Privacy Policy

PuckWhiz (“we,” “us,” or “our”) operates youth hockey challenge platforms for hockey associations. This Privacy Policy explains how we collect, use, and protect information about players and their parents or guardians.

PuckWhiz is a product of Nsquared Insights, LLC. We provide a web-based platform that hockey associations license to run skill-development challenges for their players.

The hockey association that invited your child to participate (e.g., HYHA, Hopkins Park) is a separate organization. They administer player accounts and are responsible for ensuring appropriate parental consent has been obtained.

Contact us at: puckwhiz@gmail.com

From players:

• Username (assigned by the association administrator)
• Display name (first name or nickname)
• Age group / division
• Activity data: skill drill completions, touch counts, shot locations, timestamps
• Optional: selfie photos submitted with drill completions

From parents/guardians:

• Email address — used solely for activity approval notifications

Automatically collected:

• Session tokens (stored as secure HTTP-only cookies, expire after 30 days)
• Standard server access logs (retained up to 90 days)

We do not collect:

• Full legal names (unless a parent provides one as a display name)
• Phone numbers, physical addresses, or payment information
• Government IDs or Social Security numbers
• Precise geolocation

Our platform is used by children under 13. We take the following steps to protect their privacy:

• Accounts are created by association administrators, not by children themselves. Administrators are responsible for obtaining verifiable parental consent before creating an account.
• We collect the minimum data necessary to operate the skill challenge.
• Parent email addresses are used only to send activity approval notifications. Parents may contact us at puckwhiz@gmail.com to review, correct, or delete their child's data, or to opt out of further data collection.
• We do not allow children to post publicly identifiable information. Display names are first names or nicknames only.
• Selfie photos are optional and stored securely. Parents may request deletion at any time.
• We do not share children's information with third parties for marketing or advertising purposes.

We do not use player data for advertising, profiling, or sale to third parties.

Within the platform:

• Association administrators can view all player activity data for players in their organization.
• Leaderboard pages may display player display names and achievement counts publicly. No last names or contact information are shown.

Third-party service providers:

These providers are contractually bound to protect data and may not use it for their own purposes.

We do not sell personal information. We do not share data with advertisers, data brokers, or analytics companies.

Legal requirements: We may disclose information if required by law or to protect the safety of users.

Our platform operates on a per-season license (e.g., summer, fall, spring). Retaining data across seasons allows returning players to see their progress history. Associations may request full data deletion at any time by contacting us.

We implement reasonable technical safeguards including:

• Passwords hashed using PBKDF2 with SHA-256 (100,000 iterations) — plain-text passwords are never stored
• Session tokens are random values stored in HTTP-only, Secure cookies
• All data transmitted over HTTPS/TLS
• Database access protected by Row Level Security policies
• Admin database credentials never exposed to browsers

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at puckwhiz@gmail.com.

Parents and guardians of players under 13 have the right to:

• Access — request a copy of data we hold about your child
• Deletion — request deletion of your child's account and all associated data
• Correction — request correction of inaccurate data
• Opt-out — refuse further data collection (requires account deactivation)

To exercise these rights, email puckwhiz@gmail.com with your child's username and the name of their hockey association. We will respond within 10 business days.

Players 13 and older may exercise these rights directly.

We use a single session cookie (hyha_session) to keep players logged in. This cookie:

• Is HTTP-only (not accessible to JavaScript)
• Is Secure (only sent over HTTPS in production)
• Expires after 30 days
• Contains only a random token — no personal data

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

We may update this policy as the platform evolves. If we make material changes affecting how we handle children's data, we will notify association administrators by email at least 30 days before the change takes effect.

For privacy questions, data requests, or concerns:

For COPPA concerns, you may also contact the Federal Trade Commission: ftc.gov/coppa