Privacy Policy

Ball in the 6 is a Toronto-based sports platform operated by ENUW Inc., a Canadian corporation. Our Platform serves athletes, coaches, fans, teams, organizations, and scouts in the Toronto and Greater Toronto Area sports community and beyond.

Data controller: ENUW Inc., Toronto, Ontario, Canada.
Privacy Officer: privacy@enuw.ca

Information you provide directly:

• Account registration: name, email address, date of birth, password hash (never plaintext)
• Profile information: sport(s), position, height, weight, school, graduation year, bio, profile photo
• Athlete performance logs: training notes, stats, game events, development tracking data
• Community content: posts, comments, reactions, direct messages
• Marketplace listings: item descriptions, pricing, photos, transaction history
• Forms and applications: recruitment submissions, program registrations, tryout applications
• Payment information: processed by third-party payment providers; we store transaction references only — we never store raw card numbers

Information collected automatically:

• Device and browser identifiers, IP address, operating system, browser type
• Navigation data: pages visited, features used, time on page, referral source
• Authentication tokens (stored in secure HttpOnly cookies — not accessible by JavaScript)
• Push notification subscription tokens (only if you opt in)
• Geolocation data: approximate location for finding nearby courts (only with your explicit permission)

Information from third parties:

• If you connect a social account (e.g., Google OAuth), we receive your name and email from that provider
• If a guardian or coach adds you to the Platform, we receive the information they provide about you

• Provide the Platform: account management, authentication, personalized feeds, profile pages, team rosters, game tracking, league standings
• Safety and security: detect abuse, fraud, unauthorized access, and bot activity; enforce rate limits and bans
• Communications: send transactional emails (password resets, email verification), push notifications you have opted into, and important platform announcements
• Analytics and improvement: understand aggregate usage patterns to fix bugs and improve features (see Section 11)
• Marketplace: facilitate athlete gear and equipment listings and transactions
• Youth protection: flag content and accounts associated with minors for enhanced safeguards; enable guardian oversight of youth accounts
• Legal compliance: comply with Canadian law, respond to valid legal requests, and exercise our rights

We do not sell your personal data to any third party. We do not use your data to build advertising profiles or run behavioural ad targeting.

Under PIPEDA, we collect and use personal information only with appropriate consent or as otherwise permitted by law:

• Express consent: account registration, push notifications, optional location access, marketing communications
• Implied consent: navigation data collected to provide the service you have signed up for
• Legal obligation: compliance with court orders, law enforcement requests under applicable Canadian law
• Contractual necessity: processing necessary to fulfill our Terms of Service (e.g., processing marketplace transactions)

You may withdraw consent at any time (see Section 15). Withdrawing consent for essential processing (e.g., authentication cookies) will prevent you from using the Platform.

We do not sell personal information. We share data only in these limited circumstances:

• Infrastructure providers: DigitalOcean (servers and managed database, Toronto region), Redis Cloud (session management), Cloudflare (DNS and DDoS protection), GitHub (source code and CI/CD pipelines). These providers are contractually bound to protect your data and may not use it for their own purposes.
• Email delivery: transactional email service providers for password resets and verification emails only.
• Analytics: Plausible Analytics (privacy-preserving; no personal identifiers shared — see Section 11).
• Platform participants: public profile information (name, sport, position, bio, photo) is visible to other Platform users according to your privacy settings. Direct messages are end-to-end stored and only readable by participants.
• Coaches and organizations: if you join a team or program, the coach or administrator of that team can see roster information you have made visible.
• Legal requests: we disclose data when required by Canadian law, a valid court order, or a legal process — and only to the extent required.
• Business transfers: if ENUW Inc. is acquired or merges, your data may transfer to the successor entity, subject to the same privacy protections.

The safety of young athletes is our highest priority. Our Platform is designed for users aged 13 and older. We do not knowingly collect personal information from children under 13 without verified parental consent.

• Under 13: accounts must be created and managed by a parent or guardian. The guardian controls all data, privacy settings, and consent on behalf of the child.
• Ages 13–17 (Teen accounts): users register with a date of birth. Teen accounts have restricted direct messaging (cannot initiate messages with adults outside their team), and public profile discoverability is limited by default.
• Sensitive youth data: performance stats, training logs, and health data for minors are accessible only to the account holder, their linked guardian(s), and explicitly approved coaches.
• We comply with Canada's PIPEDA, Ontario's Freedom of Information and Protection of Privacy Act (FIPPA) as applicable, and we are aware of international standards including COPPA (US) as a reference for best practices.

If you believe we have inadvertently collected information from a child under 13 without consent, contact us immediately at privacy@enuw.ca and we will delete it promptly.

Our Platform supports a guardian/athlete account linking system. A guardian (parent or legal custodian) can:

• View their linked athlete's activity, stats, and training logs
• Manage privacy settings for minor accounts
• Approve or deny coach access requests for their athlete
• Receive notifications on behalf of their athlete
• Request deletion of their athlete's data at any time

Guardian links are verified through an invitation code system. We log all guardian access to athlete data for audit purposes. Guardians may not share athlete data with third parties outside the Platform without the athlete's consent (once the athlete reaches age of majority).

All personal data is stored on DigitalOcean Managed PostgreSQL servers located in the Toronto (tor1) region, keeping your data within Canada.

Technical security measures include:

• Encryption in transit: TLS 1.2+ for all connections
• Encryption at rest: DigitalOcean managed database encryption
• Password hashing: Argon2id (OWASP-compliant parameters) — passwords are never stored in plaintext or recoverable form
• Authentication: EdDSA (Ed25519) asymmetric JWT tokens with 15-minute access token expiry and 14-day refresh token rotation
• Session security: absolute 30-day session TTL, JTI denylist on logout, device session management
• Cookie security: __Host- prefixed HttpOnly cookies (prevent JavaScript access, enforced HTTPS, path-scoped)
• CSRF protection: double-submit cookie pattern with timingSafeEqual comparison on all state-changing requests
• Rate limiting: sliding-window rate limits on all authentication endpoints

Despite our best efforts, no security system is impenetrable. In the event of a breach that creates a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada within the timeframe required by PIPEDA.

We retain personal information only as long as necessary for the purposes described in this policy:

• Active accounts: data is retained while your account is active
• Deleted accounts: we delete or anonymize personal data within 30 days of account deletion, except where required for legal, audit, or safety purposes (e.g., records of abuse reports are retained for up to 7 years)
• Authentication logs: login success/failure logs retained for 90 days
• Inactive accounts: accounts with no activity for 36 consecutive months will receive a notice before we begin deletion
• Marketplace transactions: transaction records retained for 7 years to satisfy Canadian tax and financial record-keeping requirements

You can delete your account at any time in Settings → Account → Delete Account. Guardian accounts can delete linked minor accounts on their behalf.

We use the following cookies:

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. Plausible Analytics (see Section 11) does not use cookies.

We use Plausible Analytics to understand how the Platform is used in aggregate. Plausible is a privacy-preserving analytics service that:

• Does not use cookies
• Does not collect or store personal identifiers (no IP addresses stored, no user IDs)
• Does not build cross-site tracking profiles
• Is fully compliant with PIPEDA, GDPR, and CCPA
• Data is processed in the EU and subject to EU adequacy protections

Analytics data shows us aggregate statistics like "200 people visited the games page today" — never who those 200 people are.

If you opt in to push notifications, we store a push subscription token (a device identifier generated by your browser/OS) in our database. This token is used exclusively to send you notifications you have subscribed to:

• Game score updates for teams you follow
• Community replies and mentions
• Direct message notifications
• Platform announcements

Push tokens are deleted from our database within 48 hours of you disabling notifications or deleting your account. You can manage notification preferences in Settings → Notifications at any time.

The Marketplace allows users to buy and sell sports gear and equipment. When you use the Marketplace:

• Your listing details (item name, description, price, photos) are publicly visible to Platform users
• Your display name and general location (city level only) may appear alongside listings
• Payment processing is handled by our payment provider; we receive only a transaction reference number — never raw card data
• Transaction records (amounts, dates, parties involved) are retained for 7 years for tax compliance

Public content (posts, comments, reactions in community spaces) is visible to all Platform users and may be indexed by search engines if you have not set your profile to private.

Direct messages are stored encrypted in our database and are only accessible to the conversation participants. Our staff do not read private messages except when required to investigate a safety report, comply with a legal order, or enforce our Terms of Service.

You can delete your posts and messages at any time. Deleted content is purged from our databases within 14 days. Note that other users may have copied or screenshotted content before deletion.

Under PIPEDA and applicable Canadian privacy law, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: request that inaccurate or incomplete information be corrected
• Withdrawal of consent: withdraw consent for non-essential processing at any time
• Deletion (right to erasure): request deletion of your personal data, subject to legal retention requirements
• Data portability: request your data in a machine-readable format (JSON)
• Complaint: lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise any of these rights, visit Settings → Account or contact us at privacy@enuw.ca. We will respond within 30 days as required by PIPEDA. Complex requests may be extended to 60 days with notice.

Guardian accounts may exercise these rights on behalf of linked minor accounts.

Our primary database and servers are located in Toronto, Canada (DigitalOcean tor1 region). Some of our service providers process data outside Canada:

• Redis Cloud: session data may be processed in the US (AWS us-east-1)
• Plausible Analytics: aggregate analytics data processed in the EU
• Cloudflare: DNS and CDN infrastructure globally distributed

Where data is processed outside Canada, we take steps to ensure it receives substantially similar protection to that required by PIPEDA, including contractual safeguards with service providers.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Post an in-app notification to active users at least 14 days before changes take effect
• For significant changes affecting youth accounts, send a direct email notification to account holders

Continued use of the Platform after the effective date constitutes acceptance of the updated policy.

Privacy Officer, ENUW Inc.
Email: privacy@enuw.ca
Subject line: "Privacy Request — [Your Name]"

If you are not satisfied with our response to your privacy request, you have the right to contact the Office of the Privacy Commissioner of Canada:

• Website: priv.gc.ca
• Toll-free: 1-800-282-1376
• TTY: 1-613-947-1975