# MatchMind Privacy Policy

**Last updated:** June 30, 2026
**Operated by:** [COMPANY_LEGAL_NAME] ("MatchMind," "we," "us," or "our")
**Privacy & safety contact:** help@vexmatchmind.com

> **⚠️ BEFORE PUBLIC LAUNCH — for MatchMind's operator, not users.** This policy is written to *accurately describe what the app actually does* with data. It is **not legal advice** and does not by itself make the platform "lawsuit‑proof" — no policy can. You must (1) replace `[COMPANY_LEGAL_NAME]`, `[GOVERNING_LAW / STATE]`, and `[WEBSITE_URL]` with real values; (2) have a lawyer competent in COPPA and FERPA review it, because MatchMind is used by minors; and (3) actually operate the practices described here — the verifiable parental‑consent flow (§6), the written security program (§9), and the retention schedule (§8). A policy that promises protections the platform doesn't deliver is itself a legal risk.

> **Plain‑language summary (not a substitute for the full policy):**
> MatchMind is a companion app for VEX robotics competitors, coaches, and parents. We collect the account info you give us (your **legal name**, email, role, and the team you follow), the content you create (scout notes, to‑do lists, AI chats, and photos, videos, or audio you upload or send), your messages to other users, and technical data needed to run the app. We show public competition data from the RobotEvents API. AI features send your questions and uploads to third‑party AI providers. When you message a new person, we share a limited part of your identity with them — and we tell you exactly what, and ask you to confirm, every time. **We do not sell your personal information.** You can delete your data at any time. MatchMind is **not** affiliated with VEX Robotics or the REC Foundation.

---

## 1. Who we are — and who we are NOT

MatchMind is an independent application that helps robotics teams scout, plan, communicate, and prepare for VEX competitions. It runs on phones, tablets, and computers (web browser).

**No affiliation with VEX.** MatchMind is **not** affiliated with, endorsed by, sponsored by, or connected to VEX Robotics, Innovation First International, Inc., the Robotics Education & Competition (REC) Foundation, DigiKey, or RobotEvents. "VEX," "VEX Robotics," "V5RC," "VIQRC," "VEX U," "VEX AI," and related marks are trademarks of their respective owners, used in this app only descriptively. Competition data is retrieved from the public RobotEvents API and remains the property of its owners. **MatchMind is not an official source of competition information** — always confirm schedules, scores, rankings, and rules with event officials.

## 2. Scope and acceptance

This policy explains what we collect, why, who we share it with, how long we keep it, and your choices, when you use the MatchMind app and related services (the "Service") on any device. By using the Service you agree to this policy. If you do not agree, do not use the Service.

## 3. Information we collect

### 3.1 Information you provide
- **Account information:** your **legal first and last name**, email address, and profile photo, when you sign in with Google or with an email address and password. MatchMind uses your legal name (not a nickname or username) because names are used to identify you to teammates, to people you message, and to the people you invite. You may also use MatchMind as a **guest** (an anonymous account) with no email; guest data lives on your device until you create a real account.
- **Profile choices:** display name (your legal name), avatar (a preset icon or a photo you upload), role (**student, coach, or parent**), preferred language, and appearance settings.
- **Team association:** the VEX team number(s) you choose to follow. Team numbers are public identifiers, but your *association* with a team, your role on it, and your grade level (if provided) are information you give us. Your selected team is stored on your account so it can power team features and so your team is visible to us for support and safety.
- **Content you create:** scouting notes (ratings, tags, text, and attached photos/videos), to‑do lists and tasks (including tasks you share with your team), favorites, and the legal names/emails of teammates or parents you enter to invite them.
- **Messages and shared media:** the direct and group messages you send other users, and any **images, videos (up to 400 MB), audio recordings, and files** you attach to them. Message content and attachments are stored so conversations sync across your devices and reach the other participants.
- **AI conversations:** the text you type or dictate to the AI assistant, and any images, video, or video frames you upload for analysis.
- **Reports you submit:** if you report another user or content, we collect what you send us (description, screenshots, the user/team involved).

### 3.2 Information created by safety systems
- **Moderation records.** Every message and AI prompt is checked by an automated content filter before it is sent. If content is flagged (for example, profanity, harassment, hate, sexual, or violent content), the message is **blocked and never delivered**, and we create a moderation record that includes your account ID, email, the flagged excerpt, the category, and a timestamp. These records are used only to enforce our rules, protect users (especially minors), and handle appeals. They are visible only to MatchMind's operator, never to other users.
- **Suspension state.** If your account is warned or suspended, we store that status (reason, category, and end date) on your account so it applies across your devices and can be reviewed or lifted.

### 3.3 Information collected automatically
- **App settings and local data:** preferences and content are stored on your device so the app works offline and remembers you.
- **Basic technical data:** device type, app version, language, time zone, and error/crash information used to run, debug, and secure the Service. We may infer an approximate region from your network; we do **not** collect precise GPS location.
- **Security/anti‑abuse:** we use Google reCAPTCHA / Firebase App Check to verify that requests come from the genuine app and to block automated abuse. This may process device and network signals under Google's terms.
- **Notification tokens:** if you enable push notifications, we store the device messaging token needed to deliver them.

We do **not** use third‑party advertising SDKs and we do **not** show targeted ads.

### 3.4 Information from other sources
- **RobotEvents (public competition data):** teams, events, match schedules and scores, rankings, skills results, and awards. This is public competition information; it may include your team's number and performance.
- **Google sign‑in:** provides your name, email, and profile photo when you authorize it.

## 4. How we use information

We use the information above to:
- Create and operate your account and sync your data across your phone, tablet, and computer;
- Show your team's events, matches, scores, rankings, and awards;
- Power features you invoke: scout notes, to‑do lists (including team sharing), favorites, alliance suggestions, match analysis, and the AI assistant;
- Deliver messaging: route your messages and shared media to the people and groups you send them to, and notify recipients;
- Send notifications you enable (e.g., a new message, or your team releasing a match score) and emails you trigger (e.g., teammate/parent invitations);
- Keep the Service safe: run content moderation, enforce suspensions, prevent abuse, and respond to reports;
- Debug, secure, and improve the Service, and comply with legal obligations.

We do **not** sell your personal information, and we do **not** share it with third parties for their own advertising.

## 5. AI features — important disclosures

- When you use the AI assistant (including image/video analysis and alliance recommendations), your prompts, relevant app context (such as your team number, matches, rankings, and scout notes you've saved), and any media you attach are sent to **third‑party AI providers** (which may include Groq, DeepSeek, OpenRouter, and/or similar providers we configure) to generate a response. These providers process the data to provide the service, under their own terms — not for advertising.
- To ground answers, the Service may retrieve **public content** (for example, the official game manual or VEX Forum threads) and cite the sources.
- **AI output can be wrong.** Predictions are statistical estimates, not facts. Rules answers are not official rulings — only the official game manual, official Q&A, and event referees are authoritative. Do not submit confidential or sensitive personal information to the AI.
- **Voice input vs. voice messages.** When you *dictate* to the AI or a text box, your device/browser converts speech to text and we process the transcript like typed text — we do **not** keep the raw audio. When you *record and send an audio message* to another user, that audio file **is** stored and delivered, like any other message attachment.

## 6. Children's privacy (COPPA) — verifiable parental consent

MatchMind is used by robotics teams, which include students of all ages, so we treat children's privacy as a first‑class obligation under the Children's Online Privacy Protection Act (COPPA, 16 C.F.R. Part 312).

**Ages 13 and older** may create an account normally.

**Children under 13.** Before a child under 13 can use features that collect personal information, we obtain **verifiable parental consent**:
- At sign‑up we ask for age in a neutral way (not defaulting to an age and not encouraging false answers). If the user indicates they are under 13, we collect only the parent's/child's online contact information needed to seek consent, and we do **not** open messaging or media features.
- We send the parent/guardian a **direct notice** describing exactly what we collect from the child, how we use it, who we share it with, and their rights, with a link to this policy, and we request their affirmative consent (§312.4–§312.5).
- **Until consent is verified, an under‑13 account cannot** start new conversations with people outside their own team, share media with strangers, or make any personal information available to other users. Core, low‑data features may be limited to what COPPA permits without consent.
- We do **not** condition a child's participation on providing more personal information than is reasonably necessary for a given activity (§312.7).

**Parental rights (§312.6).** A parent/guardian may, by emailing **help@vexmatchmind.com**: review the personal information we hold about their child; refuse to permit further use or collection; and direct us to delete it. We will verify that the requester is the child's parent before acting, and we will not condition the child's other rights on this.

If we learn we collected personal information from a child under 13 without the required consent, we will delete it promptly.

## 7. How messaging shares your identity — and how we tell you

Messaging is designed so you always know what you're revealing **before** you reveal it.

- **Starting a new conversation, creating a group chat, or sending an invite.** The **first time** you contact a new person (or create a group, or invite a parent/teammate), we show you an acknowledgment that your **legal first name, last initial, and email address** will be shared with that person, and you must tap **"I understand"** to continue. This confirmation appears **every time** you reach a new person for the first time — not just once.
- **If the recipient already has a MatchMind account,** they receive your message (or the group invite) in the app, plus a notification that you're reaching them. If they've never talked with you before, they're told only your **first name, last initial, and email**, and that a new person is trying to reach them.
- **If the recipient does not have a MatchMind account,** we email the address you entered to let them know that a person identified by **first name, last initial, and email** is trying to reach them on MatchMind, with step‑by‑step instructions to sign up. We do not share your full last name with a non‑user.
- **Once both people are connected and messaging,** you each gain access to the other's **full legal first and last name and profile photo**, so you know who you're talking with.
- **Group chats.** Anyone in a group can mute it (no notifications), leave it, or add other people; adding someone triggers the same identity‑sharing acknowledgment. When a group is created with you in it, you're notified.
- **Under‑13 accounts** cannot use these person‑to‑person sharing features with people outside their own team until verifiable parental consent is on file (§6).

## 8. Storage, retention, and deletion

- Data is stored on your device and, when you sign in, in our cloud database (Google Firebase / Google Cloud), which may store data in the United States or other countries. Large media may be kept at full resolution on your device and stored for delivery/sync where a message or note requires it.
- **Retention (COPPA §312.10).** We keep personal information only as long as reasonably necessary for the purpose it was collected:
  - *Account & profile:* while your account is active.
  - *Messages & shared media:* until you or another participant delete them, or you delete your account.
  - *Scout notes, to‑dos, favorites:* until you delete them or your account.
  - *Moderation & suspension records:* retained while needed to enforce rules, handle appeals, and keep repeat‑offense history; not retained indefinitely once no longer needed for safety.
  - *Invitation contact info for a non‑user:* deleted within a reasonable time if the invite isn't accepted.
- **Account deletion.** You can delete your account in Settings or by emailing **help@vexmatchmind.com**. We delete or de‑identify your personal data within 30 days, except minimal records we must keep for legal, security, or fraud‑prevention purposes. Backups are purged on a rolling basis.
- **Guest mode** stores data only on your device; deleting the app removes it.

## 9. Security (COPPA §312.8)

We maintain a written information‑security program with safeguards appropriate to the sensitivity of the data and the size of the Service. It includes: encryption in transit; scoped, per‑user database security rules (a signed‑in user can only read/write their own records; moderation evidence is append‑only and not readable or editable by any user); server‑side storage of API secrets (never shipped in the app); a designated person responsible for the program; periodic risk assessments; and written assurances from our service providers to protect the data. No system is 100% secure; use a strong password and keep your credentials private.

## 10. How information is shared

- **With other users (your choice):** content you share with teammates (a shared to‑do list or scout note) and messages/media you send are visible to those recipients, attributed to your name and avatar. Identity sharing in messaging works as described in §7.
- **Service providers (processors), who may process data only to provide services to us:** Google Firebase / Google Cloud (hosting, database, authentication, push notifications), Render (app hosting), Resend (email delivery for invitations, welcome, and safety notices you trigger), the AI providers in §5, and Google reCAPTCHA/App Check (anti‑abuse). We take reasonable steps to confirm each can protect the data and obtain assurances they will.
- **Public competition data:** anything shown from RobotEvents is already public.
- **Legal and safety:** we may disclose information if required by law, or as reasonably necessary to protect users (especially minors), investigate abuse, or enforce our Terms.
- **Business transfer:** if MatchMind is acquired or reorganized, data may transfer to the successor under this policy.

## 11. Moving your data between teams (end‑of‑school‑year transfer)

At the end of a school year you can transfer your data to a new team without losing anything. You may **close your team or change teams while keeping** your AI chats, scout notes, to‑dos, favorites, and your messages with other people. We show you what will move and what changes before you confirm; the transfer does not delete your conversations or personal content. This is a feature you control — we don't move your data between teams on our own.

## 12. Your rights and choices

Depending on where you live (e.g., EEA/UK under GDPR, California under CCPA/CPRA), you may have rights to access, correct, delete, export, or restrict processing of your personal information, and to object to certain processing. Exercise most of these in the app (Settings) or by emailing **help@vexmatchmind.com**. We will not discriminate against you for exercising your rights, and we do **not** "sell" or "share" personal information as those terms are defined under the CCPA/CPRA.

Other choices: disable push notifications in Settings or your device; mute or leave any group chat; ask us to stop non‑essential email; camera/microphone/photo access is requested only when a feature needs it and can be revoked in device settings; the AI only processes what you choose to send it.

## 13. International transfers

We operate from [GOVERNING_LAW / STATE], United States. If you use the Service elsewhere, your information may be transferred to and processed in the United States and other countries with different data‑protection laws. Where required, we rely on appropriate safeguards.

## 14. Third‑party links and services

The app links to external sites (RobotEvents pages, VEX Forum threads, official manuals). Their privacy practices are their own; this policy does not cover them.

## 15. Changes to this policy

We may update this policy as the Service evolves. We'll post the new version in the app with an updated "Last updated" date and, for material changes — including any that affect children's data — provide additional notice (e.g., an in‑app prompt) and, where required, seek renewed parental consent. Continued use after changes take effect means you accept them.

## 16. Contact us

Questions, requests, or complaints: **help@vexmatchmind.com**
[COMPANY_LEGAL_NAME] · [WEBSITE_URL]