Privacy Policy

Who we are

CSA Recruits, LLC (“CSA Recruits”, “we”, “us”) operates a recruiting platform that helps high school and transfer athletes organize their college recruiting, identify schools that fit them, and communicate with college coaches. College coaches can also sign up to search for athletes who have chosen to be found.

This policy explains what personal information we collect, why we collect it, who we share it with, and the controls you have over it.

Information you give us

Most of the information we hold is information you enter into your account. If you are an athlete, that is your athlete profile: you choose what to provide, though leaving fields empty reduces how well the platform can match you to schools.

Each sign-in is one kind of account: an athlete account, a parent account and a college coach account are separate, and one sign-in cannot be more than one of them.

• Identity and contact details: first and last name, email address, phone number, date of birth, country, city and state.
• Academic information: high school, graduating class, unweighted and weighted GPA, class rank, SAT and ACT scores, and intended major.
• Athletic information: gender, primary and secondary sport, positions, club team, dominant side, height, weight, sport statistics and athletic testing metrics.
• Recruiting preferences: the levels you are open to, your dream level, your commitment level, the factors you prioritize in a school, and the free-text “about you”, hook stat and pitch you write.
• Media you upload: photographs and video of yourself.
• Recruiting activity: your school list and any notes on it, outreach drafts and history, camps, awards, offers and commitments.
• If you are a college coach: your name, job title and work email address. We use the part of the address after the @ to find the college whose website uses that domain, and we email a single-use link to the address to confirm that you can receive mail there.
• If you are a parent an athlete invited: the email address the invitation was sent to, your own sign-in, and, once you confirm that you are the athlete’s parent or legal guardian and an adult, that confirmation, when you gave it and the date of birth you entered.
• If you join the ambassador program: your referral code, the athletes and clubs who signed up with it, the share you earned from what they paid, and the payouts made to you. Payout account details are collected and held by our payment provider’s Connect service, not by us.

Information we collect automatically

• Authentication events and session data, handled by our identity provider.
• Server and application logs, which may include IP address, browser user agent and timestamps, used to operate and secure the service.
• Website page views: when you open a page on this website, your browser tells us the page’s path (never the rest of its address), the name of the site that linked you to it, if any, and the campaign tags the link carried, if any (utm_source, utm_medium and utm_campaign — labels such as “newsletter” that say which of our own links you followed). We add one to a daily count for that page. No cookie is set, nothing is stored in your browser, and no identifier, IP address or browser user agent is recorded with the count. Your browser does not send it at all if it signals Global Privacy Control or Do Not Track.

Information we do not collect

We do not store your password — authentication is handled by our identity provider, and your password is never sent to or held by CSA Recruits.

We do not store payment card numbers. If you subscribe, card details are collected and held by our payment provider; we retain only a plan, a subscription status and an opaque reference.

How we use your information

• To create and operate your account and profile.
• To generate your ranked school list, match scores and fit assessments.
• To draft outreach emails and social posts for you to review, edit and send.
• To render your recruiting graphics from the photos and profile details you provide.
• To send transactional email you have asked for — email verification, password reset links, account deletion confirmations — and the reminders you enable in Settings.
• To secure the platform, prevent abuse, debug faults and meet legal obligations.

Automated processing and AI

Core features of CSA Recruits are powered by third-party AI models. To produce your school rankings, outreach drafts and the wording on your recruiting graphics, we send relevant parts of your profile to model providers acting on our behalf. Depending on the feature, that includes your name, your home city and state, your high school and club team, your awards, the prose you write about yourself, and your academic, athletic and preference information.

Photographs are processed by AI too. When a photo you upload is used on a recruiting graphic, the photograph itself is sent to an AI model provider so the model can describe how it is framed — how much of you is in shot, which way you are facing, where you sit in the frame. That description is what lets our layout engine place you on the card. It is stored and reused, so a given photograph is sent for this once rather than on every render.

Removing the background from that photograph is attempted first by software running on our own infrastructure. Where that does not succeed, or where that software is unavailable, the photograph is sent to an AI model provider to produce the cut-out instead.

If we have enabled the optional check that flags whether a photo plausibly shows the sport on your profile, the photograph is sent to a model for that purpose as well. The result is only ever a dismissible hint and never blocks you from using a photo.

These features produce suggestions, not decisions. A ranked school list is an opinion generated by a model, and an outreach draft is a starting point you review and edit before anything is sent. Nothing is sent to a college coach without your action.

A model chooses the card’s layout, colour scheme and visual style from fixed lists, and writes its wording. The card itself is then drawn by our own software from our own templates — a model never renders the image.

Who we share information with

We do not sell your personal information. If you are an athlete, verified college coaches can see parts of your profile, as described under “Coach search and what coaches see”, and you control that in Settings. Beyond that, we share your information only with the people listed below and with service providers who process it on our behalf, under contract, and only to deliver the platform:

• Auth0 (Okta) — identity and authentication. Because sign-up happens on Auth0’s hosted screens, the details you enter in the sign-up wizard — your name, phone number, gender, height, weight, high school, graduating class, unweighted GPA, intended major, sport, position and state — are stored against your account at Auth0 as well as in our own database.
• Amazon Web Services — application hosting, database storage, media storage and transactional email delivery.
• AI model providers — currently Google, Groq, Cerebras and Anthropic — for the processing described above, including the handling of photographs you upload. Where we use a specialist image-processing service for background removal, it receives those photographs on the same terms. We update this list when the providers we use change.
• Our payment provider (Stripe) — subscription billing, if you upgrade to a paid plan, and ambassador payouts through its Connect service.
• Parents an athlete invites — a read-only view of the athlete’s profile, school list, outreach, offers, camps and weekly plan, until the athlete removes their access.
• Ambassadors — if you signed up with an ambassador’s referral code, that ambassador sees your first name and whether you signed up or subscribed, and earns a share of what you pay.
• PostHog and Grafana Labs — product analytics, error reporting and service monitoring. They receive a pseudonymous account identifier, the screens you visit, the features you use, error reports, technical details of your browser and device, and our servers’ operational logs, which include IP addresses. They also receive your IP address directly, because your browser sends it to them when it reports to them. They never receive the contents of forms you fill in, and no recording of your screen is made.
• College coaches and programs — the messages you choose to send them, when you send them, and, through coach search, the parts of your profile described under “Coach search and what coaches see”.

Cookies and third-party content

We store data in your browser to keep you signed in between visits. That is required for the platform to work. We also remember interface choices, such as a notice you have dismissed, so that it does not come back. And we keep a random identifier for the current browser tab, and our error-reporting provider keeps its own session identifier for that tab; both are cleared when you close the tab, and they let an error report from a visit be matched with our server logs for the same visit. None of this is used for advertising, and we do not use analytics, advertising or tracking cookies: our product analytics provider, PostHog, keeps nothing in your browser, and counting views of a public profile’s videos keeps nothing in the viewer’s browser either.

Third-party content also loads in your browser. Your profile avatar is requested from Gravatar, a service operated by Automattic. This happens for every account — the platform has no avatar upload, so your avatar is always the picture your identity provider supplies, which for a CSA Recruits sign-in is a Gravatar address. That request carries a value derived from your email address, together with your IP address and browser user agent. If you have no Gravatar account, Gravatar redirects to a default image served from Automattic’s Photon network or from Auth0’s content network, and those requests carry your IP address and user agent too.

If we turn on bot detection, the sign-in, sign-up and password-reset screens also load a CAPTCHA widget from the provider we have configured, which receives your IP address and browser characteristics.

Coach search and what coaches see

College coaches can create a free account and search for athletes. A coach can search only after confirming a work email address at a college: the address must be at the domain of a college’s website, and the coach must follow the link we email to it. We do not otherwise review who a coach is, so a verified account shows that someone can receive email at a college’s domain, not that they work for its athletics program.

A coach can search by sport, position, graduating class, state, GPA range and height range. Search results show your name, sport, position, graduating class, high school, state and photo, and a link to your public profile if you have one. When a coach opens your profile they also see your secondary position, club team, city, height, weight and the highlight videos you have uploaded or linked. They see your GPA only if Show Academics Publicly is on, and a coach can never filter or sort by a GPA you keep private.

Coaches never see your email address or phone number unless you turn on “Share my contact details with verified coaches” in Settings. It is off until you turn it on.

If you are 18 or older, Coach Visibility is on unless you turn it off. If you are under 18, or we do not have your date of birth, coaches cannot find you or open your profile until you turn Coach Visibility on yourself and a parent you linked through Parent Access approves it. That parent must first confirm that they are your parent or legal guardian and an adult. An athlete who is hidden does not appear in search and cannot be opened by a direct link either. You can turn Coach Visibility off at any time, and your parent can withdraw their approval at any time; either one hides a minor again.

When a coach opens your profile we record which coach, which athlete and the day, once per coach, athlete and day. You see how many coaches viewed your profile this month and which schools they work for, never which coach. We delete these view records after 12 months, and straight away when either the athlete’s or the coach’s account is deleted.

Your public profile is a separate control. When it is on, your profile has a shareable link that anyone with the link can open. You can turn it off at any time in Settings.

When someone plays a highlight video on your public profile, we count the view so you can see how many people have watched it. You see a number, never who watched, and your own views while signed in are not counted. Counting uses no cookie and stores nothing in the viewer’s browser. Instead, our server computes a one-way hash from the viewer’s network (their IP address with its last part removed) and their browser’s user agent, using a key it derives each day from a secret only our servers hold. Only that hash is stored, never the IP address or user agent, and a viewer is counted once per video per day. The same viewer produces an unrelated hash the next day, and each day’s hashes are deleted within about an hour of that day ending (UTC). The count is approximate, and one network can add only a limited number of views to a video each day.

Your choices and controls

• View and edit every profile field from My Profile.
• Turn individual notification categories on or off in Settings.
• Control coach visibility, whether verified coaches see your contact details, and your public profile in Settings.
• Change your email address — the new address must be verified before it takes effect.
• Change your password through a secure link we email you.
• Delete your account, as described below.

Deleting your account

You can delete your account from Settings. Because deletion is irreversible, we email a confirmation link to the address on your account and only erase your data once you follow it.

Deletion means erasure, not a hidden flag. We overwrite the personal information in your athlete record and delete your awards, media, recruiting graphics, outreach drafts, school list and notes, scheduled actions, settings, subscription records and the records of coaches viewing your profile. Your uploaded photographs and video are deleted from object storage, and your account is removed from our identity provider. A de-identified key is retained so that deletion is permanent and the account cannot be re-created against old records. A link a coach saved to your profile stops working.

A college coach can ask us to delete their account by writing to info@csarecruits.com. We then erase the coach’s name, job title and work email, the college it was tied to, pending verification links and the record of the profiles they viewed, and remove the account from our identity provider.

A parent can remove their parent account from the parent dashboard. We then delete their links to athletes and the invitations sent to them, and remove the account from our identity provider. An athlete can also remove a parent’s access from Settings at any time.

We keep a limited administrative audit log recording that a change occurred and which fields were touched. It records the names of changed fields, never their values.

Deleting your account removes our records of any subscription, but it does not by itself stop billing at the payment provider. Cancel your subscription before you delete your account.

Deleted accounts are not restorable. Some copies may persist briefly in encrypted backups before those backups age out on their normal schedule.

Data retention

We keep your profile for as long as your account is open. If you delete your account, we erase it as described above. We may retain limited records where the law requires it.

Records of a coach viewing an athlete’s profile are deleted after 12 months. A coach’s email verification link expires after 48 hours.

Minors and parental consent

CSA Recruits is used by high school athletes, and many of them are under 18. If you are under 18, you may use the platform only with the involvement and consent of a parent or legal guardian, and your parent or guardian may act on your behalf in exercising any of the rights described in this policy.

We treat an athlete as a minor when their date of birth shows they are under 18, and also when we do not have a date of birth. For a minor: college coaches cannot find them in search or open their profile until the athlete turns Coach Visibility on and a linked parent approves; we do not use their commitment story or name in our marketing unless a linked parent approves; and they cannot receive ambassador payouts, although what they earn is kept for them.

A parent is linked when a Pro athlete invites them by email and they accept with a sign-in of their own. Before approving anything, the parent confirms once, for that athlete, that they are the athlete’s parent or legal guardian and 18 or older.

This section requires review by counsel before production. Services that knowingly collect personal information from minors are subject to specific legal obligations, which may include the Children’s Online Privacy Protection Act, state student-privacy and biometric statutes, and equivalent rules outside the United States.

Security

We use industry-standard measures to protect your information, including encryption in transit, storage of confirmation tokens in hashed form, and access controls on our systems. No online service can promise perfect security, and we cannot guarantee it.

Changes to this policy

We may update this policy. When we do, we will revise the “last updated” date above, and we will give notice of material changes through the platform or by email.

Contact us

Questions about this policy or about your personal information can be sent to info@csarecruits.com.