Your data, your control.

1. Who we are

TuffoNova is operated by Tuffo, Inc. (“TuffoNova,” “we,” “us”). We provide a volleyball operations platform used by clubs, high schools, tournament directors, coaches, players, and the parents and guardians of player accounts.

2. What we collect

We collect only what we need to run the operations you sign up for:

• Account data — name, email, password hash (managed by our identity provider), and any organization memberships you accept.
• Player data — legal name, date of birth, jersey number, position, and roster placement, when added by an authorized coach, club admin, or guardian.
• Performance data — match scores, in-game stats, video markers, and tournament results that authorized users record.
• Operational data — tryout submissions, communications inside the platform, audit logs of changes to roster and tournament records, and support correspondence you send us.
• Technical data — IP address, browser type, device identifiers, and request logs needed to operate, secure, and debug the service.

We do not sell personal information. We do not run third-party advertising trackers on the application surface.

3. How identity works

Authentication is handled by Google Firebase Authentication. Email/password credentials, OAuth tokens (when you sign in with Google or another provider), and password reset flows are processed by Firebase under their security and privacy program. TuffoNova receives a Firebase user identifier and the email address you authenticated with — we do not store your password.

Application data (rosters, stats, tournaments, memberships, organization records) is stored in our PostgreSQL database in the United States. Backups are encrypted and retained on a rolling schedule.

4. Children under 13 (COPPA)

Volleyball programs include athletes younger than 13. The Children’s Online Privacy Protection Act (COPPA) requires verifiable parental consent before we collect personal information from a child under 13.

• Player records for athletes under 13 must be created or claimed by a verified parent or legal guardian, or by an organization that has obtained parental consent on file.
• We collect the minimum data needed to roster and run matches for under-13 players. Optional fields stay optional.
• Parents and guardians may review, correct, or request deletion of their child’s data at any time by emailing [email protected] or by using the in-app account controls when available.
• We do not condition a child’s participation on disclosing more information than is reasonably necessary.

5. School data (FERPA)

When TuffoNova is used by a high school athletic department or other school district, we operate as a “school official” under the Family Educational Rights and Privacy Act (FERPA) and process education records only on the documented instructions of the school. School data is siloed by organization, is not used to train models, and is not shared with other organizations.

Schools may request a Data Processing Addendum (DPA) and a Parent Bill of Rights summary from [email protected].

6. SafeSport and minor protections

Where TuffoNova exposes coach-to-athlete communication surfaces, we apply U.S. Center for SafeSport-aligned practices: parents and guardians of minor athletes are copied on direct messages, two-deep adult presence is enforced for sensitive workflows, and message history is retained on a multi-year retention schedule for review by authorized program administrators.

7. How we use data

• To deliver the features you sign up for.
• To authenticate accounts and prevent abuse.
• To send transactional notifications (account, billing, roster, match).
• To debug and improve reliability of the service.
• To meet legal, tax, and compliance obligations.

8. Sharing

We share data with vetted subprocessors who help run the service — identity (Firebase Authentication), database hosting, error monitoring, and payments (when enabled). Each is bound by a written agreement that limits use to providing services to TuffoNova. We do not sell personal data, and we do not share data across organizations.

9. Retention

We retain account and roster data for as long as your organization is active on TuffoNova, plus a defined wind-down window after cancellation so administrators can export records. Audit logs are retained on a rolling multi-year schedule. Deletion requests are honored within a reasonable window once identity is verified, except where a record must be retained for legal, tax, or safety reasons.

10. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Email [email protected] with your request and we’ll respond within the window applicable law requires.

11. Security

Data in transit is protected by TLS. Data at rest is encrypted at the storage layer. Access to production systems is limited to a small set of authorized engineers, gated by short-lived credentials and audit logs. We do not promise absolute security — no system can — but we apply industry practices and maintain an incident response plan.

12. Changes

We will update this notice as the platform grows. Material changes will be communicated by email to organization admins, posted in-app, or surfaced on this page with a new effective date.

13. Contact

Privacy questions, COPPA / FERPA paperwork, deletion requests: [email protected]. General contact information lives on our contact page.