Last updated: 2026-11-02

We keep the athlete's profile, list and the emails they send so the family can follow up with coaches. Emails go from the athlete's own Gmail, and we can only send, never read. OpenAI helps draft emails; PostHog handles analytics.

1. What never happens

• We never read, search or delete anything in a Gmail mailbox.
• A coach gets an email only after the athlete presses Send on it. Parents cannot send for the athlete.
• We sell no data.
• We use no website session replay or screen recording.
• Website click capture masks text, attributes and link queries.

2. Information we handle

2.1 Server events

When a family pays, renews, gets a refund or cancels, our server reports the plan, amount, currency or months paid to PostHog. It also reports tracked-link opens and follow-up reminders sent, with no names, schools or addresses. We rely on our legitimate interest in checking sales and that the product works. These events use checkout's random analytics identifier, never an email or account. PostHog keeps delivered events under its terms. We keep no separate copy. You can request deletion of sent records.

2.2 Your account

The parent and each athlete sign in with a code sent to their email, or with Apple or Google. Under our contract, we use the email, creation date and sessions to sign you in and link the family's athletes, outreach and plan. Cloudflare stores them in the US. Each session records its starting IP address and browser. We keep the account until you delete it. Codes expire after 10 minutes, and a session ends 60 days after your last visit. We count requests by IP address and email against sign-in abuse and delete the counts within a day. You can sign out or delete your account.

2.3 Athlete profile and list

The parent adds each athlete with a name, email, birth month and year and the quiz answers. The athlete can add position, height, GPA, club, high school, home town, video and schedule links and a stats line. The parent can leave notes on drafts. We use these, under our contract, to match programs and draft emails. Cloudflare stores them in the US until the athlete or family account is deleted. A public profile shows only what the athlete switches on and asks search engines not to list it.

2.4 Gmail sending

The athlete connects their own Gmail. Google asks for one permission: send email on their behalf. We store the Google address and an encrypted refresh token and use them only to send emails the athlete approves. Colorsbound's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We keep each sent email's subject, body, recipient and send time for the tracker and follow-ups. Disconnecting, removing the athlete or deleting the family revokes the permission at Google.

2.5 Drafting

OpenAI drafts from the athlete's first name, class, position, height, GPA, club, high school and stats line, and the program's school, division, conference and coach name. It never receives an email address or phone number. OpenAI keeps that request up to 30 days for abuse monitoring and does not train on it.

2.6 Tracked links

Video and profile links in an email point to colorsbound.com first. We count each open, keep the first and last open time and forward to the video or profile. We keep no IP address or browser of whoever opened it. Under our contract, opens show the family which coaches looked.

2.7 College coaches

Our program list comes from public college athletics staff pages: coach names, titles, work emails, the page address and read date. We use them, under our legitimate interest, so athletes can write to recruiting coaches. A coach can remove their work email at colorsbound.com/coaches or hello@colorsbound.com; we then delete and block it.

2.8 Subscription and email

Stripe runs checkout with Link, LLC as merchant of record. They receive the parent's email and payment details; we never see card numbers. We keep the customer and subscription identifiers, status, renewal date, card brand and last four digits, and the first payment's date and amount. We use them, under our contract, to unlock the plan and handle cancellation and refunds. Checkout also carries the first-visit campaign source and the browser's random analytics identifier. We keep our copy until the parent deletes the account; Stripe and Link keep theirs under their terms.

Cloudflare sends sign-in codes, athlete invites, a renewal reminder and a cancellation confirmation. On follow-up days the athlete gets one reminder, and the parent can get a copy. Turn either off in Account or from any reminder.

2.9 Website analytics

We collect visits, clicks, visit duration, public page addresses and queries, referrers, campaigns, browser and device details, errors and performance. Optional survey answers you type carry a random browser identifier. We rely on our legitimate interest in comparing visit sources and fixing broken or slow pages. PostHog receives this data, retains IP addresses and derives approximate country, region and city.

PostHog keeps analytics under its terms. We keep no separate copy. Cookies and browser storage remember identifiers until you clear site data. We exclude invite, profile, unsubscribe, tracked-link and coach-removal pages. Product events carry closed values, ranges and yes-or-no answers, never names, emails, schools, coaches, grades or email text. Cloudflare API logs last up to 7 days. You can request deletion of analytics records. Clearing local data leaves sent records intact. Please omit personal and contact details from surveys.

2.10 Advertising attribution

We collect Google, Microsoft, Meta or TikTok click identifiers on ad landings, based on our legitimate interest in measuring campaigns. Our conversion relay stores them and your browser type for up to 90 days. We can report ad-attributed purchases and browser type to the originating ad platform. Your browser keeps identifiers and a reference for the session. You can request deletion of sent records. PostHog retains public URLs containing these identifiers under its terms.

2.11 Meta pixel

Our public pages load the Meta pixel to measure our ads, based on our legitimate interest. Meta receives page views and one key action with the page address, browser details and IP address, never a purchase, email or name. The pixel sets the _fbp browser ID cookie and, after a Meta ad click, the _fbc click ID cookie. Meta uses this data under its privacy policy. To opt out, block these cookies in your browser or change your Meta ad preferences.

2.12 Support email

We use your email and message to answer requests, under our legitimate interest. We keep them for 12 months after the thread closes.

3. Providers and locations

We use these providers:

• OpenAI — drafts outreach emails from profile fields, school and coach name; no email address (US).
• Stripe and Link — checkout through Stripe Managed Payments with Link, LLC as merchant of record; tax, receipts and refunds (US).
• PostHog — site analytics and payment events (US).
• Cloudflare — hosting, the account and outreach database, request logs and all our email (US).
• Google — sends the athlete's emails from their own Gmail (send permission only); optional Google sign-in (US).
• Apple — optional sign-in with an Apple Account (US).

EU and UK data reaches the United States under each provider's transfer safeguards.

4. Your rights

Where data-protection law applies, including the EU and UK, you can ask to see, correct, delete, restrict or export your data. You can object to our use of it. You can complain to your local supervisory authority.

Email hello@colorsbound.com to exercise these rights. We answer within 1 month. Write from your account email. A parent can also download the family's data as JSON in Account or delete the account.

5. Children

Colorsbound is for athletes 13 and older and is not directed at children. A parent adds each athlete and owns the account and the plan. We refuse an athlete whose birth month and year show they are under 13, and we keep no quiz answers from someone who says they are under 13. Contact us about a child under 13 and we delete the data.

6. Changes

We update this page and email account holders before a change affects our use of data.

7. Contact

Email hello@colorsbound.com or write to WaveApp LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.