Privacy Policy

1. Information We Collect

Account Information:

• Name, email address, and phone number (parents and guardians only)
• Account login details

Financial Information:

• Bank account details are collected through Plaid. We never store your full account or routing numbers.
• Transaction data for spending categorization
• Contribution amounts and investment records
• Payment details are processed by Stripe. We never see your credit card number.

Information About Your Athlete:

• First name, sport, and team (provided by you, the parent or guardian)
• We collect only what is needed to set up their savings account

Technical Information:

• Device type and operating system
• IP address and usage data

What We Do NOT Collect:

• Social Security numbers are passed directly to Unit.co for identity verification. We never store, log, or have access to them.

2. How We Use Your Information

We use information we collect to:

• Create and manage your account
• Verify your identity (required by law for financial services)
• Process contributions and ACH transfers
• Categorize your sports-related spending
• Bill your subscription through Stripe
• Provide customer support
• Monitor for fraud and keep your account secure
• Improve the app experience

3. Children’s Privacy (COPPA)

Protecting kids is a top priority for us.

• We do not collect personal information directly from children under 13
• All accounts for minors are created and managed by a parent or legal guardian
• Parents provide only limited information about their child (first name and sport)
• No child can independently create an account or give us personal information
• We do not ask for more information than what is needed
• We get parental consent through the parent’s own authenticated account

As a parent or guardian, you can:

• Review the information we have about your child
• Ask us to change or correct it
• Ask us to delete it

To make a COPPA-related request, email privacy@bagequity.com with the subject line "COPPA Request."

4. Your Athlete’s Savings Account

Accounts for minors are opened as custodial accounts for the benefit of the child, at Alpaca Securities LLC, member FINRA and SIPC. A custodial account is a securities account, not a bank deposit.

• The parent or guardian opens and manages the account
• The account is held for the benefit of the child
• The account is held at Alpaca Securities LLC, member FINRA and SIPC
• Uninvested cash may be swept to program banks, where it is FDIC-insured while it is held at those banks and only while it is held there
• SIPC protects the account if the brokerage fails. It does not protect against investment loss, and it is not deposit insurance

5. Who We Share Information With

We share data only with partners that are required to run the service:

• Unit.co: Banking services, identity verification, and ACH transfers
• Plaid: Secure bank account linking and transaction data
• Stripe: Subscription billing
• Supabase: Cloud database and user authentication
• Vercel: Web hosting

We do NOT sell your personal information. Ever. We do NOT share your data for advertising.

We may share information with law enforcement only when required by a valid legal process, such as a court order or subpoena.

6. How We Protect Your Data

We take security seriously:

• All data is encrypted when stored (AES-256 encryption at rest)
• All data is encrypted when sent over the internet (TLS 1.2 or higher)
• Multi-factor authentication (TOTP) is required before linking a bank account
• Row-level security restricts data access to your family only
• Rate limiting protects against automated attacks
• Personal information is stripped from system logs
• We run regular security reviews and automated vulnerability scans

Bank credentials are handled exclusively by Plaid and are never sent to or stored on BagEquity servers.

7. How Long We Keep Your Data

Active Accounts:

• Your data is kept as long as your account is active

Closed Accounts:

• Financial records are kept for 7 years (required by federal regulations)
• Transaction data is kept as required by BSA/AML law
• Technical logs are kept for 90 days

Deletion Requests:

• Honored within 30 days, except for data we are legally required to keep
• To request deletion, email privacy@bagequity.com

8. Your Rights

You have the right to:

• Access: Ask for a copy of your personal data
• Correction: Fix information that is wrong
• Deletion: Ask us to delete your data (subject to legal requirements)
• Portability: Get your data in a format you can take elsewhere
• Opt Out: Unsubscribe from marketing emails

California Residents (CCPA):

• Right to know what data we collect and why
• Right to delete your data
• Right to opt out of the sale of your data (we do not sell data)
• We will not treat you differently for exercising your rights

To exercise any right, email privacy@bagequity.com.

9. Cookies and Tracking

• We use only essential cookies needed for the app to work
• No advertising cookies or third-party trackers
• Analytics data is used only to improve the app

10. Changes to This Policy

If we make important changes to this policy:

• We will notify you by email and in the app
• You will have 30 days to review changes before they take effect
• Continuing to use the app after that means you accept the changes

11. Contact Us

If you have questions about this privacy policy or your data:

Email: privacy@bagequity.com Mail: Bag Equity LLC, 1001 Bannock Street, Denver, CO 80204

For COPPA requests: privacy@bagequity.com (subject line: "COPPA Request")

Questions

Email support@bagequity.com and we will get back to you.