Children's Privacy / COPPA Policy
Matside Wrestling Co. takes the privacy of children seriously. This policy explains how the Children's Online Privacy Protection Act (“COPPA”) applies to each of our products and what we do to comply with it. Matside has conducted a formal Six-Step COPPA self-audit (per the FTC's recommended methodology) across all five products in the Matside Software portfolio; the full audit is documented at matside-hq/planning/coppa-six-step-self-audit-v1.md.
Summary of COPPA Scope by Product
Matside's COPPA posture differs by product. The summary below explains why each product is in or out of scope:
| Product | COPPA Status | Why |
|---|---|---|
| MatRecruit | Out of scope | Class-year gate excludes accounts for users younger than rising 9th grade. Account creation is structurally not available to children under 13. |
| MatTime | Out of scope | Account holders are adult coaches only. Wrestlers and parents do not have accounts in MatTime. No personal information is collected from children. |
| MatPass | Out of scope (processor model) | Account holders are adult coaches, program administrators, and parents. Athlete records are input by adults about minor athletes; Matside acts as a data processor for the wrestling program, which is the data controller. School-affiliated programs may impose FERPA obligations that supersede defaults. |
| SignupSignin | Out of scope | Self-only signup model. Account holders are adult volunteers and event organizers. No mechanism exists for an adult to create or register an account on behalf of a child. |
| WrestleFA | In scope | WrestleFA's core data model involves data about minor wrestlers (free-agent listings). Parents post listings describing their wrestlers; coaches and tournament directors view those listings. |
WrestleFA: COPPA Compliance in Detail
Because WrestleFA is the only Matside product where COPPA materially applies, this section describes our compliance posture in detail.
The data we collect about minors
WrestleFA collects only the data necessary to operate the free-agent board: wrestler first name and last initial, age group, weight class, hometown / state, parent/guardian contact information, and (optionally) parent-provided commentary. We do not collect: full date of birth (only age group), street address (only state), school name, photographs, or any unique identifier beyond a randomly assigned database ID.
Parental consent
WrestleFA requires parental consent before a wrestler profile becomes visible to non-parent users (coaches, tournament directors). Our consent mechanism is currently “email plus” (per FTC guidance), implemented with versioned consent records and a database-layer Row-Level Security policy that hides wrestler profiles from non-parent users unless their consent record matches the current consent text version. A policy text bump forces re-consent before disclosure is re-enabled.
We are working with a Safe Harbor program (an FTC-approved COPPA Safe Harbor) to confirm that this consent mechanism is appropriate for WrestleFA's specific disclosure pattern. The Safe Harbor engagement is in progress as of June 2026.
Parental rights
Parents of children with data in WrestleFA can:
- Review their child's data by signing in
- Refuse to permit further collection or use by deleting their account or revoking consent
- Request deletion of all data about their child via the in-product deletion path or by emailing support@matside.org
Account deletion is reversible for 30 days; after that, all child-related data is permanently deleted.
No third-party tracking
WrestleFA's wrestler-profile pages carry zero third-party trackers (no analytics, no advertising, no marketing pixels, no behavioral profiling). This is verified by Matside's cross-product tracker inventory (2026-06-19). The page renders with no third-party requests beyond the same-origin application code itself.
Disclosures to third parties
WrestleFA does not sell, rent, or otherwise transfer information about children to third parties for marketing purposes. The only third-party processors that touch WrestleFA data are: Supabase (database + auth), Vercel (hosting), Resend (parent-facing transactional email), and Square (payment for the $99 verified-tournament-board and $10 coach-led-tournament-board SKUs). Each processor operates under a Data Processing Agreement.
Other Products: Structural-Exclusion Detail
MatRecruit
MatRecruit's onboarding flow enforces a class-year gate that excludes any user who is younger than rising 9th grade (typically age 13–14). The class-year window is documented in our COPPA scope-determination memo at matrecruit/docs/legal/coppa-scope-determination.md. We do not collect date of birth and we frame eligibility positively (“you must be in the eligible class-year window”) rather than as a minimum-age gate (“you must be 13+”) to maintain the structural exclusion under the COPPA definition.
MatTime
MatTime is a coach-only product. Wrestlers and parents do not create MatTime accounts. Coaches book their own privates schedule and manage their own client lists. No personal information is collected from children. Coach-account holders self-attest to being adult professionals.
MatPass
MatPass is a wrestling-program compliance tool. Account holders are program staff (coaches, administrators) and parents of athletes. The data model is “adult-input-data-about-child”: athlete records are created and maintained by adult program staff; data about minors is provided by the adult input layer, not by children themselves. Matside operates as a data processor for the wrestling program; the program is the data controller and is responsible for parental notice and consent under FERPA where applicable. Our processor model is documented in our COPPA scope-determination memo at matpass-app/docs/legal/coppa-scope-determination.md.
SignupSignin
SignupSignin enforces a self-only signup model: each account is for the person creating it, with no mechanism to register or sign up a child. Account holders are adult volunteers and event organizers. Our COPPA scope-determination memo for SignupSignin is at signupsignin-web-/docs/legal/coppa-scope-determination.md.
Direct Notice to Parents
For WrestleFA specifically, the in-product consent flow provides direct notice to parents covering each of the seven §312.4(c) elements required by COPPA: (1) the operator's name and contact information, (2) the types of personal information collected, (3) the operator's practices for use and disclosure, (4) that the parent's consent is required, (5) that the operator must terminate access if consent is not provided, (6) the parent's right to review and delete the information, and (7) the operator's procedures to ensure confidentiality, security, and integrity of the information collected. The exact consent text is versioned in our database and a parent's consent of record matches a specific version; if we materially update the consent text, parents are required to re-consent before disclosure resumes.
Contact
If you are a parent and have questions about your child's data on any Matside product, or if you wish to review, correct, or delete data about your child, contact support@matside.org. We respond to verified parental requests within 30 days.
Changes to This Policy
We will update this policy as our COPPA posture evolves — in particular, as the Safe Harbor engagement for WrestleFA progresses and as the bundled Sept 1, 2026 attorney review of all Matside legal documents takes place. The “Last updated” date at the top reflects the most recent change. Material changes affecting parental consent will trigger an in-product re-consent flow for affected users.