Privacy Policy

Who we are

This website runs on OurTeamSports, a platform for school and club sports teams. OurTeamSports is operated by Hollow Holdings, LLC (“we”, “us”). This policy explains what information the site collects, why, who can see it, how long it is kept, and how to ask for changes.

Two parties are involved, and they do different things:

• Hollow Holdings, LLC runs the platform: the software, the hosting, account security, and backups.
• The team program (the H.H. Dow High Chargers hockey program, meaning its coaches and the people it designates as site administrators) decides what goes on this site: the roster, player and coach photos, the game schedule, sponsors, alumni honors and spotlights, photo galleries, and the team’s internal events. The program also decides who is invited to have an account.

Who to ask. For anything about the site’s content (a name, a photo, a caption, a schedule entry), contact the program’s administrators, who can change or remove it directly. For questions about this policy, your account, or how the platform handles data, or if you cannot reach the program, email privacy@ourteamsports.com. We will pass content requests to the program and follow up on them.

Visiting the public site

You do not need an account to read this site, and the public pages have no forms: we do not ask visitors for any information. The site sets no cookies for visitors who do not sign in, and it runs no analytics, advertising, or tracking scripts.

Like any website, the servers that deliver these pages receive the technical details every browser sends with a request, such as your IP address and browser type. The site’s own database does not store them.

Video and outside links

The home page shows a play button for the team’s latest YouTube video. Nothing is loaded from YouTube, or any other third party, until you choose to play it. When you press play, the player loads from YouTube’s privacy-enhanced mode (youtube-nocookie.com), and from then on YouTube (a Google service) handles your viewing under Google’s Privacy Policy. Links to YouTube, Facebook, Instagram, Google Maps and sponsors’ websites take you to those services, whose own policies apply.

The site’s fonts are served from this site’s own server, not loaded from a third-party font service.

What the program publishes

The program publishes information about its team so that families, fans and alumni can follow it. Depending on what the program chooses to post, this includes:

• Roster: players’ names, jersey numbers, class year, and photos.
• Coaches: names, coaching roles, and photos.
• Alumni: honors lists, and alumni spotlights with names, years played, positions, jersey numbers, biographies and photos; plus photo galleries with captions.
• Schedule and sponsors: games, opponents, venues, and sponsor names, logos and links.

All of this is public: anyone can view it, and search engines may index it. Photos and videos are stored in Microsoft Azure Blob Storage with public read access, so anyone who has a file’s link can open it. Files are stored exactly as they were uploaded; we do not strip metadata such as the date or location a camera may embed in a photo.

Photos and the media library

Every uploaded photo lives in the site’s media library, and pages use photos from there. Removing a photo from the roster, an alumni spotlight or a gallery takes it off that page, but the file stays in the media library and can still be opened by anyone who has its file address. Deleting it from the media library removes the file from storage. A photo that is still used on a page cannot be deleted from the library until it has been removed from that page. Takedown requests are handled by deleting the photo from the media library.

Student-athletes and minors

The roster shows high-school student-athletes, many of whom are minors. That information and those photos are supplied by the program, and the program is responsible for having appropriate permission to publish them.

Asking for removal. A parent or guardian, or an athlete, can ask for a name, photo, or other detail to be taken down. The quickest route is the program’s administrators. You can also email privacy@ourteamsports.com; we will work with the program to act on the request. A photo taken down on request is deleted from the site’s media library, which removes the file itself, not just the page that showed it (see “Photos and the media library” below).

The site is not directed to children under 13. Accounts exist only by invitation from the program, and we do not knowingly create accounts for children under 13. If we learn that an account belongs to a child under 13, we will delete it.

Account holders

Accounts are invite-only: there is no public sign-up. A program administrator invites a coach, staff member, volunteer or team member, and the account is used to edit the site or to see the team’s internal events. For account holders, we store:

• Identity and access: your email address, your name (if one is entered), your roles (for example administrator, content editor or member), whether the account is invited, active or disabled, when it was created, and when you last signed in.
• Your password, as a hash only. Passwords are hashed with argon2id before they are stored; the password itself is never saved.
• Two-factor authentication. Staff roles must use an authenticator app. We store the authenticator secret that your app shares with the site, so the site can check your codes, and 10 one-time recovery codes, stored only as one-way hashes. Recovery codes are shown to you once and cannot be displayed again.
• Sign-in protection. Counts of failed sign-in and failed two-factor attempts, and the time any temporary lock ends. After 5 wrong passwords, sign-in is locked for 15 minutes; after 5 wrong two-factor codes, code entry is locked for 15 minutes.
• Sessions. When you sign in we record a session: a one-way hash of its token, which account it belongs to, whether two-factor verification is complete, and when it was created and expires.
• Invitations. The invited email address, the roles offered, who sent the invitation, when it expires (7 days after it is created) and when it was accepted. The invitation link is stored only as a hash. The platform does not send email: an administrator shares the link with you directly.
• Events and RSVPs. Events the program creates (title, description, location, times, and who created them) and your answer to each (going, maybe or not going) with the time you answered. Every account holder can see the totals for an event and their own answer; the names behind each answer are visible to event organizers and administrators.
• An audit log of changes. When an account holder changes something through the site, we record which account made the change, what kind of change it was (for example create, update, delete, upload, invitation, role change, or RSVP), which item it affected, and when. For role changes we also record which role, and for invitations the invited address. Everyone with an editing role sees the most recent changes on their dashboard, and administrators can open a longer list on the audit log page. RSVP entries are recorded but not shown in either list.
• Uploads. Files you upload, with their alt text, size and dimensions (see “What the program publishes” above).

Cookies

The site uses cookies only to keep account holders signed in. Both are set only when you sign in, are marked HTTP-only so page scripts cannot read them, and are sent only over HTTPS in production:

• dhh_session: your sign-in session. The cookie lasts up to 12 hours and is removed when you sign out. If a two-factor code is still needed, the session it points to expires on the server after 10 minutes unless the code is entered.
• dhh_recovery_handoff: set only while you are setting up two-factor authentication, so your recovery codes can be shown to you once. It lasts 10 minutes.

We use no advertising, analytics, or tracking cookies. If you choose to play the video on the home page, YouTube’s player is a separate service that may store its own data under YouTube’s policies.

How we use information

We use the information above only to run this site: to show the program’s content, sign account holders in and keep accounts secure, run the team’s events calendar, keep a record of changes, and back up and restore the site. We do not sell or rent personal information, we do not use it for advertising, and we do not send marketing email.

Who we share it with

• Everyone, for published content. What the program publishes is public by design.
• The program. Program administrators can see the site’s account holders, their roles and status, and the audit log. Staff with other editing roles see a short feed of recent changes, including who made them.
• Our hosting provider. The site, its database, and uploaded files are hosted on Microsoft Azure in its East US 2 region, in the United States.
• When the law requires it. We may disclose information if required by law or legal process, or where needed to protect the safety of any person or the security of the platform.

Security

The site is served over HTTPS, and browsers are told to use HTTPS only. Passwords are hashed with argon2id; session tokens, invitation links and recovery codes are stored only as one-way hashes; staff roles must use two-factor authentication; and repeated wrong passwords or codes lock the account temporarily. No system is perfectly secure, so please use a strong password that you do not use elsewhere, and tell the program’s administrators or email privacy@ourteamsports.com if you think your account has been misused.

Backups and retention

The site’s database is copied every night to private Azure storage that is not publicly accessible. Each copy is deleted automatically after 90 days, and a deleted copy stays recoverable for a further 14 days as a safeguard against accidents. So information removed from the live site can persist in backups for up to about 104 days.

• Published content stays until the program edits or removes it. Photos and videos are removed from storage when they are deleted from the media library (see “Photos and the media library” above).
• Accounts are kept while the program uses the site. An administrator can disable an account, which blocks sign-in, or delete it.
• The audit log is kept as a lasting record of changes to the site.

When an account is deleted

An administrator can delete an account; to ask for yours to be deleted, contact the program’s administrators or email privacy@ourteamsports.com. Deleting an account:

• replaces your email address with a placeholder that cannot receive mail, and your name with “Deleted user”;
• erases your password hash, your two-factor secret, your sign-in and two-factor lockout counters, and your last sign-in time;
• deletes your sessions, your recovery codes, your roles, every invitation sent to your address, and your event RSVPs;
• replaces your address with the placeholder in audit log entries for invitations sent to you; and
• disables the account, so it can never be signed in to again.

The audit log keeps its entries for changes the account made, which then refer to the deleted account (“Deleted user”) rather than to you by name or address. The deletion itself is logged, without your address. Events the account created stay on the calendar. Content that account published (photos, roster entries and the like) belongs to the program and is not removed by deleting the account; ask the program to remove it.

Your choices

You can ask to see the personal information we hold about you, to correct it, or to delete it (deletion works as described above). Content requests are usually fastest through the program’s administrators; anything else, email privacy@ourteamsports.com. We may need to confirm who you are before acting on a request, and we may keep information where the law requires us to.

Changes to this policy

If we change this policy, we will update the “Last updated” date at the top of this page. If a change materially affects how account holders’ information is handled, we will also let the program know so it can tell its account holders.

Contact