Privacy Policy

Tommy Hulihan, Inc. ("Tommy Hulihan Basketball," "we," "us," or "our") operates youth basketball leagues, camps, clinics, and training programs in the Jacksonville Beach, Florida area, and operates tommyhulihanbasketball.com and its subdomains.

This Privacy Policy explains what information we collect, why we collect it, who we share it with, and the choices you have. It applies to our website, our registration system, and our program operations.

We run programs for children. Registrations are completed by a parent or legal guardian, not by a child. We treat participant information as sensitive and we do not sell it.

1. A note about our previous registration provider

We previously used a third-party registration platform to accept registrations. We no longer use that platform. Registrations are now handled directly through our own system on this site.

Registration records created on the prior platform were imported into our system so that we can maintain accurate historical rosters, division placement, and returning-player records. Information you provided to that prior platform is now also governed by this Privacy Policy. That platform’s own handling of any data it retains is governed by its own privacy policy, not by ours. If you want us to delete imported historical records associated with your family, contact us at info@tommyhulihanbasketball.com.

2. Information we collect

Participant information (submitted by a parent or guardian):

• First and last name, date of birth, current grade, and school name
• Gender, where the program is divided by gender
• T-shirt or jersey size
• Division and team assignment, attendance, and participation history

Parent or guardian information:

• First and last name, and relationship to the participant
• Email address, phone number, and mailing address

Emergency contacts:

• Name, relationship, phone number, and email address for up to three emergency contacts

Health and safety information:

• Whether the participant has a medical condition or allergy
• Free-text medical details you choose to provide, so coaches and staff can respond appropriately
• Injury or incident reports created during a program

Requests and preferences:

• Teammate and coach requests, which may include the names of other children or of adult coaches
• Notes you add to a request

Coach and volunteer information:

• Name, email, phone, shirt size, and notes, if you volunteer to coach
• Background-check status, where a background check is required for a role. Background checks are performed by a third-party provider; we receive a result, not the underlying report contents.

Agreements:

• Whether you accepted the participation waiver, which version and exact text you accepted, the name of the signer, and the date and time of acceptance

Payment information:

• Amount, currency, program, date, payment status, refunds, and the last four digits and brand of the card, as reported to us by our payment processor
• We do not collect or store your full card number, card expiration, card security code, or bank account credentials. Card details are submitted directly to Stripe through Stripe’s hosted checkout.

Account and technical information:

• Email address and authentication credentials for any account you create. Passwords are stored only as salted hashes by our authentication provider; we cannot read them.
• Phone-verification requests and verification status. When you submit a verification code, the app transmits that user-entered code to Twilio for validation; we do not store verification codes.
• IP address, browser type and version, device type, pages viewed, referring page, and timestamps

First-party registration-journey operations:

• Limited operational progress information only after a parent or guardian deliberately begins a supported registration flow: the program, flow version, safe stage code, activity timestamps, and whether an application was saved or Checkout began. We do not place raw form answers, medical details, insurance details, requests, payment-card data, or browser tokens in this journey record.
• If a parent or guardian asks to verify a pre-save email address, the address, a short-lived one-time verification challenge, and the verification outcome. A verification email is not a marketing subscription.
• A minimum hashed delivery/suppression record and owner or administrator review audit for a manually reviewed finish-application reminder. The audit records aggregate counts and a selection digest, not the recipient address or message contents.

These first-party registration-journey operations are enabled for supported registration flows under this policy. They remain limited to the operational information described above and do not run an automatic reminder campaign.

3. Where the information comes from

• From you, when you register, create an account, submit a request, contact us, or communicate with staff.
• From our service providers, such as payment status from Stripe or a background-check result from a screening provider.
• From our prior registration platform, for historical records imported as described in Section 1.
• Automatically, from your device when you use the site.

4. How we use the information

We use it to:

• process and confirm registrations, and manage waitlists;
• verify eligibility for a division based on grade, age, gender, and school;
• build divisions, teams, rosters, and schedules;
• consider teammate and coach requests;
• process payments, refunds, and cancellation protection;
• record and prove waiver acceptance;
• contact you about registration, payment, schedule, roster, and safety matters;
• when separately enabled, send a manually reviewed finish-application reminder only to a verified, unsuppressed parent or guardian recipient; we do not run an automatic reminder campaign;
• verify phone-number ownership through one-time transactional codes; the code you submit is transmitted to Twilio for validation and is not stored by us;
• respond to a medical situation or injury during a program;
• staff programs, assign coaches, and confirm required background screening;
• produce rosters, standings, statistics, and program recaps;
• maintain historical records for returning players and league operations;
• improve our programs and our site;
• prevent fraud, abuse, and unauthorized access, and enforce our Terms; and
• comply with law and respond to legal process.

5. Children’s privacy

Our programs serve children, but our website is not designed for children to use directly. We do not knowingly permit anyone under 18 to create an account, submit a registration, or make a payment. All information about a minor participant must be submitted by that minor’s parent or legal guardian.

Parents and guardians control the information provided about their child and may review, correct, or request deletion of it at any time. We do not use children’s information for behavioral advertising, we do not sell it, and we do not share it with third parties for their own marketing.

If we learn that a child under 13 has provided information to us directly without a parent or guardian, we will delete it. Contact us at info@tommyhulihanbasketball.com.

6. Health information

Medical details you provide are used only to keep participants safe — to inform coaches and staff of a relevant condition or allergy, to respond to an injury, and to authorize emergency medical care under the participation waiver.

We are not a healthcare provider, and we are not a HIPAA-covered entity. Information you give us is not protected health information under HIPAA. We share medical details only with the coaches, staff, and emergency responders who need them, and we do not use them for any other purpose.

7. Cookies and tracking

We use cookies and similar technologies that are necessary to operate the site:

• Essential cookies that keep you signed in, keep your registration draft in progress, and protect against cross-site request forgery.
• Payment cookies set by Stripe during checkout, for fraud prevention and to complete your payment.

We do not use third-party advertising cookies, and we do not participate in cross-context behavioral advertising.

Most browsers let you block or delete cookies. Blocking essential cookies will prevent registration and sign-in from working. We do not currently respond to browser Do Not Track signals, because there is no common standard for them.

Google Analytics and Google Tag Manager. With your affirmative analytics choice, we use Google Analytics through Google Tag Manager to understand reviewed public pages and a privacy-minimized registration funnel. Analytics may process explicitly enabled Preview test traffic and Production traffic.

Vercel Web Analytics. With the same affirmative analytics choice, we use Vercel Web Analytics to count page views on reviewed public pages. Before a page view is sent, we replace dynamic path values with a fixed page template and remove query strings and fragments. Vercel may use the event timestamp, that fixed page template, referrer, approximate geography, operating system, browser, and device type to provide anonymous aggregate reporting. Vercel Web Analytics does not use cookies, does not associate the page view with an individual or IP address, and resets its daily visitor hash and session information after 24 hours.

Our analytics uses fixed page templates and nine fixed event types: page viewed, program viewed, registration started, registration step completed, registration application saved, registration review viewed, registration Checkout started, categorized registration error, and registration paid. These events use only fixed operational labels for program type, flow, mode, step, operation or result, review or Checkout kind, and broad error stage or category; they do not use registration details.

We store your analytics choice, its timestamp, and this policy version in a browser record for this site with no fixed expiration. That record remains until you change or revoke your choice, clear site or browser storage, or a new policy version means we no longer use it. When analytics is allowed, Google may use the isolated pseudonymous client and session-state cookies thb_app_ga and thb_app_ga_T60TEKXH3J; Google Analytics gives those cookies a default expiration of two years. They end sooner if you revoke your choice (which stops future collection and removes only those two analytics cookies), clear them, or the browser otherwise removes them.

Even with our privacy-minimized settings, Google Analytics may receive unavoidable technical information for consented measurement, including language, screen resolution, event and session timing statistics, browser and device data, and approximate geography derived from IP address. Google Analytics may automatically create first-visit, session-start, and engagement records. We disable Google Signals, advertising storage, ad user data, and ad personalization.

THB sends only reviewed static paths or canonical page templates and excludes administrative, account, authentication, API/internal, local, unknown, Player Development, and retired registration paths. For permitted measurement, tag configuration supplies a fixed page location made only from the public app origin plus an approved canonical template (or the root-origin default), a fixed root-origin referrer, and the fixed title THB App; it does not read a browser location, document referrer, or document title. We do not intentionally send names, contacts, medical/request/roster text, internal IDs, prices or amounts, raw errors, form values, raw browser URLs, query strings, fragments, raw referrers, page titles, or user IDs as analytics data.

8. How we share information

We do not sell personal information. We do not rent or trade contact lists. We share information only as described below.

Service providers. We use vendors to run our site and programs. They may process information only on our instructions and only to provide their service to us.

Coaches, staff, and volunteers. Team coaches receive the roster information they need to run their team — participant name, guardian contact information, emergency contact information, and any medical detail relevant to safe participation. They are required to use it only for team purposes.

Facilities, leagues, and officials. We may share a participant’s name and team with a facility, opposing organization, or officiating group as needed to run games and tournaments.

Other families. Rosters, schedules, standings, and team contact lists shared with a team may reveal a participant’s name, team, and a guardian’s contact information to other families on that team.

Public program content. Photographs, video, standings, statistics, and program recaps may be posted publicly. See the photography section of our Terms of Use and Service for how to opt out.

Legal and safety. We may disclose information when we reasonably believe it is required by law, subpoena, or court order; necessary to investigate suspected fraud or a violation of our Terms; or necessary to protect the safety of a participant, our staff, or the public.

Business transfer. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

9. Automated and AI-assisted processing

Registration lets families type teammate and coach requests in their own words. To read those requests consistently across hundreds of registrations, we use automated processing — including, in some cases, AI-assisted text analysis — to identify the names and request types contained in the free text.

• A person makes the decision. Automated analysis produces a suggestion. Division, team, and roster placement decisions are reviewed and made by our staff.
• No legally significant automated decisions. We do not use automated processing alone to make decisions that produce legal or similarly significant effects.
• Scope. This processing applies to request text and the participant and guardian names needed to interpret it. It is not used on medical details.
• Provider terms. Where an AI provider is used, it processes the text only to return a result to us and is contractually restricted from using it to train its models.

10. Your choices and rights

You may, at any time:

• Access the information we hold about you and your participant;
• Correct inaccurate information, including through your account;
• Request deletion of information we no longer need to keep;
• Opt out of photography and media use for your participant;
• Close your account.

To make a request, email info@tommyhulihanbasketball.com from the address on file. We will verify your identity and your relationship to the participant before acting, and we will respond within 30 days.

Limits on deletion. We may keep information we are required to keep or that we need to retain — including payment and tax records, waiver acceptance records, and injury or incident reports — for the periods described in Section 11, and information necessary to enforce our Terms or defend a legal claim.

Florida residents. Florida’s Digital Bill of Rights applies only to businesses above a revenue threshold that we do not meet, so its statutory rights do not apply to us. We extend the rights described in this section to all families regardless of where you live.

Residents of other states. If you live in a state with a comprehensive privacy law that applies to us, contact us and we will honor the rights that law gives you. We do not sell personal information or share it for targeted advertising under any of those laws.

11. How long we keep information

12. How we protect information

We use encryption in transit (HTTPS/TLS), access controls that limit staff and coach access to what each role needs, hosted payment processing so card data never reaches our systems, hashed passwords, audit records for registration and payment changes, and vendors that maintain their own security programs.

No system is perfectly secure. If a breach affects your information, we will notify you and the appropriate authorities as required by Florida law.

13. Other points

Where information is processed. Our providers process and store information in the United States. If you access the site from outside the United States, your information will be transferred to and processed in the United States.

Links to other sites. Our site links to schools, facilities, partner organizations, and payment pages we do not control. This Privacy Policy does not apply to those sites.

Changes to this policy. We may update this Privacy Policy. We will change the "Last updated" date and post the revised policy here. If we make a material change in how we use information you already gave us, we will notify you by email or through the registration flow before the change takes effect.

14. Contact us

Tommy Hulihan, Inc. — info@tommyhulihanbasketball.com