Privacy Notice · LeagueBrain

This Privacy Notice for League Brain, LLC (“we”, “us”, or “our”) describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”).

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services.

Summary of Key Points

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process?
When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.
Do we process any sensitive personal information?
We do not process sensitive personal information.
Do we collect any information from third parties?
We may collect information from public databases, marketing partners, social media platforms, and other outside sources. Learn more about information collected from other sources.
How do we process your information?
We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. Learn more about how we process your information.
How do we protect your information?
We use technical, organizational, and administrative measures designed to safeguard your personal information, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), private-network isolation of our production databases, least-privilege access, and multi-factor authentication for production systems. Learn more about how we protect your information.
In what situations and with which parties do we share personal information?
We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.
What are your rights?
Depending on where you live, you may have certain rights regarding your personal information. Learn more about your privacy rights.
How do you exercise your rights?
The easiest way is by submitting a data subject access request or by contacting us. We will respond in accordance with applicable data protection laws.
How do we handle Google user data?
If you connect your Gmail account so that LeagueBrain can send email messages from your address, we only ask for permission to send messages on your behalf. We never read your inbox, contacts, or any other Gmail data. Learn more about how we handle Google user data.

Want to learn more about what we do with any information we collect? Review the full Privacy Policy.

WHAT INFORMATION DO WE COLLECT?
HOW DO WE PROCESS YOUR INFORMATION?
WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
HOW DO WE PROTECT YOUR INFORMATION?
HOW DO WE HANDLE YOUR SOCIAL LOGINS?
HOW DO WE HANDLE GOOGLE USER DATA?
IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
HOW LONG DO WE KEEP YOUR INFORMATION?
DO WE COLLECT INFORMATION FROM MINORS?
WHAT ARE YOUR PRIVACY RIGHTS?
CONTROLS FOR DO-NOT-TRACK FEATURES
DO WE MAKE UPDATES TO THIS NOTICE?
HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register on the Services, express an interest in obtaining information about us or our products and Services, participate in activities on the Services, or otherwise contact us.

All personal information must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

In Short: Some information, such as your IP address and browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, location, and how and when you use our Services. We primarily use this information to ensure security and operation of our Services and for internal analytics and reporting.

We also collect information through cookies and similar technologies. See our Cookie Notice for details.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, ensure security, prevent fraud, and comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To facilitate account creation and authentication
To provide and deliver Services
To respond to user inquiries and offer support
To enforce our terms, conditions, and policies
To detect and prevent fraud and abuse
To comply with legal and regulatory obligations

In Short: We may share information in specific situations described below and/or with the following third parties.

We may disclose your personal information to:

Business transfers: In connection with any merger, sale of assets, financing, or acquisition of all or a portion of our business.
Affiliates: Our parent company, subsidiaries, joint venture partners, or other companies under common control.
Service providers: Vendors, consultants, and other third parties who perform services on our behalf.
Legal obligations: To comply with a court order or other legal obligation.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies, web beacons, pixels, and similar technologies to gather information when you interact with our Services. These technologies help us maintain security, prevent crashes, fix bugs, save your preferences, and for analytics and advertising purposes. You can learn more and manage your preferences in our Cookie Notice.

5. HOW DO WE PROTECT YOUR INFORMATION?

In Short: We protect your information using technical, organizational, and administrative measures designed to safeguard it against unauthorized access, alteration, disclosure, and destruction.

We have implemented appropriate and reasonable security measures designed to protect the personal information we process. These measures apply to all data we hold, including any information received from third-party APIs such as Google’s Gmail API. Section 7 below describes additional, specific protections that apply to Google user data.

Encryption in transit. All connections to LeagueBrain use Transport Layer Security (TLS) version 1.2 or higher. This includes connections from your browser to our application, between our internal services, and between LeagueBrain and the third-party APIs we integrate with.
Encryption at rest. Data stored in our production databases is encrypted at rest using AES-256.
Network isolation. Our production databases are hosted in a private network and are not reachable from the public internet. They can only be accessed by application services running inside that private network or, in limited circumstances, by authorized engineers via a secured, audited path.
Least-privilege access. Access to production systems and to the data they hold is restricted to a limited number of authorized engineers, granted only when needed to operate, support, or secure the Services. Production access to the underlying cloud accounts requires multi-factor authentication.
Vulnerability management. We monitor our application and infrastructure dependencies for known vulnerabilities and apply security updates on an ongoing basis.
Personnel practices. Our personnel are bound by confidentiality obligations and receive guidance on handling personal information appropriately.
Service providers. We use a limited number of reputable infrastructure and software-as-a-service providers (for example, cloud hosting, email delivery, and error monitoring). These providers are contractually required to handle data in a manner consistent with this Privacy Notice and applicable law.
Incident response. If we become aware of a security incident that affects your personal information, we will investigate, take steps to contain and remediate it, and notify affected users and applicable regulators without undue delay and in accordance with applicable law.

Despite these measures, no system is perfectly secure and we cannot guarantee that unauthorized third parties will never defeat our safeguards. By using our Services, you acknowledge that you provide information at your own risk and that you should access the Services within a secure environment.

In Short: If you choose to register or log in using a social media account, we may have access to certain information about you.

Our Services let you register and log in using third-party social media credentials (e.g., Facebook or X). We receive profile information from the social provider, such as your name, email, friends list, and profile picture. We use that information only to facilitate your registration and login and as described in this Privacy Notice. We do not control how social providers use your data. Please review their privacy policies for details.

7. HOW DO WE HANDLE GOOGLE USER DATA?

In Short: When you connect your Gmail account to LeagueBrain, we only ask for permission to send messages on your behalf. We never read your inbox, contacts, or any other Gmail data. Our use of Google user data is limited and complies with Google’s Limited Use requirements.

If you choose to connect your Gmail account so that LeagueBrain can send email messages from your address, we request the following Google API scopes:

https://www.googleapis.com/auth/gmail.send: Lets LeagueBrain send email messages on your behalf. We use this only to send messages that you compose inside the LeagueBrain Composer (for example, league announcements or messages to coaches, players, and parents). Each message is initiated by you and a copy lands in your Gmail Sent folder so you have a complete record.
https://www.googleapis.com/auth/userinfo.email and openid: Let us display the connected Gmail address (for example, Connected you@example.com) inside LeagueBrain so you can confirm which account will be used as the sender and manage the connection.

What we do with Google user data:

We send messages you author, using the access you have granted. We do not modify the contents of your messages.
We display the connected email address inside LeagueBrain so you can verify and manage the connection.
We store a secure authorization token on our servers so that the connection persists between sessions. The token is held in encrypted storage and is not shared with third parties.

What we do NOT do with Google user data:

We do not read, list, search, label, modify, or otherwise access your Gmail messages, drafts, threads, contacts, or any other Gmail data beyond sending the messages you compose inside LeagueBrain.
We do not use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.
We do not sell, rent, or transfer Google user data to third parties for advertising, marketing, or any purpose unrelated to providing the LeagueBrain Services, except as required to deliver the sending feature (transmission to Google’s Gmail API), to comply with applicable law, or as part of a merger, acquisition, or sale of assets where the receiving party agrees to honor the terms of this Notice.
We do not allow humans to read your Google user data unless (a) we have your explicit consent, (b) it is necessary for security purposes (for example, to investigate abuse), (c) it is required by law, or (d) the data has been aggregated and anonymized so that you cannot be identified.

Retention and deletion: You can disconnect your connected Gmail account at any time from Settings → Integrations inside LeagueBrain. When you disconnect, we revoke the stored authorization token, delete the associated grant from our systems, and stop accessing the connected account. We do not retain Google user data after the connection has been removed, other than as necessary to comply with applicable legal or audit obligations.

Security measures for Google user data: The protections described in Section 5 (How We Protect Your Information) apply to all data we hold, including any Google user data. In addition, the following measures apply specifically to your Gmail authorization:

Encryption in transit. All communication between LeagueBrain and Google APIs uses TLS 1.2 or higher. The handshake that exchanges Google’s authorization code for an access token is performed server-to-server over TLS.
Encryption at rest. The authorization token issued by Google is stored in our production database, which is encrypted at rest using AES-256.
Network isolation. The database that holds your authorization token is hosted in a private network and is not reachable from the public internet.
Least-privilege access. The token is read by the LeagueBrain application service only when it needs to send a message that you initiated. Access by personnel is restricted to a limited number of authorized engineers, requires multi-factor authentication on the underlying cloud account, and occurs only when necessary for support, security investigations, or compliance.
Short-lived access tokens. We use OAuth refresh tokens so that access tokens stay short-lived. Access tokens issued by Google expire automatically on Google’s schedule, and we refresh them only when needed to send a message on your behalf.
Authentication-flow protections. The OAuth handshake uses PKCE (Proof Key for Code Exchange) and a single-use, server-set, HttpOnly cookie to prevent forged or replayed callbacks.
Revocation on disconnect. When you disconnect your Gmail account, we revoke the stored authorization token, remove it from our systems, and stop accessing the connected account.
Incident notification. If we become aware of unauthorized access to your Google user data, we will notify affected users and applicable regulators without undue delay and in accordance with applicable law.

Limited Use: LeagueBrain’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in The United States of America. If you access our Services from outside that country, your information may be transferred to, stored by, and processed by us and third parties in The United States of America and other jurisdictions. If you’re in the EEA, UK, or Switzerland, those countries may not have data protection laws as comprehensive as yours. We will protect your data in accordance with this Privacy Notice and applicable law.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information only as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law.

When we have no ongoing legitimate business need, we will delete or anonymize your personal information. If deletion is not possible, we will securely store it and isolate it from further processing until deletion is feasible.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

Our Services are not intended for children under 18. We do not knowingly collect or solicit personal information from anyone under 18. If we learn we’ve collected data from a minor under 18, we will delete it promptly. If you become aware of such data, please contact us at privacy@leaguebrain.com.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, update, or delete your personal information and, where applicable, withdraw consent.

Depending on your jurisdiction, you may have the right to request access to, correction of, or deletion of your personal information, or to withdraw your consent to processing. To exercise these rights, please contact us at the details below.

Account Information: To review, change, or terminate your account, log in and update your profile or contact us to request account closure. We’ll deactivate or delete your account and information from active databases but may retain certain data for fraud prevention, legal compliance, or troubleshooting.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most browsers and operating systems include a Do-Not-Track (‘DNT’) feature you can activate to signal your privacy preference. At this time, we do not respond to DNT signals or similar mechanisms. If a standard is adopted in the future, we will update this Notice.

13. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes. We will update this Privacy Notice to stay compliant with laws and regulations.

The updated version will be indicated by an updated “Last updated” date at the top. When we make material changes, we may post a prominent notice or send you a notification. Please review this Notice regularly.

14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this Notice, you may write to us at:

League Brain, LLC
1985 Beekman Court
Yorktown Heights, NY 10598
United States
privacy@leaguebrain.com

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Under applicable law, you may have the right to request access to, correction of, or deletion of your personal information, or to withdraw previously granted consent. To exercise any of these rights or for general inquiries regarding our privacy practices, please direct your request to privacy@leaguebrain.com. We will respond to all inquiries in accordance with applicable data protection laws and regulations.