any time.
• AI output is always shown to a person to review and edit; nothing AI-generated is sent to a family automatically.

Who can see what

Our own staff access personal information only to provide support you ask for, to keep the service secure and working, or when the law requires it.

Who we share it with

We do not sell personal information, and we do not share it for advertising. We share it only:

• With your club — the point of the service. A club's staff see what the table above allows.
• With the service providers that run the app for us, under contract, only for that purpose: Amazon Web Services (hosting, database, file storage, email delivery through Amazon SES, and Amazon Bedrock for AI features), Stripe (payments, on the club's own Stripe account — Stripe's own privacy policy also applies to what you enter on its pages), and Apple or Google if you choose to sign in with them.
• With an AI app you connect, at your direction: what it reads goes to that app's company (see "How AI is used"). Connecting one is your choice, and you can disconnect it at any time.
• When required by law, or to protect someone's safety.
• If the business changes hands, with the same protections, and we'll tell you first.

A coach may choose to share content they created — for example, emailing a family its child's finished progress report. That's the coach's choice and responsibility.

Emails we send

Sign-in codes (sent by Amazon Cognito), team invitations, announcements a coach chooses to email, progress reports a coach shares with you, and payment notices (for example, a failed automatic payment). Stripe may also email you a receipt on the club's behalf. No marketing email.

A club's announcements and invitations can reach a parent or guardian whose email the club has on file even if they haven't joined the app, because the club added them as a family contact. Every announcement email has an unsubscribe link that stops that club's announcement emails to that address (other clubs' are separate). To honour it, we keep the address, the club and the date you unsubscribed for as long as the club uses the service.

Schedule emails are off unless you turn them on, per team: from the app, or from the link in an invitation if you haven't joined. They list the team's upcoming events twice a week and tell you when one is added, cancelled or moved to another time. To send them we keep your address, the team, your time zone (so the times read in it), and when you turned them on. Turning them off stops them; deleting your account deletes that record. If you're no longer on the team or its roster, they stop by themselves.

Where data lives and how it's protected

On Amazon Web Services in the United States. Data is encrypted in transit (HTTPS) and at rest; access is limited by role inside the app and by least-privilege permissions inside our systems. Data on your device is protected by your device's own security.

How long we keep it, and deleting it

• Voice audio: on the recording device only, deleted after 30 days. The Android app keeps no audio at all: your words are transcribed as you speak.
• Server logs: 30 days.
• The address a public sign-up came from: up to two days.
• AI-app connections: until you disconnect, or 30 days after connecting. A proposed change: one hour. The record of changes saved through an AI app: 400 days, so the club can see what changed and who changed it.
• Deleting your account (in the iPhone, iPad or Android app: the account menu at the top left of the home screen → Delete account; on the web: your email address at the top right; or email support@charliestormapps.com from the address on the account — see Delete your account): your sign-in is deleted and your name and email are removed at once. Coaching observations you wrote stay with the team, attributed to "Deleted coach", because they are part of the club's records about its athletes. So do changes you saved through an AI app; your AI-app connections are deleted. A parent's private notes are deleted, and so is anything you chose to share with other families. Automatic payment is turned off and your saved card is removed. Payment records stay with the club, which needs them for its own accounts, and so does the family contact on the club's own record for your child (a name, email or phone the club recorded, and a phone number you gave your coaches): a club has to be able to reach the family of a child in its care. It is disconnected from your account when the account is deleted; ask the club, or us, to remove it.
• Backups: our database keeps automatic backups for up to 14 days, so deleted data can remain in a backup for up to 14 days before it is gone.
• Information about a child: a parent or guardian can ask the club, or us at support@charliestormapps.com, to see, correct or delete it. We'll respond within 30 days.

Children

WinningTeam Sync accounts are for adults, and we do not knowingly let anyone under 18 create one. Information about athletes, who are usually minors, is entered and controlled by their clubs and guardians, limited to what running a sports team needs, and protected by the access rules above. If we learn a child has created an account, we delete it. Parents and guardians can contact us at any time about their child's information.

A parent or guardian may choose to let their own child who is 13 or older use the parent's account. We do not ask for or record who is holding the phone: anything done there, such as an RSVP or a message, is stored as the parent's, under the parent's name. The service is not for children under 13, and we do not knowingly collect personal information directly from them.

Your choices and rights

You can see and correct your own information in the app, choose whether to share a phone number, turn automatic payment on or off, replace a calendar link, and delete your account. You can ask us for a copy of your information, or to correct or delete it, at support@charliestormapps.com; we may need to confirm it's you. Depending on where you live you may have further rights under local law; we honor them and won't treat you differently for using them.

Changes to this policy

If we change this policy in a way that matters, we'll say so in the app or by email before the change takes effect, and update the effective date above.

Contact

Charlie Storm Apps LLC · support@charliestormapps.com